IBM QRadar SOAR

IBM QRadar

Join this online topic group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.


#Security
#QRadar
#SecuringhybridcloudandAI
 View Only

  • 1.  Artifacts

    Posted 05/17/21 02:29 PM
    Hi All,

    Does some one have a snipet of code that exposes the Artifact Related Incident value?  I would like to be able to trigger a notification when there's an artifact match in another incident.



    ------------------------------
    Thanks

    Paul Formosa
    ------------------------------


  • 2.  RE: Artifacts

    Posted 05/18/21 06:20 AM
    The information can be obtained via GET /orgs/{org_id}/incidents/{inc_id}/artifacts/{artifact_id}  
    Property: related_incident_count  in IncidentArtifactDTO

    ------------------------------
    Leo Kuo
    ------------------------------



  • 3.  RE: Artifacts

    Posted 05/18/21 08:33 AM
    Are you looking to do this in a workflow or a script? A bit more information about the use case may help.

    Ben

    ------------------------------
    Ben Lurie
    ------------------------------



  • 4.  RE: Artifacts

    Posted 05/18/21 10:25 AM
    Hi Ben, it would be preferable in a script.  Meaning if artifact is created and the related incident count is greater than zero, I would like to notify the owner of the incident of this fact.  I am finding that the owners are not checking for the status of the related incident count.

    ------------------------------
    PAUL FORMOSA
    ------------------------------

    Original Message


  • 5.  RE: Artifacts

    Posted 05/18/21 10:46 PM
    Hi Paul,
    How do you "notify" owners?  Via email / notifications menu using our built in Notifications?  Or do you use the outbound email integration?  Or is there some other means like creating a task or something?

    Thanks
    Chuck Schauber

    ------------------------------
    Chuck Schauber
    Product Management
    IBM Security SOAR
    Cambridge MA
    ------------------------------

    Original Message


  • 6.  RE: Artifacts

    Posted 05/19/21 08:10 AM
    Unfortunately it looks like the related count information is not available in a Script for an artifact.

    That means it is necessary to use the Resilient API to get that information. This is the API that the UI uses:

    /rest/orgs/202/incidents/11033/related_ex?handle_format=objects&want_artifacts=true

    So you could use the fn_utilities app (https://exchange.xforce.ibmcloud.com/hub/extension/2b6699ac8a3976b67dfbddee26dbe3a5) and outbound email app (https://exchange.xforce.ibmclouddfdfd.com/hub/extension/caafba4e4f6d130e7db30ed4d5e53504). Use the call rest api function from the fn_utilities app and the send outbound email from the outbound email app.

    Something like this:


    There is some work to get the function inputs set up correctly and the scripting conditions for the exclusive gateway. But it should be possible.

    Ben

    ------------------------------
    Ben Lurie
    ------------------------------

    Original Message


  • 7.  RE: Artifacts

    Posted 05/19/21 09:10 AM
    Hi  et al., thanks for reponses.

    Ben, I will try your suggestion.  Thanks.
    ​

    ------------------------------
    PAUL FORMOSA
    ------------------------------

    Original Message


Related Content