IBM QRadar SOAR

IBM QRadar SOAR

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only
  • 1.  How to see the result from a function?

    Posted Wed March 27, 2024 04:56 PM

    What is the best way to see the result returned by a function?  E.g. a function does an API call and returns a json result.
    I tried to output the results to Notes.   The result looks like a json output but when I parse it using a json tool, it doesn't like the format.

    Below are the two addNote output scripts I tried.  I am open to other ideas that can help visualize the result from a function.

    Output script 1:
    import json
    results = playbook.functions.results.rest_response
    incident.addNote("ipinfo.\n{}".format(results.get("content", {})))
      
    Output script 2:
    import json
    results = playbook.functions.results.rest_response
    data = json.dumps(results)
    incident.addNote(str(results))
     
     
     Noe: The intend to view the result is to figure out how to pull specific fields and values needed from the json dictionary.



    ------------------------------
    Ray Tam
    ------------------------------


  • 2.  RE: How to see the result from a function?
    Best Answer

    Posted Thu March 28, 2024 02:19 AM

    What I usually do when trying to understand the results is just add the whole thing to a note and then copy it and paste in to a text editor and save as json. Then, when opened with a browser it's easy to read and find what's useful. 

    the code I'd use would be something like this:

    results = playbook.functions.results.rest_response
    incident.addNote(f"{results}") 



    ------------------------------
    Maria Czapkowska
    ------------------------------



  • 3.  RE: How to see the result from a function?

    Posted Thu March 28, 2024 08:47 AM

    Hi,

    On my part, what I usually do is:

    import json

    incident.addNote(json.dumps(playbook.functions.results.rest_response),indent=2))

    The indent parameter will make the output much clearer.



    ------------------------------
    Pierre Dufresne
    ------------------------------



  • 4.  RE: How to see the result from a function?

    Posted Thu March 28, 2024 11:41 AM

    Hi Pierre and Maria,

    Thanks for the suggestions.  I tried both of the solutions. Both are able to do what I want.

    FYI - Just want to mention there is an extra closing parenthesis.  After I removed it, it works fine. 

    Original: 
    incident.addNote(json.dumps(playbook.functions.results.rest_response),indent=2))

    Modified
    incident.addNote(json.dumps(playbook.functions.results.rest_response,indent=2))



    ------------------------------
    Ray Tam
    ------------------------------