Hello

Im trying to create a workflow for query an event payload. But i need some tips for that...

1- my "payload_query" : SELECT %param1% FROM events WHERE (¿must be payload? or may I use sourceip?) LAST %param3% MINUTES

2- my "param1": UTF8(payload)

3- my "param2" with pre-process script: inputs.qradar_query_param2 = incident.properties.qradar_id

4- Post-process script= for event in results.events:
                                                    qradar_event = incident.addRow("payload_info)(is the data table name)
                                                    qradar_event.información_payload (field name) = event.utf8_payload (its that ok?)


When I execute it tells me: 

An error occurred while processing the action acknowledgement. Additional information: Post-processing script for Function 'Qradar Ariel payload' from Workflow 'Qradar query for payload' was unable to complete because: name 'results' is not defined.

Has anyone any idea about that query? Is it possible create a workflow that can query event payload?

Thank you.

------------------------------
Aitor Vivanco Sata Cruz
------------------------------

This would mean the function is not returning the results object. Are you sure the Qradar Ariel payload function loaded correctly in Resilient Circuits when started?

------------------------------
Jared Fagel
Cyber Security Analyst Intern
Public Utility
------------------------------