IBM QRadar SOAR

IBM QRadar SOAR

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only
  • 1.  Launch multiprocessing from inside a Resilient function

    Posted 12/16/21 04:31 AM
    Hello all

    It is possible to have an example of multiprocessing code which is being launched from a typical Resilient function ?
    I am asking because I am trying to do that but with poor results.

    What I am trying to do is to parallelize a check on multiple regex. From my local code it works, but as soon as I implement that in a Resilient function it doesn't work as expected (only one iteration is being executed, no other parallel tasks start)

    An example would be useful.

    Thanks

    ------------------------------
    Lucian Sipos
    ------------------------------


  • 2.  RE: Launch multiprocessing from inside a Resilient function

    Posted 12/17/21 07:39 AM
    Hi Lucian

    The problem with starting this kind of processing from inside Resilient is that it's usually a asynchronous task, and Resilient workflows were designed to work synchronously (except when it waits for a human task).

    Even the python script workflow task is subject to very limited constraints, such as 5 seconds to complete, no more than X lines of code executed by the python interpreter (which runs as an outside process in the same server, the scripting-service) and a limited amount of entities created in the same workflow (500 I think). Not all libraries can be used, there's a library "whitelist", and so on.

    The python code you run inside Resilient is subject to several restrictions. That's probably why it works in your desktop but not from inside Resilient.

    Can you provide more details about what exactly you need to do and how you're trying to address the issue?


    ------------------------------
    []

    Leonardo Kenji Shikida
    ------------------------------



  • 3.  RE: Launch multiprocessing from inside a Resilient function

    Posted 12/27/21 11:55 AM
    Lucian,

    I don't have much experience working with multiprocessing but I'm wondering if since the code in the Resilient function would be running in a thread if this has an effect on the multiprocessing?

    I was able to find one package on the IBM SOAR github that imports the multiprocessing package, but I'm not sure if it'll be very helpful. It's the 'fn_machine_learning_nlp' integration.

    Best of luck!

    ------------------------------
    Liam Mahoney
    ------------------------------