IBM QRadar SOAR

IBM QRadar

Join this online topic group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.


#Security
#QRadar
#SecuringhybridcloudandAI
 View Only
  • 1.  How to pass values to fn_components script

    Posted 11/02/21 12:55 AM
    Hello everyone! I have a case where I need to work with API and I decided to work with fn_components app to make my python integration. My problem is that I can not pass any values from SOAR to fn_components. Here is my script for test:
    import logging
    from resilient_circuits import ResilientComponent, function, handler, StatusMessage, FunctionResult, FunctionError
    PACKAGE_NAME = "test"
    
    log = logging.getLogger(__name__)
    
    
    class FunctionComponent(ResilientComponent):
        """Component that implements Resilient function"""
    
        def __init__(self, opts):
            """constructor provides access to the configuration options"""
            super(FunctionComponent, self).__init__(opts)
            self.options = opts.get(PACKAGE_NAME, {})
            
    
        @handler("reload")
        def _reload(self, event, opts):
            """Configuration options have changed, save new values"""
            self.options = opts.get(PACKAGE_NAME, {})
    
        @function("test")
        def _test(self, event, *args, **kwargs):
            """Function: None"""
            try:
    
                # Get the wf_instance_id of the workflow this Function was called in
                wf_instance_id = event.message["workflow_instance"]["workflow_instance_id"]
    
                yield StatusMessage("Starting 'test' running in workflow '{0}'".format(wf_instance_id))
    
                # Get the function parameters:
                incident_id = kwargs.get("incident_id")
                log.info("success",incident_id)
    
    
    
    
    
    ​

    Then I created message destination for fn_components that uses API "fn_components" and also created message destination for "test" that also uses same API key. Also, created a function that messages to 'test' destination with incident_id field. But when I used this function in workflow and ran it on incident it returns an error: "AttributeError: Invalid field name: incident_id"



    ------------------------------
    Magzhan Leskhan
    ------------------------------


  • 2.  RE: How to pass values to fn_components script

    Posted 11/02/21 04:13 AM

    I started to think that it's because fn_components does not have input fields settings. In this case can I add them? and if can not what is the better way to make solve this case?

    To make my case more clear: I need to block malicious URLs from SOAR artifacts in ChekPoint NGFW using it's API. I've already wrote python script that performs correct API calls. But I don't know how to pass artifact values from SOAR to script.



    ------------------------------
    Magzhan Leskhan
    ------------------------------



  • 3.  RE: How to pass values to fn_components script
    Best Answer

    Posted 11/03/21 11:34 AM
    It won't be possible to send specific inputs to an FN components function. This app was really focused on the ability to migrate python code that listened on a message destination to an AppHost. That use case doesn't use function inputs. Everything it needs would come in the object properties (incident, task, artifact, etc).

    I suggest taking a look at the function Utilities: Call REST API from the FN Utilities app: https://exchange.xforce.ibmcloud.com/hub/extension/2b6699ac8a3976b67dfbddee26dbe3a5.

    Ben

    ------------------------------
    Ben Lurie
    ------------------------------



  • 4.  RE: How to pass values to fn_components script

    Posted 11/04/21 06:51 AM
    Thank you for reply! We used this utilities function to implement our solution. It worked very well!

    ------------------------------
    Magzhan Leskhan
    ------------------------------



  • 5.  RE: How to pass values to fn_components script

    Posted 11/04/21 04:06 AM
    Using the RestAPI call from fn_utilities is a good catch by Ben Lurie, that I use when I need just to create a call and get the json results.
    If there is a need to do additional python work, I use the fn_components.

    To send functions variable to fn_components, please do, like this example on a "checkpoint" command:

    Create a message destination "Checkpoint"


    Create your function with the list of object you which to send to the integration python code

     

    Create your workflow on this function and in the pre process, affect the correct value to all your inputs objects from the function

    the post process, initially, just write a note to understand the output of the integration.

    You will do json walking later

     

     

    in the fn-components App.config add the line

     

    create a new checkpoint.py file in the app:

     

    and update the code to match your inputs, and your core request:

    Inputs :

    code:

     

     

    Global Python looks like - need to change the session get and potentially preparatory work before the get, and the validation.

     

     

    # -*- coding: utf-8 -*-
    # pragma pylint: disable=unused-argument, no-self-use
    """Function implementation"""

    import logging
    from resilient_circuits import ResilientComponent, function, handler, StatusMessage, FunctionResult, FunctionError
    # Additional Import for this integration
    import requests
    from requests.packages.urllib3.exceptions import InsecureRequestWarning

    PACKAGE_NAME = "checkpoint"

    class FunctionComponent(ResilientComponent):
        """Component that implements Resilient function 'checkpoint''"""

        def __init__(self, opts):
            """constructor provides access to the configuration options"""
            super(FunctionComponent, self).__init__(opts)
            self.options = opts.get(PACKAGE_NAME, {})

        @handler("reload")
        def _reload(self, event, opts):
            """Configuration options have changed, save new values"""
            self.options = opts.get(PACKAGE_NAME, {})

        @function("checkpoint")
        def _checkpoint_function(self, event, *args, **kwargs):
            """Function: do something in Checkpoint for ICORE and present the output"""
            try:

                # Get the wf_instance_id of the workflow this Function was called in
                wf_instance_id = event.message["workflow_instance"]["workflow_instance_id"]

                yield StatusMessage("Starting 'checkpoint' running in workflow '{0}'".format(wf_instance_id))

                # Get the function parameters:
                t = kwargs.get("artifact_type")  # text
                v = kwargs.get("artifact_value")  # text
                aid = kwargs.get("artifact_id")  # number
                inc = kwargs.get("incident_id")  # number
                
                log = logging.getLogger(__name__)
                log.info("type: %s", t)
                log.info("value: %s", v)
                log.info("id: %s", aid)           # <= not sure in Python it is %s for an integer ?
                log.info("incident: %s", inc)     # <= not sure in Python it is %s for an integer ?
                
                ##############################################
                session = requests.session()
                session.verify = False
                requests.packages.urllib3.disable_warnings(InsecureRequestWarning)
                
                try:
                    response = session.get("
    https://mycheckpoint_dosomething_on_value" % v)
                    response.raise_for_status()
                    data = response.json()
                    Name = data['ipName'] #checking the result is valid
                except:
                    Name = ''
                ##############################################

                yield StatusMessage("Finished 'checkpoint' that was running in workflow '{0}'".format(wf_instance_id))

                # Put the JSON output in results
                results = data
                
                # Produce a FunctionResult with the results
                yield FunctionResult(results)
            except Exception:
                yield FunctionError()

     

     

     

    Should work :)




    ------------------------------
    BENOIT ROSTAGNI
    ------------------------------



  • 6.  RE: How to pass values to fn_components script

    Posted 11/04/21 07:54 AM
    Thank you for reply! Unfortunately we noticed some difficulties working with components app. Firstly, It was difficult to make it take our values but we finally made it to work! Secondly, it was very challenging to view its progress to evaluate it. Lastly, it was crashing every 10-15 minutes because of resilient-circuts error as we saw in it's logs even when we re-installed it with fresh API keys and configs. Unfortunately, it was fatal flaw for us because it made it very unstable, so we used Utilities: Call REST API instead. And now we are thinking to make app from it and share with community.

    ------------------------------
    Magzhan Leskhan
    ------------------------------