IBM Security QRadar SOAR

 View Only

  • 1.  How to add keyring component within custom code

    Posted Wed March 06, 2019 03:06 AM
    Can someone help me here with the keyring component.

    I have a custom script which i am executing using the Resilient Circuits and Message Destination. Within this code currently we are passing the username and password (hard coded), but now we want to use the keyring component to have the username and password being passed from app.config file. Within the code this is the segment we are passing the credentials.

    payload = {'username': 'username', 'secretkey': 'password'}

    Can you please help with additional modifications that are needed for the script to be made in order to have the credentials fetched via keyring here.

    #Keyring #resilient-circuits​​

    ------------------------------
    Thanks and Regards
    David Joshua Edithi
    ------------------------------


  • 2.  RE: How to add keyring component within custom code

    Posted Wed March 06, 2019 07:06 AM
    Hi David,

    Credentials used in within a function on your Integrations Sever (Resilient Circuits) are generally stored in the Integrations Server local Key Store and are then referenced in Resilient Circuits' app.config file

    See section 4 in our Function Developers Guide to configuring Resilient Circuits and specifically section 4.3 and 4.4 on using the Key Store: https://github.com/ibmresilient/resilient-reference/blob/master/developer_guides/Resilient%20IRP%20Function%20Developer%20Guide.pdf

    ------------------------------
    Shane Curtin
    Integrations Engineer - IBM Resilient
    ------------------------------

    Original Message


  • 3.  RE: How to add keyring component within custom code

    Posted Wed March 06, 2019 10:38 PM
    Hi @Shane Curtin,

    Thanks for your response.

    I have refereed ​the document, this talks about how to setup Key Ring. Which is already done in our environment. However, my question is after setting up the credentials into Keyring component, how do i make sure that my script uses those values that it is getting from the app.config file.

    Currently as mentioned my code line that needs the credentials input is as follows:
    payload = {'username': 'username', 'secretkey': 'p@******'}

    My app.config file has the below details:
    [message_destination_1]
    username=user
    secretkey=^secretkey

    In order for the code to fetch the credentials from my app.config i have modified the code as below, but it is unable to fetch the details from app.config.

    payload = {'username': ["username"], 'secretkey': ["secretkey"]}

    I need to understand the syntax or modifications that have be made to the code so that the credentials are refereed from app.config file and not hard coded.

    ------------------------------
    Thanks and Regards
    David Joshua Edithi
    ------------------------------

    Original Message


  • 4.  RE: How to add keyring component within custom code

    Posted Fri March 08, 2019 05:48 AM
    Hi David,

    OK, to access app.config variables inside your FunctionComponent code, see the following example:

    We setup a Message Destination fn_sum and created a Function  my_calculator which uses the fn_sum Message Destination.

    Then we added a section in the app.config file: [fn_sum], with two variables:

    [fn_sum]
password=^my_test_password
multiply_factor=100​

    Inside the Components Directory we generated the FunctionComponent code using the codegen command:
    resilient-circuits codegen -f my_calculator​

    Which produced:
    # -*- coding: utf-8 -*-
# pragma pylint: disable=unused-argument, no-self-use
"""Function implementation"""

import logging
from resilient_circuits import ResilientComponent, function, StatusMessage, FunctionResult, FunctionError


class FunctionComponent(ResilientComponent):
    """Component that implements Resilient function(s)"""

    @function("my_calculator")
    def _my_calculator_function(self, event, *args, **kwargs):
        """Function: Example function adding two numbers"""
        try:
            # Get the function parameters:
            num_a = kwargs.get("num_a")  # number
            num_b = kwargs.get("num_b")  # number

            log = logging.getLogger(__name__)
            log.info("num_a: %s", num_a)
            log.info("num_b: %s", num_b)

            # PUT YOUR FUNCTION IMPLEMENTATION CODE HERE
            #  yield StatusMessage("starting...")
            #  yield StatusMessage("done...")

            results = {
                "value": "xyz"
            }

            # Produce a FunctionResult with the results
            yield FunctionResult(results)
        except Exception:
            yield FunctionError()
​
    Then to use the variables from the app.config file, we adjust the code like below:
    # -*- coding: utf-8 -*-
# pragma pylint: disable=unused-argument, no-self-use
"""Function implementation"""

from resilient_circuits import ResilientComponent, function, StatusMessage, FunctionResult, FunctionError


class FunctionComponent(ResilientComponent):
    """Component that implements Resilient function(s)"""

    @function("my_calculator")
    def _my_calculator_function(self, event, *args, **kwargs):
        """Function: Example function adding two numbers"""
        try:

            # Get app.config vars
            app_configs = self.opts.get("fn_sum")
            multiply_factor = int(app_configs.get("multiply_factor"))
            password = app_configs.get("password")

            # Get the function parameters:
            num_a = kwargs.get("num_a")  # number
            num_b = kwargs.get("num_b")  # number

            # Calculate and return results
            results = {
                "sum": (num_a + num_b) * multiply_factor
            }

            # Produce a FunctionResult with the results
            yield FunctionResult(results)
        except Exception:
            yield FunctionError()
​

    Hopefully this demonstrates getting the app.config variables in your Function Code!

