SIEM Agent - ImportError: No module named requests.exceptions

Products

• CASB Security Standard
• CASB Security Advanced
• CASB Security Premium
• CASB Securlet SAAS
• CASB Advanced Threat Protection
• CASB Audit
• CASB Gateway
• CASB Gateway Advanced

Issue/Introduction

Client attempting to set up a SIEM Agent for CloudSOC on an Ubuntu Server version 22.04.3 LTS

Running with Python3 Client is getting "ImportError: No module named requests.exceptions"

CASB Support ensured pre-requisites were met and Client was following the SIEM API Tech Doc 

https://techdocs.broadcom.com/us/en/symantec-security-software/information-security/symantec-cloudsoc/cloud/siem-logs-home/installation/run-installsh.html

CSAB Support also getting same error in Lab as client did in their environment after running 'sudo sh install.sh'

<ServerName>@<UUsername>:~/SIEM$ python3 qradar_agent.py --severity all --elastica_app investigate -o FILE -f LogName09292023 --app Elastica --start_date 2023-09-20
Traceback (most recent call last):
  File "/home/<Servername>/SIEM/qradar_agent.py", line 18, in <module>
    from requests.exceptions import ConnectionError
  File "/usr/local/lib/python3.10/dist-packages/requests/__init__.py", line 63, in <module>
    from . import utils
  File "/usr/local/lib/python3.10/dist-packages/requests/utils.py", line 27, in <module>
    from .cookies import RequestsCookieJar, cookiejar_from_dict
  File "/usr/local/lib/python3.10/dist-packages/requests/cookies.py", line 172, in <module>
    class RequestsCookieJar(cookielib.CookieJar, collections.MutableMapping):
AttributeError: module 'collections' has no attribute 'MutableMapping'

 

 

Resolution

Analyzed logs further discovered that "requirements.txt" file that came zipped with the SIEM Agent had old 'requests' library version 2.11.1 inside it

requirements.txt file contents as received in SIEM Agent zipped file:

Before the Change:

Edited "requirements.txt" file to contain latest requests version 2.31.0

Re-ran SIEM agent install command sudo sh install.sh

SIEM Agent installed successfully on the Lab Ubuntu Server and when Agent was run it successfully pulled data from Lab CloudSOC tenant