QRadar: Ariel query for getting related usernames in an offense

 AQL query:

SELECT username FROM events  WHERE INOFFENSE(ID) GROUP BY username

QRadar SOAR: How to increase partition size by using a new disk on RHEL with LVM

 Steps:

Steps to add a new hard disk to LVM on IBM Security SOAR appliance running Red Hat Linux with LVM support:

1. In vSphere client, add a new hard disk at Virtual Device Node SCSI (0: 1).

2. SSH to the server.

3. Get the host bus number:
sudo grep mpt /sys/class/scsi_host/host?/proc_name
The response is similar to
/sys/class/scsi_host/host2/proc_name:mptspi

4. Rescan for new disks on host bus 2:
echo "- - -" > sudo /sys/class/scsi_host/host2/scan

5. Make sure new disk /dev/sdb is added to the system:
sudo fdisk -l

6. Create a new partition on /dev/sdb with file system type 8e (Linux LVM):
sudo fdisk /dev/sdb

=======
Command (m for help): n
Select (default p): p
Partition number (1-4, default 1): 1
First sector (a-b, default a): [Enter to use the default value]
Last sector, +sectors or +size{K,M,G} (a-b, default b): [Enter to use the default value]
Command (m for help): t
Hex code (type L to list all codes): 8e
Command (m for help): p
Command (m for help): w
=======

7. Create a physical volume for LVM:
sudo pvcreate /dev/sdb1

8. Get the volume group name (VG Name):
sudo vgdisplay

9. Extend the 'resilient' volume group by adding in the physical volume of /dev/sdb1:
sudo vgextend resilient /dev/sdb1

10. Scan all disks for physical volumes:
sudo pvscan

11. Check the volume group name (VG Name) again to make sure free space is added:
sudo vgdisplay

12. Display the path of the logical volume (LV Path):
sudo lvdisplay

The following assumes that you want to split the new disk over the three logical volumes.

13. Extend the logical volume for multiple logical volumes:
sudo lvresize --resizefs --extents +80%FREE /dev/resilient/root
sudo lvresize --resizefs --extents +100%FREE /dev/resilient/co3

The previous commands allocate 80% of the extended space to "/dev/resilient/root" LVM, and then allocate the rest 20% to "/dev/resilient/co3" LVM.

14. Display the disk space usage to ensure new space is added:
sudo df -h

 

 

Reference:

 https://www.ibm.com/support/pages/node/1160644

Utility Functions for Resilient (fn_utilities-1.0.6.zip) installation problem

Resilient Functions simplify development of integrations by wrapping each external activity into an individual workflow component. These components can be easily installed, then used and combined in Resilient workflows. The Resilient platform sends data to the function component that performs an activity then returns the results to the workflow. The results can be acted upon by scripts, rules, and workflow decision points to dynamically orchestrate the security incident response activities.

The Utility Functions integration package contains several useful workflow functions for common automation and integration activities in Resilient. These include:

    Function to call generic REST/JSON web service APIs,
    Function to run arbitrary shell scripts (bash and PowerShell),
    Functions to fetch SSL certificates from a server and parse them,
    Functions to work with Excel, HTML, XML, JSON and EML files,
    Functions to work with Resilient attachments: calculate hashes, list and extract ZIP archives, convert to and from base64
    And more.



Problem:

[root@resilient ~]# pip install fn_utilities-1.0.6.zip
Processing ./fn_utilities-1.0.6.zip
    Complete output from command python setup.py egg_info:
    Traceback (most recent call last):
      File "<string>", line 1, in <module>
    IOError: [Errno 2] No such file or directory: '/tmp/pip-req-build-k_Apec/setup.py'
   
    ----------------------------------------
Command "python setup.py egg_info" failed with error code 1 in /tmp/pip-req-build-k_Apec/

Solution:

[root@resilient ~]# unzip fn_utilities-1.0.6.zip
Archive:  fn_utilities-1.0.6.zip
  inflating: fn_utilities-1.0.6.tar.gz 

[root@resilient ~]# pip install fn_utilities-1.0.6.tar.gz