Upgrade EclecticIQ Intelligence Center Integration#
Download and upgrade EclecticIQ Intelligence Center Integration for IBM QRadar SOAR to a newer version.
To download a newer version of the the app from the IBM X-Force App Exchange marketplace, and to install it in the target IBM QRadar SOAR instance to upgrade the app:
Log in to the IBM QRadar SOAR instance with the resadmin user.
Check if the
resilient-circuits
integration module is running:# Check by process name. ps -A | grep resilient # Alternatively, check by user owning the process. ps -u resadmin # Example response where the process (with PID) is listed as running. PID TTY TIME CMD 1842 pts/0 00:00:02 resilient-circu 1946 ? 00:00:00 sshd 1947 pts/1 00:00:00 bash
If it is running, stop it by pressing CTRL + C in the active terminal session where the
resilient-circuits
integration module is running.Alternatively, run
kill
orpkill
to stop it:# Specify the PID of the process. kill -9 1842 # Specify the process name or part of the name. pkill resilient-circuits
Remove the current installation of EclecticIQ Intelligence Center Integration for IBM QRadar SOAR before upgrading to a newer version:
# 'x.x.x' is a placeholder representing the app release. # Example: 1.0.3 rm -rf rc-cts-eclecticiq-x.x.x
Download the latest version of EclecticIQ Intelligence Center Integration for IBM QRadar SOAR from IBM X-Force App Exchange.
Save the archive to the
/home/resadmin
directory, and then decompress it:# Go to the '/home/resadmin' directory. cd /home/resadmin # Untar the downloaded archive. # 'x.x.x' is a placeholder representing the app release. # Example: 1.1.2 tar -zxvf rc-cts-eclecticiq-x.x.x.tar.gz
In the
/home/resadmin
directory, runpip install
to upgrade the app:# Upgrade the app. # 'x.x.x' is a placeholder representing the app release. # Example: 1.1.2 sudo pip install -e rc-cts-eclecticiq-x.x.x
Open a terminal session, log in to IBM QRadar SOAR with SSH, and start the integration module:
# Run this command to start the integration. resilient-circuits run # Successful response. resilient-circuits has started successfully and is now running... Subscribe to message destination 'eclecticiq_sighting' Subscribe to message destination actions.201.eclecticiq_sighting
Note
After creating a message destination and after
starting the resilient-circuits
integration module, IBM QRadar SOAR may return Java error messages, and it
may fail to work correctly.
If this occurs, restart the IBM QRadar SOAR instance to solve the problem.