ReflexSOAR using an existing Elasticsearch cluster as the storage backend

[ar3diu]

Are there any aspects that would complicate the setup if I used an existing Elasticsearch cluster as the backend storage? 🤔

[SMAPPER]

No. It should work fine. Just keep in mind the quickstart install script didn't have that option currently. I need to update the script as well as the manual install options.

[ar3diu]

Ok, thanks for the reply Justin!

[ar3diu]

I keep trying the setup with an existing elastic cluster but I can't get rid of this error.

reflex-api      | /root/.local/share/virtualenvs/-x-v5uFv0/lib/python3.8/site-packages/apscheduler/util.py:95: PytzUsageWarning: The zone attribute is specific to pytz's interface; please migrate to a new time zone provider. For more details on how to do so, see https://pytz-deprecation-shim.readthedocs.io/en/latest/migration.html
reflex-api      |   if obj.zone == 'local':
reflex-api      | /root/.local/share/virtualenvs/-x-v5uFv0/lib/python3.8/site-packages/apscheduler/triggers/interval.py:66: PytzUsageWarning: The normalize method is no longer necessary, as this time zone supports the fold attribute (PEP 495). For more details on migrating to a PEP 495-compliant implementation, see https://pytz-deprecation-shim.readthedocs.io/en/latest/migration.html

Other details:

• Elastic 8.2
• ReflexSOAR installed on Ubuntu Server 22.04
• I tried with both REFLEX_ES_DISTRO=opensearch and REFLEX_ES_DISTRO=elasticsearch

[n3tsurge]

This error is expected and shouldn't impact your ability to use the platform. I can confirm it should work with 8.2.2 as I spun it up in my lab last night. At bare minimum you need these in your environment config

REFLEX_ES_DISTRO="elasticsearch"
REFLEX_ES_USERNAME="username"
REFLEX_ES_PASSWORD="password"

[ar3diu]

You're right. But for some reason I did not manage to establish the connection by using the elasticsearch load balancer hostname. It works when I'm using one of the elasticsearch node hostnames in the REFLEX_ES_URL.

Thanks for your reply!

[ar3diu]

I might be missing something here. So I tried a manual install using the Getting Started instructions from here.
But I keep getting stuck on step 8: /root/.local/share/virtualenvs/-x-v5uFv0/bin/python: can't open file 'setup.py': [Errno 2] No such file or directory
The UI is loading but can't log in into it. I guess it's because credentials were not set yet.
Could you please give me a hint on how I could move forward with the install?

[n3tsurge]

Those instructions are out-of-date. If you are running this in docker for the first time Reflex will automatically create all the indices and first organization and user for you, the default username is admin@reflexsoar.com password reflex. If you see 30+ indices starting with reflex- in your Elastic cluster setup was complete. This guide is more accurate http://docs.reflexsoar.com/en/latest/getting-started/

If you aren't using docker we need to provide a more in-depth getting started guide

[ar3diu]

Somehow I thought there were two separate installation methods. I have now managed to get it to work with an existing elastic cluster. Thanks for the quick reply!

[n3tsurge]

Great to hear! Sorry for the confusion, we have some documentation staged that we will push to the actual repo to make this a little clearer.