IBM QRadar SOAR

IBM QRadar SOAR

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only
Expand all | Collapse all

Function is executed only once when triggered multiple times

  • 1.  Function is executed only once when triggered multiple times

    Posted Wed May 06, 2020 09:21 AM
    Hi,

    We have some integrations, in which we link a message destination with a function, a workflow and an automatic rule.
    When a rule is triggered the function is executed, so far so good.
    When we trigger the rule several times, and the first execution of the functions hasn't finished yet, the function is only executed that one time.

    To be more specific I'll give an example

    I'm copying values of a column from one datatable (mail information) to another datatable (user information) via an integration.
    There is an automatic rule that does a lookup in Active Directory when a value is added in a specific column in the user information datatable and adds data, found in Active Directory to the row.
    The behaviour I'm seeing, when copying multiple values, is that the automatic rule fires ones, does the lookup of the first added entry and doesn't do the lookup of the subsequent entries.
    I'm having the impression that the rule fires once and doesn't fire a next time when subsequent rows are added in the mean time.

    I'm seeing the same behaviour when copying multiple values of artifacts to the user information datatable.

    Am I missing something ?

    Thanks in advance,

    G

    ------------------------------
    Guy Snellinx
    ------------------------------


  • 2.  RE: Function is executed only once when triggered multiple times

    Posted Mon May 11, 2020 11:30 AM

    Any help on this?   Indeed,when we add a list of Artifacts for example, only the FIRST is enriched. 
    The other artifacts created at the same time are NOT picked up by the integration.  


    On the Threats however, all example IP addresses are checked against Virus total, so there it works, not for our enrichments which has been created, triggered by rules as Guy described



    ------------------------------
    --------------------------------
    Kris Caron
    ---------------------------------
    ------------------------------



  • 3.  RE: Function is executed only once when triggered multiple times

    Posted Tue May 12, 2020 12:42 PM
    Rules are activated when an item is changed, deleted, or modified. I don't fully understand the use case but...

    If a datatable row is updated then the rule files on that datatable row. The workflow then runs on the datatable row and the function in the workflow is run on that datatable row. It sounds like you need the function to "loop" on the data in the column from the datatable row? If you want something like this you'll need to build the workflow to keep track of the "list" (I think you need to do this in either an incident field or a custom workflow property). Then extract the item from the list and call the function. Then the workflow would go back to the "loop" node. Maybe something like this:



    There are ideas to make looping native to the workflow but aren't scheduled at this point.

    I may have misunderstood the use case and if so, this may not be applicable.

    Ben



    ------------------------------
    Ben Lurie
    ------------------------------



  • 4.  RE: Function is executed only once when triggered multiple times

    Posted Wed May 13, 2020 04:51 AM

    I have been launching multiple times (test up to 40) the same rule, in the same incident, rule that launch an integration. I have sometime notice delays (workflows in running states, action pending - all that potentially due to my small local VM tests) but I was always able to trace each unique calls from the rule (workflow status, action status).
    the only reason a workflow (and the action below) is not fired twice, it is because this WF is in running state on the exact same object source for the call.
    Example :
    LDAP call WF for user xben is running, if you ask twice for it, only the first will be running as when you start the 2nd time, it will "join" the first call still running.

    For me it really depends on the object that initially make the call where you should investigate why you do not see your expected results



    ------------------------------
    BENOIT ROSTAGNI
    ------------------------------



  • 5.  RE: Function is executed only once when triggered multiple times

    Posted Thu May 14, 2020 09:01 AM

    Hey Ben and Benoit,

    thanks for your replies.

    Benoit is stating that "a workflow doesn't fire twice if its in the running state on the exact same object source".  If I understand this correctly, it is what is happening with our use case.

    We have a rule with a datatable defined as an object type and the workflow triggers when a row is created.  The workflow performs a LDAP lookup and enriches some columns of that row, but when during that lookup another row is added to that datatable the workflow isn't fired anymore.  Is that what you mean ?  I don't see a possibility to add a rule to a datatable row to avoid this situation.
    I don't understand what you mean by 'join' in the sentence 'join the first call still running ' though.

    Since I noticed only one entry in the datatable being enriched, I did exactly what Ben is suggesting.  I wait until I know no rows are added anymore (counting of the rows in the datatable), and I loop over all rows in that datatable to enrich every single row.  
    For the moment it works, but I was wondering if there were more elegant ways to solve this problem.

