IBM QRadar SOAR

IBM QRadar

Join this online topic group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.


#Security
#QRadar
#SecuringhybridcloudandAI
 View Only
  • 1.  Artifact to field script

    Posted 02/10/20 10:25 AM
    hello,

    Looking for any assistance.  I'm trying to take the artifact value and populate a field value.  For example, take that artifact called Username, with a value of x1234 and populate a incident.properties.user_name field with x1234.

    I can do it the other way, create an artifact from a field name, but I can seem to get the logic for getting the value of an artifact.

    Thanks!

    ------------------------------
    Cheryl Lorei
    ------------------------------


  • 2.  RE: Artifact to field script

    Posted 02/11/20 07:17 AM
    This can only be done by using an Artifact script like this:



    You would have to set up a rule that triggers on an artifact object that runs this script.

    But I have a feeling that this may not fit your use case. If not, if you can describe it a bit more maybe there is a different way to accomplish your goal.

    Ben


    ------------------------------
    Ben Lurie
    ------------------------------



  • 3.  RE: Artifact to field script

    Posted 02/11/20 08:47 AM
    Hi Ben....I tried that exact way and got an error on the "artifact" not being defined.  BUT, your screen shot provided me one element I have over looked.  I had the Object type of Incident, and not ARTIFACT.   Changing that makes it work.

    Thanks you for providing the screen shot, that made the light bulb turn on!  LOL!!

    Cheryl

    ------------------------------
    Cheryl Lorei
    ------------------------------