Original Message:
Sent: Wed February 14, 2024 06:06 AM
From: John Quirke
Subject: integration between IBM Soar (v49) and CrowdStrike Falcon
Hi Hazzaa
Apologies for not getting back yesterday
This is the command I use to attach to a running container, you need both the namespace and deployment name.
(from 'sudo kubectl get --all-namespaces po -L App-name |grep <name of app>' )
sudo kubectl exec -it --namespace <namespace> deployments/<deployment_name> -- /bin/bash
Regards
John
Original Message:
Sent: 2/13/2024 3:37:00 AM
From: Hazzaa Alotaibi
Subject: RE: integration between IBM Soar (v49) and CrowdStrike Falcon
Hi John,
i used this command to get shell access but i cannot
#sudo kubectl exec -it 17453da7-072b-4703-8e47-0c0213b51bc8-cbc6c7856-tv52n -- bash
Error from server (NotFound): pods "17453da7-072b-4703-8e47-0c0213b51bc8-cbc6c7856-tv52n" not found
how i get shell access to crowdstrike app container ?
------------------------------
Hazzaa Alotaibi
Original Message:
Sent: Tue January 30, 2024 10:24 AM
From: John Quirke
Subject: integration between IBM Soar (v49) and CrowdStrike Falcon
Hi Hazzaa
Will reach out to the developer but am somewhat unclear with your question?
Could you elaborate please ?
Thanks John
------------------------------
John Quirke
Original Message:
Sent: Mon January 29, 2024 06:54 AM
From: Hazzaa Alotaibi
Subject: integration between IBM Soar (v49) and CrowdStrike Falcon
i have integration issue of integration between IBM Soar (v49) and CrowdStrike Falcon
The location: /var/crowdstrike is not writable for the current user. Please change dynamic_data_store in app.config to a writable directory
even this file is writable by all
and in thier documentation they put
Location to save the status of polling (Detection offset).
# The location should exist and should be writable for the current user,
otherwise the extension will use the default_detection_offset and show a
warning.
# User can change the location to the directory where the current user has
writable access. Note that this is not supported with an App Host.
dynamic_data_store=/var/rescircuits
any support
------------------------------
Hazzaa Alotaibi
------------------------------