IBM QRadar SOAR

IBM QRadar SOAR

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  Generate IBM Security QRadar SOAR Incident Link

    Posted Thu March 17, 2022 10:35 AM
    All,

    We've found it's pretty common to want to generate a link for a given IBM Security QRadar SOAR incident link within an in-product script.

    Our use-case: when an incident is generated from another security tool we like to leave a comment on the alert / ticket in that tool that contains the link to the associated IBM Security QRadar SOAR incident.

    Right now I am hardcoding the link which causes headaches when moving workflows between our test and production environments.

    Does anyone have a more dynamic way of generating incident links within the in-product scripts?

    Thanks,

    ------------------------------
    Liam Mahoney
    ------------------------------


  • 2.  RE: Generate IBM Security QRadar SOAR Incident Link

    Posted Fri March 18, 2022 11:48 AM
    Hi Liam,

    I don't know how to manage that from a script. From apps, we have common methods you can use from resilient-lib: build_incident_url and build_resilient_url. I've used  them like this:

    url = build_incident_url(build_resilient_url(res_options.get('host'), res_options.get('port')), incidentID)

    Where res_options is a dictionary of the [resilient] section from the app.config file.

    You can see all the common functions documented here: https://ibmresilient.github.io/resilient-python-api/pages/resilient-lib/resilient-lib.html

    Hope this helps
    Mark


    ------------------------------
    Mark Scherfling
    ------------------------------

    Original Message


  • 3.  RE: Generate IBM Security QRadar SOAR Incident Link

    Posted Mon March 21, 2022 10:00 AM
    Mark,

    I appreciate the response. Sounds like I'll refactor the workflows to call a function that uses the build_incident_url function before posting the note.

    The documentation on the common functions is going to be a very helpful resource, thank you guys for making it!

    Thanks again!


    ------------------------------
    Liam Mahoney
    ------------------------------

    Original Message


  • 4.  RE: Generate IBM Security QRadar SOAR Incident Link

    Posted Fri March 08, 2024 10:48 PM

    Hi Mark

    I tried the above in apps code and I'm getting an error as to res_options not defined.
    Would you have any other suggestions ?

    Thanks

    Preetham



    ------------------------------
    Fnu Preetham Nagesh
    ------------------------------

    Original Message


  • 5.  RE: Generate IBM Security QRadar SOAR Incident Link

    Posted Mon March 11, 2024 07:43 AM

    Hi Preetham,

    `res_options` in my example is a variable you've already set. Depending on your code, you may need to create that variable like this:

    @app_function(FN_NAME)
    def _app_function(self, fn_inputs):
        ...
        res_options = self.options.get("resilient", {})
        url = build_incident_url(build_resilient_url(res_options.get('host'), res_options.get('port')), incidentID)

    Hope this helps.



    ------------------------------
    Mark Scherfling
    ------------------------------

    Original Message


Related Content