IBM QRadar SOAR

 View Only

 Custom app does not listen or subscribe the message destination

Homie Zhao's profile image
Homie Zhao posted 12/12/24 03:42 AM

Hi Everyone,

We have recently installed a new custom app but somehow it didn't listen to message destination to receive action input, attaching the app.log and app.config, may I have some suggestions from you?

app.config

[root@GOAZEDLAP0049 .resilient]# cat app.config
[resilient]
# Basic service connection
host=GOAZEDLAP0049
port=443

# Use (api_key_id, api_key_secret)
api_key_id=07de07ac-8a48-422c-8663-a142b884f974
api_key_secret=****************************
# Or (email, password)
#email=unassigned@XXX.com
#password=***********

org=XXX

# Number of attempts to retry when connecting to Resilient. 0 = unlimited retries
#max_connection_retries=10

# CP4S
# Actions Module connection
# Use stomp_url when configuring an environment for CP4S
#stomp_host=<CP4S stomp URL>
#stomp_port=443
#resource_prefix=/api/respond
# stomp_port=65001
#stomp_timeout=120
#stomp_max_retries=3

# Optional parameters for stomp connections.....
# Please refer to IBM Support for additional settings to those outlined below
# format......     stomp_params=<param1=value1>,<,param2=value2>
#stomp_params=startupMaxReconnectAttempts=3,maxReconnectAttempts=10,initialReconnectDelay=20

# Directory containing additional components to load
# componentsdir=components
# Existing directory to write logs to, or set with $APP_LOG_DIR
logdir=/root/.resilient
logfile=app.log
loglevel=DEBUG

# If your Resilient server uses a self-signed TLS certificate, or some
# other certificate that is not automatically trusted by your machine,
# you need to explicitly tell the Python scripts that it should be trusted.
# If you don't want to use a cert you can set cafile=false.
# To explicitly trust a site, download its certificate to a file, e.g:
#    mkdir -p ~/.resilient
#    openssl s_client -connect resilient.example.com:443 -showcerts < /dev/null 2> /dev/null | openssl x509 -                                                 outform PEM > ~/.resilient/cert.cer
# then specify the file (remove the '#' from the line below):
#cafile=~/.resilient/cert.cer
cafile=false

[chronicle]
queue=chronicle_actions
url=https://dlttl.siemplify-soar.com/api/external/v1
verify=false
token=******************
[root@GOAZEDLAP0049 .resilient]#

