IBM QRadar SOAR

IBM QRadar SOAR

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only
  • 1.  PagerDuty Integration with Resilient

    Posted Wed January 30, 2019 04:23 AM

    Hi Team,

    We are trying to integrate resilient with PagerDuty.

    Installed pagerduty function and passing all required fields like pd_service, pd_title,pd_escalation_policy etc. Updated API key in config file.

    we were able to successfully create incidents in pagerduty via API from postman tool.

    But getting some error when we are executing from Resilient.

    I have attached app.config file and app.log file(after executing the action). Can you please check.
    ============================================== app.config ==================================================
    [resilient]
    # Basic service connection
    host=10.9.120.140
    port=443
    email=#####
    password=####
    org=##

    # Actions Module connection
    stomp_port=65001

    # Directory containing additional components to load
    # componentsdir=components
    # Existing directory to write logs to, or set with $APP_LOG_DIR
    logdir=/tmp
    logfile=app.log
    loglevel=DEBUG

    # If your Resilient server uses a self-signed TLS certificate, or some
    # other certificate that is not automatically trusted by your machine,
    # you need to explicitly tell the Python scripts that it should be trusted.
    # If you don't want to use a cert you can set cafile=false.
    # To explicitly trust a site, download its certificate to a file, e.g:
    # mkdir -p ~/.resilient
    # openssl s_client -connect resilient.example.com:443 -showcerts < /dev/null 2> /dev/null | openssl x509 -outform PEM > ~/.resilient/cert.cer
    # then specify the file (remove the '#' from the line below):
    cafile=false

    # -----------------------------------------------------------------------------
    # Configuration for the web server
    # -----------------------------------------------------------------------------
    [webserver]

    # IP or DNS for the web server. Default is localhost.
    server=10.9.120.140

    # Port for the web server. Default is 9000.
    port=9000

    # Set the web server to use secure protocol. secure=1 means HTTPS, and secure=0 means HTTP. Default is 0
    secure=0

    # The cert file is the private key certificate for the TLS server. This is required if secure=1. Default is None.
    certfile=~/.resilient/ssl.cer


    # -----------------------------------------------------------------------------
    # The 'CustomThreatService' component
    # -----------------------------------------------------------------------------
    [custom_threat_service]

    # Base URL for threat services API
    urlbase=/cts

    # Whether we support file upload (for "file"-type artifacts)
    # upload_file=False

    # Retry time indicators
    #first_retry_secs=5
    #later_retry_secs=60
    #max_retries=60

    # Cache management
    #cache_size=10000
    #cache_ttl=600000

    # tests can be run with a minimal mock in the [resilient] section,
    #resilient_mock=rc_cts.lib.resilient_mock.MyResilientMock


    [fn_splunk_integration]
    host=10.9.120.150
    port=8089
    ui_port=8000
    username=admin
    splunkpassword=####
    verify_cert=false




    [carbon_black_threat_service]
    carbon_black_url=https://10.1.120.160

    [carbonblack]
    carbon_black_url=https://10.1.120.160
    carbonblack_int_auto_configure=true
    query_results_data_table_limit=200
    artifact_queue=carbonblack_artifact
    ban_hash_queue=carbonblack_ban_hash


    [fn_utilities]

    # For safety, shell_command parameter values are escaped - set to 'sh' (bash) or 'ps' (powershell)
    shell_escaping=sh

    # NOTE: For safety, you *must* enclose shell-param substitutions in double-quotes.
    # The values of these parameters usually includes artifacts or other untrusted data
    # that may contain spaces, dashes and other content.

    # shell_command default commands (unix)
    nslookup=nslookup "{{shell_param1}}"
    dig=dig "{{shell_param1}}"
    traceroute=traceroute -m 15 "{{shell_param1}}"
    whois=whois "{{shell_param1}}"

    # more shell_command examples:
    # foo=bash $UTILBIN/foo "{{shell_param1}}"

    # on windows, powershell example:
    # psinfo=PsInfo.exe -accepteula -nobanner \{{shell_param1}} | ConvertTo-Json

    # more shell_command examples: Volatility.
    # First param is filename of the memory image, assuming $VOLATILITY_LOCATION is set
    # Second param is the profile ("Win7SP0x64" etc)
    # imageinfo=python /path/to/vol.py -f "{{shell_param1}}" imageinfo --output=json
    # kdbgscan=python /path/to/vol.py -f "{{shell_param1}}" "--profile={{shell_param2}}" kdbgscan --output=json
    # psscan=python /path/to/vol.py -f "{{shell_param1}}" "--profile={{shell_param2}}" psscan --output=json
    # dlllist=python /path/to/vol.py -f "{{shell_param1}}" "--profile={{shell_param2}}" dlllist --output=json
    # (etc)

