Hello Ben, 

Thank you for the detailed answer.

I'm trying to edit the workflow as you showed on the images above but I'm getting an error :

 "Exclusive Gateway 'ExclusiveGateway_0dr700o' has outgoing sequence flow 'SequenceFlow_10pcls6' without condition which is not the default flow."

This is the workflow:

It would be possible to add an exclusive gateway after the function that checks the results and if necessary close the incident using a script:

Sending an email would require the configuration of a Notification:

Hello Ben, 

Thank you for the detailed answer.

I'm trying to edit the workflow as you showed on the images above but I'm getting an error :

 "Exclusive Gateway 'ExclusiveGateway_0dr700o' has outgoing sequence flow 'SequenceFlow_10pcls6' without condition which is not the default flow."

This is the workflow:

It would be possible to add an exclusive gateway after the function that checks the results and if necessary close the incident using a script:

Sending an email would require the configuration of a Notification:

Hi Ben, 

Thank you for the answer reading the article you sent me, I realized that I don't actually need an exclusive gateway on that position because I need to do the Ip Void check on both cases, if the result is positive then I'll close with a mail if not I'll just close ( without mail). At this point it should be easier to close the incident in both cases with a mail notification. 

So, I'll ask you, is there a way to print the query result in the notification?  I tried to run the workflow and the action querying an artifact manually but both the action and the workflow are stuck in pending status so I'm not really sure if its working.

Hello Ben, 

Thank you for the detailed answer.

I'm trying to edit the workflow as you showed on the images above but I'm getting an error :

 "Exclusive Gateway 'ExclusiveGateway_0dr700o' has outgoing sequence flow 'SequenceFlow_10pcls6' without condition which is not the default flow."

This is the workflow:

It would be possible to add an exclusive gateway after the function that checks the results and if necessary close the incident using a script:

Sending an email would require the configuration of a Notification:

Hi Ben, 

Thank you for the answer reading the article you sent me, I realized that I don't actually need an exclusive gateway on that position because I need to do the Ip Void check on both cases, if the result is positive then I'll close with a mail if not I'll just close ( without mail). At this point it should be easier to close the incident in both cases with a mail notification. 

So, I'll ask you, is there a way to print the query result in the notification?  I tried to run the workflow and the action querying an artifact manually but both the action and the workflow are stuck in pending status so I'm not really sure if its working.

Hello Ben, 

Thank you for the detailed answer.

I'm trying to edit the workflow as you showed on the images above but I'm getting an error :

 "Exclusive Gateway 'ExclusiveGateway_0dr700o' has outgoing sequence flow 'SequenceFlow_10pcls6' without condition which is not the default flow."

This is the workflow:

It would be possible to add an exclusive gateway after the function that checks the results and if necessary close the incident using a script:

Sending an email would require the configuration of a Notification:

I tried to debug resilient-circuits several times, from the circuits logs itself I only see heartbeats. 

If I run something like: resilient-circuits selftest -l fn-ip-void

I got this output

fn-ip-void:
Test was successful!
Credits Remaining: 25
Estimated Queries: 312
selftest: success, Elapsed time: 0.000000 seconds

This is a part of the app.log regarding ip_void:

[integration@resilient .resilient]$ cat app.log | grep void
2020-08-31 09:29:27,864 DEBUG [connectionpool] https://172.25.0.169:443 "GET /rest/orgs/203/functions/fn_ip_void_request HTTP/1.1" 200 None
2020-08-31 09:29:28,776 DEBUG [decorators] @function <function _fn_ip_void_request_function at 0x7f26ba682c50>
2020-08-31 09:29:29,292 INFO [component_loader] 'fn_ip_void.components.fn_ip_void_request.FunctionComponent' loading
2020-08-31 09:29:29,293 DEBUG [component_loader] 'fn_ip_void.components.fn_ip_void_request.FunctionComponent' loaded
2020-08-31 09:29:30,468 INFO [actions_component] 'fn_ip_void.components.fn_ip_void_request.FunctionComponent' function 'fn_ip_void_request' registered to 'fn_ip_void'
2020-08-31 09:29:30,469 DEBUG [actions_component] Listeners: {u'email_outbound': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_spamhaus_query': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_qradar_integration': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_mitre_integration': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_whois_rdap': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_ipinfo': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_xforce': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_ip_void': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>])}
fn_ip_void_request/functions.fn_ip_void_request
2020-08-31 09:29:30,476 INFO [actions_component] Subscribe to message destination 'fn_ip_void'
2020-08-31 09:29:30,483 INFO [stomp_component] Subscribe to message destination actions.203.fn_ip_void
2020-08-31 09:29:30,483 DEBUG [client] Sending SUBSCRIBE frame [headers={'ack': 'client-individual', 'destination': 'actions.203.fn_ip_void', 'id': 'actions.203.fn_ip_void', 'activemq.prefetchSize': 20}, version=1.2]

I don't see any errors on this side, the workflow status is nor on "pending" but on "running", I can't find anything related to it tough.

Hi Ben, 

Thank you for the answer reading the article you sent me, I realized that I don't actually need an exclusive gateway on that position because I need to do the Ip Void check on both cases, if the result is positive then I'll close with a mail if not I'll just close ( without mail). At this point it should be easier to close the incident in both cases with a mail notification. 

So, I'll ask you, is there a way to print the query result in the notification?  I tried to run the workflow and the action querying an artifact manually but both the action and the workflow are stuck in pending status so I'm not really sure if its working.

Hello Ben, 

Thank you for the detailed answer.

I'm trying to edit the workflow as you showed on the images above but I'm getting an error :

 "Exclusive Gateway 'ExclusiveGateway_0dr700o' has outgoing sequence flow 'SequenceFlow_10pcls6' without condition which is not the default flow."

This is the workflow:

It would be possible to add an exclusive gateway after the function that checks the results and if necessary close the incident using a script:

Sending an email would require the configuration of a Notification:

I tried to debug resilient-circuits several times, from the circuits logs itself I only see heartbeats. 

If I run something like: resilient-circuits selftest -l fn-ip-void

I got this output

fn-ip-void:
Test was successful!
Credits Remaining: 25
Estimated Queries: 312
selftest: success, Elapsed time: 0.000000 seconds

This is a part of the app.log regarding ip_void:

[integration@resilient .resilient]$ cat app.log | grep void
2020-08-31 09:29:27,864 DEBUG [connectionpool] https://172.25.0.169:443 "GET /rest/orgs/203/functions/fn_ip_void_request HTTP/1.1" 200 None
2020-08-31 09:29:28,776 DEBUG [decorators] @function <function _fn_ip_void_request_function at 0x7f26ba682c50>
2020-08-31 09:29:29,292 INFO [component_loader] 'fn_ip_void.components.fn_ip_void_request.FunctionComponent' loading
2020-08-31 09:29:29,293 DEBUG [component_loader] 'fn_ip_void.components.fn_ip_void_request.FunctionComponent' loaded
2020-08-31 09:29:30,468 INFO [actions_component] 'fn_ip_void.components.fn_ip_void_request.FunctionComponent' function 'fn_ip_void_request' registered to 'fn_ip_void'
2020-08-31 09:29:30,469 DEBUG [actions_component] Listeners: {u'email_outbound': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_spamhaus_query': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_qradar_integration': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_mitre_integration': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_whois_rdap': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_ipinfo': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_xforce': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_ip_void': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>])}
fn_ip_void_request/functions.fn_ip_void_request
2020-08-31 09:29:30,476 INFO [actions_component] Subscribe to message destination 'fn_ip_void'
2020-08-31 09:29:30,483 INFO [stomp_component] Subscribe to message destination actions.203.fn_ip_void
2020-08-31 09:29:30,483 DEBUG [client] Sending SUBSCRIBE frame [headers={'ack': 'client-individual', 'destination': 'actions.203.fn_ip_void', 'id': 'actions.203.fn_ip_void', 'activemq.prefetchSize': 20}, version=1.2]

I don't see any errors on this side, the workflow status is nor on "pending" but on "running", I can't find anything related to it tough.

Hi Ben, 

Thank you for the answer reading the article you sent me, I realized that I don't actually need an exclusive gateway on that position because I need to do the Ip Void check on both cases, if the result is positive then I'll close with a mail if not I'll just close ( without mail). At this point it should be easier to close the incident in both cases with a mail notification. 

So, I'll ask you, is there a way to print the query result in the notification?  I tried to run the workflow and the action querying an artifact manually but both the action and the workflow are stuck in pending status so I'm not really sure if its working.

Hello Ben, 

Thank you for the detailed answer.

I'm trying to edit the workflow as you showed on the images above but I'm getting an error :

 "Exclusive Gateway 'ExclusiveGateway_0dr700o' has outgoing sequence flow 'SequenceFlow_10pcls6' without condition which is not the default flow."

This is the workflow:

It would be possible to add an exclusive gateway after the function that checks the results and if necessary close the incident using a script:

Sending an email would require the configuration of a Notification:

I tried to debug resilient-circuits several times, from the circuits logs itself I only see heartbeats. 

If I run something like: resilient-circuits selftest -l fn-ip-void

I got this output

fn-ip-void:
Test was successful!
Credits Remaining: 25
Estimated Queries: 312
selftest: success, Elapsed time: 0.000000 seconds

This is a part of the app.log regarding ip_void:

[integration@resilient .resilient]$ cat app.log | grep void
2020-08-31 09:29:27,864 DEBUG [connectionpool] https://172.25.0.169:443 "GET /rest/orgs/203/functions/fn_ip_void_request HTTP/1.1" 200 None
2020-08-31 09:29:28,776 DEBUG [decorators] @function <function _fn_ip_void_request_function at 0x7f26ba682c50>
2020-08-31 09:29:29,292 INFO [component_loader] 'fn_ip_void.components.fn_ip_void_request.FunctionComponent' loading
2020-08-31 09:29:29,293 DEBUG [component_loader] 'fn_ip_void.components.fn_ip_void_request.FunctionComponent' loaded
2020-08-31 09:29:30,468 INFO [actions_component] 'fn_ip_void.components.fn_ip_void_request.FunctionComponent' function 'fn_ip_void_request' registered to 'fn_ip_void'
2020-08-31 09:29:30,469 DEBUG [actions_component] Listeners: {u'email_outbound': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_spamhaus_query': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_qradar_integration': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_mitre_integration': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_whois_rdap': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_ipinfo': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_xforce': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_ip_void': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>])}
fn_ip_void_request/functions.fn_ip_void_request
2020-08-31 09:29:30,476 INFO [actions_component] Subscribe to message destination 'fn_ip_void'
2020-08-31 09:29:30,483 INFO [stomp_component] Subscribe to message destination actions.203.fn_ip_void
2020-08-31 09:29:30,483 DEBUG [client] Sending SUBSCRIBE frame [headers={'ack': 'client-individual', 'destination': 'actions.203.fn_ip_void', 'id': 'actions.203.fn_ip_void', 'activemq.prefetchSize': 20}, version=1.2]

I don't see any errors on this side, the workflow status is nor on "pending" but on "running", I can't find anything related to it tough.

Hi Ben, 

Thank you for the answer reading the article you sent me, I realized that I don't actually need an exclusive gateway on that position because I need to do the Ip Void check on both cases, if the result is positive then I'll close with a mail if not I'll just close ( without mail). At this point it should be easier to close the incident in both cases with a mail notification. 

So, I'll ask you, is there a way to print the query result in the notification?  I tried to run the workflow and the action querying an artifact manually but both the action and the workflow are stuck in pending status so I'm not really sure if its working.

Hello Ben, 

Thank you for the detailed answer.

I'm trying to edit the workflow as you showed on the images above but I'm getting an error :

 "Exclusive Gateway 'ExclusiveGateway_0dr700o' has outgoing sequence flow 'SequenceFlow_10pcls6' without condition which is not the default flow."

This is the workflow:

It would be possible to add an exclusive gateway after the function that checks the results and if necessary close the incident using a script:

Sending an email would require the configuration of a Notification:

I tried to debug resilient-circuits several times, from the circuits logs itself I only see heartbeats. 

If I run something like: resilient-circuits selftest -l fn-ip-void

I got this output

fn-ip-void:
Test was successful!
Credits Remaining: 25
Estimated Queries: 312
selftest: success, Elapsed time: 0.000000 seconds

This is a part of the app.log regarding ip_void:

[integration@resilient .resilient]$ cat app.log | grep void
2020-08-31 09:29:27,864 DEBUG [connectionpool] https://172.25.0.169:443 "GET /rest/orgs/203/functions/fn_ip_void_request HTTP/1.1" 200 None
2020-08-31 09:29:28,776 DEBUG [decorators] @function <function _fn_ip_void_request_function at 0x7f26ba682c50>
2020-08-31 09:29:29,292 INFO [component_loader] 'fn_ip_void.components.fn_ip_void_request.FunctionComponent' loading
2020-08-31 09:29:29,293 DEBUG [component_loader] 'fn_ip_void.components.fn_ip_void_request.FunctionComponent' loaded
2020-08-31 09:29:30,468 INFO [actions_component] 'fn_ip_void.components.fn_ip_void_request.FunctionComponent' function 'fn_ip_void_request' registered to 'fn_ip_void'
2020-08-31 09:29:30,469 DEBUG [actions_component] Listeners: {u'email_outbound': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_spamhaus_query': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_qradar_integration': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_mitre_integration': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_whois_rdap': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_ipinfo': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_xforce': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_ip_void': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>])}
fn_ip_void_request/functions.fn_ip_void_request
2020-08-31 09:29:30,476 INFO [actions_component] Subscribe to message destination 'fn_ip_void'
2020-08-31 09:29:30,483 INFO [stomp_component] Subscribe to message destination actions.203.fn_ip_void
2020-08-31 09:29:30,483 DEBUG [client] Sending SUBSCRIBE frame [headers={'ack': 'client-individual', 'destination': 'actions.203.fn_ip_void', 'id': 'actions.203.fn_ip_void', 'activemq.prefetchSize': 20}, version=1.2]

I don't see any errors on this side, the workflow status is nor on "pending" but on "running", I can't find anything related to it tough.

Hi Ben, 

Thank you for the answer reading the article you sent me, I realized that I don't actually need an exclusive gateway on that position because I need to do the Ip Void check on both cases, if the result is positive then I'll close with a mail if not I'll just close ( without mail). At this point it should be easier to close the incident in both cases with a mail notification. 

So, I'll ask you, is there a way to print the query result in the notification?  I tried to run the workflow and the action querying an artifact manually but both the action and the workflow are stuck in pending status so I'm not really sure if its working.

Hello Ben, 

Thank you for the detailed answer.

I'm trying to edit the workflow as you showed on the images above but I'm getting an error :

 "Exclusive Gateway 'ExclusiveGateway_0dr700o' has outgoing sequence flow 'SequenceFlow_10pcls6' without condition which is not the default flow."

This is the workflow:

It would be possible to add an exclusive gateway after the function that checks the results and if necessary close the incident using a script:

Sending an email would require the configuration of a Notification:

I tried to debug resilient-circuits several times, from the circuits logs itself I only see heartbeats. 

If I run something like: resilient-circuits selftest -l fn-ip-void

I got this output

fn-ip-void:
Test was successful!
Credits Remaining: 25
Estimated Queries: 312
selftest: success, Elapsed time: 0.000000 seconds

This is a part of the app.log regarding ip_void:

[integration@resilient .resilient]$ cat app.log | grep void
2020-08-31 09:29:27,864 DEBUG [connectionpool] https://172.25.0.169:443 "GET /rest/orgs/203/functions/fn_ip_void_request HTTP/1.1" 200 None
2020-08-31 09:29:28,776 DEBUG [decorators] @function <function _fn_ip_void_request_function at 0x7f26ba682c50>
2020-08-31 09:29:29,292 INFO [component_loader] 'fn_ip_void.components.fn_ip_void_request.FunctionComponent' loading
2020-08-31 09:29:29,293 DEBUG [component_loader] 'fn_ip_void.components.fn_ip_void_request.FunctionComponent' loaded
2020-08-31 09:29:30,468 INFO [actions_component] 'fn_ip_void.components.fn_ip_void_request.FunctionComponent' function 'fn_ip_void_request' registered to 'fn_ip_void'
2020-08-31 09:29:30,469 DEBUG [actions_component] Listeners: {u'email_outbound': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_spamhaus_query': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_qradar_integration': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_mitre_integration': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_whois_rdap': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_ipinfo': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_xforce': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_ip_void': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>])}
fn_ip_void_request/functions.fn_ip_void_request
2020-08-31 09:29:30,476 INFO [actions_component] Subscribe to message destination 'fn_ip_void'
2020-08-31 09:29:30,483 INFO [stomp_component] Subscribe to message destination actions.203.fn_ip_void
2020-08-31 09:29:30,483 DEBUG [client] Sending SUBSCRIBE frame [headers={'ack': 'client-individual', 'destination': 'actions.203.fn_ip_void', 'id': 'actions.203.fn_ip_void', 'activemq.prefetchSize': 20}, version=1.2]

I don't see any errors on this side, the workflow status is nor on "pending" but on "running", I can't find anything related to it tough.

Hi Ben, 

Thank you for the answer reading the article you sent me, I realized that I don't actually need an exclusive gateway on that position because I need to do the Ip Void check on both cases, if the result is positive then I'll close with a mail if not I'll just close ( without mail). At this point it should be easier to close the incident in both cases with a mail notification. 

So, I'll ask you, is there a way to print the query result in the notification?  I tried to run the workflow and the action querying an artifact manually but both the action and the workflow are stuck in pending status so I'm not really sure if its working.

Hello Ben, 

Thank you for the detailed answer.

I'm trying to edit the workflow as you showed on the images above but I'm getting an error :

 "Exclusive Gateway 'ExclusiveGateway_0dr700o' has outgoing sequence flow 'SequenceFlow_10pcls6' without condition which is not the default flow."

This is the workflow:

It would be possible to add an exclusive gateway after the function that checks the results and if necessary close the incident using a script:

Sending an email would require the configuration of a Notification:

This is the screenshot from the action panel, the status is constantly "pending". I executed the workflow manually in this case

I tried to debug resilient-circuits several times, from the circuits logs itself I only see heartbeats. 

If I run something like: resilient-circuits selftest -l fn-ip-void

I got this output

fn-ip-void:
Test was successful!
Credits Remaining: 25
Estimated Queries: 312
selftest: success, Elapsed time: 0.000000 seconds

This is a part of the app.log regarding ip_void:

[integration@resilient .resilient]$ cat app.log | grep void
2020-08-31 09:29:27,864 DEBUG [connectionpool] https://172.25.0.169:443 "GET /rest/orgs/203/functions/fn_ip_void_request HTTP/1.1" 200 None
2020-08-31 09:29:28,776 DEBUG [decorators] @function <function _fn_ip_void_request_function at 0x7f26ba682c50>
2020-08-31 09:29:29,292 INFO [component_loader] 'fn_ip_void.components.fn_ip_void_request.FunctionComponent' loading
2020-08-31 09:29:29,293 DEBUG [component_loader] 'fn_ip_void.components.fn_ip_void_request.FunctionComponent' loaded
2020-08-31 09:29:30,468 INFO [actions_component] 'fn_ip_void.components.fn_ip_void_request.FunctionComponent' function 'fn_ip_void_request' registered to 'fn_ip_void'
2020-08-31 09:29:30,469 DEBUG [actions_component] Listeners: {u'email_outbound': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_spamhaus_query': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_qradar_integration': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_mitre_integration': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_whois_rdap': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_ipinfo': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_xforce': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_ip_void': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>])}
fn_ip_void_request/functions.fn_ip_void_request
2020-08-31 09:29:30,476 INFO [actions_component] Subscribe to message destination 'fn_ip_void'
2020-08-31 09:29:30,483 INFO [stomp_component] Subscribe to message destination actions.203.fn_ip_void
2020-08-31 09:29:30,483 DEBUG [client] Sending SUBSCRIBE frame [headers={'ack': 'client-individual', 'destination': 'actions.203.fn_ip_void', 'id': 'actions.203.fn_ip_void', 'activemq.prefetchSize': 20}, version=1.2]

I don't see any errors on this side, the workflow status is nor on "pending" but on "running", I can't find anything related to it tough.

Hi Ben, 

Thank you for the answer reading the article you sent me, I realized that I don't actually need an exclusive gateway on that position because I need to do the Ip Void check on both cases, if the result is positive then I'll close with a mail if not I'll just close ( without mail). At this point it should be easier to close the incident in both cases with a mail notification. 

So, I'll ask you, is there a way to print the query result in the notification?  I tried to run the workflow and the action querying an artifact manually but both the action and the workflow are stuck in pending status so I'm not really sure if its working.

Hello Ben, 

Thank you for the detailed answer.

I'm trying to edit the workflow as you showed on the images above but I'm getting an error :

 "Exclusive Gateway 'ExclusiveGateway_0dr700o' has outgoing sequence flow 'SequenceFlow_10pcls6' without condition which is not the default flow."

