IBM Security QRadar SOAR

 View Only
  • 1.  netMiko for SOAR - STOMP errors

    Posted Thu June 16, 2022 05:59 AM
    Hi!

    After months of successful use, I am recently getting "STOMP" errors with netMiko, none of the other Apps on the AppHost seem to be affected, nor does uninstalling and reinstalling the netMiko module help.

    Has anyone encountered this before?

    ------------------------ Running selftest with IBM SOAR ------------------------ 
    - Getting app.configs 
    ------------------------ Testing REST connection to SOAR ------------------------ 
    - Checking if we can authenticate a REST connection with 'resilient-api-key-id' to 'soar.host.domain.tld' 
    ------------------------ Successfully connected via REST! ------------------------ 
    ------------------------ Testing STOMP connection to SOAR ------------------------ 
    - Checking if we can authenticate a STOMP connection with 'resilient-api-key-id' to 'soar.host.domain.tld' 
    ------------------------ Instantiating instance of resilient-circuits and starting it... ------------------------ 
    2022-06-08 15:47:51,122 INFO [app] Configuration file: /etc/rescircuits/app.config 
    2022-06-08 15:47:51,124 INFO [app] Resilient server: soar.host.domain.tld
    2022-06-08 15:47:51,124 INFO [app] Resilient api key id: resilient-api-key-id
    2022-06-08 15:47:51,126 INFO [app] Resilient org: OrgName
    2022-06-08 15:47:51,126 INFO [app] Logging Level: INFO 
    2022-06-08 15:47:53,851 INFO [app] Components auto-load directory: (none) /opt/app-root/lib/python3.6/site-packages/paramiko/transport.py:33: CryptographyDeprecationWarning: Python 3.6 is no longer supported by the Python core team. Therefore, support for it is deprecated in cryptography and will be removed in a future release. from cryptography.hazmat.backends import default_backend /opt/app-root/lib/python3.6/site-packages/paramiko/transport.py:236: CryptographyDeprecationWarning: Blowfish has been deprecated "class": algorithms.Blowfish, 
    2022-06-08 15:47:54,638 ERROR [component_loader] Failed to load 'NetworkDeviceFunctionComponent = fn_netdevice.components.network_device:FunctionComponent' from 'fn-netdevice 1.1.0' ERROR: could not connect to SOAR at 'host.domain.tld'. Reason: Unknown STOMP Error: No module named 'importlib.resources' Error Code: 30 
    ​


    ------------------------------
    Pumynt Chooboonraj
    Solution Architect
    Sphere Grouppe Pty Ltd
    Melbourne VIC
    ------------------------------


  • 2.  RE: netMiko for SOAR - STOMP errors

    Posted Thu June 23, 2022 10:33 PM
    Updating the AppHost to 1.9 seems to have fixed the issue.

    ------------------------------
    Pumynt Chooboonraj
    Solution Architect
    Sphere Grouppe Pty Ltd
    Melbourne VIC
    ------------------------------



  • 3.  RE: netMiko for SOAR - STOMP errors

    Posted Fri June 24, 2022 09:02 AM
    Hi Pumynt,

    Glad to hear you're back up and running. I believe the issue you had was related to our containers previously running Python 3.6, which is at its end of life. We have been going through and rebuilding these containers. So, when an container is restarted, the new image is loaded which is now running Python 3.9. All IBM developed app should be refreshed through Q3 2022.

    Regards,
    Mark

    ------------------------------
    Mark Scherfling
    ------------------------------