IBM QRadar SOAR

IBM QRadar SOAR

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only
  • 1.  Automating Email Notifications Upon Playbook Completion

    Posted Wed March 20, 2024 02:57 PM

    I have designed a playbook, and I am considering options for automatically sending an email to the relevant user when the playbook is completed. I am unsure whether using fields or scripts would be the better choice for achieving this. Can anyone provide guidance or share their experience with implementing similar functionality



    ------------------------------
    Ahmad Hassan Tariq
    ------------------------------


  • 2.  RE: Automating Email Notifications Upon Playbook Completion

    Posted Thu March 21, 2024 08:39 AM

    Hi Ahmad,

    You're probably referring to our outbound email app, https://exchange.xforce.ibmcloud.com/hub/extension/caafba4e4f6d130e7db30ed4d5e53504. 

    To answer your question, fields provide single-value settings, whereas scripts allow more pre-processing of the field settings. I find scripts provide more flexibility but do require the author to be mindful of python syntax. In the end, hopefully both will get you to the same place.

    Hope this helps,
    Mark



    ------------------------------
    Mark Scherfling
    ------------------------------