FortiSOAR Knowledge Base
FortiSOAR: Security Orchestration and Response software provides innovative case management, automation, and orchestration. It pulls together all of an organization's tools, helps unify operations, and reduce alert fatigue, context switching, and the mean time to respond to incidents.
Andy_G
Staff
Staff
Article Id 191448
Description

Issue:

Unable to execute playbooks using the MS WinRM connector.


Root cause:

This issue can occur because the MS WinRM connector fails to communicate with the Windows system when the connector is called for execution from a playbook. If this is the issue then CyOPs™ will display a 500 Internal Server Error.


Solution

Fix:

To fix this issue, perform the following steps on your Windows endpoint:

  1. Run the following command to set the default WinRM configuration values:
    winrm quickconfig
  2. (Optional) Run the following command to check whether a listener is running and verify the default listener ports (5985 for HTTP, and 5986 for HTTPS):
    winrm e winrm/config/listener
  3. Next, you require to enable basic authentication. Prior to that, run the following command to check if basic authentication is allowed :
    winrm get winrm/config/service
    If basic authentication is not allowed, run the following command to enable basic authentication:
    winrm set winrm/config/service/auth @{Basic="true"}
  4. Run the following command to allow transfer of unencrypted data on the WinRM service:
    winrm set winrm/config/service @{AllowUnencrypted="true"}


Applicable version:

Any CyOPs™ version.


Contributors