IBM QRadar SOAR

I feel like I am missing something rather basic here, but I am attempting to Auto Assign a certain Task.

I have created a script that appears to work, but is very basic (task.owner_id = "Owner@email.com") which was a task object type. I tested and this works just fine. I then created a rule that was also a task object which fired whenever a task was created with the name of "Task Name", run the script above. This rule does not appear to be firing (I verified that it was below the rule that put the task into the incident), and I am not sure what I am missing.

Any help would be appreciated! Thanks!

------------------------------
Nick Mumaw
------------------------------

Hi Nick,

So can you outline the full set of objects you have at play here?

Sounds like:
1) Rule --> Type: Incident --> Condition(s): ??? --> Action(s): Adds a task called "Task Name" to the incident
2) Rule --> Type: Task --> Condition(s): Task Created --> Action(s): Runs script that sets task owner

------------------------------
PAUL CURRAN
------------------------------

Original Message:
Sent: Fri August 16, 2019 12:09 PM
From: Nick Mumaw
Subject: Auto Assign Tasks

I feel like I am missing something rather basic here, but I am attempting to Auto Assign a certain Task.

I have created a script that appears to work, but is very basic (task.owner_id = "Owner@email.com") which was a task object type. I tested and this works just fine. I then created a rule that was also a task object which fired whenever a task was created with the name of "Task Name", run the script above. This rule does not appear to be firing (I verified that it was below the rule that put the task into the incident), and I am not sure what I am missing.

Any help would be appreciated! Thanks!

------------------------------
Nick Mumaw
------------------------------

Nick,

If you feel the issue is that the rule is not firing the easiest way to troubleshoot that is to manually create a task on an incident. If the rule does not fire then it is likely that the rule conditions are not matching. You can remove some of the conditions until you find the one in question.

Here is an example of a test rule that I set up:




------------------------------
Ben Lurie
------------------------------

Original Message:
Sent: Fri August 16, 2019 12:09 PM
From: Nick Mumaw
Subject: Auto Assign Tasks

I feel like I am missing something rather basic here, but I am attempting to Auto Assign a certain Task.

I have created a script that appears to work, but is very basic (task.owner_id = "Owner@email.com") which was a task object type. I tested and this works just fine. I then created a rule that was also a task object which fired whenever a task was created with the name of "Task Name", run the script above. This rule does not appear to be firing (I verified that it was below the rule that put the task into the incident), and I am not sure what I am missing.

Any help would be appreciated! Thanks!

------------------------------
Nick Mumaw
------------------------------

Hey Ben,

I appreciate the response. I didn't think about that, but I did just create a manual rule with the same conditions as the automatic rule other than the auto rule also states to do this on creation. And the Manual Rule works just fine, but the Automatic Rule doesn't fire still.

Manual Rule
Automatic Rule

Rule Placement

Still not sure what I am missing or if I should submit a ticket to Resilient.

Thanks!

------------------------------
Nick Mumaw
------------------------------

Original Message:
Sent: Mon August 19, 2019 09:31 AM
From: Ben Lurie
Subject: Auto Assign Tasks

Nick,

If you feel the issue is that the rule is not firing the easiest way to troubleshoot that is to manually create a task on an incident. If the rule does not fire then it is likely that the rule conditions are not matching. You can remove some of the conditions until you find the one in question.

Here is an example of a test rule that I set up:

I then go to an incident and create a task. In my case the script just uses the helper.fail() method and I get immediate feedback that the rule is firing as expected.

------------------------------
Ben Lurie

Original Message:
Sent: Fri August 16, 2019 12:09 PM
From: Nick Mumaw
Subject: Auto Assign Tasks

I feel like I am missing something rather basic here, but I am attempting to Auto Assign a certain Task.

I have created a script that appears to work, but is very basic (task.owner_id = "Owner@email.com") which was a task object type. I tested and this works just fine. I then created a rule that was also a task object which fired whenever a task was created with the name of "Task Name", run the script above. This rule does not appear to be firing (I verified that it was below the rule that put the task into the incident), and I am not sure what I am missing.

Any help would be appreciated! Thanks!

------------------------------
Nick Mumaw
------------------------------

Also I know the second rule has an advance statement, but even without the advance statement it was not firing.

Thanks!

------------------------------
Nick Mumaw
------------------------------

Original Message:
Sent: Tue August 20, 2019 09:14 AM
From: Nick Mumaw
Subject: Auto Assign Tasks

Hey Ben,

I appreciate the response. I didn't think about that, but I did just create a manual rule with the same conditions as the automatic rule other than the auto rule also states to do this on creation. And the Manual Rule works just fine, but the Automatic Rule doesn't fire still.

Manual Rule

Automatic Rule

Rule Placement

Still not sure what I am missing or if I should submit a ticket to Resilient.

Thanks!

------------------------------
Nick Mumaw

Original Message:
Sent: Mon August 19, 2019 09:31 AM
From: Ben Lurie
Subject: Auto Assign Tasks

Nick,

If you feel the issue is that the rule is not firing the easiest way to troubleshoot that is to manually create a task on an incident. If the rule does not fire then it is likely that the rule conditions are not matching. You can remove some of the conditions until you find the one in question.

Here is an example of a test rule that I set up:

I then go to an incident and create a task. In my case the script just uses the helper.fail() method and I get immediate feedback that the rule is firing as expected.

