IBM QRadar SOAR

IBM QRadar

Join this online topic group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.


#Security
#QRadar
#SecuringhybridcloudandAI
 View Only
  • 1.  How to pass action event and message to function

    Posted 05/21/19 02:50 AM
    I have a Menu Item rule, which I used like below

    @handler("enable_account")
    def enable_account(self, event, source=None, headers=None, message=None):
    self._enable_account(event=event, message=message, artefact_type="employee_lookup")
     
    Now Same rule I am trying to use in Function. I have modified the rule and passed to the appropriate workflow.
     
    I need event and message(red marked) into function.
    How to pass these variables to function ?

    ------------------------------
    Sarfaraj Sayyad
    ------------------------------


  • 2.  RE: How to pass action event and message to function

    Posted 05/22/19 10:15 AM

    Hi Sarfaraj,

    Functions have a different signature. When you use resilient-circuits codegen, you'll notice the logic generated for a function looks like this:

    class FunctionComponent(ResilientComponent):
       @function("<function_name>")
       def _my_function(self, event, *args, **kwargs):
            wf_instance_id = event.message["workflow_instance"]["workflow_instance_id"]

            # Get the function parameters:
            param1 = kwargs.get("param1") # number
            param2 = kwargs.get("param2") # number

    You can use event.message to access all data elements sent on the message destination. kwargs is used to access the parameters sent from the function.  My recommendation is to use resilient-circuits codegen to build the prototype code which you can then modify with your specific logic.

    Hope this helps.
       



    ------------------------------
    Mark Scherfling
    ------------------------------