IBM QRadar SOAR

IBM QRadar

Join this online topic group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.


#Security
#QRadar
#SecuringhybridcloudandAI
 View Only

  • 1.  Error on a script that takes incident.name as input

    Posted 11/26/19 12:54 PM
    Hi all,

    We are trying to process input from the incident name field "Name " 
    'QRadar ID 29857 , Port Scan - FW-003-192.168.89.41-178.60.254.205'
    Using a Rule that will run a script  that will parse and get the values splitted between -, using the following small code example script

    tokens = incident.name.split('-')
    incident.min_code = f'{tokens[1].strip()}-{tokens[2].strip()}'

    Just a question, cause we are getting the following error.

    Rule 'Include basic fields to an incident' is unable to update the Incident 'QRadar ID 29857 , Port Scan - FW-003-192.168.89.41-178.60.254.205' because: no viable alternative at input ''{tokens[1].strip()}-{tokens[2].strip()}''


    Any ideas? It seems an error on the input value 

    Many thanks

    Oscar

    ------------------------------
    Oscar López
    ------------------------------


  • 2.  RE: Error on a script that takes incident.name as input
    Best Answer

    Posted 11/26/19 06:34 PM
    Hi all
    It was solved with this.

    tokens = incident.name.split('-')
    incident.min_code = tokens[1].strip() + '-' + tokens[2].strip()

    Many thanks!
    Oscar

    ------------------------------
    Oscar López
    ------------------------------



Related Content