Hi Team,
We are trying to integrate resilient with PagerDuty.
Installed pagerduty function and passing all required fields like pd_service, pd_title,pd_escalation_policy etc. Updated API key in config file.
we were able to successfully create incidents in pagerduty via API from postman tool.
But getting some error when we are executing from Resilient.
I have attached app.config file and app.log file(after executing the action). Can you please check.
============================================== app.config ==================================================
[resilient]
# Basic service connection
host=10.9.120.140
port=443
email=#####
password=####
org=##
# Actions Module connection
stomp_port=65001
# Directory containing additional components to load
# componentsdir=components
# Existing directory to write logs to, or set with $APP_LOG_DIR
logdir=/tmp
logfile=app.log
loglevel=DEBUG
# If your Resilient server uses a self-signed TLS certificate, or some
# other certificate that is not automatically trusted by your machine,
# you need to explicitly tell the Python scripts that it should be trusted.
# If you don't want to use a cert you can set cafile=false.
# To explicitly trust a site, download its certificate to a file, e.g:
# mkdir -p ~/.resilient
# openssl s_client -connect resilient.example.com:443 -showcerts < /dev/null 2> /dev/null | openssl x509 -outform PEM > ~/.resilient/cert.cer
# then specify the file (remove the '#' from the line below):
cafile=false
# -----------------------------------------------------------------------------
# Configuration for the web server
# -----------------------------------------------------------------------------
[webserver]
# IP or DNS for the web server. Default is localhost.
server=10.9.120.140
# Port for the web server. Default is 9000.
port=9000
# Set the web server to use secure protocol. secure=1 means HTTPS, and secure=0 means HTTP. Default is 0
secure=0
# The cert file is the private key certificate for the TLS server. This is required if secure=1. Default is None.
certfile=~/.resilient/ssl.cer
# -----------------------------------------------------------------------------
# The 'CustomThreatService' component
# -----------------------------------------------------------------------------
[custom_threat_service]
# Base URL for threat services API
urlbase=/cts
# Whether we support file upload (for "file"-type artifacts)
# upload_file=False
# Retry time indicators
#first_retry_secs=5
#later_retry_secs=60
#max_retries=60
# Cache management
#cache_size=10000
#cache_ttl=600000
# tests can be run with a minimal mock in the [resilient] section,
#resilient_mock=rc_cts.lib.resilient_mock.MyResilientMock
[fn_splunk_integration]
host=10.9.120.150
port=8089
ui_port=8000
username=admin
splunkpassword=####
verify_cert=false
[carbon_black_threat_service]
carbon_black_url=https://10.1.120.160
[carbonblack]
carbon_black_url=https://10.1.120.160
carbonblack_int_auto_configure=true
query_results_data_table_limit=200
artifact_queue=carbonblack_artifact
ban_hash_queue=carbonblack_ban_hash
[fn_utilities]
# For safety, shell_command parameter values are escaped - set to 'sh' (bash) or 'ps' (powershell)
shell_escaping=sh
# NOTE: For safety, you *must* enclose shell-param substitutions in double-quotes.
# The values of these parameters usually includes artifacts or other untrusted data
# that may contain spaces, dashes and other content.
# shell_command default commands (unix)
nslookup=nslookup "{{shell_param1}}"
dig=dig "{{shell_param1}}"
traceroute=traceroute -m 15 "{{shell_param1}}"
whois=whois "{{shell_param1}}"
