IBM Security QRadar SOAR

 View Only
  • 1.  data feeder error

    Posted Tue June 22, 2021 04:07 PM

    Hello,

    Because of an unrelated Resilient issue I had, I reinstalled our data feeder app.
    This had been working find in the past, but now it is getting the error below.
    It appears to be configured correctly too.

    [feeds]
    # comma separated section names. ex. sqlserver_feed,file_feed
    #feed_names=mysql_feed
    feed_names=splunk_hec_feed
    .
    .
    ######### SPLUNK FEED ########
    [splunk_hec_feed]
    .
    .


    Jun 22 14:58:31 chdtx1mn06.corpdev.transunion.com resilient-circuits[11923]: 2021-06-22 14:58:31,617 INFO [feed_ingest] ingesting object
    Jun 22 14:58:31 chdtx1mn06.corpdev.transunion.com resilient-circuits[11923]: 2021-06-22 14:58:31,617 WARNING [co3] Unverified HTTPS requests (cafile=false).
    Jun 22 14:58:32 chdtx1mn06.corpdev.transunion.com resilient-circuits[11923]: 2021-06-22 14:58:32,406 ERROR [feed_ingest] Traceback Traceback (most recent call last):
    Jun 22 14:58:32 chdtx1mn06.corpdev.transunion.com resilient-circuits[11923]: File "build/bdist.linux-x86_64/egg/rc_data_feed/components/feed_ingest.py", line 190, in _feed_ingest_data
    Jun 22 14:58:32 chdtx1mn06.corpdev.transunion.com resilient-circuits[11923]: self.feed_outputs, is_deleted, self.incl_attachment_data)
    Jun 22 14:58:32 chdtx1mn06.corpdev.transunion.com resilient-circuits[11923]: AttributeError: 'FeedComponent' object has no attribute 'feed_outputs'
    Jun 22 14:58:32 chdtx1mn06.corpdev.transunion.com resilient-circuits[11923]: 2021-06-22 14:58:32,407 ERROR [feed_ingest] Failure on action modified object 0 type_info {u'incident

    Any suggestions?



    ------------------------------
    Tim Gray
    ------------------------------


  • 2.  RE: data feeder error

    Posted Wed June 23, 2021 09:37 PM
    Hi Tim,

    The issue may be that the rc-data-feed-plugin-splunkfeed package is not installed. Confirm that package by running 'resilient-circuits list'.

    Regards,
    Mark

    ------------------------------
    Mark Scherfling
    ------------------------------



  • 3.  RE: data feeder error

    Posted Fri September 24, 2021 11:08 AM
    I came across the same error and the 'resilient-circuits list' output is as follows:

    rc-data-feed-plugin-odbcfeed==1.0.5:

    (Package does not define any components)

    rc-data-feed-plugin-splunkfeed==1.0.3:

    (Package does not define any components)

    rc-data-feed==2.1.0:

    FeedComponent

    SyncIncidentsFunctionComponent


    Does Package does not define any components mean the package was incorrectly installed?

    ------------------------------
    Priyanka Mane
    ------------------------------