IBM QRadar SOAR

IBM QRadar

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only
  • 1.  FN-Utilities Local Command

    Posted Thu May 06, 2021 02:37 PM
    When it says "local Linux server commands" from fn-utilities is that from the integration server or app server?  My goal is just to create integration to add/remove IP Address artifact from a text file.  My integration server has the text file I want to modify.   I am currently just trying to do ls command and getting errors message below.

    error message

    2021-05-06 12:48:55,004 DEBUG [actions_component] success! [<resilient_circuits.action_message.FunctionResult object at 0x7f1bbb1f0cf8>], <utilities_shell_command[functions.utilities_shell_command] (id=28, workflow=update_text_file) 2021-05-06 17:48:54.089000>

    2021-05-06 12:48:55,004 DEBUG [actions_component] Message: Completed

    2021-05-06 12:48:55,005 DEBUG [actions_component] Result: {'commandline': 'ls "*"', 'start': 1620323334603, 'end': 1620323334612, 'elapsed': 9, 'exitcode': 2, 'stdout': '', 'stderr': 'ls: cannot access *: No such file or directory\n', 'stdout_json': None, 'stderr_json': None}

    app.config
    # local shell_command default commands
    nslookup=nslookup "{{shell_param1}}"
    dig=dig "{{shell_param1}}"
    traceroute=traceroute -m 15 "{{shell_param1}}"
    whois=whois "{{shell_param1}}"
    ls=ls "{{shell_param1}}"



    Thank you

    ------------------------------
    Jeffrey Foote
    ------------------------------


  • 2.  RE: FN-Utilities Local Command

    Posted Fri May 07, 2021 08:01 AM
    It does run on the Integration server.  I was not feeding it the correct shell_param

    ------------------------------
    Jeffrey Foote
    ------------------------------