IBM QRadar SOAR

IBM QRadar

Join this online topic group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.


#Security
#QRadar
#SecuringhybridcloudandAI
 View Only
  • 1.  Count artifact types

    Posted 04/27/20 07:56 AM
    Hi!

    I amended the email parsing script in a way that it extracts all the email recipients from the email and adds them as "Email Recipient" artifact.

    Now I want to do a workflow condition based on the number of recipients. But how can I run through the artifacts?

    I tried something like this but it didn't work:
    counter = 0
    for elem in list(artifact):
      if artifact.type == "Email Recipient":
        counter += 1
    log.info(counter)​
    As with content type "incident" the object artifact is not recognized I tried it with content type "artifact". But then I have to manually choose one of the artifacts which is not the result I want (and by the way counter then gives a value of 19 althought there is only one artifact type with that type and value)

    I also tried to solve this by a rule. Whenever an artifact of the type Email Recipient is created a field "number of recipients" should be incremented. But unfortunately the rule only let me set the field with an explicit number. There is no option to say... "take the field value and add 1"

    Any ideas?

    ------------------------------
    Achim Quehenberger
    ------------------------------


  • 2.  RE: Count artifact types

    Posted 04/28/20 07:31 AM
    You can create a script that increments the field by 1. Then just run the script in the rule.

    Ben

    ------------------------------
    Ben Lurie
    ------------------------------



  • 3.  RE: Count artifact types

    Posted 04/28/20 09:46 AM
    *facepalm* of course! Thanks! Sometimes I'm too focused on solutions I want that I don't see other possibilities.

    ------------------------------
    Achim Quehenberger
    ------------------------------