    ------------------------------
    Shane Curtin
    Integrations Engineer - IBM Resilient
    ------------------------------

    Original Message


  • 5.  RE: How to add keyring component within custom code

    Posted Sun March 10, 2019 04:22 AM
    Hi @Shane Curtin,

    Thanks a lot for the detailed explanation.

    I tried to replicate the same as recommended, however i am getting few errors. Kindly suggest what i am missing here.

    Modified app.config file as below:

    ​[test]
    queue=test
    user=useraccount
    secret=^key

    Modified the python code as below:

      @handler("ldap_lookup")
      def _ldap_lookup(self, event, *args, **kwargs):
         app_configs = self.opts.get("test")
         user_name = app_configs.get("user")
         password = app_configs.get("secret")

    When i run the codegen command i am getting the error.

    without sudo:

    [user@server integrations_intro]$ resilient-circuits codegen -f ldap_lookup
    Starting new HTTPS connection (1): resilient.localdomain
    /usr/lib/python2.7/site-packages/requests/packages/urllib3/connection.py:251: SecurityWarning: Certificate has no `subjectAltName`, falling back to check for a `commonName` for now. This feature is being removed by major browsers and deprecated by RFC 2818. (See https://github.com/shazow/urllib3/issues/497 for details.)
    SecurityWarning
    codegen is based on the organization export from 2019-02-27 08:48:51.415000.
    ERROR: Function 'ldap_lookup' not found in this export.

    with sudo:

    [user@server integrations_intro]$ sudo resilient-circuits codegen -f ldap_lookup
    Starting new HTTPS connection (1): resilient.localdomain
    Traceback (most recent call last):
    File "/bin/resilient-circuits", line 10, in <module>
    sys.exit(main())
    File "/usr/lib/python2.7/site-packages/resilient_circuits/bin/resilient_circuits_cmd.py", line 628, in main
    generate_code(args)
    File "/usr/lib/python2.7/site-packages/resilient_circuits/bin/resilient_circuits_cmd.py", line 286, in generate_code
    client = resilient.get_client(opts)
    File "/usr/lib/python2.7/site-packages/resilient/co3.py", line 117, in get_client
    userinfo = resilient_client.connect(opts["email"], opts["password"])
    File "/usr/lib/python2.7/site-packages/resilient/co3.py", line 194, in connect
    ret = super(SimpleClient, self).connect(email, password, timeout)
    File "/usr/lib/python2.7/site-packages/resilient/co3base.py", line 152, in connect
    return self._connect(timeout=timeout)
    File "/usr/lib/python2.7/site-packages/resilient/co3base.py", line 161, in _connect
    timeout=timeout)
    File "/usr/lib/python2.7/site-packages/requests/sessions.py", line 507, in post
    return self.request('POST', url, data=data, json=json, **kwargs)
    File "/usr/lib/python2.7/site-packages/requests/sessions.py", line 464, in request
    resp = self.send(prep, **send_kwargs)
    File "/usr/lib/python2.7/site-packages/requests/sessions.py", line 576, in send
    r = adapter.send(request, **kwargs)
    File "/usr/lib/python2.7/site-packages/requests/adapters.py", line 431, in send
    raise SSLError(e, request=request)
    requests.exceptions.SSLError: [Errno 2] No such file or directory

    ------------------------------
    Thanks and Regards
    David Joshua Edithi
    ------------------------------

    Original Message


  • 6.  RE: How to add keyring component within custom code

    Posted Mon March 11, 2019 06:15 AM
    Hi David,

    Running codegen with sudo, is correct

    However you did miss a step. When you make any changes to your Functions, Workflows or Message Destinations in the Resilient UI, you need to generate an "Export" in order for resilient-circuits codegen to know what the latest changes to those components were.

    In your case codegen does not know about the function "ldap_lookup".

    To generate the export:
    • Administrator Settings > Organization > Export > Export
    • And Save the file (the save location of the file does not matter)
    • Then run codegen again (without sudo)

    thumbnail image


    ------------------------------
    Shane Curtin
    Integrations Engineer - IBM Resilient
    ------------------------------

    Original Message