    [pagerduty]
    api_token=###
    #from_email=sajinmb@gmail.com
    # bypass https certificate validation (only set to False for testing purposes)
    verifyFlag=False

    =~=~=~=~=~=~=~=~=~=~=~=   app.log =~=~=~=~=~=~=~=~=~=~=~=
    2019-01-25 10:43:33,020 DEBUG [client] Received heart-beat
    2019-01-25 10:43:48,063 DEBUG [client] Received heart-beat
    2019-01-25 10:44:03,005 DEBUG [client] Received heart-beat
    2019-01-25 10:44:18,065 DEBUG [client] Received heart-beat
    2019-01-25 10:44:33,020 DEBUG [client] Received heart-beat
    2019-01-25 10:44:48,065 DEBUG [client] Received heart-beat
    2019-01-25 10:45:03,008 DEBUG [client] Received heart-beat
    2019-01-25 10:45:18,067 DEBUG [client] Received heart-beat










    2019-01-25 10:45:33,020 DEBUG [client] Received heart-beat
    2019-01-25 10:45:37,744 DEBUG [client] Received MESSAGE frame [headers={u'expires': u'0', u'Co3ContextToken': u'eyJhbGciOiJIUzI1NiJ9.bnVsbA.5mD99WjKnOqI91lkd2Z0RYbF31J_T4_1uQ5-4cSFj3o', u'ack': u'ID:resilient.localdomain-44546-1542954591291-56:4', u'timestamp': u'1548413137685', u'JMSXUserID': u'SYSTEM', u'destination': u'/queue/actions.201.pagerduty', u'correlation-id': u'invid:1842', u'persistent': u'true', u'priority': u'4', u'Co3MessagePayload': u'FunctionDataDTO', u'reply-to': u'/queue/acks.201.pagerduty', u'message-id': u'ID:resilient.localdomain-44546-1542954591291-4:2:3235:1:1', u'Co3ContentType': u'application/json', u'subscription': u'actions.201.pagerduty'}, body='{"function":{"creato...', version=1.2]
    2019-01-25 10:45:37,744 DEBUG [stomp_component] Recieved frame MESSAGE
    expires:0
    Co3ContextToken:eyJhbGciOiJIUzI1NiJ9.bnVsbA.5mD99WjKnOqI91lkd2Z0RYbF31J_T4_1uQ5-4cSFj3o
    correlation-id:invid\c1842
    destination:/queue/actions.201.pagerduty
    JMSXUserID:SYSTEM
    ack:ID\cresilient.localdomain-44546-1542954591291-56\c4
    subscription:actions.201.pagerduty
    priority:4
    Co3MessagePayload:FunctionDataDTO
    message-id:ID\cresilient.localdomain-44546-1542954591291-4\c2\c3235\c1\c1
    Co3ContentType:application/json
    persistent:true
    reply-to:/queue/acks.201.pagerduty
    timestamp:1548413137685

