Hello everyone,

i'm struggling with understanding Datatypes in scripting for QRadar SOAR. Is there a List of all built in Datatypes and their Attributes?
For example TextObject is no built-in data type in Python and when I try to access a Text Area Field (Datatype: TextObject) to write in it via script, I always get Errors that for example append is not an Attribute of TextObject or that the Operator + is not compatible.
I want to understand all other Datatypes as well. Unfortunatly i'm not allowed to use dir() inside SOAR.

Thank for your help!

------------------------------
Benjamin Walden
------------------------------

Hi Bejamin,
I also struggled with this TextArea field concept. For this type in particular, you must know it is not a simple string: it comes in the form of:
{'format': 'html', 'content': 'Description of incident'}
So if you want to change the text of the field, you must use the "content" part, like this:
incident.description.content = "new description of incident"

HTH

------------------------------
Pierre Dufresne
------------------------------

Hi Pierre,

thank you very much. It would be great to know if this Datatype not only looks like a Dictionary but if it has the same Methods as well. Sometimes i try out some Methods but don't know if they are even in the Spectrum of this Datatype.
It's not that this is a problem that keeps me from coding, but it would be nice to have an Overview of possible Datatypes plus their Methods somewhere, for getting some Inspiration.
I found this through the Script help resilient-scripts/1_basics at master · ibmresilient/resilient-scripts · GitHub. It is a good start but lacks the mentioned Methods or Reference to Pyton built-in Datatypes.
Maybe i'm overthinking things.

------------------------------
Benjamin Walden
------------------------------

Original Message:
Sent: Tue November 29, 2022 09:58 AM
From: Pierre Dufresne
Subject: Datatypes in QRadar SOAR

Hi Bejamin,
I also struggled with this TextArea field concept. For this type in particular, you must know it is not a simple string: it comes in the form of:
{'format': 'html', 'content': 'Description of incident'}
So if you want to change the text of the field, you must use the "content" part, like this:
incident.description.content = "new description of incident"

HTH

------------------------------
Pierre Dufresne
------------------------------