IBM QRadar SOAR

IBM QRadar

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  Qradar and Resilient Integration Error

    Posted Tue August 25, 2020 02:16 AM
    Hello,

    I install IBM Resilient QRadar Integration in Qradar.



    Create Rule and Workflow in Resilient.


    And use the utilities_shell_command.py function in Resilient APP, fn_utilities.



    The content of the rule is that when Resilient creates a new Incident, WorkFlow will be executed and part of the column content of Incidnet will be sent to RabbitMQ

    We found that when the Qradar Offense Description is in English, the job is normal.

    But when Offense Descript has Chinese characters, an error will appear.


    I tried many methods, but errors occurred.

    What settings can be adjusted, thank you!

    ------------------------------
    Sun Allen
    ------------------------------


  • 2.  RE: Qradar and Resilient Integration Error

    Posted Tue August 25, 2020 05:39 AM
    Hi,

    This article may help you to solve the issue:

    https://www.ibm.com/support/pages/node/6193791

    ------------------------------
    Jasmine
    ------------------------------

    Original Message


  • 3.  RE: Qradar and Resilient Integration Error

    Posted Tue August 25, 2020 08:44 AM

    Hi Jasmine, 

    Thank you for information, I tried that one and the result was still the same.

    Below is the error message...

    I tried to modify the file mentioned in the error message

    But none of them seem to work

    2020-08-25 20:39:15,277 INFO [actions_component] Event: <utilities_shell_command[] (id=23, workflow=send_to_mq, user=XXX)

    2020-08-25 12:39:15.021000> Channel: functions.utilities_shell_command
    2020-08-25 20:39:15,482 INFO [utilities_shell_command] shell_command: tomq
    2020-08-25 20:39:15,483 INFO [utilities_shell_command] shell_remote: False
    2020-08-25 20:39:15,483 INFO [utilities_shell_command] shell_param1: QRadar ID 2 , Excessive Firewall Denies Between Hosts preceded by For Resilient 測試用 Offense

    2020-08-25 20:39:15,583 ERROR [actions_component] <task[functionworker] (<function _call_the_task at 0x7f424bc9fe50>, <utilities_shell_command[functions.utilities_shell_command] (id=23, workflow=send_to_mq, user=XXXXX)
    2020-08-25 12:39:15.021000> shell_param1=u'QRadar ID 2 , Excessive Firewall Denies Between Hosts preceded by For Resilient \u6e2c\u8a66\u7528 Offense '
    Traceback (most recent call last):
    File "/usr/local/lib/python2.7/site-packages/fn_utilities/components/utilities_shell_command.py", line 59, in _shell_command_function
    "shell_param1": render(u"{{shell_param1|%s}}" % escaping, kwargs),
    File "/usr/local/lib/python2.7/site-packages/resilient_circuits/template_functions.py", line 357, in render
    try:
    File "/usr/local/lib/python2.7/site-packages/jinja2/environment.py", line 1090, in render
    self.environment.handle_exception()
    File "/usr/local/lib/python2.7/site-packages/jinja2/environment.py", line 832, in handle_exception
    reraise(*rewrite_traceback_stack(source=source))
    File "<template>", line 1, in top-level template code
    File "/usr/local/lib/python2.7/site-packages/resilient_circuits/template_functions.py", line 127, in sh_filter
    escaped = []
    UnicodeEncodeError: 'ascii' codec can't encode characters in position 81-83: ordinal not in range(128)



    ------------------------------
    Sun Allen
    ------------------------------

    Original Message


Related Content