IBM Security QRadar SOAR

 View Only
Expand all | Collapse all

Getting "ImportError: No module named test_function"

  • 1.  Getting "ImportError: No module named test_function"

    Posted Wed August 21, 2019 09:43 AM
    I am getting "ImportError: No module named test_function" error while starting "resilient-circuits run".
     
    Below is the procedure I have followed
     
    • Using below command I have created a module inside components directory (without package option). And it is created successfully.
      • resilient-circuits codegen -f test_function
      • file test_function.py has been created in the components directory
    • When I start "resilient-circuits run", it says 
      • Loading 'test_function' from /home/ActionModules/components/test_function.py
      • ERROR [component_loader] Failed to load component 'test_function'
      • ERROR [component_loader] No module named test_function
      • Traceback (most recent call last):
      • File "/usr/lib/python2.7/site-packages/resilient_circuits/component_loader.py", line 40, in safe_but_noisy_import
      • return __import__(name, globals(), locals(), [""])
      • ImportError: No module named test_function
    I have been following this procedure for long time to implement many function without any problem. But suddently I started getting this error for newly created function.
     
    Resilient Version is 32
     
    Have anyone faced similar issue?


    ------------------------------
    Anbalagan Rajagopal
    ------------------------------


  • 2.  RE: Getting "ImportError: No module named test_function"

    Posted Wed August 21, 2019 11:07 AM
    Hi Anbalagan,

    I tested my v32 version of resilient-circuits (32.0.186) and had no issues with component directory functions. I would review your class definitions, mine look like this:

    class FunctionComponent(ResilientComponent):



    ------------------------------
    Mark Scherfling
    ------------------------------



  • 3.  RE: Getting "ImportError: No module named test_function"

    Posted Mon September 23, 2019 04:29 AM
    Hi Mark,

    We have identified and resolved the issue. I just wanted to update the same here.
    • The issue was, the customer has enabled the endpoint security (AV) in the Action Processor Machine.
    • The AV whitelisted all the existing py files and allowed them to run, but it didn't allow any newly created py file to run.
    • Though we were running them as super user, AV was not letting us to run.
    • Enabling endpoint security was not intimated to us (partner).
    This was the root cause for the issue.

    ------------------------------
    Anbalagan Rajagopal
    ------------------------------