This is the workflow:

It would be possible to add an exclusive gateway after the function that checks the results and if necessary close the incident using a script:

Sending an email would require the configuration of a Notification:

This is the screenshot from the action panel, the status is constantly "pending". I executed the workflow manually in this case

I tried to debug resilient-circuits several times, from the circuits logs itself I only see heartbeats. 

If I run something like: resilient-circuits selftest -l fn-ip-void

I got this output

fn-ip-void:
Test was successful!
Credits Remaining: 25
Estimated Queries: 312
selftest: success, Elapsed time: 0.000000 seconds

This is a part of the app.log regarding ip_void:

[integration@resilient .resilient]$ cat app.log | grep void
2020-08-31 09:29:27,864 DEBUG [connectionpool] https://172.25.0.169:443 "GET /rest/orgs/203/functions/fn_ip_void_request HTTP/1.1" 200 None
2020-08-31 09:29:28,776 DEBUG [decorators] @function <function _fn_ip_void_request_function at 0x7f26ba682c50>
2020-08-31 09:29:29,292 INFO [component_loader] 'fn_ip_void.components.fn_ip_void_request.FunctionComponent' loading
2020-08-31 09:29:29,293 DEBUG [component_loader] 'fn_ip_void.components.fn_ip_void_request.FunctionComponent' loaded
2020-08-31 09:29:30,468 INFO [actions_component] 'fn_ip_void.components.fn_ip_void_request.FunctionComponent' function 'fn_ip_void_request' registered to 'fn_ip_void'
2020-08-31 09:29:30,469 DEBUG [actions_component] Listeners: {u'email_outbound': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_spamhaus_query': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_qradar_integration': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_mitre_integration': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_whois_rdap': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_ipinfo': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_xforce': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_ip_void': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>])}
fn_ip_void_request/functions.fn_ip_void_request
2020-08-31 09:29:30,476 INFO [actions_component] Subscribe to message destination 'fn_ip_void'
2020-08-31 09:29:30,483 INFO [stomp_component] Subscribe to message destination actions.203.fn_ip_void
2020-08-31 09:29:30,483 DEBUG [client] Sending SUBSCRIBE frame [headers={'ack': 'client-individual', 'destination': 'actions.203.fn_ip_void', 'id': 'actions.203.fn_ip_void', 'activemq.prefetchSize': 20}, version=1.2]

I don't see any errors on this side, the workflow status is nor on "pending" but on "running", I can't find anything related to it tough.

Hi Ben, 

Thank you for the answer reading the article you sent me, I realized that I don't actually need an exclusive gateway on that position because I need to do the Ip Void check on both cases, if the result is positive then I'll close with a mail if not I'll just close ( without mail). At this point it should be easier to close the incident in both cases with a mail notification. 

So, I'll ask you, is there a way to print the query result in the notification?  I tried to run the workflow and the action querying an artifact manually but both the action and the workflow are stuck in pending status so I'm not really sure if its working.

Hello Ben, 

Thank you for the detailed answer.

I'm trying to edit the workflow as you showed on the images above but I'm getting an error :

 "Exclusive Gateway 'ExclusiveGateway_0dr700o' has outgoing sequence flow 'SequenceFlow_10pcls6' without condition which is not the default flow."

This is the workflow:

It would be possible to add an exclusive gateway after the function that checks the results and if necessary close the incident using a script:

Sending an email would require the configuration of a Notification:

I tried to debug resilient-circuits several times, from the circuits logs itself I only see heartbeats. 

If I run something like: resilient-circuits selftest -l fn-ip-void

I got this output

fn-ip-void:
Test was successful!
Credits Remaining: 25
Estimated Queries: 312
selftest: success, Elapsed time: 0.000000 seconds

This is a part of the app.log regarding ip_void:

[integration@resilient .resilient]$ cat app.log | grep void
2020-08-31 09:29:27,864 DEBUG [connectionpool] https://172.25.0.169:443 "GET /rest/orgs/203/functions/fn_ip_void_request HTTP/1.1" 200 None
2020-08-31 09:29:28,776 DEBUG [decorators] @function <function _fn_ip_void_request_function at 0x7f26ba682c50>
2020-08-31 09:29:29,292 INFO [component_loader] 'fn_ip_void.components.fn_ip_void_request.FunctionComponent' loading
2020-08-31 09:29:29,293 DEBUG [component_loader] 'fn_ip_void.components.fn_ip_void_request.FunctionComponent' loaded
2020-08-31 09:29:30,468 INFO [actions_component] 'fn_ip_void.components.fn_ip_void_request.FunctionComponent' function 'fn_ip_void_request' registered to 'fn_ip_void'
2020-08-31 09:29:30,469 DEBUG [actions_component] Listeners: {u'email_outbound': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_spamhaus_query': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_qradar_integration': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_mitre_integration': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_whois_rdap': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_ipinfo': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_xforce': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_ip_void': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>])}
fn_ip_void_request/functions.fn_ip_void_request
2020-08-31 09:29:30,476 INFO [actions_component] Subscribe to message destination 'fn_ip_void'
2020-08-31 09:29:30,483 INFO [stomp_component] Subscribe to message destination actions.203.fn_ip_void
2020-08-31 09:29:30,483 DEBUG [client] Sending SUBSCRIBE frame [headers={'ack': 'client-individual', 'destination': 'actions.203.fn_ip_void', 'id': 'actions.203.fn_ip_void', 'activemq.prefetchSize': 20}, version=1.2]

I don't see any errors on this side, the workflow status is nor on "pending" but on "running", I can't find anything related to it tough.

Hi Ben, 

Thank you for the answer reading the article you sent me, I realized that I don't actually need an exclusive gateway on that position because I need to do the Ip Void check on both cases, if the result is positive then I'll close with a mail if not I'll just close ( without mail). At this point it should be easier to close the incident in both cases with a mail notification. 

So, I'll ask you, is there a way to print the query result in the notification?  I tried to run the workflow and the action querying an artifact manually but both the action and the workflow are stuck in pending status so I'm not really sure if its working.

Hello Ben, 

Thank you for the detailed answer.

I'm trying to edit the workflow as you showed on the images above but I'm getting an error :

 "Exclusive Gateway 'ExclusiveGateway_0dr700o' has outgoing sequence flow 'SequenceFlow_10pcls6' without condition which is not the default flow."

This is the workflow:

It would be possible to add an exclusive gateway after the function that checks the results and if necessary close the incident using a script:

Sending an email would require the configuration of a Notification:

I tried to debug resilient-circuits several times, from the circuits logs itself I only see heartbeats. 

If I run something like: resilient-circuits selftest -l fn-ip-void

I got this output

fn-ip-void:
Test was successful!
Credits Remaining: 25
Estimated Queries: 312
selftest: success, Elapsed time: 0.000000 seconds

This is a part of the app.log regarding ip_void:

[integration@resilient .resilient]$ cat app.log | grep void
2020-08-31 09:29:27,864 DEBUG [connectionpool] https://172.25.0.169:443 "GET /rest/orgs/203/functions/fn_ip_void_request HTTP/1.1" 200 None
2020-08-31 09:29:28,776 DEBUG [decorators] @function <function _fn_ip_void_request_function at 0x7f26ba682c50>
2020-08-31 09:29:29,292 INFO [component_loader] 'fn_ip_void.components.fn_ip_void_request.FunctionComponent' loading
2020-08-31 09:29:29,293 DEBUG [component_loader] 'fn_ip_void.components.fn_ip_void_request.FunctionComponent' loaded
2020-08-31 09:29:30,468 INFO [actions_component] 'fn_ip_void.components.fn_ip_void_request.FunctionComponent' function 'fn_ip_void_request' registered to 'fn_ip_void'
2020-08-31 09:29:30,469 DEBUG [actions_component] Listeners: {u'email_outbound': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_spamhaus_query': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_qradar_integration': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_mitre_integration': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_whois_rdap': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_ipinfo': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_xforce': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_ip_void': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>])}
fn_ip_void_request/functions.fn_ip_void_request
2020-08-31 09:29:30,476 INFO [actions_component] Subscribe to message destination 'fn_ip_void'
2020-08-31 09:29:30,483 INFO [stomp_component] Subscribe to message destination actions.203.fn_ip_void
2020-08-31 09:29:30,483 DEBUG [client] Sending SUBSCRIBE frame [headers={'ack': 'client-individual', 'destination': 'actions.203.fn_ip_void', 'id': 'actions.203.fn_ip_void', 'activemq.prefetchSize': 20}, version=1.2]

I don't see any errors on this side, the workflow status is nor on "pending" but on "running", I can't find anything related to it tough.

Hi Ben, 

Thank you for the answer reading the article you sent me, I realized that I don't actually need an exclusive gateway on that position because I need to do the Ip Void check on both cases, if the result is positive then I'll close with a mail if not I'll just close ( without mail). At this point it should be easier to close the incident in both cases with a mail notification. 

So, I'll ask you, is there a way to print the query result in the notification?  I tried to run the workflow and the action querying an artifact manually but both the action and the workflow are stuck in pending status so I'm not really sure if its working.

Hello Ben, 

Thank you for the detailed answer.

I'm trying to edit the workflow as you showed on the images above but I'm getting an error :

 "Exclusive Gateway 'ExclusiveGateway_0dr700o' has outgoing sequence flow 'SequenceFlow_10pcls6' without condition which is not the default flow."

This is the workflow:

It would be possible to add an exclusive gateway after the function that checks the results and if necessary close the incident using a script:

Sending an email would require the configuration of a Notification:

Hello Richard, 

I think I posted an example above:

This is a part of the app.log regarding ip_void:

[integration@resilient .resilient]$ cat app.log | grep void
2020-08-31 09:29:27,864 DEBUG [connectionpool] https://172.25.0.169:443 "GET /rest/orgs/203/functions/fn_ip_void_request HTTP/1.1" 200 None
2020-08-31 09:29:28,776 DEBUG [decorators] @function <function _fn_ip_void_request_function at 0x7f26ba682c50>
2020-08-31 09:29:29,292 INFO [component_loader] 'fn_ip_void.components.fn_ip_void_request.FunctionComponent' loading
2020-08-31 09:29:29,293 DEBUG [component_loader] 'fn_ip_void.components.fn_ip_void_request.FunctionComponent' loaded
2020-08-31 09:29:30,468 INFO [actions_component] 'fn_ip_void.components.fn_ip_void_request.FunctionComponent' function 'fn_ip_void_request' registered to 'fn_ip_void'
2020-08-31 09:29:30,469 DEBUG [actions_component] Listeners: {u'email_outbound': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_spamhaus_query': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_qradar_integration': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_mitre_integration': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_whois_rdap': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_ipinfo': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_xforce': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_ip_void': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>])}
fn_ip_void_request/functions.fn_ip_void_request
2020-08-31 09:29:30,476 INFO [actions_component] Subscribe to message destination 'fn_ip_void'
2020-08-31 09:29:30,483 INFO [stomp_component] Subscribe to message destination actions.203.fn_ip_void
2020-08-31 09:29:30,483 DEBUG [client] Sending SUBSCRIBE frame [headers={'ack': 'client-individual', 'destination': 'actions.203.fn_ip_void', 'id': 'actions.203.fn_ip_void', 'activemq.prefetchSize': 20}, version=1.2]

For the rest, this is an example of what's written on the log

2020-09-02 09:19:08,530 DEBUG [client] Received heart-beat
2020-09-02 09:19:23,540 DEBUG [client] Received heart-beat
2020-09-02 09:19:38,540 DEBUG [client] Received heart-beat
2020-09-02 09:19:53,507 DEBUG [client] Received heart-beat
2020-09-02 09:20:08,525 DEBUG [client] Received heart-beat
2020-09-02 09:20:23,540 DEBUG [client] Received heart-beat
2020-09-02 09:20:38,533 DEBUG [client] Received heart-beat
2020-09-02 09:20:53,491 DEBUG [client] Received heart-beat
2020-09-02 09:21:08,533 DEBUG [client] Received heart-beat
2020-09-02 09:21:23,540 DEBUG [client] Received heart-beat
2020-09-02 09:21:38,532 DEBUG [client] Received heart-beat
2020-09-02 09:21:53,494 DEBUG [client] Received heart-beat
2020-09-02 09:22:08,530 DEBUG [client] Received heart-beat
2020-09-02 09:22:22,845 DEBUG [actions_component] Idle reset
2020-09-02 09:22:23,549 DEBUG [client] Received heart-beat
2020-09-02 09:22:38,532 DEBUG [client] Received heart-beat
2020-09-02 09:22:53,496 DEBUG [client] Received heart-beat
2020-09-02 09:23:08,531 DEBUG [client] Received heart-beat
2020-09-02 09:23:23,541 DEBUG [client] Received heart-beat
2020-09-02 09:23:38,533 DEBUG [client] Received heart-beat
2020-09-02 09:23:53,492 DEBUG [client] Received heart-beat
2020-09-02 09:24:08,532 DEBUG [client] Received heart-beat
2020-09-02 09:24:23,541 DEBUG [client] Received heart-beat
2020-09-02 09:24:38,537 DEBUG [client] Received heart-beat
2020-09-02 09:24:53,500 DEBUG [client] Received heart-beat
2020-09-02 09:25:08,532 DEBUG [client] Received heart-beat
2020-09-02 09:25:23,542 DEBUG [client] Received heart-beat
2020-09-02 09:25:38,531 DEBUG [client] Received heart-beat
2020-09-02 09:25:53,490 DEBUG [client] Received heart-beat
2020-09-02 09:26:08,533 DEBUG [client] Received heart-beat
2020-09-02 09:26:23,542 DEBUG [client] Received heart-beat
2020-09-02 09:26:38,534 DEBUG [client] Received heart-beat
2020-09-02 09:26:53,497 DEBUG [client] Received heart-beat
2020-09-02 09:27:08,538 DEBUG [client] Received heart-beat
2020-09-02 09:27:23,542 DEBUG [client] Received heart-beat
2020-09-02 09:27:38,537 DEBUG [client] Received heart-beat
2020-09-02 09:27:53,497 DEBUG [client] Received heart-beat
2020-09-02 09:28:08,530 DEBUG [client] Received heart-beat
2020-09-02 09:28:23,543 DEBUG [client] Received heart-beat
2020-09-02 09:28:38,536 DEBUG [client] Received heart-beat
2020-09-02 09:28:53,496 DEBUG [client] Received heart-beat
2020-09-02 09:29:08,535 DEBUG [client] Received heart-beat
2020-09-02 09:29:23,543 DEBUG [client] Received heart-beat
2020-09-02 09:29:38,537 DEBUG [client] Received heart-beat
2020-09-02 09:29:53,497 DEBUG [client] Received heart-beat
2020-09-02 09:30:08,561 DEBUG [client] Received heart-beat
2020-09-02 09:30:23,544 DEBUG [client] Received heart-beat
2020-09-02 09:30:38,536 DEBUG [client] Received heart-beat
2020-09-02 09:30:53,496 DEBUG [client] Received heart-beat
2020-09-02 09:31:08,535 DEBUG [client] Received heart-beat
2020-09-02 09:31:23,544 DEBUG [client] Received heart-beat
2020-09-02 09:31:38,544 DEBUG [client] Received heart-beat
2020-09-02 09:31:53,505 DEBUG [client] Received heart-beat
2020-09-02 09:32:08,542 DEBUG [client] Received heart-beat
2020-09-02 09:32:22,846 DEBUG [actions_component] Idle reset
2020-09-02 09:32:23,549 DEBUG [client] Received heart-beat
2020-09-02 09:32:38,540 DEBUG [client] Received heart-beat
2020-09-02 09:32:53,502 DEBUG [client] Received heart-beat
2020-09-02 09:33:08,536 DEBUG [client] Received heart-beat
2020-09-02 09:33:23,546 DEBUG [client] Received heart-beat
2020-09-02 09:33:38,541 DEBUG [client] Received heart-beat
2020-09-02 09:33:53,500 DEBUG [client] Received heart-beat
2020-09-02 09:34:08,539 DEBUG [client] Received heart-beat
2020-09-02 09:34:23,545 DEBUG [client] Received heart-beat
2020-09-02 09:34:38,558 DEBUG [client] Received heart-beat
2020-09-02 09:34:53,520 DEBUG [client] Received heart-beat
2020-09-02 09:35:08,539 DEBUG [client] Received heart-beat
2020-09-02 09:35:23,546 DEBUG [client] Received heart-beat
2020-09-02 09:35:38,570 DEBUG [client] Received heart-beat
2020-09-02 09:35:53,526 DEBUG [client] Received heart-beat
2020-09-02 09:36:08,542 DEBUG [client] Received heart-beat
2020-09-02 09:36:23,547 DEBUG [client] Received heart-beat
2020-09-02 09:36:38,541 DEBUG [client] Received heart-beat
2020-09-02 09:36:53,502 DEBUG [client] Received heart-beat
2020-09-02 09:37:08,542 DEBUG [client] Received heart-beat
2020-09-02 09:37:23,546 DEBUG [client] Received heart-beat
2020-09-02 09:37:38,539 DEBUG [client] Received heart-beat
2020-09-02 09:37:53,498 DEBUG [client] Received heart-beat
2020-09-02 09:38:08,540 DEBUG [client] Received heart-beat
2020-09-02 09:38:23,547 DEBUG [client] Received heart-beat
2020-09-02 09:38:38,542 DEBUG [client] Received heart-beat
2020-09-02 09:38:53,500 DEBUG [client] Received heart-beat
2020-09-02 09:39:08,542 DEBUG [client] Received heart-beat
2020-09-02 09:39:23,547 DEBUG [client] Received heart-beat
2020-09-02 09:39:38,536 DEBUG [client] Received heart-beat
2020-09-02 09:39:53,493 DEBUG [client] Received heart-beat
2020-09-02 09:40:08,542 DEBUG [client] Received heart-beat
2020-09-02 09:40:23,547 DEBUG [client] Received heart-beat
2020-09-02 09:40:38,539 DEBUG [client] Received heart-beat
2020-09-02 09:40:53,498 DEBUG [client] Received heart-beat
2020-09-02 09:41:08,541 DEBUG [client] Received heart-beat
2020-09-02 09:41:23,548 DEBUG [client] Received heart-beat
2020-09-02 09:41:38,543 DEBUG [client] Received heart-beat
2020-09-02 09:41:53,505 DEBUG [client] Received heart-beat
2020-09-02 09:42:08,545 DEBUG [client] Received heart-beat
2020-09-02 09:42:22,846 DEBUG [actions_component] Idle reset
2020-09-02 09:42:23,549 DEBUG [client] Received heart-beat
2020-09-02 09:42:38,545 DEBUG [client] Received heart-beat
2020-09-02 09:42:53,505 DEBUG [client] Received heart-beat
2020-09-02 09:43:08,547 DEBUG [client] Received heart-beat
2020-09-02 09:43:23,550 DEBUG [client] Received heart-beat
2020-09-02 09:43:38,547 DEBUG [client] Received heart-beat
2020-09-02 09:43:53,506 DEBUG [client] Received heart-beat
2020-09-02 09:44:08,543 DEBUG [client] Received heart-beat
2020-09-02 09:44:23,550 DEBUG [client] Received heart-beat
2020-09-02 09:44:38,548 DEBUG [client] Received heart-beat
2020-09-02 09:44:53,528 DEBUG [client] Received heart-beat
2020-09-02 09:45:08,547 DEBUG [client] Received heart-beat
2020-09-02 09:45:23,551 DEBUG [client] Received heart-beat
2020-09-02 09:45:38,546 DEBUG [client] Received heart-beat
2020-09-02 09:45:53,507 DEBUG [client] Received heart-beat
2020-09-02 09:46:08,547 DEBUG [client] Received heart-beat
2020-09-02 09:46:23,550 DEBUG [client] Received heart-beat
2020-09-02 09:46:38,547 DEBUG [client] Received heart-beat
2020-09-02 09:46:53,507 DEBUG [client] Received heart-beat
2020-09-02 09:47:08,548 DEBUG [client] Received heart-beat
2020-09-02 09:47:23,551 DEBUG [client] Received heart-beat
2020-09-02 09:47:38,550 DEBUG [client] Received heart-beat
2020-09-02 09:47:53,511 DEBUG [client] Received heart-beat
2020-09-02 09:48:08,570 DEBUG [client] Received heart-beat
2020-09-02 09:48:23,551 DEBUG [client] Received heart-beat
2020-09-02 09:48:38,550 DEBUG [client] Received heart-beat
2020-09-02 09:48:53,509 DEBUG [client] Received heart-beat
2020-09-02 09:49:08,561 DEBUG [client] Received heart-beat
2020-09-02 09:49:23,552 DEBUG [client] Received heart-beat
2020-09-02 09:49:38,552 DEBUG [client] Received heart-beat
2020-09-02 09:49:53,512 DEBUG [client] Received heart-beat
2020-09-02 09:50:08,554 DEBUG [client] Received heart-beat
2020-09-02 09:50:23,551 DEBUG [client] Received heart-beat
2020-09-02 09:50:38,552 DEBUG [client] Received heart-beat
2020-09-02 09:50:53,515 DEBUG [client] Received heart-beat
2020-09-02 09:51:08,553 DEBUG [client] Received heart-beat
2020-09-02 09:51:23,553 DEBUG [client] Received heart-beat
2020-09-02 09:51:38,552 DEBUG [client] Received heart-beat
2020-09-02 09:51:53,513 DEBUG [client] Received heart-beat
2020-09-02 09:52:08,555 DEBUG [client] Received heart-beat
2020-09-02 09:52:22,846 DEBUG [actions_component] Idle reset
2020-09-02 09:52:23,550 DEBUG [client] Received heart-beat
2020-09-02 09:52:38,550 DEBUG [client] Received heart-beat
2020-09-02 09:52:53,510 DEBUG [client] Received heart-beat
2020-09-02 09:53:08,552 DEBUG [client] Received heart-beat
2020-09-02 09:53:23,553 DEBUG [client] Received heart-beat
2020-09-02 09:53:38,553 DEBUG [client] Received heart-beat
2020-09-02 09:53:53,510 DEBUG [client] Received heart-beat
2020-09-02 09:54:08,552 DEBUG [client] Received heart-beat
2020-09-02 09:54:23,553 DEBUG [client] Received heart-beat
2020-09-02 09:54:38,555 DEBUG [client] Received heart-beat
2020-09-02 09:54:53,517 DEBUG [client] Received heart-beat
2020-09-02 09:55:08,558 DEBUG [client] Received heart-beat
2020-09-02 09:55:23,554 DEBUG [client] Received heart-beat
2020-09-02 09:55:38,555 DEBUG [client] Received heart-beat
2020-09-02 09:55:53,519 DEBUG [client] Received heart-beat
2020-09-02 09:56:08,567 DEBUG [client] Received heart-beat
2020-09-02 09:56:23,554 DEBUG [client] Received heart-beat
2020-09-02 09:56:38,559 DEBUG [client] Received heart-beat
2020-09-02 09:56:53,519 DEBUG [client] Received heart-beat
2020-09-02 09:57:08,558 DEBUG [client] Received heart-beat
2020-09-02 09:57:23,554 DEBUG [client] Received heart-beat
2020-09-02 09:57:38,558 DEBUG [client] Received heart-beat
2020-09-02 09:57:53,517 DEBUG [client] Received heart-beat
2020-09-02 09:58:08,553 DEBUG [client] Received heart-beat
2020-09-02 09:58:23,555 DEBUG [client] Received heart-beat
2020-09-02 09:58:38,556 DEBUG [client] Received heart-beat
2020-09-02 09:58:53,514 DEBUG [client] Received heart-beat
2020-09-02 09:59:08,555 DEBUG [client] Received heart-beat
2020-09-02 09:59:23,556 DEBUG [client] Received heart-beat
2020-09-02 09:59:38,567 DEBUG [client] Received heart-beat
2020-09-02 09:59:53,528 DEBUG [client] Received heart-beat
2020-09-02 10:00:08,562 DEBUG [client] Received heart-beat
2020-09-02 10:00:23,556 DEBUG [client] Received heart-beat
2020-09-02 10:00:38,557 DEBUG [client] Received heart-beat
2020-09-02 10:00:53,513 DEBUG [client] Received heart-beat
2020-09-02 10:01:08,555 DEBUG [client] Received heart-beat
2020-09-02 10:01:23,556 DEBUG [client] Received heart-beat
2020-09-02 10:01:38,557 DEBUG [client] Received heart-beat
2020-09-02 10:01:53,514 DEBUG [client] Received heart-beat
2020-09-02 10:02:08,557 DEBUG [client] Received heart-beat
2020-09-02 10:02:22,847 DEBUG [actions_component] Idle reset
2020-09-02 10:02:23,550 DEBUG [client] Received heart-beat
2020-09-02 10:02:38,558 DEBUG [client] Received heart-beat
2020-09-02 10:02:53,517 DEBUG [client] Received heart-beat
2020-09-02 10:03:08,560 DEBUG [client] Received heart-beat

