IBM QRadar SOAR

IBM QRadar SOAR

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only
  • 1.  Check if current user is member of a specific group inside a script

    Posted Thu August 29, 2024 04:26 AM

    Hello Experts,

    is there any way one can get a list of members of a specific group and check whether the current user is a member of that group?

    Use case:

    If any user of group X has opened a case, please assign group X as owner of that case.

    I am thinking of something like:

    if (principal.id in group X):
     ...do stuff in here
    

    I also found the function groups.findByName(name) but unfortunately the object "groups" does not contain all groups that are existent in the system.

    Any help or idea is much appreciated!

    Thank you very much in advance! 



  • 2.  RE: Check if current user is member of a specific group inside a script
    Best Answer

    Posted Fri August 30, 2024 11:52 AM

    Hey Matt,

    You can definitely do this, but it is done in a slightly different way that what you are describing. I actually have this all documented in my Github which is linked below:

    https://github.com/TheIRGurus/Sample-Scripts/tree/main/Current%20User%20Analysis

    The method of doing this is actually by just checking for the group as it checks to see if the current user is part of that group already. Below is a sample of how you would go about checking a users group membership.

    if groups.findByName('Group Name'):
        <block of code to do something if they are in a group>
    else:
        <block of code to do something if they are NOT in a group>

    The groups function will actually check to see if the principal running the playbook is in a certain group. If they are in it, the results will have value, otherwise the value will be null.

    Hope this helps!



    ------------------------------
    Nick Mumaw, GPEN, GPYC
    Cyber Security Specialist - SOAR
    IBM - Security
    ------------------------------



  • 3.  RE: Check if current user is member of a specific group inside a script

    Posted Mon September 02, 2024 03:22 AM

    Hi Nick,

    now i understand the function 

    groups.findByName()

    Thank you very much for the explanation!

    Also thank you for sharing your Github repo! Much appreciated! I will definitely look into it!

    - Matt




  • 4.  RE: Check if current user is member of a specific group inside a script

    Posted Tue September 03, 2024 12:34 PM

    Glad to help!



    ------------------------------
    Nick Mumaw, GPEN, GPYC
    Cyber Security Specialist - SOAR
    IBM - Security
    ------------------------------