    {"function":{"creator":null,"description":null,"display_name":"PagerDuty Create Incident","id":23,"name":"pagerduty_create_incident","uuid":null,"version":null,"view_items":[],"workflows":[]},"groups":[],"inputs":{"pd_priority":"p4","pd_incident_key":"RES-82670","pd_description":"description","pd_service":"Resilient-API-Incidents","incidentID":82670,"pd_escalation_policy":"Default","pd_title":"Title"},"principal":{"display_name":"Sajin Mb","id":16,"name":"sajin.mb@xe04.ey.com","type":"user"},"workflow":{"actions":[],"description":null,"name":"PagerDuty Create Incident","object_type":{"name":"incident","id":0},"programmatic_name":"pagerduty_create_incident","uuid":null,"workflow_id":28},"workflow_instance":{"workflow":{"actions":[],"description":null,"name":"PagerDuty Create Incident","object_type":{"name":"incident","id":0},"programmatic_name":"pagerduty_create_incident","uuid":null,"workflow_id":28},"workflow_instance_id":1172}}
    2019-01-25 10:45:37,745 DEBUG [stomp_component] Stomp message received
    2019-01-25 10:45:37,745 DEBUG [actions_component] STOMP listener: message for actions.201.pagerduty
    2019-01-25 10:45:37,746 DEBUG [actions_component] Got Message: MESSAGE frame [headers={u'expires': u'0', u'Co3ContextToken': u'eyJhbGciOiJIUzI1NiJ9.bnVsbA.5mD99WjKnOqI91lkd2Z0RYbF31J_T4_1uQ5-4cSFj3o', u'ack': u'ID:resilient.localdomain-44546-1542954591291-56:4', u'timestamp': u'1548413137685', u'JMSXUserID': u'SYSTEM', u'destination': u'/queue/actions.201.pagerduty', u'correlation-id': u'invid:1842', u'persistent': u'true', u'priority': u'4', u'Co3MessagePayload': u'FunctionDataDTO', u'reply-to': u'/queue/acks.201.pagerduty', u'message-id': u'ID:resilient.localdomain-44546-1542954591291-4:2:3235:1:1', u'Co3ContentType': u'application/json', u'subscription': u'actions.201.pagerduty'}, body='{"function":{"creato...', version=1.2]
    2019-01-25 10:45:37,746 DEBUG [action_message] Source: <Actions/* 28898:MainThread (queued=0) [S]>
    2019-01-25 10:45:37,746 DEBUG [action_message] Headers: {
    "expires": "0",
    "Co3ContextToken": "eyJhbGciOiJIUzI1NiJ9.bnVsbA.5mD99WjKnOqI91lkd2Z0RYbF31J_T4_1uQ5-4cSFj3o",
    "ack": "ID:resilient.localdomain-44546-1542954591291-56:4",
    "timestamp": "1548413137685",
    "JMSXUserID": "SYSTEM",
    "destination": "/queue/actions.201.pagerduty",
    "correlation-id": "invid:1842",
    "persistent": "true",
    "priority": "4",
    "Co3MessagePayload": "FunctionDataDTO",
    "reply-to": "/queue/acks.201.pagerduty",
    "message-id": "ID:resilient.localdomain-44546-1542954591291-4:2:3235:1:1",
    "Co3ContentType": "application/json",
    "subscription": "actions.201.pagerduty"
    }
    2019-01-25 10:45:37,747 DEBUG [action_message] Message: {
    "function": {
    "display_name": "PagerDuty Create Incident",
    "uuid": null,
    "creator": null,
    "view_items": [],
    "name": "pagerduty_create_incident",
    "version": null,
    "workflows": [],
    "id": 23,
    "description": null
    },
    "inputs": {
    "pd_description": "description",
    "pd_service": "Resilient-API-Incidents",
    "pd_escalation_policy": "Default",
    "pd_incident_key": "RES-82670",
    "pd_priority": "p4",
    "incidentID": 82670,
    "pd_title": "Title"
    },
    "workflow": {
    "programmatic_name": "pagerduty_create_incident",
    "description": null,
    "object_type": {
    "name": "incident",
    "id": 0
    },
    "actions": [],
    "name": "PagerDuty Create Incident",
    "workflow_id": 28,
    "uuid": null
    },
    "groups": [],
    "workflow_instance": {
    "workflow_instance_id": 1172,
    "workflow": {
    "programmatic_name": "pagerduty_create_incident",
    "description": null,
    "object_type": {
    "name": "incident",
    "id": 0
    },
    "actions": [],
    "name": "PagerDuty Create Incident",
    "workflow_id": 28,
    "uuid": null
    }
    },
    "principal": {
    "type": "user",
    "display_name": "Sajin Mb",
    "id": 16,
    "name": "sajin.mb@xe04.ey.com"
    }
    }
    2019-01-25 10:45:37,747 INFO [actions_component] Event: <pagerduty_create_incident[] (id=23, workflow=pagerduty_create_incident, user=sajin.mb@xe04.ey.com) 2019-01-25 10:45:37.685000> Channel: functions.pagerduty_create_incident
