IBM QRadar SOAR

IBM QRadar SOAR

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  fn_microsoft_defender gives error 'FunctionComponent' object has no attribute 'options'

    Posted Wed March 09, 2022 09:31 AM
    I am getting error 'FunctionComponent' object has no attribute 'options' . It happens when closing resilient incident which triggers Microsoft defender incident update ('defender_update_incident'), see below

    Mar 09 08:24:25 chdtx1mn06.corpdev.com resilient-circuits[13163]: File "/home/resadmin/.local/lib/python3.6/site-packages/fn_microsoft_defender/components/funct_defender_update_incident.py", line 57, in _app_function
    Mar 09 08:24:25 chdtx1mn06.corpdev.com resilient-circuits[13163]: self.options.get("update_defender_alert_template"),
    Mar 09 08:24:25 chdtx1mn06.corpdev.com resilient-circuits[13163]: AttributeError: 'FunctionComponent' object has no attribute 'options'
    Mar 09 08:24:25 chdtx1mn06.corpdev.com resilient-circuits[13163]: 2022-03-09 08:24:25,014 ERROR [actions_component] <task[*] (<function app_function.__call__.<locals>.app_function_decorator.<locals>._invoke_app_function at 0x7f98782f3a60>, <defender_update_incident[functions.defender_update_incident] (id=276, workflow=defender_close_incident, user=irek.romaniuk@xxx.com) 2022-03-09 14:24:24.148000> defender_classification=None, defender_incident_id=723, defender_determination=None, defender_comment='<div class="rte"><div>tested</div></div>', defender_incident_status={'id': 3588, 'name': 'Resolved'})> (<class 'AttributeError'>): ERROR:
    Mar 09 08:24:25 chdtx1mn06.corpdev.com resilient-circuits[13163]: 'FunctionComponent' object has no attribute 'options'

    ------------------------------
    Irek Romaniuk
    ------------------------------


  • 2.  RE: fn_microsoft_defender gives error 'FunctionComponent' object has no attribute 'options'

    Posted Thu March 10, 2022 01:48 PM
    Hi Irek,

    Thanks for your post. I believe will have a fix for this in short order, version 1.0.1 posted to the App Exchange.

    Regards,
    Mark

    ------------------------------
    Mark Scherfling
    ------------------------------

    Original Message


  • 3.  RE: fn_microsoft_defender gives error 'FunctionComponent' object has no attribute 'options'

    Posted Fri March 11, 2022 08:24 AM
    Version 1.0.1 is now published on the AppExchange: https://exchange.xforce.ibmcloud.com/hub/extension/9eee77f6a8095af3474dcf00cdd3b97f

    I noticed another issue with the close incident template which I also corrected.

    Hope this helps.
    --Mark

    ------------------------------
    Mark Scherfling
    ------------------------------

    Original Message


  • 4.  RE: fn_microsoft_defender gives error 'FunctionComponent' object has no attribute 'options'

    Posted Fri March 11, 2022 11:10 AM
    Appreciate Mark, looks like it is fixed, thank you

    ------------------------------
    Irek Romaniuk
    ------------------------------

    Original Message


  • 5.  RE: fn_microsoft_defender gives error 'FunctionComponent' object has no attribute 'options'

    Posted Fri March 11, 2022 11:25 AM
    One more question if you don't mind, should funct_defender_update_incident.py use "update_defender_alert_template" not "update_defender_incident_template"

    cat .local/lib/python3.6/site-packages/fn_microsoft_defender/components/funct_defender_update_incident.py | grep alert_template
    self._app_configs_as_dict.get("update_defender_alert_template"),

    ------------------------------
    Irek Romaniuk
    ------------------------------

    Original Message


Related Content