IBM Security QRadar SOAR

 View Only

  • 1.  resilient-circuits clone --workflow Error

    Posted Sun June 21, 2020 10:04 PM
      |   view attached
    Hello,

    I've encountered the Error as below while cloning the workflow.

    > Resilient version : Resilient Systems version: 36.1.79
    > wf_web_attack11 [OLD workflow Name]
    > wf_web_attack_cloned [New Workflow Name]

    I've copied the export file for this process but still I have the same error massage. 
    The export file includes all excepting "Administrator Settings".

    Anyone who solve this issue, please share it with me.

    -bash-4.2$ resilient-circuits clone --workflow wf_web_attack11 wf_web_attack_cloned
    No handlers could be found for logger "resilient.co3"
    Codegen is based on the organization export from 2020-06-19 00:04:46.789000.
    Traceback (most recent call last):
    File "/usr/local/bin/resilient-circuits", line 8, in <module>
    sys.exit(main())
    File "/usr/local/lib/python2.7/site-packages/resilient_circuits/bin/resilient_circuits_cmd.py", line 695, in main
    clone(args)
    File "/usr/local/lib/python2.7/site-packages/resilient_circuits/bin/resilient_circuits_cmd.py", line 413, in clone
    raise Exception("Export does not contain workflows")
    Exception: Export does not contain workflows

    ------------------------------
    SEUNG JOON KIM
    ------------------------------


  • 2.  RE: resilient-circuits clone --workflow Error

    Posted Sun June 21, 2020 10:28 PM
    if there's anyone who want to reproduce the same symptom on your current system with the version36. please refer to below steps. 
    1. choose a workflow to be cloned. For instance, I choose 'wf_web_attack' as old workflow name and clone it to 'wf_web_attack11' with new name.
        > $resilient-circuits clone --workflow 'wf_web_attack' 'wf_web_attack11'
    2. It's done with success message.
    3. And the try to make another workflow clone with the 'wf_web_attack11' cloned by 'wf_web_attack' like as below,
        > $resilient-circuits clone --workflow 'wf_web_attack11' 'wf_test_web_attack'
    4. Then, you can see the same error, I've shared as above. with this error message, every 'resilient-circuits clone --workflow' command has the same result with the error message. 

    One thing more, I've exported the configuration file (all configuration excepting 'administrator settings') and upload the latest one before executing the 'resilient-circuits clone' command. 
    but the result is the same with the error message.


    ------------------------------
    SEUNG JOON KIM
    ------------------------------

    Original Message


  • 3.  RE: resilient-circuits clone --workflow Error

    Posted Mon June 22, 2020 02:26 AM
    This is a known problem which we are investigating.

    There is no work around at present apart from using the UI to recreate the additional workflow.

    ------------------------------
    BEN WILLIAMS
    ------------------------------

    Original Message


  • 4.  RE: resilient-circuits clone --workflow Error

    Posted Mon August 31, 2020 10:52 AM
    I've had the same problem and it seems that creating the .res file from the command line solves the problem (i'm on version 35.0.203):

    1-) resilient-circuits extract -o export.res

    2-) resilient-circuits clone --workflow wf wf_clone

    ------------------------------
    ___________________
    Manuel Marchese
    ------------------------------

    Original Message