# more shell_command examples:
# foo=bash $UTILBIN/foo "{{shell_param1}}"
# on windows, powershell example:
# psinfo=PsInfo.exe -accepteula -nobanner \{{shell_param1}} | ConvertTo-Json
# more shell_command examples: Volatility.
# First param is filename of the memory image, assuming $VOLATILITY_LOCATION is set
# Second param is the profile ("Win7SP0x64" etc)
# imageinfo=python /path/to/vol.py -f "{{shell_param1}}" imageinfo --output=json
# kdbgscan=python /path/to/vol.py -f "{{shell_param1}}" "--profile={{shell_param2}}" kdbgscan --output=json
# psscan=python /path/to/vol.py -f "{{shell_param1}}" "--profile={{shell_param2}}" psscan --output=json
# dlllist=python /path/to/vol.py -f "{{shell_param1}}" "--profile={{shell_param2}}" dlllist --output=json
# (etc)
[pagerduty]
api_token=###
#from_email=sajinmb@gmail.com
# bypass https certificate validation (only set to False for testing purposes)
verifyFlag=False
=~=~=~=~=~=~=~=~=~=~=~= app.log =~=~=~=~=~=~=~=~=~=~=~=
2019-01-25 10:43:33,020 DEBUG [client] Received heart-beat
2019-01-25 10:43:48,063 DEBUG [client] Received heart-beat
2019-01-25 10:44:03,005 DEBUG [client] Received heart-beat
2019-01-25 10:44:18,065 DEBUG [client] Received heart-beat
2019-01-25 10:44:33,020 DEBUG [client] Received heart-beat
2019-01-25 10:44:48,065 DEBUG [client] Received heart-beat
2019-01-25 10:45:03,008 DEBUG [client] Received heart-beat
2019-01-25 10:45:18,067 DEBUG [client] Received heart-beat
2019-01-25 10:45:33,020 DEBUG [client] Received heart-beat
2019-01-25 10:45:37,744 DEBUG [client] Received MESSAGE frame [headers={u'expires': u'0', u'Co3ContextToken': u'eyJhbGciOiJIUzI1NiJ9.bnVsbA.5mD99WjKnOqI91lkd2Z0RYbF31J_T4_1uQ5-4cSFj3o', u'ack': u'ID:resilient.localdomain-44546-1542954591291-56:4', u'timestamp': u'1548413137685', u'JMSXUserID': u'SYSTEM', u'destination': u'/queue/actions.201.pagerduty', u'correlation-id': u'invid:1842', u'persistent': u'true', u'priority': u'4', u'Co3MessagePayload': u'FunctionDataDTO', u'reply-to': u'/queue/acks.201.pagerduty', u'message-id': u'ID:resilient.localdomain-44546-1542954591291-4:2:3235:1:1', u'Co3ContentType': u'application/json', u'subscription': u'actions.201.pagerduty'}, body='{"function":{"creato...', version=1.2]
2019-01-25 10:45:37,744 DEBUG [stomp_component] Recieved frame MESSAGE
expires:0
Co3ContextToken:eyJhbGciOiJIUzI1NiJ9.bnVsbA.5mD99WjKnOqI91lkd2Z0RYbF31J_T4_1uQ5-4cSFj3o
correlation-id:invid\c1842
destination:/queue/actions.201.pagerduty
JMSXUserID:SYSTEM
ack:ID\cresilient.localdomain-44546-1542954591291-56\c4
subscription:actions.201.pagerduty
priority:4
Co3MessagePayload:FunctionDataDTO
message-id:ID\cresilient.localdomain-44546-1542954591291-4\c2\c3235\c1\c1
Co3ContentType:application/json
persistent:true
reply-to:/queue/acks.201.pagerduty
timestamp:1548413137685
{"function":{"creator":null,"description":null,"display_name":"PagerDuty Create Incident","id":23,"name":"pagerduty_create_incident","uuid":null,"version":null,"view_items":[],"workflows":[]},"groups":[],"inputs":{"pd_priority":"p4","pd_incident_key":"RES-82670","pd_description":"description","pd_service":"Resilient-API-Incidents","incidentID":82670,"pd_escalation_policy":"Default","pd_title":"Title"},"principal":{"display_name":"Sajin Mb","id":16,"name":"sajin.mb@xe04.ey.com","type":"user"},"workflow":{"actions":[],"description":null,"name":"PagerDuty Create Incident","object_type":{"name":"incident","id":0},"programmatic_name":"pagerduty_create_incident","uuid":null,"workflow_id":28},"workflow_instance":{"workflow":{"actions":[],"description":null,"name":"PagerDuty Create Incident","object_type":{"name":"incident","id":0},"programmatic_name":"pagerduty_create_incident","uuid":null,"workflow_id":28},"workflow_instance_id":1172}}
