IBM Security QRadar SOAR

 View Only
  • 1.  fn_relation failure in AppHost 1.6

    Posted Wed August 18, 2021 10:48 AM
      |   view attached

    @Jared Fagel

    Just tested fn_relation in new AppHost 1.6.1.294  and I got an error :
    Unable to lock /opt/app-root/src/.resilient/resilient_circuits_lockfile: [Errno 13] Permission denied: '/var/log/rescircuits/app.log'
    /etc/rescircuits/app.config: OK

    Notes:
    - in a old 1.5.218 apphost it was working
    - in a upgraded version from 1.5.218 to 1.6.1.294, now, it is not working​




    ------------------------------
    BENOIT ROSTAGNI
    ------------------------------

    Attachment(s)

    log
    fn_relations-log.log   2 KB 1 version


  • 2.  RE: fn_relation failure in AppHost 1.6

    IBM Champion
    Posted Wed August 18, 2021 11:32 AM
    Hey @BENOIT ROSTAGNI, I think you may have accidentally @ 'ed me on that one. I'm not sure what this relates to. Our org has yet to shift to the new App Host architecture.​​​​

    ------------------------------
    Jared Fagel
    Cyber Security Analyst I
    Public Utility
    ------------------------------



  • 3.  RE: fn_relation failure in AppHost 1.6

    Posted Thu August 19, 2021 10:55 AM

    Thanks to Shane, the error is linked to :

    https://community.ibm.com/community/user/security/blogs/shane-curtin1/2021/06/28/release-of-v411-ibm-security-soar-python-librarie

    The App Should be rebuilt with the new library by the owner :)



    ------------------------------
    BENOIT ROSTAGNI
    ------------------------------



  • 4.  RE: fn_relation failure in AppHost 1.6

    Posted Thu August 19, 2021 10:59 AM
    @Nick Mumaw​ for you ?

    ------------------------------
    BENOIT ROSTAGNI
    ------------------------------



  • 5.  RE: fn_relation failure in AppHost 1.6

    Posted Thu August 19, 2021 11:05 AM
    Hey @BENOIT ROSTAGNI, I am not able to work on this currently as this was something that I built at my previous employer. We are working on getting the rights to this so I can continue to work on it. Once that permission comes through, I will work on resolving this issue.

    Thanks!

    ------------------------------
    Nick Mumaw, GPEN, GPYC
    Cyber Security Specialist - SOAR
    IBM - Security
    ------------------------------



  • 6.  RE: fn_relation failure in AppHost 1.6

    Posted Mon August 23, 2021 05:27 AM
    Thanks, Nick!  Your App is a great App! I hope to see it soon back available for all App Host.
    For users you need to use it until new updates, you need to install another App Host in 1.5 in another VM.

    ------------------------------
    BENOIT ROSTAGNI
    ------------------------------



  • 7.  RE: fn_relation failure in AppHost 1.6

    Posted Sun August 22, 2021 11:09 PM
    I also encountered the similar error with my custom application:

    /opt/app-root/lib/python3.6/site-packages/setuptools/distutils_patch.py:26: UserWarning: Distutils was imported before Setuptools. This usage is discouraged and may exhibit undesirable behaviors or errors. Please use Setuptools' objects directly or at least import Setuptools first.
    "Distutils was imported before Setuptools. This usage is discouraged "
    Unable to lock /opt/app-root/src/.resilient/resilient_circuits_lockfile: [Errno 13] Permission denied: '/var/log/rescircuits/app.log'
    /etc/rescircuits/app.config: OK​


    After that, the playbook which execute the above application never ends.



    ------------------------------
    Yohji Amano
    ------------------------------



  • 8.  RE: fn_relation failure in AppHost 1.6

    Posted Mon August 23, 2021 05:30 AM

    Hi Yohji Amano

    You should check this communication and update your app:

    https://community.ibm.com/community/user/security/blogs/shane-curtin1/2021/06/28/release-of-v411-ibm-security-soar-python-librarie



    ------------------------------
    BENOIT ROSTAGNI
    ------------------------------