IBM Security QRadar SOAR

 View Only
Expand all | Collapse all

How To Check All My Integrations And If They Are Running

  • 1.  How To Check All My Integrations And If They Are Running

    Posted Thu October 24, 2019 09:26 AM

    Hey Everyone

    I want to perform health checks to sure that all the integrations feeding into resilient is up and working ( more or less try to automate this process ).

    So in the event, resilient isn't working or it is not collecting feeds I can immediately know to try to sort out the issue.

    This might be a stupid question so please forgive me.

    Is it possible for me to programmably list all the integrations that are running on resilient? And how would I be able to run a test on all the integrations to ensure that they are all up and running?

    Thank You So Much



    ------------------------------
    Simeon Jaganyi
    ------------------------------


  • 2.  RE: How To Check All My Integrations And If They Are Running

    IBM Champion
    Posted Thu October 24, 2019 03:38 PM
    This is a posted idea here: https://2e4ccba981d63ef83a875dad7396c9a0.ideas.aha.io/ideas/R-I-356

    I agree, it would be nice if Resilient supported health metrics that monitored integration connections in some capacity.

    Here are two ideas on how you could accomplish this today:

    1. Via a custom workflow that run a series of functions (maybe one per integration) and reported failures in some capacity. This would require a lot of workflow logic, and would need to be run manually.
    2. Via a Cron/System job on your integrations server that runs a custom Python script that you make to do basic check-ins with all your integrations. Should one fail, it could create an incident in Resilient via the Resilient REST API (and pause checking that integration for 24 hours via a lock file or something similar). This would be the simplest and most reliable solution, but is not Resilient-sourced.

    Hope these ideas are helpful.

    ------------------------------
    Jared Fagel
    Cyber Security Analyst Intern
    Public Utility
    ------------------------------