IBM QRadar SOAR

IBM QRadar SOAR

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only
  • 1.  fn_pagerduty KeyError: 'resilient_client'

    Posted 01/06/22 04:34 PM
    My Trigger PagerDuty Incident is failing with key error appDict['resilient_client']. 

    Traceback (most recent call last):
      File "/home/resadmin/.local/lib/python3.6/site-packages/fn_pagerduty/components/pd_create_incident.py", line 41, in _pagerduty_create_incident_function
        resp = create_incident(createDict)
      File "/home/resadmin/.local/lib/python3.6/site-packages/fn_pagerduty/components/pd_common.py", line 46, in create_incident
        session = APISession(appDict['api_token'], name=appDict['resilient_client'], default_from=appDict['from_email'])
    KeyError: 'resilient_client'​

    Not sure what 'resilient_client' should be set to because not mentioned in docs

    $cat /home/resadmin/.resilient/app.config | grep -A 4 pagerduty
    [pagerduty]
    api_token=***
    from_email=security1@example.com
    # bypass https certificate validation (only set to False for testing purposes)
    verifyFlag=False
    ​


    ------------------------------
    Irek Romaniuk
    ------------------------------


  • 2.  RE: fn_pagerduty KeyError: 'resilient_client'

    Posted 02/11/22 08:55 AM
    Hi Irek,

    Apologies for the delay in replying. 'resilient-client' is an app.config setting use to identify the source of the pagerDuty alert. It was missed in the templated app.config settings file. My settings look like this:

    [pagerduty]
    # name of application when link viewed in Resilient
    resilient_client=IBM Resilient

    ------------------------------
    Mark Scherfling
    ------------------------------