IBM Security QRadar SOAR

# -*- coding: utf-8 -*-
# pragma pylint: disable=unused-argument, no-self-use
"""Function implementation"""

import logging
from resilient_circuits import ResilientComponent, function, handler, StatusMessage, FunctionResult, FunctionError
import dt_poc.util.selftest as selftest


class FunctionComponent(ResilientComponent):
    """Component that implements Resilient function 'fn_record_domaintools_domain_risk_score"""

    def __init__(self, opts):
        """constructor provides access to the configuration options"""
        super(FunctionComponent, self).__init__(opts)
        self.options = opts.get("dt_poc", {})
        selftest.selftest_function(opts)

    @handler("reload")
    def _reload(self, event, opts):
        """Configuration options have changed, save new values"""
        self.options = opts.get("dt_poc", {})

    @function("fn_record_domaintools_domain_risk_score")
    def _fn_record_domaintools_domain_risk_score_function(self, event, *args, **kwargs):
        """Function: """
        try:
            # Get the function parameters:
            domaintools_domain_name = kwargs.get("domaintools_domain_name")  # text

            log = logging.getLogger(__name__)
            log.info("domaintools_domain_name: %s", domaintools_domain_name)

            # PUT YOUR FUNCTION IMPLEMENTATION CODE HERE
            #  yield StatusMessage("starting...")
            #  yield StatusMessage("done...")

            results = {
                "value": "xyz"
            }

            # Produce a FunctionResult with the results
            yield FunctionResult(results)
        except Exception:
            yield FunctionError()

Hi Anthony,

You're in the right place. I ran your code below and was able to get it to run correctly using Resilient v31 and resilient-circuits v32. One common problem folks have is when creating a rule to only reference a workflow and not a destination as well. But even when I tried that I couldn't reproduce your error.

What platform are you running resilient-circuits on?

# -*- coding: utf-8 -*-
# pragma pylint: disable=unused-argument, no-self-use
"""Function implementation"""

import logging
from resilient_circuits import ResilientComponent, function, handler, StatusMessage, FunctionResult, FunctionError
import dt_poc.util.selftest as selftest


class FunctionComponent(ResilientComponent):
    """Component that implements Resilient function 'fn_record_domaintools_domain_risk_score"""

    def __init__(self, opts):
        """constructor provides access to the configuration options"""
        super(FunctionComponent, self).__init__(opts)
        self.options = opts.get("dt_poc", {})
        selftest.selftest_function(opts)

    @handler("reload")
    def _reload(self, event, opts):
        """Configuration options have changed, save new values"""
        self.options = opts.get("dt_poc", {})

    @function("fn_record_domaintools_domain_risk_score")
    def _fn_record_domaintools_domain_risk_score_function(self, event, *args, **kwargs):
        """Function: """
        try:
            # Get the function parameters:
            domaintools_domain_name = kwargs.get("domaintools_domain_name")  # text

            log = logging.getLogger(__name__)
            log.info("domaintools_domain_name: %s", domaintools_domain_name)

            # PUT YOUR FUNCTION IMPLEMENTATION CODE HERE
            #  yield StatusMessage("starting...")
            #  yield StatusMessage("done...")

            results = {
                "value": "xyz"
            }

            # Produce a FunctionResult with the results
            yield FunctionResult(results)
        except Exception:
            yield FunctionError()

Hi Anthony,

You're in the right place. I ran your code below and was able to get it to run correctly using Resilient v31 and resilient-circuits v32. One common problem folks have is when creating a rule to only reference a workflow and not a destination as well. But even when I tried that I couldn't reproduce your error.

What platform are you running resilient-circuits on?

# -*- coding: utf-8 -*-
# pragma pylint: disable=unused-argument, no-self-use
"""Function implementation"""

import logging
from resilient_circuits import ResilientComponent, function, handler, StatusMessage, FunctionResult, FunctionError
import dt_poc.util.selftest as selftest


class FunctionComponent(ResilientComponent):
    """Component that implements Resilient function 'fn_record_domaintools_domain_risk_score"""

    def __init__(self, opts):
        """constructor provides access to the configuration options"""
        super(FunctionComponent, self).__init__(opts)
        self.options = opts.get("dt_poc", {})
        selftest.selftest_function(opts)

    @handler("reload")
    def _reload(self, event, opts):
        """Configuration options have changed, save new values"""
        self.options = opts.get("dt_poc", {})

    @function("fn_record_domaintools_domain_risk_score")
    def _fn_record_domaintools_domain_risk_score_function(self, event, *args, **kwargs):
        """Function: """
        try:
            # Get the function parameters:
            domaintools_domain_name = kwargs.get("domaintools_domain_name")  # text

            log = logging.getLogger(__name__)
            log.info("domaintools_domain_name: %s", domaintools_domain_name)

            # PUT YOUR FUNCTION IMPLEMENTATION CODE HERE
            #  yield StatusMessage("starting...")
            #  yield StatusMessage("done...")

            results = {
                "value": "xyz"
            }

            # Produce a FunctionResult with the results
            yield FunctionResult(results)
        except Exception:
            yield FunctionError()

Hi Anthony,

You're in the right place. I ran your code below and was able to get it to run correctly using Resilient v31 and resilient-circuits v32. One common problem folks have is when creating a rule to only reference a workflow and not a destination as well. But even when I tried that I couldn't reproduce your error.

What platform are you running resilient-circuits on?