2019-01-25 10:45:37,745 DEBUG [stomp_component] Stomp message received
2019-01-25 10:45:37,745 DEBUG [actions_component] STOMP listener: message for actions.201.pagerduty
2019-01-25 10:45:37,746 DEBUG [actions_component] Got Message: MESSAGE frame [headers={u'expires': u'0', u'Co3ContextToken': u'eyJhbGciOiJIUzI1NiJ9.bnVsbA.5mD99WjKnOqI91lkd2Z0RYbF31J_T4_1uQ5-4cSFj3o', u'ack': u'ID:resilient.localdomain-44546-1542954591291-56:4', u'timestamp': u'1548413137685', u'JMSXUserID': u'SYSTEM', u'destination': u'/queue/actions.201.pagerduty', u'correlation-id': u'invid:1842', u'persistent': u'true', u'priority': u'4', u'Co3MessagePayload': u'FunctionDataDTO', u'reply-to': u'/queue/acks.201.pagerduty', u'message-id': u'ID:resilient.localdomain-44546-1542954591291-4:2:3235:1:1', u'Co3ContentType': u'application/json', u'subscription': u'actions.201.pagerduty'}, body='{"function":{"creato...', version=1.2]
2019-01-25 10:45:37,746 DEBUG [action_message] Source: <Actions/* 28898:MainThread (queued=0) [S]>
2019-01-25 10:45:37,746 DEBUG [action_message] Headers: {
"expires": "0",
"Co3ContextToken": "eyJhbGciOiJIUzI1NiJ9.bnVsbA.5mD99WjKnOqI91lkd2Z0RYbF31J_T4_1uQ5-4cSFj3o",
"ack": "ID:resilient.localdomain-44546-1542954591291-56:4",
"timestamp": "1548413137685",
"JMSXUserID": "SYSTEM",
"destination": "/queue/actions.201.pagerduty",
"correlation-id": "invid:1842",
"persistent": "true",
"priority": "4",
"Co3MessagePayload": "FunctionDataDTO",
"reply-to": "/queue/acks.201.pagerduty",
"message-id": "ID:resilient.localdomain-44546-1542954591291-4:2:3235:1:1",
"Co3ContentType": "application/json",
"subscription": "actions.201.pagerduty"
}
2019-01-25 10:45:37,747 DEBUG [action_message] Message: {
"function": {
"display_name": "PagerDuty Create Incident",
"uuid": null,
"creator": null,
"view_items": [],
"name": "pagerduty_create_incident",
"version": null,
"workflows": [],
"id": 23,
"description": null
},
"inputs": {
"pd_description": "description",
"pd_service": "Resilient-API-Incidents",
"pd_escalation_policy": "Default",
"pd_incident_key": "RES-82670",
"pd_priority": "p4",
"incidentID": 82670,
"pd_title": "Title"
},
"workflow": {
"programmatic_name": "pagerduty_create_incident",
"description": null,
"object_type": {
"name": "incident",
"id": 0
},
"actions": [],
"name": "PagerDuty Create Incident",
"workflow_id": 28,
"uuid": null
},
"groups": [],
"workflow_instance": {
"workflow_instance_id": 1172,
"workflow": {
"programmatic_name": "pagerduty_create_incident",
"description": null,
"object_type": {
"name": "incident",
"id": 0
},
"actions": [],
"name": "PagerDuty Create Incident",
"workflow_id": 28,
"uuid": null
}
},
"principal": {
"type": "user",
"display_name": "Sajin Mb",
"id": 16,
"name": "sajin.mb@xe04.ey.com"
}
}
2019-01-25 10:45:37,747 INFO [actions_component] Event: <pagerduty_create_incident[] (id=23, workflow=pagerduty_create_incident, user=sajin.mb@xe04.ey.com) 2019-01-25 10:45:37.685000> Channel: functions.pagerduty_create_incident
2019-01-25 10:45:37,747 DEBUG [client] Received heart-beat
2019-01-25 10:45:37,848 DEBUG [decorators] decorated
2019-01-25 10:45:37,950 DEBUG [actions_component] Task: <function _call_the_task at 0x7fa3aad0dc08>
2019-01-25 10:45:37,951 DEBUG [decorators] Thread-4: _call_the_task
2019-01-25 10:45:37,952 INFO [decorators] [pagerduty_create_incident] StatusMessage: starting...
