IBM QRadar SOAR

IBM QRadar

Join this online topic group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.


#Security
#QRadar
#SecuringhybridcloudandAI
 View Only
  • 1.  Auto Close Tasks Based on Field Values

    Posted 06/10/19 09:04 AM
    I was wondering if anyone had any luck finding a way to auto close tasks within the application (without building a function).

    What I am looking to do is create a task called "Assign Incident" then have it auto-close the task if the Field "Owner" is assigned to anyone other than the default group I currently have it assigned to. Seems like a simple task and I don't know if I am just missing something, but I have not been able to find a way to do this.

    Currently have an automatic rule set as a "Task" object type with the conditions to run when the owner is not equal to {group} and the task name is "Assign Incident" invoking the action of Set Field Task: Status to Closed.

    But this does not appear to work when I change the current owner to myself.

    Thanks for the help in advance!

    ------------------------------
    Nick Mumaw
    ------------------------------


  • 2.  RE: Auto Close Tasks Based on Field Values

    Posted 06/10/19 11:23 AM
    Hey mate. The best way to do this is to leverage scripts and workflows. Which requires a little bit of python knowledge.

    if task.status == "C":
      owner = task.owner_id
      log.info(owner)
      
      if owner:
        incident.owner_id = owner
        log.info(incident.owner_id)

    You can use this in your workflow. If the task is closed, and the owner is assigned to the task, take that owner and assign them to the owner of the incident..



    ------------------------------
    Nathan Getty
    ------------------------------



  • 3.  RE: Auto Close Tasks Based on Field Values

    Posted 06/10/19 01:51 PM
    I am not sure if this does what I am asking. I am not asking for it to check if the task is closed and assign the owner of the task to the incident, I am trying figure out how to close task based on the value of an incident field. The way this would help would be if someone clicks that "Assign to Me" button in the list of incidents it would close the tasks to all of the incidents that had an open task to "Assign Incident. I hope this clears up my question.

    I have some Python knowledge, but I also know that they Python is limited within the system. Is there a location where I can see all of the available commands within the platform?

    I appreciate the help in this!

    ------------------------------
    Nick Mumaw
    ------------------------------



  • 4.  RE: Auto Close Tasks Based on Field Values
    Best Answer

    Posted 06/11/19 09:38 AM
      |   view attached
    Unfortunately the current in-product scripting won't help for this scenario. The reason is that the in-product scripting does not have access to the tasks for an incident rule (e.g. when an incident changes).

    You would have to use a workflow with function. The function, which would run outside of Resilient (inside Resilient circuits) would make a query for open tasks for the incident, find that specific task, and then close it if appropriate.

    So maybe set up an incident rule like this (see attached screenshot).



    The function would send the information off to a function. The function would query the tasks and close it as appropriate.


    Ben

    ------------------------------
    Ben Lurie
    ------------------------------



  • 5.  RE: Auto Close Tasks Based on Field Values

    Posted 06/11/19 09:50 AM
    Hey Ben,

    I thought this would be the case. I was hoping (thought it would make a lot of sense) to be able to do this within the platform itself without needing to build a external script to do this.

    Thanks!

    ------------------------------
    Nick Mumaw
    ------------------------------



  • 6.  RE: Auto Close Tasks Based on Field Values

    Posted 06/11/19 10:11 AM
      |   view attached
    Hello Nick,

    I have a function that might be able to help you with this! See attached.

    This is a function that can close a Task on an incident by name.

    ------------------------------
    Andrew Wadsworth
    ------------------------------

    Attachment(s)



  • 7.  RE: Auto Close Tasks Based on Field Values

    Posted 06/11/19 02:42 PM
    Hey Andrew!

    Always a pleasure working with you. Is this something available on the app exchange? Just wondering if this is something that has documentation at all.

    Thanks!

    ------------------------------
    Nick Mumaw
    ------------------------------