app.log

2024-12-11 17:22:04,812 DEBUG [client] [MainThread] Received heart-beat
2024-12-11 17:22:18,528 DEBUG [debugger] [MainThread] <retry_failed_deliveries[*] ( )>
2024-12-11 17:22:19,836 DEBUG [client] [MainThread] Received heart-beat
2024-12-11 17:22:21,238 DEBUG [debugger] [MainThread] <ServerHeartbeat[*] ()>
2024-12-11 17:22:21,239 DEBUG [stomp_component] [MainThread] Checking server heartbeat
2024-12-11 17:22:21,240 DEBUG [debugger] [MainThread] <ServerHeartbeat_success[*] (<ServerHeartbeat[*] ()>, None )>
2024-12-11 17:22:22,790 DEBUG [debugger] [MainThread] <signal[*] (15, <frame object at 0x1e132d8> )>
2024-12-11 17:22:22,791 DEBUG [_api] [MainThread] Attempting to release lock 139927506194216 on /root/.resilient/resilient_circuits.lock
2024-12-11 17:22:22,792 DEBUG [_api] [MainThread] Lock 139927506194216 released on /root/.resilient/resilient_circuits.lock
2024-12-11 17:22:23,782 INFO [app] [MainThread] Configuration file: /root/.resilient/app.config
2024-12-11 17:22:23,785 INFO [app] [MainThread] Resilient server: GOAZEDLAP0049
2024-12-11 17:22:23,785 INFO [app] [MainThread] Resilient api key id: 07de07ac-8a48-422c-8663-a142b884f974
2024-12-11 17:22:23,786 INFO [app] [MainThread] Resilient org: AIA
2024-12-11 17:22:23,787 INFO [app] [MainThread] Logging Level: DEBUG
2024-12-11 17:22:23,787 INFO [app] [MainThread] App Config plugin: Keyring
2024-12-11 17:22:23,789 DEBUG [actions_component] [MainThread] create idle timer
2024-12-11 17:22:23,790 WARNING [co3] [MainThread] Unverified HTTPS requests (cafile=false).
2024-12-11 17:22:23,794 DEBUG [connectionpool] [MainThread] Starting new HTTPS connection (1): goazedlap0049:443
2024-12-11 17:22:23,968 DEBUG [connectionpool] [MainThread] https://goazedlap0049:443 "GET /rest/session?include_permissions=false HTTP/1.1" 200 905
2024-12-11 17:22:23,970 INFO [co3base] [MainThread] Using org name: AIA
2024-12-11 17:22:23,971 DEBUG [co3] [MainThread] {
  "orgs": [
    {
      "id": 201,
      "name": "AIA",
      "addr": null,
      "addr2": null,
      "city": null,
      "state": null,
      "zip": null,
      "attachments_enabled": true,
      "final_phase_required": false,
      "tasks_private": false,
      "has_saml": true,
      "require_saml": false,
      "twofactor_auth_domain": null,
      "has_available_twofactor": false,
      "authorized_ldap_group": null,
      "supports_ldap": false,
      "incident_deletion_allowed": true,
      "configuration_type": "standard",
      "parent_org": null,
      "session_timeout": 1200,
      "last_modified_by": {
        "id": 9,
        "type": "user",
        "name": "unassigned@aia.com",
        "display_name": "Unassigned Account"
      },
      "last_modified_time": 1729240249963,
      "uuid": "4138b335-a342-4981-ad1c-3dadc2c0c138",
      "timezone": null,
      "cloud_account": null,
      "perms": null,
      "effective_permissions": [],
      "role_handles": [],
      "enabled": true,
      "twofactor_cookie_lifetime_secs": 0
    }
  ],
  "password_expiration_date": null,
  "api_key_handle": 4,
  "client_id": "07de07ac-8a48-422c-8663-a142b884f974",
  "display_name": "SplunkPhantom Integration"
}
2024-12-11 17:22:24,181 DEBUG [connectionpool] [MainThread] https://goazedlap0049:443 "GET /rest/orgs/201 HTTP/1.1" 200 None
2024-12-11 17:22:24,184 DEBUG [rest_helper] [MainThread] Getting server version
2024-12-11 17:22:24,322 DEBUG [connectionpool] [MainThread] https://goazedlap0049:443 "GET /rest/const HTTP/1.1" 200 None
2024-12-11 17:22:24,333 INFO [rest_helper] [MainThread] IBM Security QRadar SOAR version: v47.2.45
2024-12-11 17:22:24,574 DEBUG [connectionpool] [MainThread] https://goazedlap0049:443 "GET /rest/orgs/201/types/incident/fields HTTP/1.1" 200 None
2024-12-11 17:22:24,792 DEBUG [connectionpool] [MainThread] https://goazedlap0049:443 "GET /rest/orgs/201/types/actioninvocation/fields HTTP/1.1" 200 None
2024-12-11 17:22:24,990 DEBUG [connectionpool] [MainThread] https://goazedlap0049:443 "GET /rest/orgs/201/actions HTTP/1.1" 200 None
2024-12-11 17:22:24,994 INFO [actions_component] [MainThread] stomp_prefetch_limit set to 25
2024-12-11 17:22:25,006 INFO [actions_component] [MainThread] num_workers set to 25
