IBM QRadar SOAR

IBM QRadar

Join this online topic group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.


#Security
#QRadar
#SecuringhybridcloudandAI
 View Only

  • 1.  Error exception handling of multiselect type field value input

    Posted 08/25/20 01:27 AM
    Hello,
    I found out that when I input wrong value to multiselect type field in script,
    I can't error-handle it.

    Like, for example "hl11_policy_violations" is a multiselect type field.
    there is no preset value named "lorem ipsum", so an error will occur. I tried to error exception handle it like this,
    try:
      incident.properties.hl11_policy_violations="lorem ipsum"
    except:
      pass

    but it seems it doesn't handle the error, just puts an error log.
    Is there any way to handle this error?
    (Error Running Script: Unable to set value Lorem Ipsum for Field HL11. Policy Violations)

    Thank you.

    ------------------------------
    Hanyu Lee
    ------------------------------


  • 2.  RE: Error exception handling of multiselect type field value input

    Posted 08/25/20 04:01 PM
    Great question, it would be awesome if there was, but I do not believe this is an existing capability.


    ------------------------------
    Jared Fagel
    Cyber Security Analyst I
    Public Utility
    ------------------------------



  • 3.  RE: Error exception handling of multiselect type field value input

    Posted 08/26/20 08:08 AM
    That is because when the script is evaluated in the sandbox, all possible known values are not known. The value is applied to the incident after the script is run as a result of potential changes made by the script. At that point, python is no longer involved so there is no opportunity to catch an error like this.

    Ben

    ------------------------------
    Ben Lurie
    ------------------------------



Related Content