IBM Security QRadar SOAR

 View Only
  • 1.  I need to write a file to the local disk of the Apphost

    Posted Wed August 03, 2022 09:09 AM

    Hi,
    To create an external dynamic list,  I need to write to a text file on the filesystem of the Apphost. Is there any way to achieve this?
    Writing to the container won't do it, I need to access the disk of the RH OS.

    Thanks!



    ------------------------------
    LUCIANO ZEPPA
    ------------------------------


  • 2.  RE: I need to write a file to the local disk of the Apphost

    Posted Thu August 04, 2022 08:01 AM
    Hi Luciano,

    I don't believe this is possible. There are discussions on how to support persistent storage for apps, but this currently not available.

    Regards,
    Mark

    ------------------------------
    Mark Scherfling
    ------------------------------



  • 3.  RE: I need to write a file to the local disk of the Apphost

    Posted Fri August 05, 2022 02:02 AM
    Hi Luciano,

    You may use volume mapping between container and RHEL os.

    For example, i add basic lines in my function code in order to write something to test.txt file. Then i found the file in RHEL OS with a simple linux command.

    with open('/tmp/test.txt',"w") as file:
        file.write("lorem ipsum dolor")​

    To find that file in linux;

    bash-4.2$ find /var/lib/rancher/k3s/agent/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots -name "test.txt"

    Result;

    /var/lib/rancher/k3s/agent/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/570/fs/tmp/test.txt


    Then, you can use the file.

    If you have to work with specific path of RHEL OS. You can try to use watchdog to listening activities and take actions.

    For example,

    If you have to create a new file in specific path. You can write a watchdog script which monitor file creation and move file to another directory.

    If you have to write lines to existing file in local path. You can write a watchdog script which monitor file modification and move lines to existing file.



    ------------------------------
    Burak Karaduman
    ------------------------------



  • 4.  RE: I need to write a file to the local disk of the Apphost

    Posted Fri August 05, 2022 02:09 AM

    Thank you for your suggestions. I made it work using the 'command shell' function from the utility functions.
    In app.config I define the IP of the apphost as a remote_computer, and then I run a command shell with the 'echo' command. 



    ------------------------------
    LUCIANO ZEPPA
    ------------------------------