IBM QRadar SOAR

IBM QRadar

Join this online topic group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.


#Security
#QRadar
#SecuringhybridcloudandAI
 View Only
  • 1.  How to copy workflow

    Posted 09/28/21 01:45 PM
    Hi everyone,

    Sorry for this newbie question but how can you copy a workflow in the customization settings?

    I tried creating a new one and I copied each element (input, pre-process, post-process,...) from an example provided with an app.  It has only one function call (QRadar search).
    The original example works fine.  The manual copy I made fails with an error like "...An error occurred while processing the action acknowledgement. Additional information: Post-processing script for Function 'QRadar Search' from Workflow 'My Test search QRadar event' was unable to complete because: AttributeError: 'dict' object has no attribute 'StartTime'.

    Thanks for your help.

    ------------------------------
    Pierre Dufresne
    ------------------------------


  • 2.  RE: How to copy workflow

    Posted 09/29/21 08:07 AM
    Unfortunately there is no easy way to duplicate/copy an existing workflow. If the post-processing script is the same in both cases that likely means that the data returned from the function is different in some way. 

    Ben

    ------------------------------
    Ben Lurie
    ------------------------------



  • 3.  RE: How to copy workflow

    Posted 07/13/22 04:39 PM
    You should use the resilient-sdk clone --workflow 'workflow name' 'new workflow name' command, but you need to install and configure resilient-sdk before that obviously

    ------------------------------
    Jonatan Arellano
    ------------------------------