IBM QRadar SOAR

IBM QRadar SOAR

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only
Back to discussions
Expand all | Collapse all

How to extract Artifact.id and import them to application's function on Incident Playbook

  • 1.  How to extract Artifact.id and import them to application's function on Incident Playbook

    Posted Fri April 05, 2024 10:42 AM

    Good day! everyone,

    I'm newbie of IBM SOAR.
    I have parse an suspicious email to many elements and add them to artifacts table like below:


    I knew that each artifact have an unique artifact.id and artifact.id only available in Playbook object type: Artifact. So, how can I extract them and assign these artifact.id values to field task layout which can used by application function (Like Virustotal) in Playbook object type: Incident ?

    Any answer will be highly appreciated.
    Best Regard!




     



    ------------------------------
    Benny On
    ------------------------------