Prerequisites

The following sections describe the system and network requirements. Specific apps may have additional requirements, as described in the app’s documentation.

Minimum system requirements for installing the Integration server

Ensure that the system that hosts the integration server meets the minimum requirements that are listed here.

Depending on which apps are installed, the integration server might require more resources. For example, some apps that operate on files in memory might require extra memory. Apps that run decryption tasks might need more CPU. Therefore, you might need to increase those resources.

Table 1. Minimum system requirements for the Integration server
Requirement	Details
Operating system	You must have one of the following operating systems. Red Hat® Enterprise Linux® 7.4 to 7.9, 8.6 to 8.10, or 9.1 to 9.4. Centos Linux 7.4 or later. Windows Enterprise Server 2016 or later. If you use a Windows server, you also need to install the `pywin32` library, which you can download from the Python for Windows (pywin32) Extensions GitHub repository. Do not use the `pypi/pip` version of `pywin32`. Installing the wrong version of the `pywin32` library might result in a Resilient® service that installs successfully but is unable to start.
Python (Required for Python-based apps)	The following Python versions are supported: Python 3.6.x, where `x` is 9 or later. Python 3.9.x, where `x` is 14 or later. Python 3.11.x, where `x` is 5 or later (`resilient-circuits`>=V51.0.1.0 or later). Note: Python 3.12 is not supported. On a Linux system, you can verify the Python version by using the following command: `python --version`. The Python installation must include the `pip` package manager. If you are using a key ring backend, the backend might require a later version of Python.
Operating system account	The SOAR Platform requires a dedicated operating system account for running apps. The Resilient Circuits components run as an unprivileged user, typically named `integration`.
Storage	5 GB (minimum)
Memory (RAM)	8 GB (minimum)
Text editor	A text editor, such as Nano, is required to edit the configuration file.

SOAR platform

The following lists the prerequisites for the SOAR Platform:

Version 31 or later. Some apps may require a later version.
Dedicated user account to use as the API user specifically for the integration server. The system administrator provides the account, its credentials and set of permissions. The administrator provides one of the following accounts.
- User account with user name (in the form of an email address) and password. With most apps, the account must have the permission to view and edit incidents, and view and modify administrator and customization settings. If the SOAR organization has Two Factor Authentication enabled, the account is configured as excluded.
- API key account with ID and secret, only if using V35.2 or later of the SOAR Platform and Resilient Circuits. This is a more secure account. With most apps, the account must have the permission to view and edit incidents, and view and modify administrator and customization settings. If using the SOAR MSSP add-on deployment, the SOAR Platform must be V38 or later.
IMPORTANT: If using multiple instances of the integration server, each server must be assigned its own unique account.

For more information about accounts, refer to the System Administrator Guide.

IBM Security® recommends that you use a SOAR Platform in a test environment to create the function, message destination, rules, workflows and other components needed for your app. This can be a separate SOAR Platform or a SOAR organization within your platform dedicated for testing. Once tested, you can deploy the app into any SOAR Platform that is at the same or later version as your test platform.

Network configuration

If the SOAR Platform is beyond a firewall, such as in a cloud configuration, configure the firewall to allow the integration server access to the following ports. All connections are “inbound-only” from the integration server to the SOAR Platform.

443. Required for the app to connect to SOAR data using the REST API.
65000. Only if supporting Java™-based apps. The integration server communicates with port 65000 of the platform using ActiveMQ OpenWire.
65001. Only if supporting Python-based apps. All SOAR functions are Python-based. The integration server communicates with port 65001 of the platform using the STOMP messaging protocol.
9000 (default). Only if supporting custom threat feeds, which is not applicable for a SOAR Platform in a cloud configuration. The platform must be in your environment. The SOAR Platform communicates with the integration server over HTTPS on a port that you choose (by default on port 9000).

If the integration server has access to the Internet, make sure the server can access the pypi.org, python.pypi.org and files.pythonhosted.org web sites.