IBM Security QRadar SOAR

 View Only
  • 1.  Creating Custom AppHost

    Posted Wed December 01, 2021 09:00 AM
    Dears,

    Appreciated anyone's support if he can help me regarding custom APP host creation. As what I found regarding the steps is as follows:
    1) create needed message destination, function , workflow, and rule.
    2)From vm machine away off the app host and soar platform run below command to generate the code:
    resilient-sdk codegen -p (Name I choose) -f (function API name) --workflow ( workflow API name) --rule "Rule Name" -e export settings -m "message destination"
    3)Once code is finalized then Package the code to get .zip and .tar file
    resilient-sdk package -p name of function file
    4) regarding the docker part I got too confused appreciate if you can support me in this part.

    Thanks in Advance,
    Mohamed Khalil

    ------------------------------
    Mohamed Khalil
    ------------------------------


  • 2.  RE: Creating Custom AppHost

    Posted Thu December 02, 2021 10:48 AM
    Is there a specific question you have regarding the Dockerfile configuration? In general, it isn't necessary to change it. If your app needs python libraries that aren't included by default, you'll need to customize the Dockerfile to include them:

    # uncomment and replicate if additional pypi packages are needed
    #RUN pip install <package>

    Ben

    ------------------------------
    Ben Lurie
    ------------------------------



  • 3.  RE: Creating Custom AppHost

    Posted Sun December 05, 2021 05:28 PM

    To be more specific, I managed to pack the app and I added my private repo in the packing by the use of resilient-sdk package -p fn --repository-name name of repo
    and I added the private repo to my app host by the use of 
    sudo manageAppHost registry --registry docker.io -u my username 
    but my app is stuck in the app.config test when I test it. 



    ------------------------------
    Mohamed Khalil
    ------------------------------



  • 4.  RE: Creating Custom AppHost

    Posted Mon December 06, 2021 06:36 AM
    I'm not sure you have already consider the following:

    If you create an application package and the registry for App Host,
        - resilient-sdk package -p fn --repository-name <repository-name>   (==> app-<app-name>-<app-version>.zip)
        - sudo manageAppHost registry --registry <registry_host>:<registry_port> -u <username>

    1. App Host will suppose container image is supposed to be accessed with the following way:
    <registry-host>:<registry-port>/<repository-name>/<app-name>:<app-version>

    2. On the other hand container image on a custom registry with <username>  is usually like  <registry-host>:<registry-port>/<username>/<image-name>:<tag-name>.

    From 1 and 2, <repository_name> should usually match the <username> for custom registry.
    In that case resilient-sdk package -p fn --repository-name <username> 

    a. extract app.json in your app-<app-name>-<app-version>.zip
    b. check the following:
    cat app.json | jq [.current_installation.executables[0].image]
    The above will display [ "<repostitory_name>/<app-name>:<app-version> ]. This portion is used to pull container  image.




    ------------------------------
    Yohji Amano
    ------------------------------



  • 5.  RE: Creating Custom AppHost

    Posted Mon December 06, 2021 07:02 AM
    I have done below command cat app.json | jq [.current_installation.executables[0].image] and it shows the correct repo.

    ------------------------------
    Mohamed Khalil
    ------------------------------



  • 6.  RE: Creating Custom AppHost

    Posted Sun December 12, 2021 08:47 PM
    I just updated my apphost to 1.7.1.341. Then I encountered the errors for the time beings and touched the followings:
    (From root user)
     docker is not running (system status docker)
         system start docker
    - my registry(github:ghcr.io) access token(password) expired.
         manageAppHost registry --registry=<registry> -u=<user>
         ex. manageAppHost registry --registry=ghcr.io -u=yj-amano
             Select AppHost and type Password (access token as password)

    Then I could make my app up and running.


    Events:
    Type Reason Age From Message
    ---- ------ ---- ---- -------
    Normal Scheduled 22m default-scheduler Successfully assigned f6a98bfa-05d9-4001-a876-3fb8d224cbdf/03e964f4-1257-475f-a4cf-0c32ff035297-59d47cfdb7-z7twt to apphost.localdomain
    Normal Pulling 22m kubelet Pulling image "ghcr.io/yj-amano/fn_assetinfo:1.0.2"
    Normal Pulled 22m kubelet Successfully pulled image "ghcr.io/yj-amano/fn_assetinfo:1.0.2"
    Normal Created 22m kubelet Created container 03e964f4-1257-475f-a4cf-0c32ff035297
    Normal Started 22m kubelet Started container 03e964f4-1257-475f-a4cf-0c32ff035297

       


    ------------------------------
    Yohji Amano
    ------------------------------