I tried to debug resilient-circuits several times, from the circuits logs itself I only see heartbeats. 

If I run something like: resilient-circuits selftest -l fn-ip-void

I got this output

fn-ip-void:
Test was successful!
Credits Remaining: 25
Estimated Queries: 312
selftest: success, Elapsed time: 0.000000 seconds

This is a part of the app.log regarding ip_void:

[integration@resilient .resilient]$ cat app.log | grep void
2020-08-31 09:29:27,864 DEBUG [connectionpool] https://172.25.0.169:443 "GET /rest/orgs/203/functions/fn_ip_void_request HTTP/1.1" 200 None
2020-08-31 09:29:28,776 DEBUG [decorators] @function <function _fn_ip_void_request_function at 0x7f26ba682c50>
2020-08-31 09:29:29,292 INFO [component_loader] 'fn_ip_void.components.fn_ip_void_request.FunctionComponent' loading
2020-08-31 09:29:29,293 DEBUG [component_loader] 'fn_ip_void.components.fn_ip_void_request.FunctionComponent' loaded
2020-08-31 09:29:30,468 INFO [actions_component] 'fn_ip_void.components.fn_ip_void_request.FunctionComponent' function 'fn_ip_void_request' registered to 'fn_ip_void'
2020-08-31 09:29:30,469 DEBUG [actions_component] Listeners: {u'email_outbound': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_spamhaus_query': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_qradar_integration': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_mitre_integration': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_whois_rdap': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_ipinfo': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_xforce': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_ip_void': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>])}
fn_ip_void_request/functions.fn_ip_void_request
2020-08-31 09:29:30,476 INFO [actions_component] Subscribe to message destination 'fn_ip_void'
2020-08-31 09:29:30,483 INFO [stomp_component] Subscribe to message destination actions.203.fn_ip_void
2020-08-31 09:29:30,483 DEBUG [client] Sending SUBSCRIBE frame [headers={'ack': 'client-individual', 'destination': 'actions.203.fn_ip_void', 'id': 'actions.203.fn_ip_void', 'activemq.prefetchSize': 20}, version=1.2]

I don't see any errors on this side, the workflow status is nor on "pending" but on "running", I can't find anything related to it tough.

Hi Ben, 

Thank you for the answer reading the article you sent me, I realized that I don't actually need an exclusive gateway on that position because I need to do the Ip Void check on both cases, if the result is positive then I'll close with a mail if not I'll just close ( without mail). At this point it should be easier to close the incident in both cases with a mail notification. 

So, I'll ask you, is there a way to print the query result in the notification?  I tried to run the workflow and the action querying an artifact manually but both the action and the workflow are stuck in pending status so I'm not really sure if its working.

Hello Ben, 

Thank you for the detailed answer.

I'm trying to edit the workflow as you showed on the images above but I'm getting an error :

 "Exclusive Gateway 'ExclusiveGateway_0dr700o' has outgoing sequence flow 'SequenceFlow_10pcls6' without condition which is not the default flow."

This is the workflow:

It would be possible to add an exclusive gateway after the function that checks the results and if necessary close the incident using a script:

Sending an email would require the configuration of a Notification:

Hello Richard, 

I think I posted an example above:

This is a part of the app.log regarding ip_void:

[integration@resilient .resilient]$ cat app.log | grep void
2020-08-31 09:29:27,864 DEBUG [connectionpool] https://172.25.0.169:443 "GET /rest/orgs/203/functions/fn_ip_void_request HTTP/1.1" 200 None
2020-08-31 09:29:28,776 DEBUG [decorators] @function <function _fn_ip_void_request_function at 0x7f26ba682c50>
2020-08-31 09:29:29,292 INFO [component_loader] 'fn_ip_void.components.fn_ip_void_request.FunctionComponent' loading
2020-08-31 09:29:29,293 DEBUG [component_loader] 'fn_ip_void.components.fn_ip_void_request.FunctionComponent' loaded
2020-08-31 09:29:30,468 INFO [actions_component] 'fn_ip_void.components.fn_ip_void_request.FunctionComponent' function 'fn_ip_void_request' registered to 'fn_ip_void'
2020-08-31 09:29:30,469 DEBUG [actions_component] Listeners: {u'email_outbound': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_spamhaus_query': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_qradar_integration': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_mitre_integration': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_whois_rdap': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_ipinfo': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_xforce': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_ip_void': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>])}
fn_ip_void_request/functions.fn_ip_void_request
2020-08-31 09:29:30,476 INFO [actions_component] Subscribe to message destination 'fn_ip_void'
2020-08-31 09:29:30,483 INFO [stomp_component] Subscribe to message destination actions.203.fn_ip_void
2020-08-31 09:29:30,483 DEBUG [client] Sending SUBSCRIBE frame [headers={'ack': 'client-individual', 'destination': 'actions.203.fn_ip_void', 'id': 'actions.203.fn_ip_void', 'activemq.prefetchSize': 20}, version=1.2]

For the rest, this is an example of what's written on the log

2020-09-02 09:19:08,530 DEBUG [client] Received heart-beat
2020-09-02 09:19:23,540 DEBUG [client] Received heart-beat
2020-09-02 09:19:38,540 DEBUG [client] Received heart-beat
2020-09-02 09:19:53,507 DEBUG [client] Received heart-beat
2020-09-02 09:20:08,525 DEBUG [client] Received heart-beat
2020-09-02 09:20:23,540 DEBUG [client] Received heart-beat
2020-09-02 09:20:38,533 DEBUG [client] Received heart-beat
2020-09-02 09:20:53,491 DEBUG [client] Received heart-beat
2020-09-02 09:21:08,533 DEBUG [client] Received heart-beat
2020-09-02 09:21:23,540 DEBUG [client] Received heart-beat
2020-09-02 09:21:38,532 DEBUG [client] Received heart-beat
2020-09-02 09:21:53,494 DEBUG [client] Received heart-beat
2020-09-02 09:22:08,530 DEBUG [client] Received heart-beat
2020-09-02 09:22:22,845 DEBUG [actions_component] Idle reset
2020-09-02 09:22:23,549 DEBUG [client] Received heart-beat
2020-09-02 09:22:38,532 DEBUG [client] Received heart-beat
2020-09-02 09:22:53,496 DEBUG [client] Received heart-beat
2020-09-02 09:23:08,531 DEBUG [client] Received heart-beat
2020-09-02 09:23:23,541 DEBUG [client] Received heart-beat
2020-09-02 09:23:38,533 DEBUG [client] Received heart-beat
2020-09-02 09:23:53,492 DEBUG [client] Received heart-beat
2020-09-02 09:24:08,532 DEBUG [client] Received heart-beat
2020-09-02 09:24:23,541 DEBUG [client] Received heart-beat
2020-09-02 09:24:38,537 DEBUG [client] Received heart-beat
2020-09-02 09:24:53,500 DEBUG [client] Received heart-beat
2020-09-02 09:25:08,532 DEBUG [client] Received heart-beat
2020-09-02 09:25:23,542 DEBUG [client] Received heart-beat
2020-09-02 09:25:38,531 DEBUG [client] Received heart-beat
2020-09-02 09:25:53,490 DEBUG [client] Received heart-beat
2020-09-02 09:26:08,533 DEBUG [client] Received heart-beat
2020-09-02 09:26:23,542 DEBUG [client] Received heart-beat
2020-09-02 09:26:38,534 DEBUG [client] Received heart-beat
2020-09-02 09:26:53,497 DEBUG [client] Received heart-beat
2020-09-02 09:27:08,538 DEBUG [client] Received heart-beat
2020-09-02 09:27:23,542 DEBUG [client] Received heart-beat
2020-09-02 09:27:38,537 DEBUG [client] Received heart-beat
2020-09-02 09:27:53,497 DEBUG [client] Received heart-beat
2020-09-02 09:28:08,530 DEBUG [client] Received heart-beat
2020-09-02 09:28:23,543 DEBUG [client] Received heart-beat
2020-09-02 09:28:38,536 DEBUG [client] Received heart-beat
2020-09-02 09:28:53,496 DEBUG [client] Received heart-beat
2020-09-02 09:29:08,535 DEBUG [client] Received heart-beat
2020-09-02 09:29:23,543 DEBUG [client] Received heart-beat
2020-09-02 09:29:38,537 DEBUG [client] Received heart-beat
2020-09-02 09:29:53,497 DEBUG [client] Received heart-beat
2020-09-02 09:30:08,561 DEBUG [client] Received heart-beat
2020-09-02 09:30:23,544 DEBUG [client] Received heart-beat
2020-09-02 09:30:38,536 DEBUG [client] Received heart-beat
2020-09-02 09:30:53,496 DEBUG [client] Received heart-beat
2020-09-02 09:31:08,535 DEBUG [client] Received heart-beat
2020-09-02 09:31:23,544 DEBUG [client] Received heart-beat
2020-09-02 09:31:38,544 DEBUG [client] Received heart-beat
2020-09-02 09:31:53,505 DEBUG [client] Received heart-beat
2020-09-02 09:32:08,542 DEBUG [client] Received heart-beat
2020-09-02 09:32:22,846 DEBUG [actions_component] Idle reset
2020-09-02 09:32:23,549 DEBUG [client] Received heart-beat
2020-09-02 09:32:38,540 DEBUG [client] Received heart-beat
2020-09-02 09:32:53,502 DEBUG [client] Received heart-beat
2020-09-02 09:33:08,536 DEBUG [client] Received heart-beat
2020-09-02 09:33:23,546 DEBUG [client] Received heart-beat
2020-09-02 09:33:38,541 DEBUG [client] Received heart-beat
2020-09-02 09:33:53,500 DEBUG [client] Received heart-beat
2020-09-02 09:34:08,539 DEBUG [client] Received heart-beat
2020-09-02 09:34:23,545 DEBUG [client] Received heart-beat
2020-09-02 09:34:38,558 DEBUG [client] Received heart-beat
2020-09-02 09:34:53,520 DEBUG [client] Received heart-beat
2020-09-02 09:35:08,539 DEBUG [client] Received heart-beat
2020-09-02 09:35:23,546 DEBUG [client] Received heart-beat
2020-09-02 09:35:38,570 DEBUG [client] Received heart-beat
2020-09-02 09:35:53,526 DEBUG [client] Received heart-beat
2020-09-02 09:36:08,542 DEBUG [client] Received heart-beat
2020-09-02 09:36:23,547 DEBUG [client] Received heart-beat
2020-09-02 09:36:38,541 DEBUG [client] Received heart-beat
2020-09-02 09:36:53,502 DEBUG [client] Received heart-beat
2020-09-02 09:37:08,542 DEBUG [client] Received heart-beat
2020-09-02 09:37:23,546 DEBUG [client] Received heart-beat
2020-09-02 09:37:38,539 DEBUG [client] Received heart-beat
2020-09-02 09:37:53,498 DEBUG [client] Received heart-beat
2020-09-02 09:38:08,540 DEBUG [client] Received heart-beat
2020-09-02 09:38:23,547 DEBUG [client] Received heart-beat
2020-09-02 09:38:38,542 DEBUG [client] Received heart-beat
2020-09-02 09:38:53,500 DEBUG [client] Received heart-beat
2020-09-02 09:39:08,542 DEBUG [client] Received heart-beat
2020-09-02 09:39:23,547 DEBUG [client] Received heart-beat
2020-09-02 09:39:38,536 DEBUG [client] Received heart-beat
2020-09-02 09:39:53,493 DEBUG [client] Received heart-beat
2020-09-02 09:40:08,542 DEBUG [client] Received heart-beat
2020-09-02 09:40:23,547 DEBUG [client] Received heart-beat
2020-09-02 09:40:38,539 DEBUG [client] Received heart-beat
2020-09-02 09:40:53,498 DEBUG [client] Received heart-beat
2020-09-02 09:41:08,541 DEBUG [client] Received heart-beat
2020-09-02 09:41:23,548 DEBUG [client] Received heart-beat
2020-09-02 09:41:38,543 DEBUG [client] Received heart-beat
2020-09-02 09:41:53,505 DEBUG [client] Received heart-beat
2020-09-02 09:42:08,545 DEBUG [client] Received heart-beat
2020-09-02 09:42:22,846 DEBUG [actions_component] Idle reset
2020-09-02 09:42:23,549 DEBUG [client] Received heart-beat
2020-09-02 09:42:38,545 DEBUG [client] Received heart-beat
2020-09-02 09:42:53,505 DEBUG [client] Received heart-beat
2020-09-02 09:43:08,547 DEBUG [client] Received heart-beat
2020-09-02 09:43:23,550 DEBUG [client] Received heart-beat
2020-09-02 09:43:38,547 DEBUG [client] Received heart-beat
2020-09-02 09:43:53,506 DEBUG [client] Received heart-beat
2020-09-02 09:44:08,543 DEBUG [client] Received heart-beat
2020-09-02 09:44:23,550 DEBUG [client] Received heart-beat
2020-09-02 09:44:38,548 DEBUG [client] Received heart-beat
2020-09-02 09:44:53,528 DEBUG [client] Received heart-beat
2020-09-02 09:45:08,547 DEBUG [client] Received heart-beat
2020-09-02 09:45:23,551 DEBUG [client] Received heart-beat
2020-09-02 09:45:38,546 DEBUG [client] Received heart-beat
2020-09-02 09:45:53,507 DEBUG [client] Received heart-beat
2020-09-02 09:46:08,547 DEBUG [client] Received heart-beat
2020-09-02 09:46:23,550 DEBUG [client] Received heart-beat
2020-09-02 09:46:38,547 DEBUG [client] Received heart-beat
2020-09-02 09:46:53,507 DEBUG [client] Received heart-beat
2020-09-02 09:47:08,548 DEBUG [client] Received heart-beat
2020-09-02 09:47:23,551 DEBUG [client] Received heart-beat
2020-09-02 09:47:38,550 DEBUG [client] Received heart-beat
2020-09-02 09:47:53,511 DEBUG [client] Received heart-beat
2020-09-02 09:48:08,570 DEBUG [client] Received heart-beat
2020-09-02 09:48:23,551 DEBUG [client] Received heart-beat
2020-09-02 09:48:38,550 DEBUG [client] Received heart-beat
2020-09-02 09:48:53,509 DEBUG [client] Received heart-beat
2020-09-02 09:49:08,561 DEBUG [client] Received heart-beat
2020-09-02 09:49:23,552 DEBUG [client] Received heart-beat
2020-09-02 09:49:38,552 DEBUG [client] Received heart-beat
2020-09-02 09:49:53,512 DEBUG [client] Received heart-beat
2020-09-02 09:50:08,554 DEBUG [client] Received heart-beat
2020-09-02 09:50:23,551 DEBUG [client] Received heart-beat
2020-09-02 09:50:38,552 DEBUG [client] Received heart-beat
2020-09-02 09:50:53,515 DEBUG [client] Received heart-beat
2020-09-02 09:51:08,553 DEBUG [client] Received heart-beat
2020-09-02 09:51:23,553 DEBUG [client] Received heart-beat
2020-09-02 09:51:38,552 DEBUG [client] Received heart-beat
2020-09-02 09:51:53,513 DEBUG [client] Received heart-beat
2020-09-02 09:52:08,555 DEBUG [client] Received heart-beat
2020-09-02 09:52:22,846 DEBUG [actions_component] Idle reset
2020-09-02 09:52:23,550 DEBUG [client] Received heart-beat
2020-09-02 09:52:38,550 DEBUG [client] Received heart-beat
2020-09-02 09:52:53,510 DEBUG [client] Received heart-beat
2020-09-02 09:53:08,552 DEBUG [client] Received heart-beat
2020-09-02 09:53:23,553 DEBUG [client] Received heart-beat
2020-09-02 09:53:38,553 DEBUG [client] Received heart-beat
2020-09-02 09:53:53,510 DEBUG [client] Received heart-beat
2020-09-02 09:54:08,552 DEBUG [client] Received heart-beat
2020-09-02 09:54:23,553 DEBUG [client] Received heart-beat
2020-09-02 09:54:38,555 DEBUG [client] Received heart-beat
2020-09-02 09:54:53,517 DEBUG [client] Received heart-beat
2020-09-02 09:55:08,558 DEBUG [client] Received heart-beat
2020-09-02 09:55:23,554 DEBUG [client] Received heart-beat
2020-09-02 09:55:38,555 DEBUG [client] Received heart-beat
2020-09-02 09:55:53,519 DEBUG [client] Received heart-beat
2020-09-02 09:56:08,567 DEBUG [client] Received heart-beat
2020-09-02 09:56:23,554 DEBUG [client] Received heart-beat
2020-09-02 09:56:38,559 DEBUG [client] Received heart-beat
2020-09-02 09:56:53,519 DEBUG [client] Received heart-beat
2020-09-02 09:57:08,558 DEBUG [client] Received heart-beat
2020-09-02 09:57:23,554 DEBUG [client] Received heart-beat
2020-09-02 09:57:38,558 DEBUG [client] Received heart-beat
2020-09-02 09:57:53,517 DEBUG [client] Received heart-beat
2020-09-02 09:58:08,553 DEBUG [client] Received heart-beat
2020-09-02 09:58:23,555 DEBUG [client] Received heart-beat
2020-09-02 09:58:38,556 DEBUG [client] Received heart-beat
2020-09-02 09:58:53,514 DEBUG [client] Received heart-beat
2020-09-02 09:59:08,555 DEBUG [client] Received heart-beat
2020-09-02 09:59:23,556 DEBUG [client] Received heart-beat
2020-09-02 09:59:38,567 DEBUG [client] Received heart-beat
2020-09-02 09:59:53,528 DEBUG [client] Received heart-beat
2020-09-02 10:00:08,562 DEBUG [client] Received heart-beat
2020-09-02 10:00:23,556 DEBUG [client] Received heart-beat
2020-09-02 10:00:38,557 DEBUG [client] Received heart-beat
2020-09-02 10:00:53,513 DEBUG [client] Received heart-beat
2020-09-02 10:01:08,555 DEBUG [client] Received heart-beat
2020-09-02 10:01:23,556 DEBUG [client] Received heart-beat
2020-09-02 10:01:38,557 DEBUG [client] Received heart-beat
2020-09-02 10:01:53,514 DEBUG [client] Received heart-beat
2020-09-02 10:02:08,557 DEBUG [client] Received heart-beat
2020-09-02 10:02:22,847 DEBUG [actions_component] Idle reset
2020-09-02 10:02:23,550 DEBUG [client] Received heart-beat
2020-09-02 10:02:38,558 DEBUG [client] Received heart-beat
2020-09-02 10:02:53,517 DEBUG [client] Received heart-beat
2020-09-02 10:03:08,560 DEBUG [client] Received heart-beat

I tried to debug resilient-circuits several times, from the circuits logs itself I only see heartbeats. 

