IBM QRadar SOAR

IBM QRadar SOAR

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only
Expand all | Collapse all

How To Check All My Integrations And If They Are Running

  • 1.  How To Check All My Integrations And If They Are Running

    Posted Thu October 24, 2019 09:26 AM

    Hey Everyone

    I want to perform health checks to sure that all the integrations feeding into resilient is up and working ( more or less try to automate this process ).

    So in the event, resilient isn't working or it is not collecting feeds I can immediately know to try to sort out the issue.

    This might be a stupid question so please forgive me.

    Is it possible for me to programmably list all the integrations that are running on resilient? And how would I be able to run a test on all the integrations to ensure that they are all up and running?

    Thank You So Much



    ------------------------------
    Simeon Jaganyi
    ------------------------------


  • 2.  RE: How To Check All My Integrations And If They Are Running

    Posted Thu October 24, 2019 03:38 PM
    This is a posted idea here: https://2e4ccba981d63ef83a875dad7396c9a0.ideas.aha.io/ideas/R-I-356

    I agree, it would be nice if Resilient supported health metrics that monitored integration connections in some capacity.

    Here are two ideas on how you could accomplish this today:

    1. Via a custom workflow that run a series of functions (maybe one per integration) and reported failures in some capacity. This would require a lot of workflow logic, and would need to be run manually.
    2. Via a Cron/System job on your integrations server that runs a custom Python script that you make to do basic check-ins with all your integrations. Should one fail, it could create an incident in Resilient via the Resilient REST API (and pause checking that integration for 24 hours via a lock file or something similar). This would be the simplest and most reliable solution, but is not Resilient-sourced.

    Hope these ideas are helpful.

    ------------------------------
    Jared Fagel
    Cyber Security Analyst Intern
    Public Utility
    ------------------------------