2024-12-11 17:22:25,007 INFO [app] [MainThread] Components auto-load directory: (none)
2024-12-11 17:22:25,345 INFO [component_loader] [MainThread] Loading 2 components
2024-12-11 17:22:25,346 INFO [component_loader] [MainThread] 'rc_phantomcyber.components.phantomactions.PhantomActions' loading
2024-12-11 17:22:25,348 DEBUG [phantomactions] [MainThread] {'queue': 'chronicle_actions', 'url': 'https://dlttl.siemplify-soar.com/api/external/v1', 'verify': 'false', 'token': '***'}
2024-12-11 17:22:25,348 DEBUG [component_loader] [MainThread] 'rc_phantomcyber.components.phantomactions.PhantomActions' loaded
2024-12-11 17:22:25,349 INFO [component_loader] [MainThread] 'chronicle_actions.components.chronicleactions.ChronicleActions' loading
2024-12-11 17:22:25,351 DEBUG [chronicleactions] [MainThread] {'queue': 'chronicle_actions', 'url': 'https://dlttl.siemplify-soar.com/api/external/v1', 'verify': 'false', 'token': '***'}
2024-12-11 17:22:25,351 DEBUG [component_loader] [MainThread] 'chronicle_actions.components.chronicleactions.ChronicleActions' loaded
2024-12-11 17:22:25,352 DEBUG [debugger] [MainThread] <registered[*] (<Debugger/* 11837:MainThread (queued=0) [S]>, <App/* 11837:MainThread (queued=10) [R]> )>
2024-12-11 17:22:25,353 DEBUG [debugger] [MainThread] <registered[*] (<PhantomActions/* 11837:MainThread (queued=0) [S]>, <ComponentLoader/loader 11837:MainThread (queued=0) [S]> )>
2024-12-11 17:22:25,354 DEBUG [debugger] [MainThread] <registered[*] (<Timer/* 11837:MainThread (queued=0) [S]>, <Actions/* 11837:MainThread (queued=0) [S]> )>
2024-12-11 17:22:25,354 DEBUG [debugger] [MainThread] <registered[*] (<ChronicleActions/* 11837:MainThread (queued=0) [S]>, <ComponentLoader/loader 11837:MainThread (queued=0) [S]> )>
2024-12-11 17:22:25,355 DEBUG [debugger] [MainThread] <registered[*] (<Timer/* 11837:MainThread (queued=0) [S]>, <Actions/* 11837:MainThread (queued=0) [S]> )>
2024-12-11 17:22:25,356 DEBUG [debugger] [MainThread] <registered[*] (<Actions/* 11837:MainThread (queued=0) [S]>, <App/* 11837:MainThread (queued=5) [R]> )>
2024-12-11 17:22:25,356 WARNING [actions_component] [MainThread] Unverified STOMP TLS certificate (cafile=false)
2024-12-11 17:22:25,365 INFO [stomp_component] [MainThread] Connect to GOAZEDLAP0049:65001
2024-12-11 17:22:25,365 DEBUG [stomp_component] [MainThread] Stomp uri: failover:(ssl://GOAZEDLAP0049:65001)?maxReconnectAttempts=3,startupMaxReconnectAttempts=3
2024-12-11 17:22:25,366 DEBUG [debugger] [MainThread] <registered[loader] (<ComponentLoader/loader 11837:MainThread (queued=0) [S]>, <App/* 11837:MainThread (queued=6) [R]> )>
2024-12-11 17:22:25,367 DEBUG [debugger] [MainThread] <load_all_success[loader] ( )>
2024-12-11 17:22:25,367 INFO [app] [MainThread] Components loaded
2024-12-11 17:22:25,370 DEBUG [app] [MainThread] Components:
  <App/* 11837:MainThread (queued=5) [R]>
    do_initialization/*
    stopped/*
    load_all_success/*
    config_logging/*
    reload_opts/*
    started/*
    load_all_failure/*
    <Actions/* 11837:MainThread (queued=0) [S]>
      registered/*
      FunctionErrorEvent/*
      subscribe_to_all/*
      exception/*
      OnStompError/*
      Send_failure/*
      signal/*
      Ack_success/*
      reconnect/*
      reload/*, *
      StatusMessageEvent/*
      Connected/*
      Send_success/*
      SelftestTerminateEvent/*
      retry_failed_deliveries/*
      Connect_success/*
      load_all_success/*
      prepare_unregister/*
      HeartbeatTimeout/*
      Message/*
      Ack_failure/*
      Disconnected/*
      idle_reset/*
      <Timer/* 11837:MainThread (queued=0) [S]>
        generate_events/*
      <FunctionWorker/functionworker 11837:MainThread (queued=0) [S]>
        stopped/*
        signal/*
        unregistered/*
        task/*
      <Timer/* 11837:MainThread (queued=0) [S]>
        generate_events/*
      <StompClient/stomp 11837:MainThread (queued=0) [S]>
        Ack/*
        ServerHeartbeat/*
        Send/*
        generate_events/*
        Disconnect/*
        Connect/*
        Message/*
        ClientHeartbeat/*
        Subscribe/*
        Unsubscribe/*
    <ComponentLoader/loader 11837:MainThread (queued=0) [S]>
