IBM QRadar SOAR

IBM QRadar SOAR

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only
  • 1.  Custom Threat service

    Posted Thu June 06, 2019 10:08 AM
    Hi,
    Can custom threat service can be implemented using resilient circuit running on integration server? Or it should be implemented only on resilient appliance server ? 
    I  am getting "resutil" not found error on integration server while registring

    ------------------------------
    Dastagirsab Mulla
    ------------------------------


  • 2.  RE: Custom Threat service

    Posted Thu June 06, 2019 08:42 PM
    Hi Dastagirsab,

    You can run the custom threat service which is based on "resilient-circuits" on your integration server. However to install the threat service, you need to run command below on Resilient server:
    sudo resutil threatserviceedit -name your_cts_name -resturl http://your-integration-server/cts/custom_threat_service

    You can refer a sample on github here.

    ------------------------------
    LILY WANG
    ------------------------------



  • 3.  RE: Custom Threat service

    Posted Fri June 07, 2019 01:42 AM
    Thanks for your reply, I did tried that  but as I said got  error "-bash: resutil: command not found" may be resutil module missing in my resilient circuit server?



    ------------------------------
    Dastagirsab Mulla
    ------------------------------



  • 4.  RE: Custom Threat service

    Posted Fri June 07, 2019 02:52 AM
    Hi Dastagirsab,

    Just to clarify the custom threat service is running on integration server. But the "sudo resutil threatservice edit" command should be run on Resilient appliance server.  Using "-resturl" argument in the command to add your integration server information which provide custom threat service.
    On Resilient appliance server, you should have "resutil" command which is under "/bin/resutil". Actually most of Resilient related commands are started with "sudo resutil".

    ------------------------------
    LILY WANG
    ------------------------------