IBM QRadar SOAR

IBM QRadar SOAR

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only
  • 1.  Connector API

    Posted yesterday

    I'm creating an API connector using the SOAR function. I've done some testing and it works perfectly, but how can I send a variable within the field?

    The documentation only mentions using "playbook.inputs.xxxxxx", but the query can't possibly be an input!

    What alternatives do you think are possible?



    ------------------------------
    Juan Cruz Del Col
    ------------------------------


  • 2.  RE: Connector API

    Posted 8 hours ago

    Hi Juan,

    If I understand correctly, you wish to mix constant text with variable text so that the request string matches what the endpoints expects.


    You are going to have to manage this with a script. 


    To do this, I have created a subplaybook that take one parameter as input for the artifact.value.
    I define the output for the subplaybook with the json schema so that the data navigator knows the subplaybook will return a string as part of the result.

    {
      "type": "object",
      "properties": {
        "request": {
          "type": "string"
        }
      },
      "required": [
        "request"
      ]
    }


    I setup the subplaybook with just one start and one end point. In the end point, I define  the result in that way:

    playbook.results = {"request": "param1=hard-value1&param2=value2&artifact=" + playbook.inputs.artifact}

    Add the subplaybook node just before your connector add a result name and save the playbook. For the subplaybook input select the field you want to use with the data navigator.
    For the request parameter select the subplyabook request attribute from result object.



    ------------------------------
    YANNICK LAVANANT
    ------------------------------