Hi everyone,

I am trying to use script from official IBM documentation:

https://www.ibm.com/support/pages/qradar-custom-action-script-testing-scripts

Doing everything as wrote in the article, but it doesn't works for me.

I am using Qradar 7.3.3 FixPack 4.

Test script - is success and txt file is updating correctly, but it's not working when rule is triggering.

Is it possible that Qradar is limiting auto update of any files created by script during execution of script by Custom action?

Regards,

IBM customer

Hi,

testing custom action script from admin tab and life execution using rule are very different. When you say not working for you, you dont see no output to txt file right? There maybe multiple reasons for that.

You may want to create a metaevent plus refset to be used by your rule in order to better track whats happening. Execution in qradar jail is very limited to prevent side effects.

BR Karl

Hi Karl,

Thank you for your answer.

As you mentioned I am already using Reference set in my rule, and I see that my rule is triggering. But I can't find any error outputs on why Custom action script is not executed when the rule action fires.

I also tested to use Qradar API in Custom action and result was the same. Example of the script:

#!/bin/bash

#Test data input to Reference set Test01 by using Qradar API:

output=$(curl -X POST -k -H "SEC:$1" -H "Version:12.1" -H "Accept:application/json" https://Console server/api/reference_data/sets/Test01?value=$2)

echo $output

Conversation with official IBM support team did not resolve the problem, I am still waiting for answer from them (ticket was raised 07 October).

Could you share your experience in using Custom actions in Qradar? Are you using Custom actions in your Qradar environment? If you have any existed tested custom script, could you share it?

Regards,

Berik