If I run something like: resilient-circuits selftest -l fn-ip-void

I got this output

fn-ip-void:
Test was successful!
Credits Remaining: 25
Estimated Queries: 312
selftest: success, Elapsed time: 0.000000 seconds

This is a part of the app.log regarding ip_void:

[integration@resilient .resilient]$ cat app.log | grep void
2020-08-31 09:29:27,864 DEBUG [connectionpool] https://172.25.0.169:443 "GET /rest/orgs/203/functions/fn_ip_void_request HTTP/1.1" 200 None
2020-08-31 09:29:28,776 DEBUG [decorators] @function <function _fn_ip_void_request_function at 0x7f26ba682c50>
2020-08-31 09:29:29,292 INFO [component_loader] 'fn_ip_void.components.fn_ip_void_request.FunctionComponent' loading
2020-08-31 09:29:29,293 DEBUG [component_loader] 'fn_ip_void.components.fn_ip_void_request.FunctionComponent' loaded
2020-08-31 09:29:30,468 INFO [actions_component] 'fn_ip_void.components.fn_ip_void_request.FunctionComponent' function 'fn_ip_void_request' registered to 'fn_ip_void'
2020-08-31 09:29:30,469 DEBUG [actions_component] Listeners: {u'email_outbound': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_spamhaus_query': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_qradar_integration': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_mitre_integration': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_whois_rdap': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_ipinfo': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_xforce': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_ip_void': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>])}
fn_ip_void_request/functions.fn_ip_void_request
2020-08-31 09:29:30,476 INFO [actions_component] Subscribe to message destination 'fn_ip_void'
2020-08-31 09:29:30,483 INFO [stomp_component] Subscribe to message destination actions.203.fn_ip_void
2020-08-31 09:29:30,483 DEBUG [client] Sending SUBSCRIBE frame [headers={'ack': 'client-individual', 'destination': 'actions.203.fn_ip_void', 'id': 'actions.203.fn_ip_void', 'activemq.prefetchSize': 20}, version=1.2]

I don't see any errors on this side, the workflow status is nor on "pending" but on "running", I can't find anything related to it tough.

Hi Ben, 

Thank you for the answer reading the article you sent me, I realized that I don't actually need an exclusive gateway on that position because I need to do the Ip Void check on both cases, if the result is positive then I'll close with a mail if not I'll just close ( without mail). At this point it should be easier to close the incident in both cases with a mail notification. 

So, I'll ask you, is there a way to print the query result in the notification?  I tried to run the workflow and the action querying an artifact manually but both the action and the workflow are stuck in pending status so I'm not really sure if its working.

Hello Ben, 

Thank you for the detailed answer.

I'm trying to edit the workflow as you showed on the images above but I'm getting an error :

 "Exclusive Gateway 'ExclusiveGateway_0dr700o' has outgoing sequence flow 'SequenceFlow_10pcls6' without condition which is not the default flow."

This is the workflow:

It would be possible to add an exclusive gateway after the function that checks the results and if necessary close the incident using a script:

Sending an email would require the configuration of a Notification:

Hello Richard, 

In the very same app.log I  see lines like :

2020-08-24 10:55:55,909 INFO [actions_component] resilient-circuits has started successfully and is now running...,
 and

2020-08-24 10:55:55,909 INFO [stomp_component] Subscribe to message destination actions.201.{integration function

For what concern the second line you posted I only have this:

[integration@resilient ~]$ cat /home/integration/.resilient/app.log | grep subscribe
subscribe_to_all/*
Unsubscribe/*
2020-08-31 09:29:30,476 DEBUG [actions_component] Connected successfully. Resubscribe? False
subscribe_to_all/*
Unsubscribe/*
2020-09-01 14:52:05,863 DEBUG [actions_component] Connected successfully. Resubscribe? False
subscribe_to_all/*
Unsubscribe/*
2020-09-01 14:52:11,650 DEBUG [actions_component] Connected successfully. Resubscribe? False
subscribe_to_all/*
Unsubscribe/*
2020-09-01 14:52:23,958 DEBUG [actions_component] Connected successfully. Resubscribe? False

Hello Richard, 

I think I posted an example above:

This is a part of the app.log regarding ip_void:

[integration@resilient .resilient]$ cat app.log | grep void
2020-08-31 09:29:27,864 DEBUG [connectionpool] https://172.25.0.169:443 "GET /rest/orgs/203/functions/fn_ip_void_request HTTP/1.1" 200 None
2020-08-31 09:29:28,776 DEBUG [decorators] @function <function _fn_ip_void_request_function at 0x7f26ba682c50>
2020-08-31 09:29:29,292 INFO [component_loader] 'fn_ip_void.components.fn_ip_void_request.FunctionComponent' loading
2020-08-31 09:29:29,293 DEBUG [component_loader] 'fn_ip_void.components.fn_ip_void_request.FunctionComponent' loaded
2020-08-31 09:29:30,468 INFO [actions_component] 'fn_ip_void.components.fn_ip_void_request.FunctionComponent' function 'fn_ip_void_request' registered to 'fn_ip_void'
2020-08-31 09:29:30,469 DEBUG [actions_component] Listeners: {u'email_outbound': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_spamhaus_query': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_qradar_integration': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_mitre_integration': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_whois_rdap': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_ipinfo': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_xforce': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_ip_void': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>])}
fn_ip_void_request/functions.fn_ip_void_request
2020-08-31 09:29:30,476 INFO [actions_component] Subscribe to message destination 'fn_ip_void'
2020-08-31 09:29:30,483 INFO [stomp_component] Subscribe to message destination actions.203.fn_ip_void
2020-08-31 09:29:30,483 DEBUG [client] Sending SUBSCRIBE frame [headers={'ack': 'client-individual', 'destination': 'actions.203.fn_ip_void', 'id': 'actions.203.fn_ip_void', 'activemq.prefetchSize': 20}, version=1.2]

For the rest, this is an example of what's written on the log

2020-09-02 09:19:08,530 DEBUG [client] Received heart-beat
2020-09-02 09:19:23,540 DEBUG [client] Received heart-beat
2020-09-02 09:19:38,540 DEBUG [client] Received heart-beat
2020-09-02 09:19:53,507 DEBUG [client] Received heart-beat
2020-09-02 09:20:08,525 DEBUG [client] Received heart-beat
2020-09-02 09:20:23,540 DEBUG [client] Received heart-beat
2020-09-02 09:20:38,533 DEBUG [client] Received heart-beat
2020-09-02 09:20:53,491 DEBUG [client] Received heart-beat
2020-09-02 09:21:08,533 DEBUG [client] Received heart-beat
2020-09-02 09:21:23,540 DEBUG [client] Received heart-beat
2020-09-02 09:21:38,532 DEBUG [client] Received heart-beat
2020-09-02 09:21:53,494 DEBUG [client] Received heart-beat
2020-09-02 09:22:08,530 DEBUG [client] Received heart-beat
2020-09-02 09:22:22,845 DEBUG [actions_component] Idle reset
2020-09-02 09:22:23,549 DEBUG [client] Received heart-beat
2020-09-02 09:22:38,532 DEBUG [client] Received heart-beat
2020-09-02 09:22:53,496 DEBUG [client] Received heart-beat
2020-09-02 09:23:08,531 DEBUG [client] Received heart-beat
2020-09-02 09:23:23,541 DEBUG [client] Received heart-beat
2020-09-02 09:23:38,533 DEBUG [client] Received heart-beat
2020-09-02 09:23:53,492 DEBUG [client] Received heart-beat
2020-09-02 09:24:08,532 DEBUG [client] Received heart-beat
2020-09-02 09:24:23,541 DEBUG [client] Received heart-beat
2020-09-02 09:24:38,537 DEBUG [client] Received heart-beat
2020-09-02 09:24:53,500 DEBUG [client] Received heart-beat
2020-09-02 09:25:08,532 DEBUG [client] Received heart-beat
2020-09-02 09:25:23,542 DEBUG [client] Received heart-beat
2020-09-02 09:25:38,531 DEBUG [client] Received heart-beat
2020-09-02 09:25:53,490 DEBUG [client] Received heart-beat
2020-09-02 09:26:08,533 DEBUG [client] Received heart-beat
2020-09-02 09:26:23,542 DEBUG [client] Received heart-beat
2020-09-02 09:26:38,534 DEBUG [client] Received heart-beat
2020-09-02 09:26:53,497 DEBUG [client] Received heart-beat
2020-09-02 09:27:08,538 DEBUG [client] Received heart-beat
2020-09-02 09:27:23,542 DEBUG [client] Received heart-beat
2020-09-02 09:27:38,537 DEBUG [client] Received heart-beat
2020-09-02 09:27:53,497 DEBUG [client] Received heart-beat
2020-09-02 09:28:08,530 DEBUG [client] Received heart-beat
2020-09-02 09:28:23,543 DEBUG [client] Received heart-beat
2020-09-02 09:28:38,536 DEBUG [client] Received heart-beat
2020-09-02 09:28:53,496 DEBUG [client] Received heart-beat
2020-09-02 09:29:08,535 DEBUG [client] Received heart-beat
2020-09-02 09:29:23,543 DEBUG [client] Received heart-beat
2020-09-02 09:29:38,537 DEBUG [client] Received heart-beat
2020-09-02 09:29:53,497 DEBUG [client] Received heart-beat
2020-09-02 09:30:08,561 DEBUG [client] Received heart-beat
2020-09-02 09:30:23,544 DEBUG [client] Received heart-beat
2020-09-02 09:30:38,536 DEBUG [client] Received heart-beat
2020-09-02 09:30:53,496 DEBUG [client] Received heart-beat
2020-09-02 09:31:08,535 DEBUG [client] Received heart-beat
2020-09-02 09:31:23,544 DEBUG [client] Received heart-beat
2020-09-02 09:31:38,544 DEBUG [client] Received heart-beat
2020-09-02 09:31:53,505 DEBUG [client] Received heart-beat
2020-09-02 09:32:08,542 DEBUG [client] Received heart-beat
2020-09-02 09:32:22,846 DEBUG [actions_component] Idle reset
2020-09-02 09:32:23,549 DEBUG [client] Received heart-beat
2020-09-02 09:32:38,540 DEBUG [client] Received heart-beat
2020-09-02 09:32:53,502 DEBUG [client] Received heart-beat
2020-09-02 09:33:08,536 DEBUG [client] Received heart-beat
2020-09-02 09:33:23,546 DEBUG [client] Received heart-beat
2020-09-02 09:33:38,541 DEBUG [client] Received heart-beat
2020-09-02 09:33:53,500 DEBUG [client] Received heart-beat
2020-09-02 09:34:08,539 DEBUG [client] Received heart-beat
2020-09-02 09:34:23,545 DEBUG [client] Received heart-beat
2020-09-02 09:34:38,558 DEBUG [client] Received heart-beat
2020-09-02 09:34:53,520 DEBUG [client] Received heart-beat
2020-09-02 09:35:08,539 DEBUG [client] Received heart-beat
2020-09-02 09:35:23,546 DEBUG [client] Received heart-beat
2020-09-02 09:35:38,570 DEBUG [client] Received heart-beat
2020-09-02 09:35:53,526 DEBUG [client] Received heart-beat
2020-09-02 09:36:08,542 DEBUG [client] Received heart-beat
2020-09-02 09:36:23,547 DEBUG [client] Received heart-beat
2020-09-02 09:36:38,541 DEBUG [client] Received heart-beat
2020-09-02 09:36:53,502 DEBUG [client] Received heart-beat
2020-09-02 09:37:08,542 DEBUG [client] Received heart-beat
2020-09-02 09:37:23,546 DEBUG [client] Received heart-beat
2020-09-02 09:37:38,539 DEBUG [client] Received heart-beat
2020-09-02 09:37:53,498 DEBUG [client] Received heart-beat
2020-09-02 09:38:08,540 DEBUG [client] Received heart-beat
2020-09-02 09:38:23,547 DEBUG [client] Received heart-beat
2020-09-02 09:38:38,542 DEBUG [client] Received heart-beat
2020-09-02 09:38:53,500 DEBUG [client] Received heart-beat
2020-09-02 09:39:08,542 DEBUG [client] Received heart-beat
2020-09-02 09:39:23,547 DEBUG [client] Received heart-beat
2020-09-02 09:39:38,536 DEBUG [client] Received heart-beat
2020-09-02 09:39:53,493 DEBUG [client] Received heart-beat
2020-09-02 09:40:08,542 DEBUG [client] Received heart-beat
2020-09-02 09:40:23,547 DEBUG [client] Received heart-beat
2020-09-02 09:40:38,539 DEBUG [client] Received heart-beat
2020-09-02 09:40:53,498 DEBUG [client] Received heart-beat
2020-09-02 09:41:08,541 DEBUG [client] Received heart-beat
2020-09-02 09:41:23,548 DEBUG [client] Received heart-beat
2020-09-02 09:41:38,543 DEBUG [client] Received heart-beat
2020-09-02 09:41:53,505 DEBUG [client] Received heart-beat
2020-09-02 09:42:08,545 DEBUG [client] Received heart-beat
2020-09-02 09:42:22,846 DEBUG [actions_component] Idle reset
2020-09-02 09:42:23,549 DEBUG [client] Received heart-beat
2020-09-02 09:42:38,545 DEBUG [client] Received heart-beat
2020-09-02 09:42:53,505 DEBUG [client] Received heart-beat
2020-09-02 09:43:08,547 DEBUG [client] Received heart-beat
2020-09-02 09:43:23,550 DEBUG [client] Received heart-beat
2020-09-02 09:43:38,547 DEBUG [client] Received heart-beat
2020-09-02 09:43:53,506 DEBUG [client] Received heart-beat
2020-09-02 09:44:08,543 DEBUG [client] Received heart-beat
2020-09-02 09:44:23,550 DEBUG [client] Received heart-beat
2020-09-02 09:44:38,548 DEBUG [client] Received heart-beat
2020-09-02 09:44:53,528 DEBUG [client] Received heart-beat
2020-09-02 09:45:08,547 DEBUG [client] Received heart-beat
2020-09-02 09:45:23,551 DEBUG [client] Received heart-beat
2020-09-02 09:45:38,546 DEBUG [client] Received heart-beat
2020-09-02 09:45:53,507 DEBUG [client] Received heart-beat
2020-09-02 09:46:08,547 DEBUG [client] Received heart-beat
2020-09-02 09:46:23,550 DEBUG [client] Received heart-beat
2020-09-02 09:46:38,547 DEBUG [client] Received heart-beat
2020-09-02 09:46:53,507 DEBUG [client] Received heart-beat
2020-09-02 09:47:08,548 DEBUG [client] Received heart-beat
2020-09-02 09:47:23,551 DEBUG [client] Received heart-beat
2020-09-02 09:47:38,550 DEBUG [client] Received heart-beat
2020-09-02 09:47:53,511 DEBUG [client] Received heart-beat
2020-09-02 09:48:08,570 DEBUG [client] Received heart-beat
2020-09-02 09:48:23,551 DEBUG [client] Received heart-beat
2020-09-02 09:48:38,550 DEBUG [client] Received heart-beat
2020-09-02 09:48:53,509 DEBUG [client] Received heart-beat
2020-09-02 09:49:08,561 DEBUG [client] Received heart-beat
2020-09-02 09:49:23,552 DEBUG [client] Received heart-beat
2020-09-02 09:49:38,552 DEBUG [client] Received heart-beat
2020-09-02 09:49:53,512 DEBUG [client] Received heart-beat
2020-09-02 09:50:08,554 DEBUG [client] Received heart-beat
2020-09-02 09:50:23,551 DEBUG [client] Received heart-beat
2020-09-02 09:50:38,552 DEBUG [client] Received heart-beat
2020-09-02 09:50:53,515 DEBUG [client] Received heart-beat
2020-09-02 09:51:08,553 DEBUG [client] Received heart-beat
2020-09-02 09:51:23,553 DEBUG [client] Received heart-beat
2020-09-02 09:51:38,552 DEBUG [client] Received heart-beat
2020-09-02 09:51:53,513 DEBUG [client] Received heart-beat
2020-09-02 09:52:08,555 DEBUG [client] Received heart-beat
2020-09-02 09:52:22,846 DEBUG [actions_component] Idle reset
2020-09-02 09:52:23,550 DEBUG [client] Received heart-beat
2020-09-02 09:52:38,550 DEBUG [client] Received heart-beat
2020-09-02 09:52:53,510 DEBUG [client] Received heart-beat
2020-09-02 09:53:08,552 DEBUG [client] Received heart-beat
2020-09-02 09:53:23,553 DEBUG [client] Received heart-beat
2020-09-02 09:53:38,553 DEBUG [client] Received heart-beat
2020-09-02 09:53:53,510 DEBUG [client] Received heart-beat
2020-09-02 09:54:08,552 DEBUG [client] Received heart-beat
2020-09-02 09:54:23,553 DEBUG [client] Received heart-beat
2020-09-02 09:54:38,555 DEBUG [client] Received heart-beat
2020-09-02 09:54:53,517 DEBUG [client] Received heart-beat
2020-09-02 09:55:08,558 DEBUG [client] Received heart-beat
2020-09-02 09:55:23,554 DEBUG [client] Received heart-beat
2020-09-02 09:55:38,555 DEBUG [client] Received heart-beat
2020-09-02 09:55:53,519 DEBUG [client] Received heart-beat
2020-09-02 09:56:08,567 DEBUG [client] Received heart-beat
2020-09-02 09:56:23,554 DEBUG [client] Received heart-beat
2020-09-02 09:56:38,559 DEBUG [client] Received heart-beat
2020-09-02 09:56:53,519 DEBUG [client] Received heart-beat
2020-09-02 09:57:08,558 DEBUG [client] Received heart-beat
2020-09-02 09:57:23,554 DEBUG [client] Received heart-beat
2020-09-02 09:57:38,558 DEBUG [client] Received heart-beat
2020-09-02 09:57:53,517 DEBUG [client] Received heart-beat
2020-09-02 09:58:08,553 DEBUG [client] Received heart-beat
2020-09-02 09:58:23,555 DEBUG [client] Received heart-beat
2020-09-02 09:58:38,556 DEBUG [client] Received heart-beat
2020-09-02 09:58:53,514 DEBUG [client] Received heart-beat
2020-09-02 09:59:08,555 DEBUG [client] Received heart-beat
2020-09-02 09:59:23,556 DEBUG [client] Received heart-beat
2020-09-02 09:59:38,567 DEBUG [client] Received heart-beat
2020-09-02 09:59:53,528 DEBUG [client] Received heart-beat
2020-09-02 10:00:08,562 DEBUG [client] Received heart-beat
2020-09-02 10:00:23,556 DEBUG [client] Received heart-beat
2020-09-02 10:00:38,557 DEBUG [client] Received heart-beat
2020-09-02 10:00:53,513 DEBUG [client] Received heart-beat
2020-09-02 10:01:08,555 DEBUG [client] Received heart-beat
2020-09-02 10:01:23,556 DEBUG [client] Received heart-beat
2020-09-02 10:01:38,557 DEBUG [client] Received heart-beat
2020-09-02 10:01:53,514 DEBUG [client] Received heart-beat
2020-09-02 10:02:08,557 DEBUG [client] Received heart-beat
2020-09-02 10:02:22,847 DEBUG [actions_component] Idle reset
2020-09-02 10:02:23,550 DEBUG [client] Received heart-beat
2020-09-02 10:02:38,558 DEBUG [client] Received heart-beat
2020-09-02 10:02:53,517 DEBUG [client] Received heart-beat
2020-09-02 10:03:08,560 DEBUG [client] Received heart-beat

I tried to debug resilient-circuits several times, from the circuits logs itself I only see heartbeats. 

