IBM Security QRadar SOAR

 View Only
Expand all | Collapse all

Launch multiprocessing from inside a Resilient function

  • 1.  Launch multiprocessing from inside a Resilient function

    Posted Thu December 16, 2021 04:31 AM
    Hello all

    It is possible to have an example of multiprocessing code which is being launched from a typical Resilient function ?
    I am asking because I am trying to do that but with poor results.

    What I am trying to do is to parallelize a check on multiple regex. From my local code it works, but as soon as I implement that in a Resilient function it doesn't work as expected (only one iteration is being executed, no other parallel tasks start)

    An example would be useful.

    Thanks

    ------------------------------
    Lucian Sipos
    ------------------------------


  • 2.  RE: Launch multiprocessing from inside a Resilient function

    Posted Fri December 17, 2021 07:39 AM
    Hi Lucian

    The problem with starting this kind of processing from inside Resilient is that it's usually a asynchronous task, and Resilient workflows were designed to work synchronously (except when it waits for a human task).

    Even the python script workflow task is subject to very limited constraints, such as 5 seconds to complete, no more than X lines of code executed by the python interpreter (which runs as an outside process in the same server, the scripting-service) and a limited amount of entities created in the same workflow (500 I think). Not all libraries can be used, there's a library "whitelist", and so on.

    The python code you run inside Resilient is subject to several restrictions. That's probably why it works in your desktop but not from inside Resilient.

    Can you provide more details about what exactly you need to do and how you're trying to address the issue?


    ------------------------------
    []

    Leonardo Kenji Shikida
    ------------------------------

    Original Message


  • 3.  RE: Launch multiprocessing from inside a Resilient function

    IBM Champion
    Posted Mon December 27, 2021 11:55 AM
    Lucian,

    I don't have much experience working with multiprocessing but I'm wondering if since the code in the Resilient function would be running in a thread if this has an effect on the multiprocessing?

    I was able to find one package on the IBM SOAR github that imports the multiprocessing package, but I'm not sure if it'll be very helpful. It's the 'fn_machine_learning_nlp' integration.

    Best of luck!

    ------------------------------
    Liam Mahoney
    ------------------------------

    Original Message