IBM QRadar SOAR

IBM QRadar SOAR

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  The App Host is paired but communication has not yet been successful.

    Posted Fri January 28, 2022 03:08 PM
    Hi 

    I have a problem with pairing app host and SOAR. I did everything correct from documentation by soar gives me communicate like :


    App Host and SOAR have correct information about DNS. I can ping by IP or hostname. 

    I don't have proxy, and both instances don't have connection to the internet. 

    How to fix this 




    ------------------------------
    Lukas Sirega
    ------------------------------


  • 2.  RE: The App Host is paired but communication has not yet been successful.

    Posted Mon January 31, 2022 07:50 AM
    As you have surmised this is typically a networking issue of some type from the Apphost to the SOAR server.

    The logs would probably show an error that points to a solution. I would start with this:

    https://www.ibm.com/support/pages/node/6338707

    These pages may also help:

    https://www.ibm.com/support/pages/ibm-resilient-apphost-integrations-install-successfully-however-all-workflows-and-actions-are-pending-and-fail-complete
    https://www.securitylearningacademy.com/course/view.php?id=6088

    Ben

    ------------------------------
    Ben Lurie
    ------------------------------

    Original Message


  • 3.  RE: The App Host is paired but communication has not yet been successful.

    Posted Mon January 31, 2022 09:19 AM
    Hi Lukas,
    In order to configure App Host you are required to provide internet access to the following sites:
    quay.io
    docker.com
    docker.io
    ntp:ntp.org
    https://www.ibm.com/docs/en/sqsp/43?topic=installation-network-configuration

    If you do not have access to the internet, you can configure a private repository to host the resources required by the server.
    https://www.ibm.com/docs/en/sqsp/43?topic=guide-private-repository

    ------------------------------
    Elizabeth Hecht
    ------------------------------

    Original Message


  • 4.  RE: The App Host is paired but communication has not yet been successful.

    Posted Tue February 08, 2022 02:49 AM
    Hi Elizabeth and Lucas,

    I am in the same situation for Lucas, but I opened the connection between App Host and quay.io , docker.com & docker.io but I didn'e open it to ntp:ntp.org.

    when I tested the connection using the following command on the APPHOST:

    manageAppHost checkconnection
    INFO: Checking cluster API connectivity
    Select the app host to test:
    1

    I get the below reply:

    INFO: Using app host 7cea808b-d278-4653-bc8b-9656bb795c36 (Test Repo)
    INFO: Checking app host 7cea808b-d278-4653-bc8b-9656bb795c36 (Test Repo, version 1.7.1.341)
    INFO: Check controller deployment
    INFO: Controller deployment deployment-synchronizer is not ready to serve (0/1)
    INFO: Controller deployment deployment-operator is not ready to serve (0/1)
    INFO: Check controller functionality
    ERROR: Exec Failure: HTTP:500. Message:container not found ("container-synchronizer")
    ERROR: Synchronizer container exec channel unexpectedly closed: Response{protocol=http/1.1, code=500, message=Internal Server Error, url=https://urldefense.proofpoint.com/v2/url?u=https-3A__127.0.0.1-3A6443_api_v1_namespaces_7cea808b-2Dd278-2D4653-2Dbc8b-2D9656bb795c36_pods_deployment-2Dsynchronizer-2D59d7dbff7f-2Dqgkr6_exec-3Fcommand-3Djava-26command-3D-2Dcp-26command-3D-252Fapp-252Fresources-253A-252Fapp-252Fclasses-253A-252Fapp-252Flibs-252F-2A-26command-3Dcom.ibm.security.apps-252Fcontroller-252Fsynchronizer.AppChecker-26container-3Dcontainer-2Dsynchronizer-26stdout-3Dtrue-26stderr-3Dtrue&d=DwIGAg&c=--1RjWWBW4Kf6aBAaj53vPItwfT0BR1YjSDV46P5EvE&r=I0E6bamAVeGNLl4WmlGY8WUcQ4ztKidlPMU7UWFyq4c&m=9JsbcSBcQqfNTU8rh4Qlr13_QKFOlanKO5yyc_W3wdTY6fBIm79DSIts0E3PHGuw&s=u3NhpMQPswYPkPnUmpPvyrUCnJmEwBq0QMKObekpHOY&e= }
    ERROR: An unexpected error occurred
    INFO: End of app host check for 7cea808b-d278-4653-bc8b-9656bb795c36

    >>> App host 7cea808b-d278-4653-bc8b-9656bb795c36 (Test Repo, version 1.7.1.341) <<<
    - [error] Component synchronizer is not ready
    - [error] Component operator is not ready
    - [error] Unexpected error occurred in step com.ibm.security.apps.controller.management.setup.steps.impl.CheckControllerFunctionalityStep

    Some tests failed
    ERROR: Command failed; error: 3. Log File: /var/log/apphost/management-20220208144043248.log.

    Note:
    Iam using IBM SOAR version 43
    and AppHost version 1.7.1.341

    ------------------------------
    Omar Darweesh
    ------------------------------

    Original Message