If I run something like: resilient-circuits selftest -l fn-ip-void

I got this output

fn-ip-void:
Test was successful!
Credits Remaining: 25
Estimated Queries: 312
selftest: success, Elapsed time: 0.000000 seconds

This is a part of the app.log regarding ip_void:

[integration@resilient .resilient]$ cat app.log | grep void
2020-08-31 09:29:27,864 DEBUG [connectionpool] https://172.25.0.169:443 "GET /rest/orgs/203/functions/fn_ip_void_request HTTP/1.1" 200 None
2020-08-31 09:29:28,776 DEBUG [decorators] @function <function _fn_ip_void_request_function at 0x7f26ba682c50>
2020-08-31 09:29:29,292 INFO [component_loader] 'fn_ip_void.components.fn_ip_void_request.FunctionComponent' loading
2020-08-31 09:29:29,293 DEBUG [component_loader] 'fn_ip_void.components.fn_ip_void_request.FunctionComponent' loaded
2020-08-31 09:29:30,468 INFO [actions_component] 'fn_ip_void.components.fn_ip_void_request.FunctionComponent' function 'fn_ip_void_request' registered to 'fn_ip_void'
2020-08-31 09:29:30,469 DEBUG [actions_component] Listeners: {u'email_outbound': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_spamhaus_query': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_qradar_integration': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_mitre_integration': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_whois_rdap': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_ipinfo': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_xforce': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_ip_void': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>])}
fn_ip_void_request/functions.fn_ip_void_request
2020-08-31 09:29:30,476 INFO [actions_component] Subscribe to message destination 'fn_ip_void'
2020-08-31 09:29:30,483 INFO [stomp_component] Subscribe to message destination actions.203.fn_ip_void
2020-08-31 09:29:30,483 DEBUG [client] Sending SUBSCRIBE frame [headers={'ack': 'client-individual', 'destination': 'actions.203.fn_ip_void', 'id': 'actions.203.fn_ip_void', 'activemq.prefetchSize': 20}, version=1.2]

I don't see any errors on this side, the workflow status is nor on "pending" but on "running", I can't find anything related to it tough.

Hi Ben, 

Thank you for the answer reading the article you sent me, I realized that I don't actually need an exclusive gateway on that position because I need to do the Ip Void check on both cases, if the result is positive then I'll close with a mail if not I'll just close ( without mail). At this point it should be easier to close the incident in both cases with a mail notification. 

So, I'll ask you, is there a way to print the query result in the notification?  I tried to run the workflow and the action querying an artifact manually but both the action and the workflow are stuck in pending status so I'm not really sure if its working.

Hello Ben, 

Thank you for the detailed answer.

I'm trying to edit the workflow as you showed on the images above but I'm getting an error :

 "Exclusive Gateway 'ExclusiveGateway_0dr700o' has outgoing sequence flow 'SequenceFlow_10pcls6' without condition which is not the default flow."

This is the workflow:

It would be possible to add an exclusive gateway after the function that checks the results and if necessary close the incident using a script:

Sending an email would require the configuration of a Notification:

Hello Richard, 

In the very same app.log I  see lines like :

2020-08-24 10:55:55,909 INFO [actions_component] resilient-circuits has started successfully and is now running...,
 and

2020-08-24 10:55:55,909 INFO [stomp_component] Subscribe to message destination actions.201.{integration function

For what concern the second line you posted I only have this:

[integration@resilient ~]$ cat /home/integration/.resilient/app.log | grep subscribe
subscribe_to_all/*
Unsubscribe/*
2020-08-31 09:29:30,476 DEBUG [actions_component] Connected successfully. Resubscribe? False
subscribe_to_all/*
Unsubscribe/*
2020-09-01 14:52:05,863 DEBUG [actions_component] Connected successfully. Resubscribe? False
subscribe_to_all/*
Unsubscribe/*
2020-09-01 14:52:11,650 DEBUG [actions_component] Connected successfully. Resubscribe? False
subscribe_to_all/*
Unsubscribe/*
2020-09-01 14:52:23,958 DEBUG [actions_component] Connected successfully. Resubscribe? False

Hello Richard, 

I think I posted an example above:

This is a part of the app.log regarding ip_void:

[integration@resilient .resilient]$ cat app.log | grep void
2020-08-31 09:29:27,864 DEBUG [connectionpool] https://172.25.0.169:443 "GET /rest/orgs/203/functions/fn_ip_void_request HTTP/1.1" 200 None
2020-08-31 09:29:28,776 DEBUG [decorators] @function <function _fn_ip_void_request_function at 0x7f26ba682c50>
2020-08-31 09:29:29,292 INFO [component_loader] 'fn_ip_void.components.fn_ip_void_request.FunctionComponent' loading
2020-08-31 09:29:29,293 DEBUG [component_loader] 'fn_ip_void.components.fn_ip_void_request.FunctionComponent' loaded
2020-08-31 09:29:30,468 INFO [actions_component] 'fn_ip_void.components.fn_ip_void_request.FunctionComponent' function 'fn_ip_void_request' registered to 'fn_ip_void'
2020-08-31 09:29:30,469 DEBUG [actions_component] Listeners: {u'email_outbound': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_spamhaus_query': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_qradar_integration': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_mitre_integration': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_whois_rdap': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_ipinfo': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_xforce': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_ip_void': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>])}
fn_ip_void_request/functions.fn_ip_void_request
2020-08-31 09:29:30,476 INFO [actions_component] Subscribe to message destination 'fn_ip_void'
2020-08-31 09:29:30,483 INFO [stomp_component] Subscribe to message destination actions.203.fn_ip_void
2020-08-31 09:29:30,483 DEBUG [client] Sending SUBSCRIBE frame [headers={'ack': 'client-individual', 'destination': 'actions.203.fn_ip_void', 'id': 'actions.203.fn_ip_void', 'activemq.prefetchSize': 20}, version=1.2]

For the rest, this is an example of what's written on the log

2020-09-02 09:19:08,530 DEBUG [client] Received heart-beat
2020-09-02 09:19:23,540 DEBUG [client] Received heart-beat
2020-09-02 09:19:38,540 DEBUG [client] Received heart-beat
2020-09-02 09:19:53,507 DEBUG [client] Received heart-beat
2020-09-02 09:20:08,525 DEBUG [client] Received heart-beat
2020-09-02 09:20:23,540 DEBUG [client] Received heart-beat
2020-09-02 09:20:38,533 DEBUG [client] Received heart-beat
2020-09-02 09:20:53,491 DEBUG [client] Received heart-beat
2020-09-02 09:21:08,533 DEBUG [client] Received heart-beat
2020-09-02 09:21:23,540 DEBUG [client] Received heart-beat
2020-09-02 09:21:38,532 DEBUG [client] Received heart-beat
2020-09-02 09:21:53,494 DEBUG [client] Received heart-beat
2020-09-02 09:22:08,530 DEBUG [client] Received heart-beat
2020-09-02 09:22:22,845 DEBUG [actions_component] Idle reset
2020-09-02 09:22:23,549 DEBUG [client] Received heart-beat
2020-09-02 09:22:38,532 DEBUG [client] Received heart-beat
2020-09-02 09:22:53,496 DEBUG [client] Received heart-beat
2020-09-02 09:23:08,531 DEBUG [client] Received heart-beat
2020-09-02 09:23:23,541 DEBUG [client] Received heart-beat
2020-09-02 09:23:38,533 DEBUG [client] Received heart-beat
2020-09-02 09:23:53,492 DEBUG [client] Received heart-beat
2020-09-02 09:24:08,532 DEBUG [client] Received heart-beat
2020-09-02 09:24:23,541 DEBUG [client] Received heart-beat
2020-09-02 09:24:38,537 DEBUG [client] Received heart-beat
2020-09-02 09:24:53,500 DEBUG [client] Received heart-beat
2020-09-02 09:25:08,532 DEBUG [client] Received heart-beat
2020-09-02 09:25:23,542 DEBUG [client] Received heart-beat
2020-09-02 09:25:38,531 DEBUG [client] Received heart-beat
2020-09-02 09:25:53,490 DEBUG [client] Received heart-beat
2020-09-02 09:26:08,533 DEBUG [client] Received heart-beat
2020-09-02 09:26:23,542 DEBUG [client] Received heart-beat
2020-09-02 09:26:38,534 DEBUG [client] Received heart-beat
2020-09-02 09:26:53,497 DEBUG [client] Received heart-beat
2020-09-02 09:27:08,538 DEBUG [client] Received heart-beat
2020-09-02 09:27:23,542 DEBUG [client] Received heart-beat
2020-09-02 09:27:38,537 DEBUG [client] Received heart-beat
2020-09-02 09:27:53,497 DEBUG [client] Received heart-beat
2020-09-02 09:28:08,530 DEBUG [client] Received heart-beat
2020-09-02 09:28:23,543 DEBUG [client] Received heart-beat
2020-09-02 09:28:38,536 DEBUG [client] Received heart-beat
2020-09-02 09:28:53,496 DEBUG [client] Received heart-beat
2020-09-02 09:29:08,535 DEBUG [client] Received heart-beat
2020-09-02 09:29:23,543 DEBUG [client] Received heart-beat
2020-09-02 09:29:38,537 DEBUG [client] Received heart-beat
2020-09-02 09:29:53,497 DEBUG [client] Received heart-beat
2020-09-02 09:30:08,561 DEBUG [client] Received heart-beat
2020-09-02 09:30:23,544 DEBUG [client] Received heart-beat
2020-09-02 09:30:38,536 DEBUG [client] Received heart-beat
2020-09-02 09:30:53,496 DEBUG [client] Received heart-beat
2020-09-02 09:31:08,535 DEBUG [client] Received heart-beat
2020-09-02 09:31:23,544 DEBUG [client] Received heart-beat
2020-09-02 09:31:38,544 DEBUG [client] Received heart-beat
2020-09-02 09:31:53,505 DEBUG [client] Received heart-beat
2020-09-02 09:32:08,542 DEBUG [client] Received heart-beat
2020-09-02 09:32:22,846 DEBUG [actions_component] Idle reset
2020-09-02 09:32:23,549 DEBUG [client] Received heart-beat
2020-09-02 09:32:38,540 DEBUG [client] Received heart-beat
2020-09-02 09:32:53,502 DEBUG [client] Received heart-beat
2020-09-02 09:33:08,536 DEBUG [client] Received heart-beat
2020-09-02 09:33:23,546 DEBUG [client] Received heart-beat
2020-09-02 09:33:38,541 DEBUG [client] Received heart-beat
2020-09-02 09:33:53,500 DEBUG [client] Received heart-beat
2020-09-02 09:34:08,539 DEBUG [client] Received heart-beat
2020-09-02 09:34:23,545 DEBUG [client] Received heart-beat
2020-09-02 09:34:38,558 DEBUG [client] Received heart-beat
2020-09-02 09:34:53,520 DEBUG [client] Received heart-beat
2020-09-02 09:35:08,539 DEBUG [client] Received heart-beat
2020-09-02 09:35:23,546 DEBUG [client] Received heart-beat
2020-09-02 09:35:38,570 DEBUG [client] Received heart-beat
2020-09-02 09:35:53,526 DEBUG [client] Received heart-beat
2020-09-02 09:36:08,542 DEBUG [client] Received heart-beat
2020-09-02 09:36:23,547 DEBUG [client] Received heart-beat
2020-09-02 09:36:38,541 DEBUG [client] Received heart-beat
2020-09-02 09:36:53,502 DEBUG [client] Received heart-beat
2020-09-02 09:37:08,542 DEBUG [client] Received heart-beat
2020-09-02 09:37:23,546 DEBUG [client] Received heart-beat
2020-09-02 09:37:38,539 DEBUG [client] Received heart-beat
2020-09-02 09:37:53,498 DEBUG [client] Received heart-beat
2020-09-02 09:38:08,540 DEBUG [client] Received heart-beat
2020-09-02 09:38:23,547 DEBUG [client] Received heart-beat
2020-09-02 09:38:38,542 DEBUG [client] Received heart-beat
2020-09-02 09:38:53,500 DEBUG [client] Received heart-beat
2020-09-02 09:39:08,542 DEBUG [client] Received heart-beat
2020-09-02 09:39:23,547 DEBUG [client] Received heart-beat
2020-09-02 09:39:38,536 DEBUG [client] Received heart-beat
2020-09-02 09:39:53,493 DEBUG [client] Received heart-beat
2020-09-02 09:40:08,542 DEBUG [client] Received heart-beat
2020-09-02 09:40:23,547 DEBUG [client] Received heart-beat
2020-09-02 09:40:38,539 DEBUG [client] Received heart-beat
2020-09-02 09:40:53,498 DEBUG [client] Received heart-beat
2020-09-02 09:41:08,541 DEBUG [client] Received heart-beat
2020-09-02 09:41:23,548 DEBUG [client] Received heart-beat
2020-09-02 09:41:38,543 DEBUG [client] Received heart-beat
2020-09-02 09:41:53,505 DEBUG [client] Received heart-beat
2020-09-02 09:42:08,545 DEBUG [client] Received heart-beat
2020-09-02 09:42:22,846 DEBUG [actions_component] Idle reset
2020-09-02 09:42:23,549 DEBUG [client] Received heart-beat
2020-09-02 09:42:38,545 DEBUG [client] Received heart-beat
2020-09-02 09:42:53,505 DEBUG [client] Received heart-beat
2020-09-02 09:43:08,547 DEBUG [client] Received heart-beat
2020-09-02 09:43:23,550 DEBUG [client] Received heart-beat
2020-09-02 09:43:38,547 DEBUG [client] Received heart-beat
2020-09-02 09:43:53,506 DEBUG [client] Received heart-beat
2020-09-02 09:44:08,543 DEBUG [client] Received heart-beat
2020-09-02 09:44:23,550 DEBUG [client] Received heart-beat
2020-09-02 09:44:38,548 DEBUG [client] Received heart-beat
2020-09-02 09:44:53,528 DEBUG [client] Received heart-beat
2020-09-02 09:45:08,547 DEBUG [client] Received heart-beat
2020-09-02 09:45:23,551 DEBUG [client] Received heart-beat
2020-09-02 09:45:38,546 DEBUG [client] Received heart-beat
2020-09-02 09:45:53,507 DEBUG [client] Received heart-beat
2020-09-02 09:46:08,547 DEBUG [client] Received heart-beat
2020-09-02 09:46:23,550 DEBUG [client] Received heart-beat
2020-09-02 09:46:38,547 DEBUG [client] Received heart-beat
2020-09-02 09:46:53,507 DEBUG [client] Received heart-beat
2020-09-02 09:47:08,548 DEBUG [client] Received heart-beat
2020-09-02 09:47:23,551 DEBUG [client] Received heart-beat
2020-09-02 09:47:38,550 DEBUG [client] Received heart-beat
2020-09-02 09:47:53,511 DEBUG [client] Received heart-beat
2020-09-02 09:48:08,570 DEBUG [client] Received heart-beat
2020-09-02 09:48:23,551 DEBUG [client] Received heart-beat
2020-09-02 09:48:38,550 DEBUG [client] Received heart-beat
2020-09-02 09:48:53,509 DEBUG [client] Received heart-beat
2020-09-02 09:49:08,561 DEBUG [client] Received heart-beat
2020-09-02 09:49:23,552 DEBUG [client] Received heart-beat
2020-09-02 09:49:38,552 DEBUG [client] Received heart-beat
2020-09-02 09:49:53,512 DEBUG [client] Received heart-beat
2020-09-02 09:50:08,554 DEBUG [client] Received heart-beat
2020-09-02 09:50:23,551 DEBUG [client] Received heart-beat
2020-09-02 09:50:38,552 DEBUG [client] Received heart-beat
2020-09-02 09:50:53,515 DEBUG [client] Received heart-beat
2020-09-02 09:51:08,553 DEBUG [client] Received heart-beat
2020-09-02 09:51:23,553 DEBUG [client] Received heart-beat
2020-09-02 09:51:38,552 DEBUG [client] Received heart-beat
2020-09-02 09:51:53,513 DEBUG [client] Received heart-beat
2020-09-02 09:52:08,555 DEBUG [client] Received heart-beat
2020-09-02 09:52:22,846 DEBUG [actions_component] Idle reset
2020-09-02 09:52:23,550 DEBUG [client] Received heart-beat
2020-09-02 09:52:38,550 DEBUG [client] Received heart-beat
2020-09-02 09:52:53,510 DEBUG [client] Received heart-beat
2020-09-02 09:53:08,552 DEBUG [client] Received heart-beat
2020-09-02 09:53:23,553 DEBUG [client] Received heart-beat
2020-09-02 09:53:38,553 DEBUG [client] Received heart-beat
2020-09-02 09:53:53,510 DEBUG [client] Received heart-beat
2020-09-02 09:54:08,552 DEBUG [client] Received heart-beat
2020-09-02 09:54:23,553 DEBUG [client] Received heart-beat
2020-09-02 09:54:38,555 DEBUG [client] Received heart-beat
2020-09-02 09:54:53,517 DEBUG [client] Received heart-beat
2020-09-02 09:55:08,558 DEBUG [client] Received heart-beat
2020-09-02 09:55:23,554 DEBUG [client] Received heart-beat
2020-09-02 09:55:38,555 DEBUG [client] Received heart-beat
2020-09-02 09:55:53,519 DEBUG [client] Received heart-beat
2020-09-02 09:56:08,567 DEBUG [client] Received heart-beat
2020-09-02 09:56:23,554 DEBUG [client] Received heart-beat
2020-09-02 09:56:38,559 DEBUG [client] Received heart-beat
2020-09-02 09:56:53,519 DEBUG [client] Received heart-beat
2020-09-02 09:57:08,558 DEBUG [client] Received heart-beat
2020-09-02 09:57:23,554 DEBUG [client] Received heart-beat
2020-09-02 09:57:38,558 DEBUG [client] Received heart-beat
2020-09-02 09:57:53,517 DEBUG [client] Received heart-beat
2020-09-02 09:58:08,553 DEBUG [client] Received heart-beat
2020-09-02 09:58:23,555 DEBUG [client] Received heart-beat
2020-09-02 09:58:38,556 DEBUG [client] Received heart-beat
2020-09-02 09:58:53,514 DEBUG [client] Received heart-beat
2020-09-02 09:59:08,555 DEBUG [client] Received heart-beat
2020-09-02 09:59:23,556 DEBUG [client] Received heart-beat
2020-09-02 09:59:38,567 DEBUG [client] Received heart-beat
2020-09-02 09:59:53,528 DEBUG [client] Received heart-beat
2020-09-02 10:00:08,562 DEBUG [client] Received heart-beat
2020-09-02 10:00:23,556 DEBUG [client] Received heart-beat
2020-09-02 10:00:38,557 DEBUG [client] Received heart-beat
2020-09-02 10:00:53,513 DEBUG [client] Received heart-beat
2020-09-02 10:01:08,555 DEBUG [client] Received heart-beat
2020-09-02 10:01:23,556 DEBUG [client] Received heart-beat
2020-09-02 10:01:38,557 DEBUG [client] Received heart-beat
2020-09-02 10:01:53,514 DEBUG [client] Received heart-beat
2020-09-02 10:02:08,557 DEBUG [client] Received heart-beat
2020-09-02 10:02:22,847 DEBUG [actions_component] Idle reset
2020-09-02 10:02:23,550 DEBUG [client] Received heart-beat
2020-09-02 10:02:38,558 DEBUG [client] Received heart-beat
2020-09-02 10:02:53,517 DEBUG [client] Received heart-beat
2020-09-02 10:03:08,560 DEBUG [client] Received heart-beat

I tried to debug resilient-circuits several times, from the circuits logs itself I only see heartbeats. 

