IBM QRadar SOAR

IBM QRadar SOAR

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only
  • 1.  Can an automatically generated task be set to "inactive" rather than "close" it

    Posted Fri August 30, 2019 09:50 AM
    We have a kind of summary reporting based on tasks in an incident.
    For some of the tasks, no action is needed and we don't want these to show up in the report.
    If these tasks are closed, we have no possibility to make a difference between these an normal closed tasks.

    Is there an alternative, like having an action (script) that can set a task back to inactive ?

    ------------------------------
    Guido Janssens
    ------------------------------


  • 2.  RE: Can an automatically generated task be set to "inactive" rather than "close" it

    Posted Tue September 03, 2019 03:41 PM
    Edited by Brenden Glynn Tue September 03, 2019 03:43 PM
    Guido,

    Today it's possible to filter the Task list widget on the Incident and in the Incident Reports by Completed/Closed.

    There is also the feature to set Tasks as Mandatory or Optional. However, there is not currently a filter for this state.

    My personal recommendation is not to mark tasks without action needed as closed. Only Tasks that have been performed should be closed. Tasks where they were not needed, I would recommend that the User/Analyst add a Note to that Task indicating why it's unnecessary. It would be possible to create this action into a Menu Item Rule to streamline this approach. Where it would automatically add a Note of "Not Required" to the Task. Although, I would prefer that more context as to why to be added for future reference.

    There are a few Ideas (RFEs) that are focused on this idea of selectively setting a Task to Inactive. Which results on them being removed from Active View/Filter in the the Task Widget. The "Active" Field/value for a Task is currently Read-Only. If they were allowed to be modified by a User/Automation, they could be removed Manually and or Automatically.

    Please have a look and vote for them here:

    Selectively make Tasks Inactive (remove them) through - Rules, Scripts, Workflows and Functions 
    https://2e4ccba981d63ef83a875dad7396c9a0.ideas.aha.io/ideas/R-I-141

    Automate Remove Tasks
    https://2e4ccba981d63ef83a875dad7396c9a0.ideas.aha.io/ideas/R-I-129

    Some things you can do today:

    1. You can append additional Text to the Task Name using a Task Menu Item and Task Script. The code in the Script you would use to do this would look something like:


     Which would result it:



    2. It possible to set a Tasks "Required" from Mandatory to Not Mandatory, and vise versa.

    Not Mandatory to Mandatory - There is currently a blue button on the Task to accomplish this.
    Mandatory to Not Mandatory - A Task Menu Item Rule can be created to set the Task Field "Required" to "No".





    ------------------------------
    Brenden Glynn
    CISSP, GCIH
    Incident Response Business Consultant
    IBM Resilient
    ------------------------------



  • 3.  RE: Can an automatically generated task be set to "inactive" rather than "close" it

    Posted Wed September 04, 2019 05:05 PM
    A button on the Task itself to mark in Inactive would be the most streamlined, I agree.

    Because of the inherent behavior of Rules, and the Tasks at are added as Activities. It would be possible to make the Rule evaluate to "not true", by undoing/make a change to what the Rule triggered on. This would result in all Tasks that were added as part of that Rule, to be marked as Inactive. Removing them from the Active view of the Task Widget.


    ------------------------------
    Brenden Glynn
    CISSP, GCIH
    Incident Response Business Consultant
    IBM Resilient
    ------------------------------



  • 4.  RE: Can an automatically generated task be set to "inactive" rather than "close" it

    Posted Thu September 05, 2019 03:52 AM

    I agree that adding a button to the task to mark it inactive would be the best approach.

    However, making it inactive should then avoid that the initial rule that created it kicks in again and re-activates it.
    It would be a burden to have to update all existing rules to include some artificial condition to avoid this.



    ------------------------------
    Guido Janssens
    ------------------------------



  • 5.  RE: Can an automatically generated task be set to "inactive" rather than "close" it

    Posted Fri September 06, 2019 11:03 AM
    So, this is a great enhancement request. In the meantime you can map it if you're okay with creating dummy fields in the incident record for each task you wish to force to be inactive.

    For example, consider a Task that shows up when the City is set to "Cambridge" - add in the additional requirement that the dummy field is not set to true:

    Then add a MenuItem rule to mark as Inactive:

    and optionally you can similarly add another menuitem to appear on the inactive task to allow it to be reactivated if desired

    ------------------------------
    Marty James
    ------------------------------