IBM QRadar SOAR

IBM QRadar

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  proxy settings in app.config

    Posted Fri December 04, 2020 07:11 AM
    I have a question about the usage of the following settings:

    [integrations]
    # To override, add any parameter to your specific integration section
    http_proxy=<PROXY URL>
    https_proxy=<PROXY URL>
    timeout=120

    The above is described in https://www.ibm.com/support/knowledgecenter/SSBRUQ_38.0.0/doc/apps/proxy.html

    I'm developing the application which invoke a internet page.

    (1) If I code proxy in the function processor as follows, I got the response from the internet page successfully.

    - function processor

    :
    proxies = {
    'http' : 'http://<proxy-host>:<proxy-port>',
    'https' : 'http://<proxy-host>:<proxy-port>'
    }
    url = "http://<internet-page>"
    res = requests.get(url,proxies=proxies)
    :
    (2) If I specify proxy settings in app.config and code without proxy in the function processor, I got the timeout error.

    - app.config

    [integrations]
    http_proxy=http://<proxy-host>:<proxy-port>
    https_proxy=http://<proxy-host>:<proxy-port>
    timeout=120

    - function processor

    url = "http://<internet-page>"
    res = requests.get(url)

    ----
    In addition I tried to display a value from function processor as follows but got the error "KeyError: 'http_proxy'".
      log.info("http_proxy: %s", self.options["http_proxy"])

    So I wonder how I use the proxy settings in app.config for the application. Any suggestions would be appreciated

    ------------------------------
    Yohji Amano
    ------------------------------


  • 2.  RE: proxy settings in app.config

    Posted Mon December 07, 2020 08:14 AM
    https://www.ibm.com/support/knowledgecenter/SSBRUQ_38.0.0/doc/apps/proxy.html says:

    If an app requires an external internet connection, add the following section to its app.config

    [integrations]
    # To override, add any parameter to your specific integration section
    http_proxy=<PROXY URL>
    https_proxy=<PROXY URL>
    timeout=120

    The above sentence seems that resilient application can access to internet. 
    But I'm afraid that it allow us to connect only to Resilient on internet rather than the any sites on internet.

    Is this right?

    ------------------------------
    Yohji Amano
    ------------------------------

    Original Message


  • 3.  RE: proxy settings in app.config

    Posted Mon December 07, 2020 09:20 AM
    Hi Yohji,
      I believe the integrations proxy settings are automatically used by the RequestsCommon class of the resilient-lib library.

    https://pypi.org/project/resilient-lib/

    The RequestsCommon class parses the app config [integrations] section looking for proxy settings to use when either execute_call() or execute_call_v2() are used.

    https://github.com/ibmresilient/resilient-python-api/blob/master/resilient-lib/resilient_lib/components/requests_common.py

    I've used resilient-lib in my integrations to try and standardize things like proxy configuration.  The library also has some other useful features too that make it worth looking into using.

    ------------------------------
    David Vasil
    ------------------------------

    Original Message


  • 4.  RE: proxy settings in app.config

    Posted Mon December 07, 2020 08:04 PM
    Hi David

    Thank you for your guidance.

    With some samples you referred, I thought the following was simple implementation to use proxy for my app.

    1) app.config
    described in my app section instead of integrations section
    [fn_XXX]
    http_proxy=http://<proxy_host>:<proxy_port>
    https_proxy=http://<proxy_host>:<proxy_port>

    2) function processor
    from resilient_lib import RequestsCommon
               :
          rc = RequestsCommon(self.options)                              # passed self.options to RequestsCommon as argument
               :
          res = requests.get(url, proxies=rc.get_proxies())       # pass proxy information by rc.get_proxies()

    The above worked as expected.

    Thank you very much.
    ​​

    ------------------------------
    Yohji Amano
    ------------------------------

    Original Message


  • 5.  RE: proxy settings in app.config

    Posted Thu December 10, 2020 04:11 AM
    Let me correct my previous message since it happened to work at that time.

    Finally I storeed argument "opts" as "self.opts" and passed it to RequestsCommon. Then I got the expected behaviors

    1) app.config

[integrations]
http_proxy=http://<host>:<port>
https_proxy=http:/<host>:<port>

2) function processor
from resilient_lib import RequestsCommon
             :     
     def __init__(self, opts):
             :
          self.opts = opts  
             :
     def _reload(self, event, opts):
             :
          self.opts = opts  
             :
     def _zipsearch_function(self, event, *args, **kwargs): 
             :
          rc = RequestsCommon(self.opts) # passed self.opts to RequestsCommon as argument
             :
          res = requests.get(url, proxies=rc.get_proxies()) # pass proxy information by 
             :
 ​


    ------------------------------
    Yohji Amano
    ------------------------------

    Original Message