IBM Security QRadar SOAR

 View Only

  • 1.  Errors when configuring integration with MISP(fn_misp)

    Posted Mon November 21, 2022 09:39 AM
    Good afternoon! I wanted to integrate SOAR with MISP through the fn_misp application, but after setting up, an error comes out when checking the configuration (I'll attach a screenshot). You can look at it and give recommendations, or tell me who to contact. Thanks!




    ------------------------------
    Almaz Nadirov
    ------------------------------


  • 2.  RE: Errors when configuring integration with MISP(fn_misp)

    Posted Tue November 22, 2022 08:43 AM
    Hi Almaz,

    The issue you're experiencing seems to be with the connection back to SOAR. If using a FQDN, perhaps try an IP address to see if that resolves the issue.

    Regards,
    Mark

    ------------------------------
    Mark Scherfling
    ------------------------------

    Original Message


  • 3.  RE: Errors when configuring integration with MISP(fn_misp)

    Posted Wed November 23, 2022 02:36 AM
    Hi Almaz,

    "Name or service is not known" means that it cannot resolve the hostname. Containers do not pick up host file entries so if the hostname you have chosen to use is not in your DNS then it will not resolve it from hosts file.

    In https://www.ibm.com/docs/en/sqsp/47?topic=installation-create-app-hosts is the following command which you can use to create a IP/hostname mapping from within App Host. You could use this to map the hostname to an IP address and try again.

    manageAppHost dns --set --ip <ip_address> --hostname <hostname1> --hostname <hostname2>


    ------------------------------
    BEN WILLIAMS
    ------------------------------

    Original Message