what is stomp is used in IBM soar
In IBM SOAR, STOMP (Simple Text Oriented Messaging Protocol) is used as the messaging layer that delivers events, playbook triggers, and function calls between the SOAR platform and its apps/integrations. It enables real-time communication by sending messages from SOAR to external components (like custom apps or integrations) and receiving responses back.
π What STOMP Does in IBM SOAR
-
Message transport: STOMP provides a lightweight protocol for sending and receiving messages between SOAR and connected apps.
-
Integration communication: SOAR apps and integrations use STOMP queues to listen for incoming events (e.g., playbook triggers, case updates).
-
Function execution: When a playbook calls a function, SOAR sends a STOMP message to the integration server, which executes the function and returns results.
-
Resilient Circuits framework: IBM's Python-based integration framework (resilient-circuits) listens on STOMP queues for messages and processes them.
-
Certificate-based security: Communication over STOMP is secured using certificates, which can be customized to establish trust between SOAR and the Edge Gateway.
βοΈ How It Works
-
SOAR generates an event (e.g., case update, workflow trigger).
-
Message sent via STOMP to a queue on the integration server.
-
Integration app listens on that queue, processes the event, and executes logic (Python or Go functions).
-
Response returned via STOMP back to SOAR, updating the case or playbook.
π Comparison: STOMP vs REST in IBM SOAR
| Protocol |
Purpose |
Usage in SOAR |
Security |
| STOMP |
Event-driven messaging |
Playbook triggers, function calls, app communication |
Certificate-based, queue-based |
| REST |
API-based interaction |
Case management, querying data, external API calls |
HTTPS with certificates |
π¨ Risks & Considerations
-
Message reliability: If STOMP queues are misconfigured, playbooks may fail to trigger.
-
Certificate management: Incorrect certificates can block communication between SOAR and apps.
-
Performance: STOMP is lightweight but requires proper scaling for high-volume environments.
-
Debugging: Logs from resilient-circuits are essential to trace STOMP message flow.
β
Key Takeaway
STOMP in IBM SOAR is the backbone for real-time, event-driven communication between the SOAR platform and its integrations. REST handles API calls, while STOMP ensures playbooks and functions execute seamlessly through message queues.
Would you like me to dive deeper into resilient-circuits (the Python framework that powers STOMP messaging in SOAR), or into certificate setup for securing STOMP connections?
i am working on ibm soar okay in which when a offense come it goes in it do aql search from soar to qradar and get the data an then parse that data after that it create ticket in my itsm and then send the mail okay but they are doing it for the one offense okay but my monitoring is doing the same in manual way but when the same offense comes they don't create a ticket for that what they do is just rever on the previous mail that the same offense again triggered and add the data there or they create a single ticket for multiple same type of offense so how i can achieve this using soar. improve this paragraph so people can easily understand i will upload this in ibm soar community to seek help
Here's a clearer version of your paragraph, rewritten so the IBM SOAR community can easily understand your use case and question:
I'm working with IBM SOAR integrated with QRadar. Currently, when an offense is triggered, SOAR runs an AQL search in QRadar, retrieves the data, parses it, then creates a ticket in my ITSM system and sends an email notification. This works fine for single offenses.
However, in my manual monitoring process, we handle repeated offenses differently. When the same type of offense occurs again, instead of creating a new ticket, we either:
-
Reply to the previous email, adding the new offense details there, or
-
Keep a single ITSM ticket open and update it with information about all repeated offenses of the same type.
I want to achieve this same behavior in SOAR - so that repeated offenses don't generate new tickets every time, but instead update the existing ticket or email thread with the new data. How can I configure SOAR to handle offenses in this way?
------------------------------
Ajay jha
------------------------------