Managing SOAR services

The resilient.service and resilient-email.service depend on the resilient-messaging.service and cannot function unless it is up and running. Elastic search and Java™ and Python based apps are also dependent on the resilient-messaging.service.

The resilient-messaging.service is a separate service that is used by email and other SOAR components. The resilient-messaging.service is supported only if you have SSL enabled.

To use the resutil tool, the resilient-messaging.service must be up and running.

If you change the co3.properties file, you must restart the resilient-messaging.service for the changes to take effect. Restarting the resilient-messaging.service also restarts resilient.service and resilient-email.service.

You can start and stop some services independently. However, resilient.service and resilient-email.service depend on the resilient-messaging.service, as described in the following list.
  • If you stop resilient-messaging.service, the resilient.service and resilient-email.service services are also stopped.
  • If you restart the resilient-messaging.service, the resilient.service and resilient-email.service services are also restarted.
  • If all three services are inactive and if you start or restart resilient.service, resilient-messaging.service and resilient-email.service are also started or restarted. If all three services are active and if you start or restart resilient.service, only the resilient.service is started or restarted.

Use the systemctl command to manage services.

To check the status of a service, use the following command.
sudo systemctl status <servicename>
To stop a service, use the following command.
sudo systemctl stop <servicename>
To start a service, use the following command.
sudo systemctl start <servicename>
To restart a service, use the following command.
sudo systemctl restart <servicename>