------------------------------
Ben Lurie

Original Message:
Sent: Fri August 16, 2019 12:09 PM
From: Nick Mumaw
Subject: Auto Assign Tasks

I feel like I am missing something rather basic here, but I am attempting to Auto Assign a certain Task.

I have created a script that appears to work, but is very basic (task.owner_id = "Owner@email.com") which was a task object type. I tested and this works just fine. I then created a rule that was also a task object which fired whenever a task was created with the name of "Task Name", run the script above. This rule does not appear to be firing (I verified that it was below the rule that put the task into the incident), and I am not sure what I am missing.

Any help would be appreciated! Thanks!

------------------------------
Nick Mumaw
------------------------------

I just set up an automatic rule with the same settings as in your screenshot and the rule activities ran as expected. The support team should be able to help with that.

------------------------------
Ben Lurie
------------------------------

Original Message:
Sent: Tue August 20, 2019 09:15 AM
From: Nick Mumaw
Subject: Auto Assign Tasks

Also I know the second rule has an advance statement, but even without the advance statement it was not firing.

Thanks!

------------------------------
Nick Mumaw

Original Message:
Sent: Tue August 20, 2019 09:14 AM
From: Nick Mumaw
Subject: Auto Assign Tasks

Hey Ben,

I appreciate the response. I didn't think about that, but I did just create a manual rule with the same conditions as the automatic rule other than the auto rule also states to do this on creation. And the Manual Rule works just fine, but the Automatic Rule doesn't fire still.

Manual Rule

Automatic Rule

Rule Placement

Still not sure what I am missing or if I should submit a ticket to Resilient.

Thanks!

------------------------------
Nick Mumaw

Original Message:
Sent: Mon August 19, 2019 09:31 AM
From: Ben Lurie
Subject: Auto Assign Tasks

Nick,

If you feel the issue is that the rule is not firing the easiest way to troubleshoot that is to manually create a task on an incident. If the rule does not fire then it is likely that the rule conditions are not matching. You can remove some of the conditions until you find the one in question.

Here is an example of a test rule that I set up:

I then go to an incident and create a task. In my case the script just uses the helper.fail() method and I get immediate feedback that the rule is firing as expected.

------------------------------
Ben Lurie

Original Message:
Sent: Fri August 16, 2019 12:09 PM
From: Nick Mumaw
Subject: Auto Assign Tasks

I feel like I am missing something rather basic here, but I am attempting to Auto Assign a certain Task.

I have created a script that appears to work, but is very basic (task.owner_id = "Owner@email.com") which was a task object type. I tested and this works just fine. I then created a rule that was also a task object which fired whenever a task was created with the name of "Task Name", run the script above. This rule does not appear to be firing (I verified that it was below the rule that put the task into the incident), and I am not sure what I am missing.

Any help would be appreciated! Thanks!

------------------------------
Nick Mumaw
------------------------------

Thanks Ben!

------------------------------
Nick Mumaw
------------------------------

Original Message:
Sent: Tue August 20, 2019 11:56 AM
From: Ben Lurie
Subject: Auto Assign Tasks

I just set up an automatic rule with the same settings as in your screenshot and the rule activities ran as expected. The support team should be able to help with that.

------------------------------
Ben Lurie

Original Message:
Sent: Tue August 20, 2019 09:15 AM
From: Nick Mumaw
Subject: Auto Assign Tasks

Also I know the second rule has an advance statement, but even without the advance statement it was not firing.

Thanks!

------------------------------
Nick Mumaw

Original Message:
Sent: Tue August 20, 2019 09:14 AM
From: Nick Mumaw
Subject: Auto Assign Tasks

Hey Ben,

I appreciate the response. I didn't think about that, but I did just create a manual rule with the same conditions as the automatic rule other than the auto rule also states to do this on creation. And the Manual Rule works just fine, but the Automatic Rule doesn't fire still.

Manual Rule

Automatic Rule

Rule Placement

Still not sure what I am missing or if I should submit a ticket to Resilient.

Thanks!

------------------------------
Nick Mumaw

Original Message:
Sent: Mon August 19, 2019 09:31 AM
From: Ben Lurie
Subject: Auto Assign Tasks

Nick,

If you feel the issue is that the rule is not firing the easiest way to troubleshoot that is to manually create a task on an incident. If the rule does not fire then it is likely that the rule conditions are not matching. You can remove some of the conditions until you find the one in question.

Here is an example of a test rule that I set up:

I then go to an incident and create a task. In my case the script just uses the helper.fail() method and I get immediate feedback that the rule is firing as expected.

------------------------------
Ben Lurie

Original Message:
Sent: Fri August 16, 2019 12:09 PM
From: Nick Mumaw
Subject: Auto Assign Tasks

I feel like I am missing something rather basic here, but I am attempting to Auto Assign a certain Task.

I have created a script that appears to work, but is very basic (task.owner_id = "Owner@email.com") which was a task object type. I tested and this works just fine. I then created a rule that was also a task object which fired whenever a task was created with the name of "Task Name", run the script above. This rule does not appear to be firing (I verified that it was below the rule that put the task into the incident), and I am not sure what I am missing.

Any help would be appreciated! Thanks!

------------------------------
Nick Mumaw
------------------------------