Enable Communication Tasks

[r_buchwalder]

Hello all

I'm trying to activate the Communication Task.

The Idea is, that User may answer without to have a xsoar account.

So far, I found this Doc:

https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-0/cortex-xsoar-admin/engines/configure-engin...

I've entered both settings into troubleshooting.

the d1.conf file looks like:

{
"BindAddress":"8080"
}

the rights of the file looks like:

-rw-r--r-- 1 demisto demisto 26 Jun 29 10:08 d1.conf

I've restarted demisto - but do not see any port 8080 on "ss -tulpen"

What is wrong on my side? What did I overseen?

Thanks

roger

[atullo]

I understand that port 8080 isn't in the output of that command. Just to verify, after adding the server config and the d1 config, users are still unable to access forms sent out in communication tasks, correct? 

[r_buchwalder]

Atullo

As far as I untersood is, that I need first a running communication Task, before I may use it in any Playbook.

And I don't think, that this communication-Port is the same port as demisto for admin is running on it (https/443)

So I choose a different Port. 

And no, that port (8080) is not in the open ports list of "ss", looks like, demisto is not opening it.

thanks

roger

[atullo]

Please verify that there's a colon in front of the port number. Let me know if I should further explain any of the following commands

Display current conf

sudo grep BindAddress /usr/local/demisto/d1.conf

Replace line in conf

sudo sed -i 's/BindAddress.*/BindAddress": ":8080",/' /usr/local/demisto/d1.conf

Verify new conf

sudo grep BindAddress /usr/local/demisto/d1.conf

    
Restart XSOAR engine service

sudo systemctl restart d1

Verify listening port

ss -tulpen | grep 8080

[r_buchwalder]

Hello Atullo

Indeed, I did not hat the colon in the config - could you please take care, that this little info gets into the document in my thead opening?

How ever, I did all your steps, but system could not find d1.service, I tried first with demisto.service then with a reboot - still no port 8080

(btw, I like the -tulpen, use it since years 🙂 )

regards

roger

[atullo]

Roger,

  Are you able to restart demisto like you have in the past? How are you verifying that demisto is running? Could you share the commands you're using and their output (please redact anything sensitive)?

Thanks

[r_buchwalder]

Hello Atullo

I'll enter the following command:

sudo systemctl restart demisto | tail -f /var/log/demisto/server.log

After that I do see Logs from Demisto and wait until I see:

info Server up and running, good luck to us all

After that I do a:

systemctl status demisto

And check, If there is:

   Loaded: loaded (/etc/systemd/system/demisto.service; enabled; vendor preset: disabled)
   Active: active (running) since Thu 2021-08-26 17:01:05 CEST; 2min 41s ago

thanks

roger

PS: I just saw, that the one Demisto-Service is still in a shutdown prodecere, and is traped in a loop:

2021-08-26 17:11:53.3694 info Long running has stopped for instance [an_instance_1]
2021-08-26 17:11:53.3698 info Creating container manager for single run for docker image [demisto/pyt...]
2021-08-26 17:11:53.4215 info Stopping docker container demistoserver_py
2021-08-26 17:11:53.7984 error Container exit with error. container name: [demistoserver_py...] error: [exit status 137] (2619)
2021-08-26 17:11:54.3401 info Existing long running instance [an_instance_1]
2021-08-26 17:11:54.3403 info Long running execution has stopped for instance [an_instance_1]

I'm going to reboot the machine.

[r_buchwalder]

reboot was done, but still no port 8080:

:~$ sudo grep BindAddress /usr/local/demisto/d1.conf
"BindAddress": ":8080",
:~$ ss -tulpen | grep 8080
:~$

[atullo]

You'll need to restart the XSOAR engine service on your engine (not the demisto service on your app server; my apologies, I did not word my previous questions correctly).

For engines running a Debian based distro the command would be

sudo service d1 restart

More info for starting & restarting the XSOAR engine service can be found here: Install a Cortex XSOAR Engine.

[r_buchwalder]

Atullo

I do not have an d1 installation here. Since I'm not able to install d1-Service on Demisto machine.

"Failed - Cannot install engine along with Cortex XSOAR server"

Do I need an Engine to use those Communication Task?

If so, I need first to setup a new machine.

Thanks

roger

[atullo]

We may be confusing "accounts" with "access", where, in this context, "access" means "network connectivity". 

These users would still require an account which aligns with XSOAR's licensing model (licenses are purchased based on the number of users).

If this answers the question I'd appreciate if it were marked as an accepted answer.

From the guide: "You can use engines to enable users who do not have access to the Cortex XSOAR server ..."

Thanks,

Adrian