IBM QRadar SOAR

IBM QRadar

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  Getting "ImportError: No module named test_function"

    Posted Wed August 21, 2019 09:43 AM
    I am getting "ImportError: No module named test_function" error while starting "resilient-circuits run".
     
    Below is the procedure I have followed
     
    • Using below command I have created a module inside components directory (without package option). And it is created successfully.
      • resilient-circuits codegen -f test_function
      • file test_function.py has been created in the components directory
    • When I start "resilient-circuits run", it says 
      • Loading 'test_function' from /home/ActionModules/components/test_function.py
      • ERROR [component_loader] Failed to load component 'test_function'
      • ERROR [component_loader] No module named test_function
      • Traceback (most recent call last):
      • File "/usr/lib/python2.7/site-packages/resilient_circuits/component_loader.py", line 40, in safe_but_noisy_import
      • return __import__(name, globals(), locals(), [""])
      • ImportError: No module named test_function
    I have been following this procedure for long time to implement many function without any problem. But suddently I started getting this error for newly created function.
     
    Resilient Version is 32
     
    Have anyone faced similar issue?


    ------------------------------
    Anbalagan Rajagopal
    ------------------------------


  • 2.  RE: Getting "ImportError: No module named test_function"

    Posted Wed August 21, 2019 11:07 AM
    Hi Anbalagan,

    I tested my v32 version of resilient-circuits (32.0.186) and had no issues with component directory functions. I would review your class definitions, mine look like this:

    class FunctionComponent(ResilientComponent):



    ------------------------------
    Mark Scherfling
    ------------------------------

    Original Message


  • 3.  RE: Getting "ImportError: No module named test_function"

    Posted Mon September 23, 2019 04:29 AM
    Hi Mark,

    We have identified and resolved the issue. I just wanted to update the same here.
    • The issue was, the customer has enabled the endpoint security (AV) in the Action Processor Machine.
    • The AV whitelisted all the existing py files and allowed them to run, but it didn't allow any newly created py file to run.
    • Though we were running them as super user, AV was not letting us to run.
    • Enabling endpoint security was not intimated to us (partner).
    This was the root cause for the issue.

    ------------------------------
    Anbalagan Rajagopal
    ------------------------------

    Original Message