If I run something like: resilient-circuits selftest -l fn-ip-void

I got this output

fn-ip-void:
Test was successful!
Credits Remaining: 25
Estimated Queries: 312
selftest: success, Elapsed time: 0.000000 seconds

This is a part of the app.log regarding ip_void:

[integration@resilient .resilient]$ cat app.log | grep void
2020-08-31 09:29:27,864 DEBUG [connectionpool] https://172.25.0.169:443 "GET /rest/orgs/203/functions/fn_ip_void_request HTTP/1.1" 200 None
2020-08-31 09:29:28,776 DEBUG [decorators] @function <function _fn_ip_void_request_function at 0x7f26ba682c50>
2020-08-31 09:29:29,292 INFO [component_loader] 'fn_ip_void.components.fn_ip_void_request.FunctionComponent' loading
2020-08-31 09:29:29,293 DEBUG [component_loader] 'fn_ip_void.components.fn_ip_void_request.FunctionComponent' loaded
2020-08-31 09:29:30,468 INFO [actions_component] 'fn_ip_void.components.fn_ip_void_request.FunctionComponent' function 'fn_ip_void_request' registered to 'fn_ip_void'
2020-08-31 09:29:30,469 DEBUG [actions_component] Listeners: {u'email_outbound': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_spamhaus_query': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_qradar_integration': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_mitre_integration': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_whois_rdap': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_ipinfo': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_xforce': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_ip_void': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>])}
fn_ip_void_request/functions.fn_ip_void_request
2020-08-31 09:29:30,476 INFO [actions_component] Subscribe to message destination 'fn_ip_void'
2020-08-31 09:29:30,483 INFO [stomp_component] Subscribe to message destination actions.203.fn_ip_void
2020-08-31 09:29:30,483 DEBUG [client] Sending SUBSCRIBE frame [headers={'ack': 'client-individual', 'destination': 'actions.203.fn_ip_void', 'id': 'actions.203.fn_ip_void', 'activemq.prefetchSize': 20}, version=1.2]

I don't see any errors on this side, the workflow status is nor on "pending" but on "running", I can't find anything related to it tough.

Hi Ben, 

Thank you for the answer reading the article you sent me, I realized that I don't actually need an exclusive gateway on that position because I need to do the Ip Void check on both cases, if the result is positive then I'll close with a mail if not I'll just close ( without mail). At this point it should be easier to close the incident in both cases with a mail notification. 

So, I'll ask you, is there a way to print the query result in the notification?  I tried to run the workflow and the action querying an artifact manually but both the action and the workflow are stuck in pending status so I'm not really sure if its working.

Hello Ben, 

Thank you for the detailed answer.

I'm trying to edit the workflow as you showed on the images above but I'm getting an error :

 "Exclusive Gateway 'ExclusiveGateway_0dr700o' has outgoing sequence flow 'SequenceFlow_10pcls6' without condition which is not the default flow."

This is the workflow:

It would be possible to add an exclusive gateway after the function that checks the results and if necessary close the incident using a script:

Sending an email would require the configuration of a Notification:

@Richard Giesige

Thanks for the answer, I guess that was the problem.

I changed the app.config file on the resilient-circuits directory to the Org that I'm actually testing.

Maybe you can't answer to this question but I'll give it a shot:

I previously configured the Organization on the app.config file with the Configuration organization of my MSSP environment, changing that with the single organization name made the trick. The question is: how can I manage multiple organization with a single integration server? do I need to deploy an integration server for every single organization?​

Hello Richard, 

In the very same app.log I  see lines like :

2020-08-24 10:55:55,909 INFO [actions_component] resilient-circuits has started successfully and is now running...,
 and

2020-08-24 10:55:55,909 INFO [stomp_component] Subscribe to message destination actions.201.{integration function

For what concern the second line you posted I only have this:

[integration@resilient ~]$ cat /home/integration/.resilient/app.log | grep subscribe
subscribe_to_all/*
Unsubscribe/*
2020-08-31 09:29:30,476 DEBUG [actions_component] Connected successfully. Resubscribe? False
subscribe_to_all/*
Unsubscribe/*
2020-09-01 14:52:05,863 DEBUG [actions_component] Connected successfully. Resubscribe? False
subscribe_to_all/*
Unsubscribe/*
2020-09-01 14:52:11,650 DEBUG [actions_component] Connected successfully. Resubscribe? False
subscribe_to_all/*
Unsubscribe/*
2020-09-01 14:52:23,958 DEBUG [actions_component] Connected successfully. Resubscribe? False

Hello Richard, 

I think I posted an example above:

This is a part of the app.log regarding ip_void:

[integration@resilient .resilient]$ cat app.log | grep void
2020-08-31 09:29:27,864 DEBUG [connectionpool] https://172.25.0.169:443 "GET /rest/orgs/203/functions/fn_ip_void_request HTTP/1.1" 200 None
2020-08-31 09:29:28,776 DEBUG [decorators] @function <function _fn_ip_void_request_function at 0x7f26ba682c50>
2020-08-31 09:29:29,292 INFO [component_loader] 'fn_ip_void.components.fn_ip_void_request.FunctionComponent' loading
2020-08-31 09:29:29,293 DEBUG [component_loader] 'fn_ip_void.components.fn_ip_void_request.FunctionComponent' loaded
2020-08-31 09:29:30,468 INFO [actions_component] 'fn_ip_void.components.fn_ip_void_request.FunctionComponent' function 'fn_ip_void_request' registered to 'fn_ip_void'
2020-08-31 09:29:30,469 DEBUG [actions_component] Listeners: {u'email_outbound': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_spamhaus_query': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_qradar_integration': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_mitre_integration': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_whois_rdap': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_ipinfo': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_xforce': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_ip_void': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>])}
fn_ip_void_request/functions.fn_ip_void_request
2020-08-31 09:29:30,476 INFO [actions_component] Subscribe to message destination 'fn_ip_void'
2020-08-31 09:29:30,483 INFO [stomp_component] Subscribe to message destination actions.203.fn_ip_void
2020-08-31 09:29:30,483 DEBUG [client] Sending SUBSCRIBE frame [headers={'ack': 'client-individual', 'destination': 'actions.203.fn_ip_void', 'id': 'actions.203.fn_ip_void', 'activemq.prefetchSize': 20}, version=1.2]

For the rest, this is an example of what's written on the log

2020-09-02 09:19:08,530 DEBUG [client] Received heart-beat
2020-09-02 09:19:23,540 DEBUG [client] Received heart-beat
2020-09-02 09:19:38,540 DEBUG [client] Received heart-beat
2020-09-02 09:19:53,507 DEBUG [client] Received heart-beat
2020-09-02 09:20:08,525 DEBUG [client] Received heart-beat
2020-09-02 09:20:23,540 DEBUG [client] Received heart-beat
2020-09-02 09:20:38,533 DEBUG [client] Received heart-beat
2020-09-02 09:20:53,491 DEBUG [client] Received heart-beat
2020-09-02 09:21:08,533 DEBUG [client] Received heart-beat
2020-09-02 09:21:23,540 DEBUG [client] Received heart-beat
2020-09-02 09:21:38,532 DEBUG [client] Received heart-beat
2020-09-02 09:21:53,494 DEBUG [client] Received heart-beat
2020-09-02 09:22:08,530 DEBUG [client] Received heart-beat
2020-09-02 09:22:22,845 DEBUG [actions_component] Idle reset
2020-09-02 09:22:23,549 DEBUG [client] Received heart-beat
2020-09-02 09:22:38,532 DEBUG [client] Received heart-beat
2020-09-02 09:22:53,496 DEBUG [client] Received heart-beat
2020-09-02 09:23:08,531 DEBUG [client] Received heart-beat
2020-09-02 09:23:23,541 DEBUG [client] Received heart-beat
2020-09-02 09:23:38,533 DEBUG [client] Received heart-beat
2020-09-02 09:23:53,492 DEBUG [client] Received heart-beat
2020-09-02 09:24:08,532 DEBUG [client] Received heart-beat
2020-09-02 09:24:23,541 DEBUG [client] Received heart-beat
2020-09-02 09:24:38,537 DEBUG [client] Received heart-beat
2020-09-02 09:24:53,500 DEBUG [client] Received heart-beat
2020-09-02 09:25:08,532 DEBUG [client] Received heart-beat
2020-09-02 09:25:23,542 DEBUG [client] Received heart-beat
2020-09-02 09:25:38,531 DEBUG [client] Received heart-beat
2020-09-02 09:25:53,490 DEBUG [client] Received heart-beat
2020-09-02 09:26:08,533 DEBUG [client] Received heart-beat
2020-09-02 09:26:23,542 DEBUG [client] Received heart-beat
2020-09-02 09:26:38,534 DEBUG [client] Received heart-beat
2020-09-02 09:26:53,497 DEBUG [client] Received heart-beat
2020-09-02 09:27:08,538 DEBUG [client] Received heart-beat
2020-09-02 09:27:23,542 DEBUG [client] Received heart-beat
2020-09-02 09:27:38,537 DEBUG [client] Received heart-beat
2020-09-02 09:27:53,497 DEBUG [client] Received heart-beat
2020-09-02 09:28:08,530 DEBUG [client] Received heart-beat
2020-09-02 09:28:23,543 DEBUG [client] Received heart-beat
2020-09-02 09:28:38,536 DEBUG [client] Received heart-beat
2020-09-02 09:28:53,496 DEBUG [client] Received heart-beat
2020-09-02 09:29:08,535 DEBUG [client] Received heart-beat
2020-09-02 09:29:23,543 DEBUG [client] Received heart-beat
2020-09-02 09:29:38,537 DEBUG [client] Received heart-beat
2020-09-02 09:29:53,497 DEBUG [client] Received heart-beat
2020-09-02 09:30:08,561 DEBUG [client] Received heart-beat
2020-09-02 09:30:23,544 DEBUG [client] Received heart-beat
2020-09-02 09:30:38,536 DEBUG [client] Received heart-beat
2020-09-02 09:30:53,496 DEBUG [client] Received heart-beat
2020-09-02 09:31:08,535 DEBUG [client] Received heart-beat
2020-09-02 09:31:23,544 DEBUG [client] Received heart-beat
2020-09-02 09:31:38,544 DEBUG [client] Received heart-beat
2020-09-02 09:31:53,505 DEBUG [client] Received heart-beat
2020-09-02 09:32:08,542 DEBUG [client] Received heart-beat
2020-09-02 09:32:22,846 DEBUG [actions_component] Idle reset
2020-09-02 09:32:23,549 DEBUG [client] Received heart-beat
2020-09-02 09:32:38,540 DEBUG [client] Received heart-beat
2020-09-02 09:32:53,502 DEBUG [client] Received heart-beat
2020-09-02 09:33:08,536 DEBUG [client] Received heart-beat
2020-09-02 09:33:23,546 DEBUG [client] Received heart-beat
2020-09-02 09:33:38,541 DEBUG [client] Received heart-beat
2020-09-02 09:33:53,500 DEBUG [client] Received heart-beat
2020-09-02 09:34:08,539 DEBUG [client] Received heart-beat
2020-09-02 09:34:23,545 DEBUG [client] Received heart-beat
2020-09-02 09:34:38,558 DEBUG [client] Received heart-beat
2020-09-02 09:34:53,520 DEBUG [client] Received heart-beat
2020-09-02 09:35:08,539 DEBUG [client] Received heart-beat
2020-09-02 09:35:23,546 DEBUG [client] Received heart-beat
2020-09-02 09:35:38,570 DEBUG [client] Received heart-beat
2020-09-02 09:35:53,526 DEBUG [client] Received heart-beat
2020-09-02 09:36:08,542 DEBUG [client] Received heart-beat
2020-09-02 09:36:23,547 DEBUG [client] Received heart-beat
2020-09-02 09:36:38,541 DEBUG [client] Received heart-beat
2020-09-02 09:36:53,502 DEBUG [client] Received heart-beat
2020-09-02 09:37:08,542 DEBUG [client] Received heart-beat
2020-09-02 09:37:23,546 DEBUG [client] Received heart-beat
2020-09-02 09:37:38,539 DEBUG [client] Received heart-beat
2020-09-02 09:37:53,498 DEBUG [client] Received heart-beat
2020-09-02 09:38:08,540 DEBUG [client] Received heart-beat
2020-09-02 09:38:23,547 DEBUG [client] Received heart-beat
2020-09-02 09:38:38,542 DEBUG [client] Received heart-beat
2020-09-02 09:38:53,500 DEBUG [client] Received heart-beat
2020-09-02 09:39:08,542 DEBUG [client] Received heart-beat
2020-09-02 09:39:23,547 DEBUG [client] Received heart-beat
2020-09-02 09:39:38,536 DEBUG [client] Received heart-beat
2020-09-02 09:39:53,493 DEBUG [client] Received heart-beat
2020-09-02 09:40:08,542 DEBUG [client] Received heart-beat
2020-09-02 09:40:23,547 DEBUG [client] Received heart-beat
2020-09-02 09:40:38,539 DEBUG [client] Received heart-beat
2020-09-02 09:40:53,498 DEBUG [client] Received heart-beat
2020-09-02 09:41:08,541 DEBUG [client] Received heart-beat
2020-09-02 09:41:23,548 DEBUG [client] Received heart-beat
2020-09-02 09:41:38,543 DEBUG [client] Received heart-beat
2020-09-02 09:41:53,505 DEBUG [client] Received heart-beat
2020-09-02 09:42:08,545 DEBUG [client] Received heart-beat
2020-09-02 09:42:22,846 DEBUG [actions_component] Idle reset
2020-09-02 09:42:23,549 DEBUG [client] Received heart-beat
2020-09-02 09:42:38,545 DEBUG [client] Received heart-beat
2020-09-02 09:42:53,505 DEBUG [client] Received heart-beat
2020-09-02 09:43:08,547 DEBUG [client] Received heart-beat
2020-09-02 09:43:23,550 DEBUG [client] Received heart-beat
2020-09-02 09:43:38,547 DEBUG [client] Received heart-beat
2020-09-02 09:43:53,506 DEBUG [client] Received heart-beat
2020-09-02 09:44:08,543 DEBUG [client] Received heart-beat
2020-09-02 09:44:23,550 DEBUG [client] Received heart-beat
2020-09-02 09:44:38,548 DEBUG [client] Received heart-beat
2020-09-02 09:44:53,528 DEBUG [client] Received heart-beat
2020-09-02 09:45:08,547 DEBUG [client] Received heart-beat
2020-09-02 09:45:23,551 DEBUG [client] Received heart-beat
2020-09-02 09:45:38,546 DEBUG [client] Received heart-beat
2020-09-02 09:45:53,507 DEBUG [client] Received heart-beat
2020-09-02 09:46:08,547 DEBUG [client] Received heart-beat
2020-09-02 09:46:23,550 DEBUG [client] Received heart-beat
2020-09-02 09:46:38,547 DEBUG [client] Received heart-beat
2020-09-02 09:46:53,507 DEBUG [client] Received heart-beat
2020-09-02 09:47:08,548 DEBUG [client] Received heart-beat
2020-09-02 09:47:23,551 DEBUG [client] Received heart-beat
2020-09-02 09:47:38,550 DEBUG [client] Received heart-beat
2020-09-02 09:47:53,511 DEBUG [client] Received heart-beat
2020-09-02 09:48:08,570 DEBUG [client] Received heart-beat
2020-09-02 09:48:23,551 DEBUG [client] Received heart-beat
2020-09-02 09:48:38,550 DEBUG [client] Received heart-beat
2020-09-02 09:48:53,509 DEBUG [client] Received heart-beat
2020-09-02 09:49:08,561 DEBUG [client] Received heart-beat
2020-09-02 09:49:23,552 DEBUG [client] Received heart-beat
2020-09-02 09:49:38,552 DEBUG [client] Received heart-beat
2020-09-02 09:49:53,512 DEBUG [client] Received heart-beat
2020-09-02 09:50:08,554 DEBUG [client] Received heart-beat
2020-09-02 09:50:23,551 DEBUG [client] Received heart-beat
2020-09-02 09:50:38,552 DEBUG [client] Received heart-beat
2020-09-02 09:50:53,515 DEBUG [client] Received heart-beat
2020-09-02 09:51:08,553 DEBUG [client] Received heart-beat
2020-09-02 09:51:23,553 DEBUG [client] Received heart-beat
2020-09-02 09:51:38,552 DEBUG [client] Received heart-beat
2020-09-02 09:51:53,513 DEBUG [client] Received heart-beat
2020-09-02 09:52:08,555 DEBUG [client] Received heart-beat
2020-09-02 09:52:22,846 DEBUG [actions_component] Idle reset
2020-09-02 09:52:23,550 DEBUG [client] Received heart-beat
2020-09-02 09:52:38,550 DEBUG [client] Received heart-beat
2020-09-02 09:52:53,510 DEBUG [client] Received heart-beat
2020-09-02 09:53:08,552 DEBUG [client] Received heart-beat
2020-09-02 09:53:23,553 DEBUG [client] Received heart-beat
2020-09-02 09:53:38,553 DEBUG [client] Received heart-beat
2020-09-02 09:53:53,510 DEBUG [client] Received heart-beat
2020-09-02 09:54:08,552 DEBUG [client] Received heart-beat
2020-09-02 09:54:23,553 DEBUG [client] Received heart-beat
2020-09-02 09:54:38,555 DEBUG [client] Received heart-beat
2020-09-02 09:54:53,517 DEBUG [client] Received heart-beat
2020-09-02 09:55:08,558 DEBUG [client] Received heart-beat
2020-09-02 09:55:23,554 DEBUG [client] Received heart-beat
2020-09-02 09:55:38,555 DEBUG [client] Received heart-beat
2020-09-02 09:55:53,519 DEBUG [client] Received heart-beat
2020-09-02 09:56:08,567 DEBUG [client] Received heart-beat
2020-09-02 09:56:23,554 DEBUG [client] Received heart-beat
2020-09-02 09:56:38,559 DEBUG [client] Received heart-beat
2020-09-02 09:56:53,519 DEBUG [client] Received heart-beat
2020-09-02 09:57:08,558 DEBUG [client] Received heart-beat
2020-09-02 09:57:23,554 DEBUG [client] Received heart-beat
2020-09-02 09:57:38,558 DEBUG [client] Received heart-beat
2020-09-02 09:57:53,517 DEBUG [client] Received heart-beat
2020-09-02 09:58:08,553 DEBUG [client] Received heart-beat
2020-09-02 09:58:23,555 DEBUG [client] Received heart-beat
2020-09-02 09:58:38,556 DEBUG [client] Received heart-beat
2020-09-02 09:58:53,514 DEBUG [client] Received heart-beat
2020-09-02 09:59:08,555 DEBUG [client] Received heart-beat
2020-09-02 09:59:23,556 DEBUG [client] Received heart-beat
2020-09-02 09:59:38,567 DEBUG [client] Received heart-beat
2020-09-02 09:59:53,528 DEBUG [client] Received heart-beat
2020-09-02 10:00:08,562 DEBUG [client] Received heart-beat
2020-09-02 10:00:23,556 DEBUG [client] Received heart-beat
2020-09-02 10:00:38,557 DEBUG [client] Received heart-beat
2020-09-02 10:00:53,513 DEBUG [client] Received heart-beat
2020-09-02 10:01:08,555 DEBUG [client] Received heart-beat
2020-09-02 10:01:23,556 DEBUG [client] Received heart-beat
2020-09-02 10:01:38,557 DEBUG [client] Received heart-beat
2020-09-02 10:01:53,514 DEBUG [client] Received heart-beat
2020-09-02 10:02:08,557 DEBUG [client] Received heart-beat
2020-09-02 10:02:22,847 DEBUG [actions_component] Idle reset
2020-09-02 10:02:23,550 DEBUG [client] Received heart-beat
2020-09-02 10:02:38,558 DEBUG [client] Received heart-beat
2020-09-02 10:02:53,517 DEBUG [client] Received heart-beat
2020-09-02 10:03:08,560 DEBUG [client] Received heart-beat

I tried to debug resilient-circuits several times, from the circuits logs itself I only see heartbeats. 

If I run something like: resilient-circuits selftest -l fn-ip-void

I got this output

fn-ip-void:
Test was successful!
Credits Remaining: 25
Estimated Queries: 312
selftest: success, Elapsed time: 0.000000 seconds

This is a part of the app.log regarding ip_void:

[integration@resilient .resilient]$ cat app.log | grep void
2020-08-31 09:29:27,864 DEBUG [connectionpool] https://172.25.0.169:443 "GET /rest/orgs/203/functions/fn_ip_void_request HTTP/1.1" 200 None
2020-08-31 09:29:28,776 DEBUG [decorators] @function <function _fn_ip_void_request_function at 0x7f26ba682c50>
2020-08-31 09:29:29,292 INFO [component_loader] 'fn_ip_void.components.fn_ip_void_request.FunctionComponent' loading
2020-08-31 09:29:29,293 DEBUG [component_loader] 'fn_ip_void.components.fn_ip_void_request.FunctionComponent' loaded
2020-08-31 09:29:30,468 INFO [actions_component] 'fn_ip_void.components.fn_ip_void_request.FunctionComponent' function 'fn_ip_void_request' registered to 'fn_ip_void'
2020-08-31 09:29:30,469 DEBUG [actions_component] Listeners: {u'email_outbound': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_spamhaus_query': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_qradar_integration': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_mitre_integration': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_whois_rdap': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_ipinfo': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_xforce': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_ip_void': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>])}
fn_ip_void_request/functions.fn_ip_void_request
2020-08-31 09:29:30,476 INFO [actions_component] Subscribe to message destination 'fn_ip_void'
2020-08-31 09:29:30,483 INFO [stomp_component] Subscribe to message destination actions.203.fn_ip_void
2020-08-31 09:29:30,483 DEBUG [client] Sending SUBSCRIBE frame [headers={'ack': 'client-individual', 'destination': 'actions.203.fn_ip_void', 'id': 'actions.203.fn_ip_void', 'activemq.prefetchSize': 20}, version=1.2]

I don't see any errors on this side, the workflow status is nor on "pending" but on "running", I can't find anything related to it tough.

