IBM QRadar SOAR

IBM QRadar SOAR

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only
  • 1.  Attempting to Make a Workflow that has Multiple Paths

    Posted 12/12/19 10:05 AM
    I am trying to create a workflow that would be manually activated asking the user for certain information such as should I use data from 2 DBs or just one of them, then take different paths per the answer? Not sure if this is possible, so I figured I would ask.

    Thanks!

    ------------------------------
    Nick Mumaw
    ------------------------------


  • 2.  RE: Attempting to Make a Workflow that has Multiple Paths

    Posted 12/16/19 10:29 AM
    If undderstand right:
    1. If you want manually activate a workflow you need to use Rule (type: 'menu item') and additionally use 'Activity Fields' where you can add a question for users about DBs which will be used.
    2. The second way is using 'Exclusive Gateway' in workflow where you should specify a condition depended on the certain field. Value of the field have to be selected by user: '2DBs' or 'only one'


    ------------------------------
    Igor Talankin
    ------------------------------



  • 3.  RE: Attempting to Make a Workflow that has Multiple Paths

    Posted 02/25/20 11:57 AM
    Hey Igor,

    Sorry for the late response. I didn't see the response. Your understanding is correct. The problem I am having though is more in the second part. I want to create a loop basically in the workflow. My understanding in talking with IBM was that this is not possible. I need to take the DT that the user selected and then iterate through that list to send one email at a time until I hit the end of the list, then finish the rest of the workflow. Basically the beginning of the workflow would use the Exclusive Gateway to read from either or both of the DTs at hand, then the second part would, based on the users input, would either send one big email with everyone included or send 1 email at a time per line from the DT.

    I know the rest of this was not included in the initial request/question, but figured I would explain my situation more.

    Thanks!

    ------------------------------
    Nick Mumaw
    ------------------------------



  • 4.  RE: Attempting to Make a Workflow that has Multiple Paths
    Best Answer

    Posted 02/26/20 01:20 AM
    Actually I faced to similar issue recently (I needed to add/update/process each cell and avoid duplicates) and I decided that using function is the best way to process DTs.
    You can use 'Data Table Helper Functions' to understand how to work with DTs then develop own function - that was my way.
    I found out - in any unclear situation use function:)

    ------------------------------
    Igor Talankin
    ------------------------------



  • 5.  RE: Attempting to Make a Workflow that has Multiple Paths

    Posted 02/27/20 10:28 AM
    I agree that is what I am seeing too. I just find that it is strange that basic functionality like doing a check for something then moving back to a previous point on a workflow is not capable. I would like to see this change as I don't think I should have to build another function to send emails when the capability should already be in the platform.

    Thanks and hopefully you resolved our issue as well!

    ------------------------------
    Nick Mumaw
    ------------------------------



  • 6.  RE: Attempting to Make a Workflow that has Multiple Paths

    Posted 02/29/20 11:43 AM
    Nick, we are tracking this need here as an RFE/Idea: Step-back in workflow
    https://2e4ccba981d63ef83a875dad7396c9a0.ideas.aha.io/ideas/R-I-107

    It is certainly a gap in the workflow feature, which is why I tend to not to use them for process. The Workflow always wants to move forward to completion. You could try and mesh all of the Tasks, however one of the main issues there is facing infinite loops.

    If possible I would evaluate using Rules for this particular part of your Playbook, as they add more flexibility as they can add and mark Tasks inactive on an Incident.

    Approaching this with a Workflow, if you were able to either:

    1. Terminate the Workflow, set the "new path" condition values, then re-trigger the Workflow, then it should work as desired.
    2. Terminate the Workflow, in this case re-open the Task where the user makes the Field value choice that sets the Exclusive Gateway condition (before the exclusive gateway), then it should work as desired.

    Keep in mind, I haven't tested the above (1/2) nor am recommending it as a solution. This should be addressed as a core feature enhancement to Workflows.

    Note, all Tasks added to an Incident by a Workflow will persist. They will not be removed from the Incident as if they were added by the Rule.

    ------------------------------
    Brenden Glynn
    CISSP, GCIH
    Incident Response Business Consultant
    IBM Resilient
    ------------------------------