IBM QRadar SOAR

IBM QRadar SOAR

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only
  • 1.  Detect "resolution" field change w/ Script

    Posted Thu July 06, 2023 03:26 PM

    Greetings everyone,

    I have a good question I think, this is regarding the "Scripts" tab.

    Writing a while loop breaks the "Scripts" tab. This is because of the built-in IBM Resilient "forever loop" protection controls. 

    For example, the following code will be stopped/killed by Resilient for running > 5 seconds. My comments follow the "###".

    +++
    a = (len(incident.properties.resolution)###this line grabs forces/grabs integer value from the resolution field
    while a == 0:###this line waits until the "resolution" field is populated or does not equal 0
      pass
    else:
      a = int(time.time())###getting local epoch/timestamp
      new_a = (a*1000)###converting to a proper epoch for future subtraction 
      b = (incident.discovered_date)###pull in Resilient field discovered_date epoch value
      math = new_a - b###perform math/formula for this control
      convert_math_to_proper_seconds = (math // 1000) % 60###convrt this number to seconds -- can also do minutes as well
      incident.properties.mean_time_to_recovery_mttr = convert_math_to_proper_seconds
    +++


    I need an alternative way to monitor when the "resolution" field (incident.properties.resolution) is changed and then continue the rest of the script. Does anyone have any experience with this?

    IBM Resilient "Scripts" tab cannot use time.sleep() either even though the library is installed. 

    Respectfully,
    Rick



    ------------------------------
    Rick Strackbein
    ------------------------------


  • 2.  RE: Detect "resolution" field change w/ Script

    Posted Wed August 09, 2023 04:02 AM

    you can use a rule , where the condition would be filed : resolution : is changed.

    and make the activity > run you script.



    ------------------------------
    mohamad islam hamadieh
    ------------------------------



  • 3.  RE: Detect "resolution" field change w/ Script

    Posted Tue September 19, 2023 04:15 PM
    Edited by Pol Estecha Hernández Tue September 19, 2023 04:15 PM

    Greetings!

    As mohamed stated, creatin a Rule with the field condition would be the best approach.

    Finish your first workflow once the item starts, and then add a Rule to continue execution in a separate workflow when resolution is changed. This would also help with atomization and making sure you don't end up with a beefy, hard-to-debug workflow.

    Another good approach would be creatin a workflow with a timer function that loops over the resolution field, and add it in your original workflow, although this solution is far from ideal.

    Cheers!



    ------------------------------
    Pol Estecha Hernández
    ------------------------------