Hi Ben, 

Thank you for the answer reading the article you sent me, I realized that I don't actually need an exclusive gateway on that position because I need to do the Ip Void check on both cases, if the result is positive then I'll close with a mail if not I'll just close ( without mail). At this point it should be easier to close the incident in both cases with a mail notification. 

So, I'll ask you, is there a way to print the query result in the notification?  I tried to run the workflow and the action querying an artifact manually but both the action and the workflow are stuck in pending status so I'm not really sure if its working.

Hello Ben, 

Thank you for the detailed answer.

I'm trying to edit the workflow as you showed on the images above but I'm getting an error :

 "Exclusive Gateway 'ExclusiveGateway_0dr700o' has outgoing sequence flow 'SequenceFlow_10pcls6' without condition which is not the default flow."

This is the workflow:

It would be possible to add an exclusive gateway after the function that checks the results and if necessary close the incident using a script:

Sending an email would require the configuration of a Notification:

@Richard Giesige

Thanks for the answer, I guess that was the problem.

I changed the app.config file on the resilient-circuits directory to the Org that I'm actually testing.

Maybe you can't answer to this question but I'll give it a shot:

I previously configured the Organization on the app.config file with the Configuration organization of my MSSP environment, changing that with the single organization name made the trick. The question is: how can I manage multiple organization with a single integration server? do I need to deploy an integration server for every single organization?​

Hello Richard, 

In the very same app.log I  see lines like :

2020-08-24 10:55:55,909 INFO [actions_component] resilient-circuits has started successfully and is now running...,
 and

2020-08-24 10:55:55,909 INFO [stomp_component] Subscribe to message destination actions.201.{integration function

For what concern the second line you posted I only have this:

[integration@resilient ~]$ cat /home/integration/.resilient/app.log | grep subscribe
subscribe_to_all/*
Unsubscribe/*
2020-08-31 09:29:30,476 DEBUG [actions_component] Connected successfully. Resubscribe? False
subscribe_to_all/*
Unsubscribe/*
2020-09-01 14:52:05,863 DEBUG [actions_component] Connected successfully. Resubscribe? False
subscribe_to_all/*
Unsubscribe/*
2020-09-01 14:52:11,650 DEBUG [actions_component] Connected successfully. Resubscribe? False
subscribe_to_all/*
Unsubscribe/*
2020-09-01 14:52:23,958 DEBUG [actions_component] Connected successfully. Resubscribe? False

Hello Richard, 

I think I posted an example above:

This is a part of the app.log regarding ip_void:

[integration@resilient .resilient]$ cat app.log | grep void
2020-08-31 09:29:27,864 DEBUG [connectionpool] https://172.25.0.169:443 "GET /rest/orgs/203/functions/fn_ip_void_request HTTP/1.1" 200 None
2020-08-31 09:29:28,776 DEBUG [decorators] @function <function _fn_ip_void_request_function at 0x7f26ba682c50>
2020-08-31 09:29:29,292 INFO [component_loader] 'fn_ip_void.components.fn_ip_void_request.FunctionComponent' loading
2020-08-31 09:29:29,293 DEBUG [component_loader] 'fn_ip_void.components.fn_ip_void_request.FunctionComponent' loaded
2020-08-31 09:29:30,468 INFO [actions_component] 'fn_ip_void.components.fn_ip_void_request.FunctionComponent' function 'fn_ip_void_request' registered to 'fn_ip_void'
2020-08-31 09:29:30,469 DEBUG [actions_component] Listeners: {u'email_outbound': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_spamhaus_query': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_qradar_integration': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_mitre_integration': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_whois_rdap': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_ipinfo': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_xforce': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_ip_void': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>])}
fn_ip_void_request/functions.fn_ip_void_request
2020-08-31 09:29:30,476 INFO [actions_component] Subscribe to message destination 'fn_ip_void'
2020-08-31 09:29:30,483 INFO [stomp_component] Subscribe to message destination actions.203.fn_ip_void
2020-08-31 09:29:30,483 DEBUG [client] Sending SUBSCRIBE frame [headers={'ack': 'client-individual', 'destination': 'actions.203.fn_ip_void', 'id': 'actions.203.fn_ip_void', 'activemq.prefetchSize': 20}, version=1.2]

For the rest, this is an example of what's written on the log

2020-09-02 09:19:08,530 DEBUG [client] Received heart-beat
2020-09-02 09:19:23,540 DEBUG [client] Received heart-beat
2020-09-02 09:19:38,540 DEBUG [client] Received heart-beat
2020-09-02 09:19:53,507 DEBUG [client] Received heart-beat
2020-09-02 09:20:08,525 DEBUG [client] Received heart-beat
2020-09-02 09:20:23,540 DEBUG [client] Received heart-beat
2020-09-02 09:20:38,533 DEBUG [client] Received heart-beat
2020-09-02 09:20:53,491 DEBUG [client] Received heart-beat
2020-09-02 09:21:08,533 DEBUG [client] Received heart-beat
2020-09-02 09:21:23,540 DEBUG [client] Received heart-beat
2020-09-02 09:21:38,532 DEBUG [client] Received heart-beat
2020-09-02 09:21:53,494 DEBUG [client] Received heart-beat
2020-09-02 09:22:08,530 DEBUG [client] Received heart-beat
2020-09-02 09:22:22,845 DEBUG [actions_component] Idle reset
2020-09-02 09:22:23,549 DEBUG [client] Received heart-beat
2020-09-02 09:22:38,532 DEBUG [client] Received heart-beat
2020-09-02 09:22:53,496 DEBUG [client] Received heart-beat
2020-09-02 09:23:08,531 DEBUG [client] Received heart-beat
2020-09-02 09:23:23,541 DEBUG [client] Received heart-beat
2020-09-02 09:23:38,533 DEBUG [client] Received heart-beat
2020-09-02 09:23:53,492 DEBUG [client] Received heart-beat
2020-09-02 09:24:08,532 DEBUG [client] Received heart-beat
2020-09-02 09:24:23,541 DEBUG [client] Received heart-beat
2020-09-02 09:24:38,537 DEBUG [client] Received heart-beat
2020-09-02 09:24:53,500 DEBUG [client] Received heart-beat
2020-09-02 09:25:08,532 DEBUG [client] Received heart-beat
2020-09-02 09:25:23,542 DEBUG [client] Received heart-beat
2020-09-02 09:25:38,531 DEBUG [client] Received heart-beat
2020-09-02 09:25:53,490 DEBUG [client] Received heart-beat
2020-09-02 09:26:08,533 DEBUG [client] Received heart-beat
2020-09-02 09:26:23,542 DEBUG [client] Received heart-beat
2020-09-02 09:26:38,534 DEBUG [client] Received heart-beat
2020-09-02 09:26:53,497 DEBUG [client] Received heart-beat
2020-09-02 09:27:08,538 DEBUG [client] Received heart-beat
2020-09-02 09:27:23,542 DEBUG [client] Received heart-beat
2020-09-02 09:27:38,537 DEBUG [client] Received heart-beat
2020-09-02 09:27:53,497 DEBUG [client] Received heart-beat
2020-09-02 09:28:08,530 DEBUG [client] Received heart-beat
2020-09-02 09:28:23,543 DEBUG [client] Received heart-beat
2020-09-02 09:28:38,536 DEBUG [client] Received heart-beat
2020-09-02 09:28:53,496 DEBUG [client] Received heart-beat
2020-09-02 09:29:08,535 DEBUG [client] Received heart-beat
2020-09-02 09:29:23,543 DEBUG [client] Received heart-beat
2020-09-02 09:29:38,537 DEBUG [client] Received heart-beat
2020-09-02 09:29:53,497 DEBUG [client] Received heart-beat
2020-09-02 09:30:08,561 DEBUG [client] Received heart-beat
2020-09-02 09:30:23,544 DEBUG [client] Received heart-beat
2020-09-02 09:30:38,536 DEBUG [client] Received heart-beat
2020-09-02 09:30:53,496 DEBUG [client] Received heart-beat
2020-09-02 09:31:08,535 DEBUG [client] Received heart-beat
2020-09-02 09:31:23,544 DEBUG [client] Received heart-beat
2020-09-02 09:31:38,544 DEBUG [client] Received heart-beat
2020-09-02 09:31:53,505 DEBUG [client] Received heart-beat
2020-09-02 09:32:08,542 DEBUG [client] Received heart-beat
2020-09-02 09:32:22,846 DEBUG [actions_component] Idle reset
2020-09-02 09:32:23,549 DEBUG [client] Received heart-beat
2020-09-02 09:32:38,540 DEBUG [client] Received heart-beat
2020-09-02 09:32:53,502 DEBUG [client] Received heart-beat
2020-09-02 09:33:08,536 DEBUG [client] Received heart-beat
2020-09-02 09:33:23,546 DEBUG [client] Received heart-beat
2020-09-02 09:33:38,541 DEBUG [client] Received heart-beat
2020-09-02 09:33:53,500 DEBUG [client] Received heart-beat
2020-09-02 09:34:08,539 DEBUG [client] Received heart-beat
2020-09-02 09:34:23,545 DEBUG [client] Received heart-beat
2020-09-02 09:34:38,558 DEBUG [client] Received heart-beat
2020-09-02 09:34:53,520 DEBUG [client] Received heart-beat
2020-09-02 09:35:08,539 DEBUG [client] Received heart-beat
2020-09-02 09:35:23,546 DEBUG [client] Received heart-beat
2020-09-02 09:35:38,570 DEBUG [client] Received heart-beat
2020-09-02 09:35:53,526 DEBUG [client] Received heart-beat
2020-09-02 09:36:08,542 DEBUG [client] Received heart-beat
2020-09-02 09:36:23,547 DEBUG [client] Received heart-beat
2020-09-02 09:36:38,541 DEBUG [client] Received heart-beat
2020-09-02 09:36:53,502 DEBUG [client] Received heart-beat
2020-09-02 09:37:08,542 DEBUG [client] Received heart-beat
2020-09-02 09:37:23,546 DEBUG [client] Received heart-beat
2020-09-02 09:37:38,539 DEBUG [client] Received heart-beat
2020-09-02 09:37:53,498 DEBUG [client] Received heart-beat
2020-09-02 09:38:08,540 DEBUG [client] Received heart-beat
2020-09-02 09:38:23,547 DEBUG [client] Received heart-beat
2020-09-02 09:38:38,542 DEBUG [client] Received heart-beat
2020-09-02 09:38:53,500 DEBUG [client] Received heart-beat
2020-09-02 09:39:08,542 DEBUG [client] Received heart-beat
2020-09-02 09:39:23,547 DEBUG [client] Received heart-beat
2020-09-02 09:39:38,536 DEBUG [client] Received heart-beat
2020-09-02 09:39:53,493 DEBUG [client] Received heart-beat
2020-09-02 09:40:08,542 DEBUG [client] Received heart-beat
2020-09-02 09:40:23,547 DEBUG [client] Received heart-beat
2020-09-02 09:40:38,539 DEBUG [client] Received heart-beat
2020-09-02 09:40:53,498 DEBUG [client] Received heart-beat
2020-09-02 09:41:08,541 DEBUG [client] Received heart-beat
2020-09-02 09:41:23,548 DEBUG [client] Received heart-beat
2020-09-02 09:41:38,543 DEBUG [client] Received heart-beat
2020-09-02 09:41:53,505 DEBUG [client] Received heart-beat
2020-09-02 09:42:08,545 DEBUG [client] Received heart-beat
2020-09-02 09:42:22,846 DEBUG [actions_component] Idle reset
2020-09-02 09:42:23,549 DEBUG [client] Received heart-beat
2020-09-02 09:42:38,545 DEBUG [client] Received heart-beat
2020-09-02 09:42:53,505 DEBUG [client] Received heart-beat
2020-09-02 09:43:08,547 DEBUG [client] Received heart-beat
2020-09-02 09:43:23,550 DEBUG [client] Received heart-beat
2020-09-02 09:43:38,547 DEBUG [client] Received heart-beat
2020-09-02 09:43:53,506 DEBUG [client] Received heart-beat
2020-09-02 09:44:08,543 DEBUG [client] Received heart-beat
2020-09-02 09:44:23,550 DEBUG [client] Received heart-beat
2020-09-02 09:44:38,548 DEBUG [client] Received heart-beat
2020-09-02 09:44:53,528 DEBUG [client] Received heart-beat
2020-09-02 09:45:08,547 DEBUG [client] Received heart-beat
2020-09-02 09:45:23,551 DEBUG [client] Received heart-beat
2020-09-02 09:45:38,546 DEBUG [client] Received heart-beat
2020-09-02 09:45:53,507 DEBUG [client] Received heart-beat
2020-09-02 09:46:08,547 DEBUG [client] Received heart-beat
2020-09-02 09:46:23,550 DEBUG [client] Received heart-beat
2020-09-02 09:46:38,547 DEBUG [client] Received heart-beat
2020-09-02 09:46:53,507 DEBUG [client] Received heart-beat
2020-09-02 09:47:08,548 DEBUG [client] Received heart-beat
2020-09-02 09:47:23,551 DEBUG [client] Received heart-beat
2020-09-02 09:47:38,550 DEBUG [client] Received heart-beat
2020-09-02 09:47:53,511 DEBUG [client] Received heart-beat
2020-09-02 09:48:08,570 DEBUG [client] Received heart-beat
2020-09-02 09:48:23,551 DEBUG [client] Received heart-beat
2020-09-02 09:48:38,550 DEBUG [client] Received heart-beat
2020-09-02 09:48:53,509 DEBUG [client] Received heart-beat
2020-09-02 09:49:08,561 DEBUG [client] Received heart-beat
2020-09-02 09:49:23,552 DEBUG [client] Received heart-beat
2020-09-02 09:49:38,552 DEBUG [client] Received heart-beat
2020-09-02 09:49:53,512 DEBUG [client] Received heart-beat
2020-09-02 09:50:08,554 DEBUG [client] Received heart-beat
2020-09-02 09:50:23,551 DEBUG [client] Received heart-beat
2020-09-02 09:50:38,552 DEBUG [client] Received heart-beat
2020-09-02 09:50:53,515 DEBUG [client] Received heart-beat
2020-09-02 09:51:08,553 DEBUG [client] Received heart-beat
2020-09-02 09:51:23,553 DEBUG [client] Received heart-beat
2020-09-02 09:51:38,552 DEBUG [client] Received heart-beat
2020-09-02 09:51:53,513 DEBUG [client] Received heart-beat
2020-09-02 09:52:08,555 DEBUG [client] Received heart-beat
2020-09-02 09:52:22,846 DEBUG [actions_component] Idle reset
2020-09-02 09:52:23,550 DEBUG [client] Received heart-beat
2020-09-02 09:52:38,550 DEBUG [client] Received heart-beat
2020-09-02 09:52:53,510 DEBUG [client] Received heart-beat
2020-09-02 09:53:08,552 DEBUG [client] Received heart-beat
2020-09-02 09:53:23,553 DEBUG [client] Received heart-beat
2020-09-02 09:53:38,553 DEBUG [client] Received heart-beat
2020-09-02 09:53:53,510 DEBUG [client] Received heart-beat
2020-09-02 09:54:08,552 DEBUG [client] Received heart-beat
2020-09-02 09:54:23,553 DEBUG [client] Received heart-beat
2020-09-02 09:54:38,555 DEBUG [client] Received heart-beat
2020-09-02 09:54:53,517 DEBUG [client] Received heart-beat
2020-09-02 09:55:08,558 DEBUG [client] Received heart-beat
2020-09-02 09:55:23,554 DEBUG [client] Received heart-beat
2020-09-02 09:55:38,555 DEBUG [client] Received heart-beat
2020-09-02 09:55:53,519 DEBUG [client] Received heart-beat
2020-09-02 09:56:08,567 DEBUG [client] Received heart-beat
2020-09-02 09:56:23,554 DEBUG [client] Received heart-beat
2020-09-02 09:56:38,559 DEBUG [client] Received heart-beat
2020-09-02 09:56:53,519 DEBUG [client] Received heart-beat
2020-09-02 09:57:08,558 DEBUG [client] Received heart-beat
2020-09-02 09:57:23,554 DEBUG [client] Received heart-beat
2020-09-02 09:57:38,558 DEBUG [client] Received heart-beat
2020-09-02 09:57:53,517 DEBUG [client] Received heart-beat
2020-09-02 09:58:08,553 DEBUG [client] Received heart-beat
2020-09-02 09:58:23,555 DEBUG [client] Received heart-beat
2020-09-02 09:58:38,556 DEBUG [client] Received heart-beat
2020-09-02 09:58:53,514 DEBUG [client] Received heart-beat
2020-09-02 09:59:08,555 DEBUG [client] Received heart-beat
2020-09-02 09:59:23,556 DEBUG [client] Received heart-beat
2020-09-02 09:59:38,567 DEBUG [client] Received heart-beat
2020-09-02 09:59:53,528 DEBUG [client] Received heart-beat
2020-09-02 10:00:08,562 DEBUG [client] Received heart-beat
2020-09-02 10:00:23,556 DEBUG [client] Received heart-beat
2020-09-02 10:00:38,557 DEBUG [client] Received heart-beat
2020-09-02 10:00:53,513 DEBUG [client] Received heart-beat
2020-09-02 10:01:08,555 DEBUG [client] Received heart-beat
2020-09-02 10:01:23,556 DEBUG [client] Received heart-beat
2020-09-02 10:01:38,557 DEBUG [client] Received heart-beat
2020-09-02 10:01:53,514 DEBUG [client] Received heart-beat
2020-09-02 10:02:08,557 DEBUG [client] Received heart-beat
2020-09-02 10:02:22,847 DEBUG [actions_component] Idle reset
2020-09-02 10:02:23,550 DEBUG [client] Received heart-beat
2020-09-02 10:02:38,558 DEBUG [client] Received heart-beat
2020-09-02 10:02:53,517 DEBUG [client] Received heart-beat
2020-09-02 10:03:08,560 DEBUG [client] Received heart-beat

I tried to debug resilient-circuits several times, from the circuits logs itself I only see heartbeats. 

If I run something like: resilient-circuits selftest -l fn-ip-void

I got this output

fn-ip-void:
Test was successful!
Credits Remaining: 25
Estimated Queries: 312
selftest: success, Elapsed time: 0.000000 seconds

This is a part of the app.log regarding ip_void:

[integration@resilient .resilient]$ cat app.log | grep void
2020-08-31 09:29:27,864 DEBUG [connectionpool] https://172.25.0.169:443 "GET /rest/orgs/203/functions/fn_ip_void_request HTTP/1.1" 200 None
2020-08-31 09:29:28,776 DEBUG [decorators] @function <function _fn_ip_void_request_function at 0x7f26ba682c50>
2020-08-31 09:29:29,292 INFO [component_loader] 'fn_ip_void.components.fn_ip_void_request.FunctionComponent' loading
2020-08-31 09:29:29,293 DEBUG [component_loader] 'fn_ip_void.components.fn_ip_void_request.FunctionComponent' loaded
2020-08-31 09:29:30,468 INFO [actions_component] 'fn_ip_void.components.fn_ip_void_request.FunctionComponent' function 'fn_ip_void_request' registered to 'fn_ip_void'
2020-08-31 09:29:30,469 DEBUG [actions_component] Listeners: {u'email_outbound': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_spamhaus_query': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_qradar_integration': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_mitre_integration': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_whois_rdap': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_ipinfo': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_xforce': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_ip_void': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>])}
fn_ip_void_request/functions.fn_ip_void_request
2020-08-31 09:29:30,476 INFO [actions_component] Subscribe to message destination 'fn_ip_void'
2020-08-31 09:29:30,483 INFO [stomp_component] Subscribe to message destination actions.203.fn_ip_void
2020-08-31 09:29:30,483 DEBUG [client] Sending SUBSCRIBE frame [headers={'ack': 'client-individual', 'destination': 'actions.203.fn_ip_void', 'id': 'actions.203.fn_ip_void', 'activemq.prefetchSize': 20}, version=1.2]

I don't see any errors on this side, the workflow status is nor on "pending" but on "running", I can't find anything related to it tough.

Hi Ben, 

Thank you for the answer reading the article you sent me, I realized that I don't actually need an exclusive gateway on that position because I need to do the Ip Void check on both cases, if the result is positive then I'll close with a mail if not I'll just close ( without mail). At this point it should be easier to close the incident in both cases with a mail notification. 