2019-01-25 10:45:37,954 DEBUG [connectionpool] Starting new HTTPS connection (1): api.pagerduty.com
2019-01-25 10:45:37,955 DEBUG [stomp_component] send()
2019-01-25 10:45:37,955 DEBUG [client] Sending SEND frame [headers={'destination': u'/queue/acks.201.pagerduty', 'correlation-id': u'invid:1842'}, body='{"message": "startin...', version=1.2]
2019-01-25 10:45:37,956 DEBUG [stomp_component] Message sent
2019-01-25 10:45:38,300 DEBUG [connectionpool] https://api.pagerduty.com:443 "GET /services HTTP/1.1" 401 1
2019-01-25 10:45:38,358 ERROR [actions_component] <task[functionworker] (<function _call_the_task at 0x7fa3aad0dc08>, <pagerduty_create_incident[functions.pagerduty_create_incident] (id=23, workflow=pagerduty_create_incident, user=sajin.mb@xe04.ey.com) 2019-01-25 10:45:37.685000> pd_description=u'description', pd_service=u'Resilient-API-Incidents', pd_escalation_policy=u'Default', pd_incident_key=u'RES-82670', pd_priority=u'p4', incidentID=82670, pd_title=u'Title')> (<class 'resilient_circuits.action_message.FunctionException_'>): FunctionException_: <Traceback (most recent call last):
File "/usr/local/lib/python2.7/site-packages/fn_pagerduty/components/pd_create_incident.py", line 41, in _pagerduty_create_incident_function
resp = create_incident(self.log, createDict)
File "/usr/local/lib/python2.7/site-packages/fn_pagerduty/components/pd_common.py", line 83, in create_incident
payload = build_incident_payload(appDict)
File "/usr/local/lib/python2.7/site-packages/fn_pagerduty/components/pd_common.py", line 183, in build_incident_payload
serviceId = find_service_by_name(None, appDict, appDict['service'])
File "/usr/local/lib/python2.7/site-packages/fn_pagerduty/components/pd_common.py", line 50, in find_service_by_name
resp = execute_call(log, 'get', url, None, None, None, True, headers, None)
File "/usr/local/lib/python2.7/site-packages/fn_pagerduty/lib/requests_common.py", line 52, in execute_call
raise IntegrationError(err)
IntegrationError: IntegrationError()
>
File "/usr/local/lib/python2.7/site-packages/circuits/core/manager.py", line 856, in processTask
raise value.extract()
Traceback (most recent call last):
File "/usr/local/lib/python2.7/site-packages/circuits/core/manager.py", line 617, in _dispatcher
event_handlers = self._cache[(event.name, channels)]
KeyError: ('exception', ('*',))
2019-01-25 10:45:38,359 DEBUG [actions_component] Ack ID:resilient.localdomain-44546-1542954591291-4:2:3235:1:1
2019-01-25 10:45:38,359 DEBUG [stomp_component] ack_frame()
2019-01-25 10:45:38,360 DEBUG [client] Sending ACK frame [headers={'id': u'ID:resilient.localdomain-44546-1542954591291-56:4'}, version=1.2]
2019-01-25 10:45:38,360 DEBUG [stomp_component] Ack Sent
2019-01-25 10:45:38,361 DEBUG [stomp_component] send()
2019-01-25 10:45:38,361 DEBUG [client] Sending SEND frame [headers={'destination': u'/queue/acks.201.pagerduty', 'correlation-id': u'invid:1842'}, body='{"message": "Functio...', version=1.2]
2019-01-25 10:45:38,361 DEBUG [stomp_component] Message sent
2019-01-25 10:46:03,028 DEBUG [client] Received heart-beat
2019-01-25 10:46:18,065 DEBUG [client] Received heart-beat
2019-01-25 10:46:33,020 DEBUG [client] Received heart-beat
2019-01-25 10:46:48,071 DEBUG [client] Received heart-beat
------------------------------
Sajin MB
------------------------------