    2019-01-25 10:45:37,747 DEBUG [client] Received heart-beat
    2019-01-25 10:45:37,848 DEBUG [decorators] decorated
    2019-01-25 10:45:37,950 DEBUG [actions_component] Task: <function _call_the_task at 0x7fa3aad0dc08>
    2019-01-25 10:45:37,951 DEBUG [decorators] Thread-4: _call_the_task
    2019-01-25 10:45:37,952 INFO [decorators] [pagerduty_create_incident] StatusMessage: starting...
    2019-01-25 10:45:37,954 DEBUG [connectionpool] Starting new HTTPS connection (1): api.pagerduty.com
    2019-01-25 10:45:37,955 DEBUG [stomp_component] send()
    2019-01-25 10:45:37,955 DEBUG [client] Sending SEND frame [headers={'destination': u'/queue/acks.201.pagerduty', 'correlation-id': u'invid:1842'}, body='{"message": "startin...', version=1.2]
    2019-01-25 10:45:37,956 DEBUG [stomp_component] Message sent
    2019-01-25 10:45:38,300 DEBUG [connectionpool] https://api.pagerduty.com:443 "GET /services HTTP/1.1" 401 1
    2019-01-25 10:45:38,358 ERROR [actions_component] <task[functionworker] (<function _call_the_task at 0x7fa3aad0dc08>, <pagerduty_create_incident[functions.pagerduty_create_incident] (id=23, workflow=pagerduty_create_incident, user=sajin.mb@xe04.ey.com) 2019-01-25 10:45:37.685000> pd_description=u'description', pd_service=u'Resilient-API-Incidents', pd_escalation_policy=u'Default', pd_incident_key=u'RES-82670', pd_priority=u'p4', incidentID=82670, pd_title=u'Title')> (<class 'resilient_circuits.action_message.FunctionException_'>): FunctionException_: <Traceback (most recent call last):
    File "/usr/local/lib/python2.7/site-packages/fn_pagerduty/components/pd_create_incident.py", line 41, in _pagerduty_create_incident_function
    resp = create_incident(self.log, createDict)
    File "/usr/local/lib/python2.7/site-packages/fn_pagerduty/components/pd_common.py", line 83, in create_incident
    payload = build_incident_payload(appDict)
    File "/usr/local/lib/python2.7/site-packages/fn_pagerduty/components/pd_common.py", line 183, in build_incident_payload
    serviceId = find_service_by_name(None, appDict, appDict['service'])
    File "/usr/local/lib/python2.7/site-packages/fn_pagerduty/components/pd_common.py", line 50, in find_service_by_name
    resp = execute_call(log, 'get', url, None, None, None, True, headers, None)
    File "/usr/local/lib/python2.7/site-packages/fn_pagerduty/lib/requests_common.py", line 52, in execute_call
    raise IntegrationError(err)
    IntegrationError: IntegrationError()
    >
    File "/usr/local/lib/python2.7/site-packages/circuits/core/manager.py", line 856, in processTask
    raise value.extract()
    Traceback (most recent call last):
    File "/usr/local/lib/python2.7/site-packages/circuits/core/manager.py", line 617, in _dispatcher
    event_handlers = self._cache[(event.name, channels)]
    KeyError: ('exception', ('*',))
    2019-01-25 10:45:38,359 DEBUG [actions_component] Ack ID:resilient.localdomain-44546-1542954591291-4:2:3235:1:1
    2019-01-25 10:45:38,359 DEBUG [stomp_component] ack_frame()
    2019-01-25 10:45:38,360 DEBUG [client] Sending ACK frame [headers={'id': u'ID:resilient.localdomain-44546-1542954591291-56:4'}, version=1.2]
    2019-01-25 10:45:38,360 DEBUG [stomp_component] Ack Sent
    2019-01-25 10:45:38,361 DEBUG [stomp_component] send()
    2019-01-25 10:45:38,361 DEBUG [client] Sending SEND frame [headers={'destination': u'/queue/acks.201.pagerduty', 'correlation-id': u'invid:1842'}, body='{"message": "Functio...', version=1.2]
    2019-01-25 10:45:38,361 DEBUG [stomp_component] Message sent
    2019-01-25 10:46:03,028 DEBUG [client] Received heart-beat
    2019-01-25 10:46:18,065 DEBUG [client] Received heart-beat
    2019-01-25 10:46:33,020 DEBUG [client] Received heart-beat
    2019-01-25 10:46:48,071 DEBUG [client] Received heart-beat











    ------------------------------
    Sajin MB
    ------------------------------


  • 2.  RE: PagerDuty Integration with Resilient

    Posted Wed January 30, 2019 12:47 PM
    I believe this error is an http 401 (authorization error) returned from pagerduty. Please check your api token specified in the app.config file.

    ------------------------------
    Mark Scherfling
    ------------------------------