So, I'll ask you, is there a way to print the query result in the notification?  I tried to run the workflow and the action querying an artifact manually but both the action and the workflow are stuck in pending status so I'm not really sure if its working.

Hello Ben, 

Thank you for the detailed answer.

I'm trying to edit the workflow as you showed on the images above but I'm getting an error :

 "Exclusive Gateway 'ExclusiveGateway_0dr700o' has outgoing sequence flow 'SequenceFlow_10pcls6' without condition which is not the default flow."

This is the workflow:

It would be possible to add an exclusive gateway after the function that checks the results and if necessary close the incident using a script:

Sending an email would require the configuration of a Notification:

@Richard Giesige

Thanks for the answer, I guess that was the problem.

I changed the app.config file on the resilient-circuits directory to the Org that I'm actually testing.

Maybe you can't answer to this question but I'll give it a shot:

I previously configured the Organization on the app.config file with the Configuration organization of my MSSP environment, changing that with the single organization name made the trick. The question is: how can I manage multiple organization with a single integration server? do I need to deploy an integration server for every single organization?​

Hello Richard, 

In the very same app.log I  see lines like :

2020-08-24 10:55:55,909 INFO [actions_component] resilient-circuits has started successfully and is now running...,
 and

2020-08-24 10:55:55,909 INFO [stomp_component] Subscribe to message destination actions.201.{integration function

For what concern the second line you posted I only have this:

[integration@resilient ~]$ cat /home/integration/.resilient/app.log | grep subscribe
subscribe_to_all/*
Unsubscribe/*
2020-08-31 09:29:30,476 DEBUG [actions_component] Connected successfully. Resubscribe? False
subscribe_to_all/*
Unsubscribe/*
2020-09-01 14:52:05,863 DEBUG [actions_component] Connected successfully. Resubscribe? False
subscribe_to_all/*
Unsubscribe/*
2020-09-01 14:52:11,650 DEBUG [actions_component] Connected successfully. Resubscribe? False
subscribe_to_all/*
Unsubscribe/*
2020-09-01 14:52:23,958 DEBUG [actions_component] Connected successfully. Resubscribe? False

Hello Richard, 

I think I posted an example above:

This is a part of the app.log regarding ip_void:

[integration@resilient .resilient]$ cat app.log | grep void
2020-08-31 09:29:27,864 DEBUG [connectionpool] https://172.25.0.169:443 "GET /rest/orgs/203/functions/fn_ip_void_request HTTP/1.1" 200 None
2020-08-31 09:29:28,776 DEBUG [decorators] @function <function _fn_ip_void_request_function at 0x7f26ba682c50>
2020-08-31 09:29:29,292 INFO [component_loader] 'fn_ip_void.components.fn_ip_void_request.FunctionComponent' loading
2020-08-31 09:29:29,293 DEBUG [component_loader] 'fn_ip_void.components.fn_ip_void_request.FunctionComponent' loaded
2020-08-31 09:29:30,468 INFO [actions_component] 'fn_ip_void.components.fn_ip_void_request.FunctionComponent' function 'fn_ip_void_request' registered to 'fn_ip_void'
2020-08-31 09:29:30,469 DEBUG [actions_component] Listeners: {u'email_outbound': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_spamhaus_query': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_qradar_integration': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_mitre_integration': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_whois_rdap': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_ipinfo': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_xforce': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_ip_void': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>])}
fn_ip_void_request/functions.fn_ip_void_request
2020-08-31 09:29:30,476 INFO [actions_component] Subscribe to message destination 'fn_ip_void'
2020-08-31 09:29:30,483 INFO [stomp_component] Subscribe to message destination actions.203.fn_ip_void
2020-08-31 09:29:30,483 DEBUG [client] Sending SUBSCRIBE frame [headers={'ack': 'client-individual', 'destination': 'actions.203.fn_ip_void', 'id': 'actions.203.fn_ip_void', 'activemq.prefetchSize': 20}, version=1.2]

For the rest, this is an example of what's written on the log

2020-09-02 09:19:08,530 DEBUG [client] Received heart-beat
2020-09-02 09:19:23,540 DEBUG [client] Received heart-beat
2020-09-02 09:19:38,540 DEBUG [client] Received heart-beat
2020-09-02 09:19:53,507 DEBUG [client] Received heart-beat
2020-09-02 09:20:08,525 DEBUG [client] Received heart-beat
2020-09-02 09:20:23,540 DEBUG [client] Received heart-beat
2020-09-02 09:20:38,533 DEBUG [client] Received heart-beat
2020-09-02 09:20:53,491 DEBUG [client] Received heart-beat
2020-09-02 09:21:08,533 DEBUG [client] Received heart-beat
2020-09-02 09:21:23,540 DEBUG [client] Received heart-beat
2020-09-02 09:21:38,532 DEBUG [client] Received heart-beat
2020-09-02 09:21:53,494 DEBUG [client] Received heart-beat
2020-09-02 09:22:08,530 DEBUG [client] Received heart-beat
2020-09-02 09:22:22,845 DEBUG [actions_component] Idle reset
2020-09-02 09:22:23,549 DEBUG [client] Received heart-beat
2020-09-02 09:22:38,532 DEBUG [client] Received heart-beat
2020-09-02 09:22:53,496 DEBUG [client] Received heart-beat
2020-09-02 09:23:08,531 DEBUG [client] Received heart-beat
2020-09-02 09:23:23,541 DEBUG [client] Received heart-beat
2020-09-02 09:23:38,533 DEBUG [client] Received heart-beat
2020-09-02 09:23:53,492 DEBUG [client] Received heart-beat
2020-09-02 09:24:08,532 DEBUG [client] Received heart-beat
2020-09-02 09:24:23,541 DEBUG [client] Received heart-beat
2020-09-02 09:24:38,537 DEBUG [client] Received heart-beat
2020-09-02 09:24:53,500 DEBUG [client] Received heart-beat
2020-09-02 09:25:08,532 DEBUG [client] Received heart-beat
2020-09-02 09:25:23,542 DEBUG [client] Received heart-beat
2020-09-02 09:25:38,531 DEBUG [client] Received heart-beat
2020-09-02 09:25:53,490 DEBUG [client] Received heart-beat
2020-09-02 09:26:08,533 DEBUG [client] Received heart-beat
2020-09-02 09:26:23,542 DEBUG [client] Received heart-beat
2020-09-02 09:26:38,534 DEBUG [client] Received heart-beat
2020-09-02 09:26:53,497 DEBUG [client] Received heart-beat
2020-09-02 09:27:08,538 DEBUG [client] Received heart-beat
2020-09-02 09:27:23,542 DEBUG [client] Received heart-beat
2020-09-02 09:27:38,537 DEBUG [client] Received heart-beat
2020-09-02 09:27:53,497 DEBUG [client] Received heart-beat
2020-09-02 09:28:08,530 DEBUG [client] Received heart-beat
2020-09-02 09:28:23,543 DEBUG [client] Received heart-beat
2020-09-02 09:28:38,536 DEBUG [client] Received heart-beat
2020-09-02 09:28:53,496 DEBUG [client] Received heart-beat
2020-09-02 09:29:08,535 DEBUG [client] Received heart-beat
2020-09-02 09:29:23,543 DEBUG [client] Received heart-beat
2020-09-02 09:29:38,537 DEBUG [client] Received heart-beat
2020-09-02 09:29:53,497 DEBUG [client] Received heart-beat
2020-09-02 09:30:08,561 DEBUG [client] Received heart-beat
2020-09-02 09:30:23,544 DEBUG [client] Received heart-beat
2020-09-02 09:30:38,536 DEBUG [client] Received heart-beat
2020-09-02 09:30:53,496 DEBUG [client] Received heart-beat
2020-09-02 09:31:08,535 DEBUG [client] Received heart-beat
2020-09-02 09:31:23,544 DEBUG [client] Received heart-beat
2020-09-02 09:31:38,544 DEBUG [client] Received heart-beat
2020-09-02 09:31:53,505 DEBUG [client] Received heart-beat
2020-09-02 09:32:08,542 DEBUG [client] Received heart-beat
2020-09-02 09:32:22,846 DEBUG [actions_component] Idle reset
2020-09-02 09:32:23,549 DEBUG [client] Received heart-beat
2020-09-02 09:32:38,540 DEBUG [client] Received heart-beat
2020-09-02 09:32:53,502 DEBUG [client] Received heart-beat
2020-09-02 09:33:08,536 DEBUG [client] Received heart-beat
2020-09-02 09:33:23,546 DEBUG [client] Received heart-beat
2020-09-02 09:33:38,541 DEBUG [client] Received heart-beat
2020-09-02 09:33:53,500 DEBUG [client] Received heart-beat
2020-09-02 09:34:08,539 DEBUG [client] Received heart-beat
2020-09-02 09:34:23,545 DEBUG [client] Received heart-beat
2020-09-02 09:34:38,558 DEBUG [client] Received heart-beat
2020-09-02 09:34:53,520 DEBUG [client] Received heart-beat
2020-09-02 09:35:08,539 DEBUG [client] Received heart-beat
2020-09-02 09:35:23,546 DEBUG [client] Received heart-beat
2020-09-02 09:35:38,570 DEBUG [client] Received heart-beat
2020-09-02 09:35:53,526 DEBUG [client] Received heart-beat
2020-09-02 09:36:08,542 DEBUG [client] Received heart-beat
2020-09-02 09:36:23,547 DEBUG [client] Received heart-beat
2020-09-02 09:36:38,541 DEBUG [client] Received heart-beat
2020-09-02 09:36:53,502 DEBUG [client] Received heart-beat
2020-09-02 09:37:08,542 DEBUG [client] Received heart-beat
2020-09-02 09:37:23,546 DEBUG [client] Received heart-beat
2020-09-02 09:37:38,539 DEBUG [client] Received heart-beat
2020-09-02 09:37:53,498 DEBUG [client] Received heart-beat
2020-09-02 09:38:08,540 DEBUG [client] Received heart-beat
2020-09-02 09:38:23,547 DEBUG [client] Received heart-beat
2020-09-02 09:38:38,542 DEBUG [client] Received heart-beat
2020-09-02 09:38:53,500 DEBUG [client] Received heart-beat
2020-09-02 09:39:08,542 DEBUG [client] Received heart-beat
2020-09-02 09:39:23,547 DEBUG [client] Received heart-beat
2020-09-02 09:39:38,536 DEBUG [client] Received heart-beat
2020-09-02 09:39:53,493 DEBUG [client] Received heart-beat
2020-09-02 09:40:08,542 DEBUG [client] Received heart-beat
2020-09-02 09:40:23,547 DEBUG [client] Received heart-beat
2020-09-02 09:40:38,539 DEBUG [client] Received heart-beat
2020-09-02 09:40:53,498 DEBUG [client] Received heart-beat
2020-09-02 09:41:08,541 DEBUG [client] Received heart-beat
2020-09-02 09:41:23,548 DEBUG [client] Received heart-beat
2020-09-02 09:41:38,543 DEBUG [client] Received heart-beat
2020-09-02 09:41:53,505 DEBUG [client] Received heart-beat
2020-09-02 09:42:08,545 DEBUG [client] Received heart-beat
2020-09-02 09:42:22,846 DEBUG [actions_component] Idle reset
2020-09-02 09:42:23,549 DEBUG [client] Received heart-beat
2020-09-02 09:42:38,545 DEBUG [client] Received heart-beat
2020-09-02 09:42:53,505 DEBUG [client] Received heart-beat
2020-09-02 09:43:08,547 DEBUG [client] Received heart-beat
2020-09-02 09:43:23,550 DEBUG [client] Received heart-beat
2020-09-02 09:43:38,547 DEBUG [client] Received heart-beat
2020-09-02 09:43:53,506 DEBUG [client] Received heart-beat
2020-09-02 09:44:08,543 DEBUG [client] Received heart-beat
2020-09-02 09:44:23,550 DEBUG [client] Received heart-beat
2020-09-02 09:44:38,548 DEBUG [client] Received heart-beat
2020-09-02 09:44:53,528 DEBUG [client] Received heart-beat
2020-09-02 09:45:08,547 DEBUG [client] Received heart-beat
2020-09-02 09:45:23,551 DEBUG [client] Received heart-beat
2020-09-02 09:45:38,546 DEBUG [client] Received heart-beat
2020-09-02 09:45:53,507 DEBUG [client] Received heart-beat
2020-09-02 09:46:08,547 DEBUG [client] Received heart-beat
2020-09-02 09:46:23,550 DEBUG [client] Received heart-beat
2020-09-02 09:46:38,547 DEBUG [client] Received heart-beat
2020-09-02 09:46:53,507 DEBUG [client] Received heart-beat
2020-09-02 09:47:08,548 DEBUG [client] Received heart-beat
2020-09-02 09:47:23,551 DEBUG [client] Received heart-beat
2020-09-02 09:47:38,550 DEBUG [client] Received heart-beat
2020-09-02 09:47:53,511 DEBUG [client] Received heart-beat
2020-09-02 09:48:08,570 DEBUG [client] Received heart-beat
2020-09-02 09:48:23,551 DEBUG [client] Received heart-beat
2020-09-02 09:48:38,550 DEBUG [client] Received heart-beat
2020-09-02 09:48:53,509 DEBUG [client] Received heart-beat
2020-09-02 09:49:08,561 DEBUG [client] Received heart-beat
2020-09-02 09:49:23,552 DEBUG [client] Received heart-beat
2020-09-02 09:49:38,552 DEBUG [client] Received heart-beat
2020-09-02 09:49:53,512 DEBUG [client] Received heart-beat
2020-09-02 09:50:08,554 DEBUG [client] Received heart-beat
2020-09-02 09:50:23,551 DEBUG [client] Received heart-beat
2020-09-02 09:50:38,552 DEBUG [client] Received heart-beat
2020-09-02 09:50:53,515 DEBUG [client] Received heart-beat
2020-09-02 09:51:08,553 DEBUG [client] Received heart-beat
2020-09-02 09:51:23,553 DEBUG [client] Received heart-beat
2020-09-02 09:51:38,552 DEBUG [client] Received heart-beat
2020-09-02 09:51:53,513 DEBUG [client] Received heart-beat
2020-09-02 09:52:08,555 DEBUG [client] Received heart-beat
2020-09-02 09:52:22,846 DEBUG [actions_component] Idle reset
2020-09-02 09:52:23,550 DEBUG [client] Received heart-beat
2020-09-02 09:52:38,550 DEBUG [client] Received heart-beat
2020-09-02 09:52:53,510 DEBUG [client] Received heart-beat
2020-09-02 09:53:08,552 DEBUG [client] Received heart-beat
2020-09-02 09:53:23,553 DEBUG [client] Received heart-beat
2020-09-02 09:53:38,553 DEBUG [client] Received heart-beat
2020-09-02 09:53:53,510 DEBUG [client] Received heart-beat
2020-09-02 09:54:08,552 DEBUG [client] Received heart-beat
2020-09-02 09:54:23,553 DEBUG [client] Received heart-beat
2020-09-02 09:54:38,555 DEBUG [client] Received heart-beat
2020-09-02 09:54:53,517 DEBUG [client] Received heart-beat
2020-09-02 09:55:08,558 DEBUG [client] Received heart-beat
2020-09-02 09:55:23,554 DEBUG [client] Received heart-beat
2020-09-02 09:55:38,555 DEBUG [client] Received heart-beat
2020-09-02 09:55:53,519 DEBUG [client] Received heart-beat
2020-09-02 09:56:08,567 DEBUG [client] Received heart-beat
2020-09-02 09:56:23,554 DEBUG [client] Received heart-beat
2020-09-02 09:56:38,559 DEBUG [client] Received heart-beat
2020-09-02 09:56:53,519 DEBUG [client] Received heart-beat
2020-09-02 09:57:08,558 DEBUG [client] Received heart-beat
2020-09-02 09:57:23,554 DEBUG [client] Received heart-beat
2020-09-02 09:57:38,558 DEBUG [client] Received heart-beat
2020-09-02 09:57:53,517 DEBUG [client] Received heart-beat
2020-09-02 09:58:08,553 DEBUG [client] Received heart-beat
2020-09-02 09:58:23,555 DEBUG [client] Received heart-beat
2020-09-02 09:58:38,556 DEBUG [client] Received heart-beat
2020-09-02 09:58:53,514 DEBUG [client] Received heart-beat
2020-09-02 09:59:08,555 DEBUG [client] Received heart-beat
2020-09-02 09:59:23,556 DEBUG [client] Received heart-beat
2020-09-02 09:59:38,567 DEBUG [client] Received heart-beat
2020-09-02 09:59:53,528 DEBUG [client] Received heart-beat
2020-09-02 10:00:08,562 DEBUG [client] Received heart-beat
2020-09-02 10:00:23,556 DEBUG [client] Received heart-beat
2020-09-02 10:00:38,557 DEBUG [client] Received heart-beat
2020-09-02 10:00:53,513 DEBUG [client] Received heart-beat
2020-09-02 10:01:08,555 DEBUG [client] Received heart-beat
2020-09-02 10:01:23,556 DEBUG [client] Received heart-beat
2020-09-02 10:01:38,557 DEBUG [client] Received heart-beat
2020-09-02 10:01:53,514 DEBUG [client] Received heart-beat
2020-09-02 10:02:08,557 DEBUG [client] Received heart-beat
2020-09-02 10:02:22,847 DEBUG [actions_component] Idle reset
2020-09-02 10:02:23,550 DEBUG [client] Received heart-beat
2020-09-02 10:02:38,558 DEBUG [client] Received heart-beat
2020-09-02 10:02:53,517 DEBUG [client] Received heart-beat
2020-09-02 10:03:08,560 DEBUG [client] Received heart-beat

I tried to debug resilient-circuits several times, from the circuits logs itself I only see heartbeats. 

If I run something like: resilient-circuits selftest -l fn-ip-void

I got this output

fn-ip-void:
Test was successful!
Credits Remaining: 25
Estimated Queries: 312
selftest: success, Elapsed time: 0.000000 seconds

This is a part of the app.log regarding ip_void:

[integration@resilient .resilient]$ cat app.log | grep void
2020-08-31 09:29:27,864 DEBUG [connectionpool] https://172.25.0.169:443 "GET /rest/orgs/203/functions/fn_ip_void_request HTTP/1.1" 200 None
2020-08-31 09:29:28,776 DEBUG [decorators] @function <function _fn_ip_void_request_function at 0x7f26ba682c50>
2020-08-31 09:29:29,292 INFO [component_loader] 'fn_ip_void.components.fn_ip_void_request.FunctionComponent' loading
2020-08-31 09:29:29,293 DEBUG [component_loader] 'fn_ip_void.components.fn_ip_void_request.FunctionComponent' loaded
2020-08-31 09:29:30,468 INFO [actions_component] 'fn_ip_void.components.fn_ip_void_request.FunctionComponent' function 'fn_ip_void_request' registered to 'fn_ip_void'
2020-08-31 09:29:30,469 DEBUG [actions_component] Listeners: {u'email_outbound': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_spamhaus_query': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_qradar_integration': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_mitre_integration': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_whois_rdap': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_ipinfo': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_xforce': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>, <FunctionComponent/* 26263:MainThread (queued=0) [S]>]), u'fn_ip_void': set([<FunctionComponent/* 26263:MainThread (queued=0) [S]>])}
fn_ip_void_request/functions.fn_ip_void_request
2020-08-31 09:29:30,476 INFO [actions_component] Subscribe to message destination 'fn_ip_void'
2020-08-31 09:29:30,483 INFO [stomp_component] Subscribe to message destination actions.203.fn_ip_void
2020-08-31 09:29:30,483 DEBUG [client] Sending SUBSCRIBE frame [headers={'ack': 'client-individual', 'destination': 'actions.203.fn_ip_void', 'id': 'actions.203.fn_ip_void', 'activemq.prefetchSize': 20}, version=1.2]

I don't see any errors on this side, the workflow status is nor on "pending" but on "running", I can't find anything related to it tough.

Hi Ben, 

Thank you for the answer reading the article you sent me, I realized that I don't actually need an exclusive gateway on that position because I need to do the Ip Void check on both cases, if the result is positive then I'll close with a mail if not I'll just close ( without mail). At this point it should be easier to close the incident in both cases with a mail notification. 

So, I'll ask you, is there a way to print the query result in the notification?  I tried to run the workflow and the action querying an artifact manually but both the action and the workflow are stuck in pending status so I'm not really sure if its working.

Hello Ben, 

Thank you for the detailed answer.

I'm trying to edit the workflow as you showed on the images above but I'm getting an error :

 "Exclusive Gateway 'ExclusiveGateway_0dr700o' has outgoing sequence flow 'SequenceFlow_10pcls6' without condition which is not the default flow."

This is the workflow:

It would be possible to add an exclusive gateway after the function that checks the results and if necessary close the incident using a script:

Sending an email would require the configuration of a Notification: