IBM QRadar SOAR

IBM QRadar

Join this online topic group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.


#Security
#QRadar
#SecuringhybridcloudandAI
 View Only
  • 1.  Close task using action artifact

    Posted 02/11/19 01:39 PM
    Is it possible to close a specific task through an action from the artifact associated with the incident?

    for example:
    The incident has a task called "check blocked user", also has a artifact type "User Accoun". Configure an automatic action for the artifact where you consult in a system, of third parties, if it is blocked and after this verification, I would like to be able to close the task "check blocked user".

    It's possible? as?
    Maybe from a script?

    Thank you!

    ------------------------------
    Juan Cruz Del Col
    ------------------------------


  • 2.  RE: Close task using action artifact
    Best Answer

    Posted 02/12/19 04:34 AM
      |   view attached
    Hi Juan, 

    I have previously written a function which achieves this, I haven't put it up on App Exchange yet but attached is a "prerelease" of it. 

    Hopefully that should help address your use case, 

    Let me know if you have any issues with it,

    ------------------------------
    CRAIG ROBERTS
    ------------------------------

    Attachment(s)