IBM Security QRadar SOAR

 View Only
  • 1.  Can't run resilient circuits on same OVA

    Posted Tue May 25, 2021 04:18 PM
    Dears I can't integrate with the Integration server running on the same HOST I get below error 


    -bash-4.2$ resilient-circuits run
    ###############

    Environment:

    Python Version: 2.7.18 (v2.7.18:8d21aa2, Jul 22 2020, 13:20:28)
    [GCC 4.8.5 20150623 (Red Hat 4.8.5-28)]

    Installed packages:

    argparse: 1.4.0
    backports.functools-lru-cache: 1.6.4
    beautifulsoup4: 4.9.3
    bs4: 0.0.1
    cachetools: 2.0.1
    certifi: 2017.7.27.1
    chardet: 3.0.4
    circuits: 3.2
    configparser: 3.5.0
    filelock: 2.0.12
    idna: 2.6
    Jinja2: 2.9.6
    keyring: 9.1
    MarkupSafe: 1.0
    meld3: 2.0.1
    pathtools: 0.1.2
    pbr: 3.1.1
    pip: 20.3.4
    py: 1.4.33
    PySocks: 1.6.7
    pytest: 3.0.7
    Python: 2.7.18
    pytz: 2017.2
    requests: 2.25.1
    requests-mock: 1.3.0
    requests-toolbelt: 0.8.0
    resilient: 41.0.1976
    resilient-circuits: 41.0.1976
    resilient-lib: 41.0.1976
    setuptools: 44.1.1
    six: 1.10.0
    soupsieve: 1.9.6
    stomp.py: 4.1.18
    stompest: 2.3.0
    supervisor: 3.0
    urllib3: 1.22
    watchdog: 0.10.6
    wheel: 0.30.0
    wsgiref: 0.1.2
    ###############
    2021-05-25 20:38:43,786 WARNING [co3argparse] Couldn't read config file '/home/resadmin/.resilient/app.config': While reading from u'/home/resadmin/.resilient/app.config' [line 17]: option u'org' in section u'resilient' already exists
    usage: resilient-circuits [-h] [--email EMAIL] [--password PASSWORD]
    [--api_key_id API_KEY_ID]
    [--api_key_secret API_KEY_SECRET] --host HOST
    [--port PORT] [--proxy [PROXY [PROXY ...]]]
    [--org ORG] [--cafile CAFILE]
    [--cache-ttl CACHE_TTL] [--proxy_host PROXY_HOST]
    [--proxy_port PROXY_PORT] [--proxy_user PROXY_USER]
    [--proxy_password PROXY_PASSWORD]
    [--stomp-prefetch-limit STOMP_PREFETCH_LIMIT]
    [--resilient-mock RESILIENT_MOCK]
    [--stomp-host STOMP_HOST] [--stomp-port STOMP_PORT]
    [--stomp-cafile STOMP_CAFILE]
    [--stomp-timeout STOMP_TIMEOUT]
    [--stomp-max-retries STOMP_MAX_RETRIES]
    [--max-connection-retries MAX_CONNECTION_RETRIES]
    [--resource-prefix RESOURCE_PREFIX]
    [--componentsdir COMPONENTSDIR] [--noload NOLOAD]
    [--logdir LOGDIR] [--loglevel LOGLEVEL]
    [--logfile LOGFILE]
    [--no-prompt-password NO_PROMPT_PASSWORD]
    [--test-actions] [--test-host TEST_HOST]
    [--test-port TEST_PORT]
    [--log-http-responses LOG_HTTP_RESPONSES]
    [--num-workers NUM_WORKERS]
    resilient-circuits: error: argument --host is required

    ------------------------------
    Moemen Nassar
    ------------------------------


  • 2.  RE: Can't run resilient circuits on same OVA

    Posted Wed May 26, 2021 05:50 AM
    Hi Moemen
    Can you share your app.config and location of same.
    Please verify that your app.config exists and is in the correct location referenced ('/home/resadmin/.resilient/app.config')
    It look like you may have a mis-configuration and may have missing or duplicate parameters.
    Regards
    John

    ------------------------------
    John Quirke
    ------------------------------



  • 3.  RE: Can't run resilient circuits on same OVA

    Posted Wed May 26, 2021 07:30 AM
    Hi Moeman

    Running Resilient-Circuits on the Resilient Host is not supported.
    Resilient-circuits should be ran on independent integration server.

    John

    ------------------------------
    John Quirke
    ------------------------------



  • 4.  RE: Can't run resilient circuits on same OVA

    Posted Wed May 26, 2021 02:37 PM
      |   view attached
    Can you check the attached 
    I see it available in one of IBM docs 


    What I need is to install any of resilient integration server or app host to be able to import IBM X-force apps

    Please advice

    Mo'men

    ------------------------------
    Moemen Nassar
    ------------------------------



  • 5.  RE: Can't run resilient circuits on same OVA

    Posted Thu May 27, 2021 06:18 AM
    Hi Moeman

    I would suggest that  you create an integration server or apphost.
    Once created you can import and run apps on apphost or integration server for integration that are not apphost supported.

    https://www.ibm.com/docs/en/search/apphost%20install?scope=SSBRUQ_41.0.0

    Regards
    John

    ------------------------------
    John Quirke
    ------------------------------