IBM QRadar SOAR

IBM QRadar

Join this online topic group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.


#Security
#QRadar
#SecuringhybridcloudandAI
 View Only

  • 1.  Java SOAR Messaging engine connection

    Posted 11/05/21 09:16 AM
    Edited by Alison Donato 11/05/21 03:19 PM

    Hi group!

    I am a newbie using Resilient. I am building a frontend for Resilient. While I have had success using the REST API, I would like to be able to interface also with the messaging engine. 
    I have created a Queue in Resilient and given access to both my user and an API Key.  I have been able to write a piece of Java code which connects to the messaging engine using those credentials.

    But I cannot read or write from the queue. I am not sure if I am using the proper queue name (is it just the name I provided or should I use some prefix such as the organization Id?). Each time I try to access the queue I receive read or write error access.

    I am currently using the SOAR VMWare (v41) for testing. I do not know if that is a limitation.

    Any ideas / sample Java code to access the messaging engine?

    Thanks in advance.



    ------------------------------
    GENARO NIETO FERNANDEZ
    ------------------------------



  • 2.  RE: Java SOAR Messaging engine connection

    Posted 11/08/21 08:06 AM
    Typically the queue name will be something like this:

    actions.201.queue_one

    Where 201 is the id of the organization in which the queue is created.

    What is the exact error message received? Also take a look at the logs on the resilient side in /usr/share/co3/logs/resilient_messaging.log.

    Ben

    ------------------------------
    Ben Lurie
    ------------------------------



  • 3.  RE: Java SOAR Messaging engine connection

    Posted 11/08/21 09:02 AM
    Thanks!
     
    Today I almost managed to solve the problem. Yes, I found somewhere that the queues are called action+org+name. The problem was I tried to write on that queue (in order to have something to read). And it seems no one is allowed to write.
     
    I have modified a rule so that incident information is sent when created. Now I receive this warning in my Java console:
     
    WARN | Received a message on a connection which is not yet started. Have you forgotten to call Connection.start()? Connection: ActiveMQConnection
     
    So, the information arrives but it seems I am having a coding issue with Java. I am using ActiveMQ. ActiveMQ, which I had not used previously, probably is not required if using plain JMS (I am not sure as I have not indicated STOMP in the connection URL). So I am now wondering why I am receiving that warning as I have started the connection. Well, I think so.
     
    Saludos / Best regards              
     
    Genaro Nieto Fernández     
    IBM Corporate Security Architect   Telf.: (34) 91.397.6611
    IBM CHQ eMail: genaro@es.ibm.com
         
         

           
     
     



    Salvo indicado de otro modo más arriba / Unless stated otherwise above:

    International Business Machines, S.A.

    Santa Hortensia, 26-28, 28002 Madrid

    Registro Mercantil de Madrid; Folio 1; Tomo 1525; Hoja M-28146

    CIF A28-010791





    Original Message


  • 4.  RE: Java SOAR Messaging engine connection

    Posted 11/08/21 09:29 AM

    Hi group (again)!

    I just solved the issue. A stupid bug in the code.

    So, now I am capable of sending information to a queue from Resilient and read that information in my Java code.

    If anyone is interested in the solution, just let me know.

    Next Step: receiving notifications when an incident has not been solved in time.

    Thanks!



    ------------------------------
    GENARO NIETO FERNANDEZ
    ------------------------------

    Original Message


  • 5.  RE: Java SOAR Messaging engine connection

    Posted 11/08/21 12:29 PM
    I am interested in your solution. Do you think you can share it in a GIT or something like that?

    TIA

    Leo
    leoks@br.ibm.com

    ------------------------------
    []

    Leonardo Kenji Shikida
    ------------------------------

    Original Message


  • 6.  RE: Java SOAR Messaging engine connection

    Posted 11/09/21 08:07 AM

    I have created a repository. 


    This is a work in progress. Just code for testing the integration. I know, there are credentials in the code, but while that is not a good practice, those are just valid for my own local instance of Resilient.



    ------------------------------
    GENARO NIETO FERNANDEZ
    ------------------------------

    Original Message


  • 7.  RE: Java SOAR Messaging engine connection

    Posted 11/09/21 08:22 AM
    thanks a lot!
    Leonardo Kenji Shikida
    Security Delivery Specialist
     
    Phone: 55 31 99994 0875





    Original Message


Related Content