IBM QRadar SOAR

IBM QRadar SOAR

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only
  • 1.  Connector API

    Posted Wed December 17, 2025 10:43 AM

    I'm creating an API connector using the SOAR function. I've done some testing and it works perfectly, but how can I send a variable within the field?

    The documentation only mentions using "playbook.inputs.xxxxxx", but the query can't possibly be an input!

    What alternatives do you think are possible?



    ------------------------------
    Juan Cruz Del Col
    ------------------------------


  • 2.  RE: Connector API

    Posted Thu December 18, 2025 06:01 AM

    Hi Juan,

    If I understand correctly, you wish to mix constant text with variable text so that the request string matches what the endpoints expects.


    You are going to have to manage this with a script. 


    To do this, I have created a subplaybook that take one parameter as input for the artifact.value.
    I define the output for the subplaybook with the json schema so that the data navigator knows the subplaybook will return a string as part of the result.

    {
      "type": "object",
      "properties": {
        "request": {
          "type": "string"
        }
      },
      "required": [
        "request"
      ]
    }


    I setup the subplaybook with just one start and one end point. In the end point, I define  the result in that way:

    playbook.results = {"request": "param1=hard-value1&param2=value2&artifact=" + playbook.inputs.artifact}

    Add the subplaybook node just before your connector add a result name and save the playbook. For the subplaybook input select the field you want to use with the data navigator.
    For the request parameter select the subplyabook request attribute from result object.



    ------------------------------
    YANNICK LAVANANT
    ------------------------------



  • 3.  RE: Connector API

    Posted 4 days ago

    Hi,
    I've just stumbled upon the very same issue today.
    I find it quite odd that IBM has provided us with ability to define Form and Raw input for connector function's request body, but we can't do the same for Request Parameters.

    And what is even more frustrating - I did properly format my input via local script and stored it within playbook.properties object via playbook.addProperty function before passing it to connector function. And yet, it was to no avail - request parameter schema wouldn't show properties object under playbook.

    All of this fiddling with sub-playbooks just to do this simple operation seems like IBM has done a poor job with connector function usability.

    I don't even know why I wrote it hear - just my cry of the soul, I guess 😅



    ------------------------------
    Mykhailo Honcharov
    ------------------------------



  • 4.  RE: Connector API

    Posted 4 days ago

    Myke, oh yes… welcome to the club.
    There are so many little things in SOAR/QRadar that feel like they were just slapped together and never looked at again.

    I totally share the rage-cry. Been there many times. And of course, when you go to IBM support, the answer is always the same magical solution:
    👉 "Have you tried asking the community?"
    Because nothing says "enterprise product" like crowdsourcing basic usability fixes.

    Honestly, it really feels like IBM has already mentally moved on from SOAR and QRadar. They're clearly not investing time in improving what's already good - and let's not even start with AI. That promise came and went without ever delivering anything actually useful in real-world playbooks.

    So here we are, building sub‑playbooks on top of sub‑playbooks, just to work around something that - as you correctly said - should be solvable with a simple script. Peak design.

    Your forum post sums it up perfectly:

    All of this fiddling with sub-playbooks just to do this simple operation seems like IBM has done a poor job with connector function usability.

    Exactly that. A powerful platform, handicapped by decisions that make you wonder if anyone actually uses it at scale before releasing features.

    Anyway, thanks for sharing the pain publicly - if nothing else, at least it's comforting to know we're not alone screaming into the SOAR void.



    ------------------------------
    Juan Cruz Del Col
    ------------------------------



  • 5.  RE: Connector API

    Posted 5 hours ago



    ------------------------------
    Lucian Sipos
    ------------------------------