IBM QRadar SOAR

IBM QRadar

Join this online topic group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.


#Security
#QRadar
#SecuringhybridcloudandAI
 View Only

  • 1.  Failed Functions Within a Child Workflow

    Posted 10/02/19 04:55 PM
    Edited by Liam Mahoney 10/02/19 05:00 PM
    All,

    Please bear with me through this post...

    Issue

    We noticed behavior where if a workflow has children workflow in it and a function in one of those child workflows fails, the parent workflow's status remains running. Perhaps this isn't an issue, but this is not our desired behavior. We would prefer if the failed child workflow would bubble up a completed status to the parent workflow causing the parent workflow to eventually finish / move forward.

    Test/Explanation

    Parallel Gateway Parent Workflow 1

    To test, we created a simplified version of our problem. We made a parent workflow that contains two child workflows running in parallel. One of the workflows posts "hello world" to the incident. The other workflow contains a function that only throws an exception, which is handled with the yield FunctionError() method within resilient circuits.

    parallel-parent-workflow

    After invoking this workflow with a menu-item rule, [DEV] Post Note to Incident successfully posted "hello world" to the incident. The function inside of [DEV] Function Error Test 3 failed, causing the whole workflow to fail. However, when checking the status of the workflows within the incident, we found the following:
    parallel-parent-workflow-1-status

    This fits with what we are seeing in our environment. We'd prefer if the workflow [DEV] Parallel Gateway Parent would have a status of Failed/Complete rather than Running. We've noticed the workflow will have a status of Running until it eventually changes to Suspended.

    We decided to get cheeky and test if the inclusive gateway behaved the same way.

    Inclusive Gateway Parent Workflow 1

    We reproduced a nearly identical workflow as the one above except this time we used inclusive gateways instead of parallel gateways.

    inclusive-parent-workflow-1

    Again invoking this rule via a menu-item rule, we got the following output from the workflow status page:

    inclusive-parent-workflow-1-status

    However, this was different than the result we had gotten in our environment doing a similar test (replacing parallel gateways in the parent workflow with inclusive gateways).

    Inclusive Gateway Parent Workflow 2

    We created the same workflow as above but this time replaced the child workflow [DEV] Post Note to Incident(which only contained a script) with [DEV] LDAP User Search Test, which is a workflow that contains an LDAP Search function configured to look me up in AD.

    inclusive-parent-workflow-2We ran this workflow like normal but this time we got the results we desired:
    inclusive-parent-workflow-2-status

    What we gathered was that the difference was the workflow that failed, [DEV] Function Error Test 3, returned before the successful workflow [DEV] LDAP User Search Test finished.

    Again this is the behavior that we desire, as some of our child workflows will sometimes error out and it results in a parent workflow that's still Running, and remains running until we manually go through and close out all of the workflow instances (identical to the first two test results). We have created a function that we can trigger on incident close to go through and close all running workflow instances associated to that incident, but we're still curious why this happens.

    We then wanted to see if this happened with parallel gateways as well.

    Parallel Gateway Parent Workflow 2

    We remade the original workflow but this time replacing the child workflow that contained a script posting a note with a child workflow that looked me up in AD via the LDAP Search function.

    parallel-parent-workflow-2
    Here's the workflow status after the parent workflow was run:

    parallel-parent-workflow-2-status
    So the failing child workflow returning before the successful child workflow had no affect on the parallel gateways.

    Our Question

    Is this expected behavior within the Resilient Platform? We think it would make more sense to have failed child workflows allow parent workflows to continue execution, as it seems like when a child workflow fails it prevents the parent workflow from moving on and completing (we tested this by placing another workflow/function after the second gateway before the end and it was never reached).

    We'd appreciate some guidance on how to get our desired behavior to happen if possible. 

    Thanks for your time!



    ------------------------------
    Liam Mahoney
    ------------------------------


  • 2.  RE: Failed Functions Within a Child Workflow

    Posted 10/08/19 01:29 PM
    Great observations and tests.

    I agree-- if a child fails in a parallel or inclusive workflow, this should not block the workflow from completing (with a failed status). Additionally, the logic in the outcome of the inclusive gateway workflows should not be dependent on which function (success/failure) completed first.

    I'd be curious to hear from the Resilient side why this is. What exactly does Suspended mean and cause to happen? Why/how is it different than a Failed?

    ------------------------------
    Jared Fagel
    Cyber Security Analyst Intern
    Public Utility
    ------------------------------



  • 3.  RE: Failed Functions Within a Child Workflow

    Posted 10/09/19 12:08 PM
    Hello Liam,

    I'm afraid that this query is a bit too involved to handle here on the forum. Please open a ticket with our support team where we can have the appropriate subject matter experts research your problem and get back to you.


    ------------------------------
    Jim Tonra
    ------------------------------



  • 4.  RE: Failed Functions Within a Child Workflow

    Posted 10/09/19 01:04 PM
    Jim,

    Will do, thank you!

    ------------------------------
    Liam Mahoney
    ------------------------------

    Original Message


  • 5.  RE: Failed Functions Within a Child Workflow

    Posted 10/09/19 01:10 PM
    Hey Liam,

    Keep us posted on what you hear, if possible!

    Thanks.

    ------------------------------
    Jared Fagel
    Cyber Security Analyst Intern
    Public Utility
    ------------------------------

    Original Message


Related Content