    Thanks again,

    G



    ------------------------------
    Guy Snellinx
    ------------------------------



  • 6.  RE: Function is executed only once when triggered multiple times

    Posted Thu May 14, 2020 11:26 AM
    Guy,

    You said:

    The workflow performs a LDAP lookup and enriches some columns of that row, but when during that lookup another row is added to that datatable the workflow isn't fired anymore.

    If a row is added anytime during the processing then that new row should get rules/workflow run on it as applicable. If that is not happening that is a bug.

    Ben

    ------------------------------
    Ben Lurie
    ------------------------------



  • 7.  RE: Function is executed only once when triggered multiple times

    Posted Thu May 14, 2020 11:35 AM
    Strange thing is that we see a similar behaviour on Artifacts.
    If we add 10 ARtificats (eg User Ids), only the first gets enriched, the second one not.

    ------------------------------
    --------------------------------
    Kris Caron
    ---------------------------------
    ------------------------------



  • 8.  RE: Function is executed only once when triggered multiple times

    Posted Fri May 15, 2020 09:05 AM
    I don't see the same behavior. I have a script that adds artifacts:

    I have a workflow that runs this script:



    I have a menu item rule that runs this workflow (not show).

    I have a script that updates the description of the artifacts:



    I have an automatic rule that runs this script when an artifact is created:



    When I run the menu item that adds the artifacts all the descriptions are updated for all the added artifacts.



    There could possibly be bugs where sometimes the rules engine is not running properly. If so, you'd need to open a support case to track that down.

    Ben

    ------------------------------
    Ben Lurie
    ------------------------------



  • 9.  RE: Function is executed only once when triggered multiple times

    Posted Fri May 15, 2020 10:02 AM
    @Ben Lurie: In You Case, Ben, 1 single WF is running 1 script with in product direct action -  of adding artifact - it works. no specific calls of multiple WF from the same object. And your WF is triggered by a rule that with the source object = 1 artifact. if you change multiple artifacts, you change multiple rules with different source.

    if you want to see what I say, create 3 rules:
    Rule 1 : if artifact is added, run WF (that will be "long enough" to stay live several seconds) like : update QRadar Ref Set X, and in post processing script, write a note Artifact.value added to ref set X
    Repeat the "same rule 3 times, rule 1, rule 2 & rule 3
     You will 3 times the same call on the same WF, still open, you should get only 1 note.

    @Guy Snellinx: I have a tested a WF launched from datatable, and I got 5 WF visibility (see below VIP System remediation control) if I have 5 lines added. Each datatable source is different

    so for me you should get al your WF & actions below running correctly, as the source is different each time like me

    @Kris Caron and below from the same artifact, I have also 6 WF launched, same source artifact but different WF name:

    (errors are unfinished/incorrect/cascading WFs) - 3 different enrichment from OOTB App Exchange functions






    ​​​​​​​​​

    ------------------------------
    BENOIT ROSTAGNI
    ------------------------------



  • 10.  RE: Function is executed only once when triggered multiple times

    Posted Wed May 20, 2020 06:06 AM

    Hi Benoit,

    I do not fully understand when you say "each datatable source is different"

    A way I can think of it is that you are using the "datatable helper functions" and that you're using the rules 'Get DT Row', 'Update DT Row' and potentially 'Delete DT Row'.  Am I correct with this assumption ?  

    If not, could you elaborate a bit more on how you take care to get each datatable source different ?

    Thanks a lot.

    Kind regards,

    G



    ------------------------------
    Guy Snellinx
    ------------------------------



  • 11.  RE: Function is executed only once when triggered multiple times

    Posted Wed May 20, 2020 09:34 AM
    What I mean by "Each datatable source is different" is that for each line added in the table, that fire the WF, is that we will have times the same workflow call listed in the workflow running list, one for each line, like I show in my screenshot for "VIP System Remediation Control".
    I do not use any datatable helper functions, just a rule that launch the WF each time a line is added.

    ------------------------------
    BENOIT ROSTAGNI
    ------------------------------



  • 12.  RE: Function is executed only once when triggered multiple times

    Posted Tue June 02, 2020 12:48 AM
    Hey Benoit,

    changing the "object type" to Data Table in the workflow solved my problem.
    Many thanks for your help.

    Kind regards,

    G

    ------------------------------
    Guy Snellinx
    ------------------------------



  • 13.  RE: Function is executed only once when triggered multiple times

    Posted Fri May 22, 2020 09:36 AM
    This also happened to me when i was working with artifacts
    Admin
    geometrydashapks.com

    ------------------------------
    Gau Muk
    ------------------------------