      exception/loader
      load/*
      load_complete/*
      <PhantomActions/* 11837:MainThread (queued=0) [S]>
        reload/*
      <ChronicleActions/* 11837:MainThread (queued=0) [S]>
        reload/*
    <Debugger/* 11837:MainThread (queued=0) [S]>
      signal/*
      exception/*
2024-12-11 17:22:25,370 DEBUG [debugger] [MainThread] <registered[functionworker] (<FunctionWorker/functionworker 11837:MainThread (queued=0) [S]>, <Actions/* 11837:MainThread (queued=0) [S]> )>
2024-12-11 17:22:25,371 DEBUG [debugger] [MainThread] <started[*] (<App/* 11837:MainThread (queued=3) [R]> )>
2024-12-11 17:22:25,372 INFO [app] [MainThread] App Started
2024-12-11 17:22:25,374 DEBUG [debugger] [MainThread] <registered[stomp] (<StompClient/stomp 11837:MainThread (queued=0) [S]>, <Actions/* 11837:MainThread (queued=0) [S]> )>
2024-12-11 17:22:25,375 DEBUG [debugger] [MainThread] <reconnect[*] ( subscribe=False)>
2024-12-11 17:22:25,476 INFO [actions_component] [MainThread] STOMP attempting to connect
2024-12-11 17:22:25,478 DEBUG [debugger] [MainThread] <Connect[*] ()>
2024-12-11 17:22:25,479 INFO [stomp_component] [MainThread] Connect to Stomp...
2024-12-11 17:22:25,480 INFO [client] [MainThread] Connecting to GOAZEDLAP0049:65001 ...
2024-12-11 17:22:25,480 DEBUG [stomp_transport] [MainThread] stomp_transport.connect()
2024-12-11 17:22:25,527 INFO [client] [MainThread] Connection established
2024-12-11 17:22:25,528 DEBUG [client] [MainThread] Sending CONNECT frame [headers={'login': '07de07ac-8a48-422c-8663-a142b884f974', 'passcode': '***', 'accept-version': '1.0,1.1,1.2', 'host': '', 'heart-beat': '0,15000'}, version=1.2]
2024-12-11 17:22:25,716 DEBUG [client] [MainThread] Received CONNECTED frame [headers={'version': '1.2', 'session': '***', 'heart-beat': '15000,0', 'server': 'ActiveMQ/5.15.14'}, version=1.2]
2024-12-11 17:22:25,717 INFO [client] [MainThread] Connected to stomp broker [session=ID:GOAZEDLAP0049.AIAAZURE.BIZ-37994-1733871871907-4:10, version=1.2]
2024-12-11 17:22:25,718 DEBUG [stomp_component] [MainThread] State after Connection Attempt: connected
2024-12-11 17:22:25,719 INFO [stomp_component] [MainThread] Connected to failover:(ssl://GOAZEDLAP0049:65001)?maxReconnectAttempts=3,startupMaxReconnectAttempts=3
2024-12-11 17:22:25,719 INFO [stomp_component] [MainThread] Client HB: 0  Server HB: 15000
2024-12-11 17:22:25,720 INFO [stomp_component] [MainThread] No Client heartbeats will be sent
2024-12-11 17:22:25,720 INFO [stomp_component] [MainThread] Requested heartbeats from server.
2024-12-11 17:22:25,722 DEBUG [client] [MainThread] Received heart-beat
2024-12-11 17:22:25,723 DEBUG [debugger] [MainThread] <Connected[stomp] ()>
2024-12-11 17:22:25,724 INFO [actions_component] [MainThread] STOMP connected.
2024-12-11 17:22:25,724 DEBUG [debugger] [MainThread] <registered[*] (<Timer/* 11837:MainThread (queued=0) [S]>, <StompClient/stomp 11837:MainThread (queued=0) [S]> )>
2024-12-11 17:22:25,725 DEBUG [debugger] [MainThread] <Connect_success[*] (<Connect[*] ()>, 'success' )>
2024-12-11 17:22:25,726 DEBUG [actions_component] [MainThread] Connected successfully. Resubscribe? False
2024-12-11 17:22:25,727 DEBUG [debugger] [MainThread] <Connected_done[stomp] (None )>
2024-12-11 17:22:25,728 DEBUG [debugger] [MainThread] <Connected_success[stomp] (<Connected[stomp] ()>, None )>
2024-12-11 17:22:25,830 INFO [actions_component] [MainThread] resilient-circuits has started successfully and is now running...
2024-12-11 17:22:55,588 DEBUG [client] [MainThread] Received heart-beat
2024-12-11 17:22:55,722 DEBUG [debugger] [MainThread] <ServerHeartbeat[*] ()>
2024-12-11 17:22:55,723 DEBUG [stomp_component] [MainThread] Checking server heartbeat
2024-12-11 17:22:55,725 DEBUG [debugger] [MainThread] <ServerHeartbeat_success[*] (<ServerHeartbeat[*] ()>, None )>
2024-12-11 17:23:10,612 DEBUG [client] [MainThread] Received heart-beat

Message stuck in quque

JOHN PRENDERGAST's profile image
JOHN PRENDERGAST

Hello Homie,

One thing you  can check is if your api  key cred has access to the Message destination. 

You  can check this in Customization Settings / Message Destinations in the console

Regards,