IBM Security QRadar SOAR

 View Only
  • 1.  FN-Utilities Local Command

    Posted Thu May 06, 2021 02:37 PM
    When it says "local Linux server commands" from fn-utilities is that from the integration server or app server?  My goal is just to create integration to add/remove IP Address artifact from a text file.  My integration server has the text file I want to modify.   I am currently just trying to do ls command and getting errors message below.

    error message

    2021-05-06 12:48:55,004 DEBUG [actions_component] success! [<resilient_circuits.action_message.FunctionResult object at 0x7f1bbb1f0cf8>], <utilities_shell_command[functions.utilities_shell_command] (id=28, workflow=update_text_file) 2021-05-06 17:48:54.089000>

    2021-05-06 12:48:55,004 DEBUG [actions_component] Message: Completed

    2021-05-06 12:48:55,005 DEBUG [actions_component] Result: {'commandline': 'ls "*"', 'start': 1620323334603, 'end': 1620323334612, 'elapsed': 9, 'exitcode': 2, 'stdout': '', 'stderr': 'ls: cannot access *: No such file or directory\n', 'stdout_json': None, 'stderr_json': None}

    app.config
    # local shell_command default commands
    nslookup=nslookup "{{shell_param1}}"
    dig=dig "{{shell_param1}}"
    traceroute=traceroute -m 15 "{{shell_param1}}"
    whois=whois "{{shell_param1}}"
    ls=ls "{{shell_param1}}"



    Thank you

    ------------------------------
    Jeffrey Foote
    ------------------------------


  • 2.  RE: FN-Utilities Local Command

    Posted Fri May 07, 2021 08:01 AM
    It does run on the Integration server.  I was not feeding it the correct shell_param

    ------------------------------
    Jeffrey Foote
    ------------------------------