IBM QRadar SOAR

IBM QRadar

Join this online topic group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.


#Security
#QRadar
#SecuringhybridcloudandAI
 View Only
  • 1.  Handling Artifact Creation Errors in Scripts

    Posted 02/13/20 10:59 AM
    Edited by Liam Mahoney 02/13/20 11:18 AM

    All,

    I'm trying to create URL artifacts in the post-process script of one of my functions, but some of the URLs that are being returned are junk (e.g. 'http://').

    When I try to add 'http://' as a URL artifact I get an error. I'm fine with 'http://' not getting added as an artifact, but the error causes the rest of the script/workflow to stop executing.

    I could use regex to validate that the URL follows a URL pattern before attempting to add it as a URL artifact, but I feel handling the artifact error would be more robust.

    I tried using this try/except:

    try:
        incident.addArtifact("URL", "http://", "description")
    except Exception:
        log.info("Artifact creation failed")
        pass

    but it didn't catch the "Error Running Script: The Script is unable to update the Incident <name> because: The specified URL is invalid: 'http://'" error.

    Is there any way to catch/handle the artifact creation error and continue script execution?

    Thanks,



    ------------------------------
    Liam Mahoney
    ------------------------------


  • 2.  RE: Handling Artifact Creation Errors in Scripts

    Posted 02/24/20 04:56 PM
    Unfortunately the actual artifact creation is done later on in the process so it won't show up as a python exception.

    Ben

    ------------------------------
    Ben Lurie
    ------------------------------