IBM QRadar SOAR

IBM QRadar

Join this online topic group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.


#Security
#QRadar
#SecuringhybridcloudandAI
 View Only

  • 1.  Call Action when Updating Data Table

    Posted 11/12/19 08:44 AM
    I was wondering if there is a way to call an action whenever a data table is updated? For instance if my Data Table consists of usernames and other data but I wanted to create an artifact every time a username was added, can that be done? 

    Thanks in advance!

    ------------------------------
    Adina Bodkins
    ------------------------------


  • 2.  RE: Call Action when Updating Data Table

    Posted 11/12/19 09:48 AM
    Adina,

    You can create an automatic rule with the data type data table that can trigger when a new row is added or when a row is modified. You could then launch a script to create an artifact. Within the script you will have access to the row object which is where you can get the username value that was just entered into the data table row.

    ------------------------------
    Liam Mahoney
    ------------------------------



  • 3.  RE: Call Action when Updating Data Table

    Posted 11/12/19 04:10 PM
    Hi Liam, 
    Thank you so much! I'm new to working with Data Tables so I'm sorry if these questions are basics. I tried to read the documentation...

    I have my rule and I have a script on type Data Table. However I don't see an option to access the row in the script. I see in the debug output the information of the row but how can I access the row itself via the script? 

    Thanks, 
    Adina

    ------------------------------
    Adina Bodkins
    ------------------------------

    Original Message


  • 4.  RE: Call Action when Updating Data Table

    Posted 11/13/19 09:55 AM
    Here is an example....

    I created a data table with a column that has a user name:


    I then created a built-in product script that adds an artifact from a data table row:



    I then created a rule that runs the script when a new row is added:


    This strategy has a limitation in that if there are two rows with the same username then two artifacts with the same user name would be created.

    The script example also assumes there is a custom artifact of type "artifact_user_type". But you can substitute either a built in artifact type there or create your own artifact type (which I didn't provide a screenshot for).

    Ben



    ------------------------------
    Ben Lurie
    ------------------------------

    Original Message


Related Content