Introduction
An integration server is the system that you use to deploy specific types of apps to the SOAR Platform.
Use this guide to learn about creating and maintaining an integration server, and how to deploy apps to it.
An app, formerly called extension or integration, is a collection of playbook components, code executables or both that represent an end-to-end function and is deployed to the SOAR Platform. Playbook components can include rules, workflows, Python scripts, custom fields, data tables and message destinations. An code executable can access and return external data, interact or integrate with other security systems, or be a utility that performs a specific action.
An app is available in two formats, one format supports the App Host Kubernetes-based container environments, the other supports the previously available extension format. The integration server is required only when deploying apps in the extension format, which is available as a .tar.gz file.
See the Apps section in the System Administrator Guide for the procedure to install and deploy container-based apps.
IBM Security has a number of apps in the extension format that you can download, customize and deploy. See Installing an app package on the SOAR Platform for details about accessing these extensions.
- If developing an app based on functions, use the SOAR SDK as described in the App Developer's Guide.
- If developing an app based on custom actions, see the Custom Action Developer’s Guide.
- If developing a threat service, see the Custom Threat Service Guide