IBM QRadar SOAR

IBM QRadar SOAR

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  How to use API Secret values ​​in REST API Functions without hardcoding them

    Posted 03/20/25 02:26 AM
      |   view attached

    Hello, Everyone

    I am trying to query a DataTable using the REST API.

    Currently, the API key and secret need to be hardcoded in the REST API function. However, the client considers this a security issue and is looking for an alternative method.

    The official IBM documentation (GitHub) only provides examples using tokens, and community responses I've found also suggest hardcoding as the only method.

    If anyone has solved this issue before or has a good idea, please share your insights.

    Below are the links I referenced.

    Github : https://github.com/ibmresilient/resilient-community-apps/tree/main/fn_rest_api#example--

    Community Links
    https://community.ibm.com/community/user/security/question/rest-api-how-to-get-data-from-soar-by-call-api-to-soar-itself#0049151b-2804-4f11-b30f-0192e2ecf9ae
    https://community.ibm.com/community/user/security/discussion/call-rest-api-to-servicenow-using-basic-authentication-error#bm91c68550-85be-4f37-8f61-50bccc74a5a5
    http://community.ibm.com/community/user/security/discussion/call-rest-api-function-script-authentication-parameter-help#bm882305b4-5e87-4bb8-9d67-018ea692cd95
    https://community.ibm.com/community/user/security/discussion/apphost-rest-api-function#bm4550dace-fa00-4ab3-a5f0-7beef6a8a08a



    ------------------------------
    Yongwon Song
    ------------------------------


  • 2.  RE: How to use API Secret values ​​in REST API Functions without hardcoding them

    Posted 03/20/25 02:28 AM

    These are the methods I used.



    ------------------------------
    Yongwon Song
    ------------------------------



  • 3.  RE: How to use API Secret values ​​in REST API Functions without hardcoding them

    Posted 03/20/25 05:10 AM

    Hi Yongwon , 

    please refer to this part of the documentation, I'm sure you can use these secrets defined here in your app configuration but not sure if you can use them in a playbook you have to test that.



    ------------------------------
    Mohamad islam Hamadieh
    I post SOAR content and tips on linkedIn , follow me :)
    https://linkedin.com/in/mohamadislam
    ------------------------------



  • 4.  RE: How to use API Secret values ​​in REST API Functions without hardcoding them

    Posted 03/21/25 11:13 AM

    I have the same question and was looking for a solution a while back but no luck.  I tried that in the playbook but doesn't work.



    ------------------------------
    Raymond Tam
    ------------------------------

    Original Message


  • 5.  RE: How to use API Secret values ​​in REST API Functions without hardcoding them

    Posted 03/25/25 03:48 AM
    Edited by Yongwon Song 03/25/25 03:57 AM

    Hello, Mohamad islam Hamadieh.

    Thank you for reply.

    I have already tried the link you attached.

    I created a secret key in app.config and then added it to the The intention is to get the secret key from the playbook and use it as the basic in the header.

    However, the problem is that base64 doesn't encode the imported value, it encodes the variable name as it is.

    Thank you.

    ------------------------------
    Yongwon Song
    ------------------------------

    Original Message


  • 6.  RE: How to use API Secret values ​​in REST API Functions without hardcoding them
    Best Answer

    Posted 03/25/25 04:03 AM

    a workaround you could do then is to encode the key:secret as base64 outside the code , maybe on your device or using an online encoder.

    then you can create a secret for that base64 and use it directly without encoding inside your code.

     



    ------------------------------
    Mohamad islam Hamadieh
    I post SOAR content and tips on linkedIn , follow me :)
    https://linkedin.com/in/mohamadislam
    ------------------------------

    Original Message


  • 7.  RE: How to use API Secret values ​​in REST API Functions without hardcoding them

    Posted 03/24/25 10:49 AM

    Hi Yongwon one question and one recommendation:

    1. What fn/app are you specifically using ? (including the version) ?
    2. Take a look to this part of the documentation https://ibmresilient.github.io/resilient-community-apps/fn_rest_api/README.html#input-considerations related to the latest fn_rest_api App, I think it's exacly what you're looking for.

    Hope that helps



    ------------------------------
    Juan Paulo
    IBM
    Santiago
    ------------------------------



  • 8.  RE: How to use API Secret values ​​in REST API Functions without hardcoding them

    Posted 03/25/25 03:57 AM

    Hello, Juan

    Thank you for reply.

    1. What fn/app are you specifically using ? (including the version) ?

    -> fn_rest_api (ver.1.2.1)

    2. Take a look to this part of the documentation https://ibmresilient.github.io/resilient-community-apps/fn_rest_api/README.html#input-considerations related to the latest fn_rest_api App, I think it's exacly what you're looking for.

    -> I also tried the link you attached.

    The documentation only explains how to use Token, not Key - Secret.

    Even when it is described, it is hardcoded.

    My intention is to create a secret key in app.config and then get that secret key from the playbook and use it as the Basic in the header.

    Thank you.



    ------------------------------
    Yongwon Song
    ------------------------------

    Original Message


  • 9.  RE: How to use API Secret values ​​in REST API Functions without hardcoding them

    Posted 03/31/25 03:13 AM
      |   view attached

    Hello, everyone!

    I wasn't able to solve it exactly the way I wanted, but I managed to find a workaround.

    I'm not sure if this will be helpful, but I'd like to share the solution I found in case it is! :)

    I encoded the SOAR API Key:Secret using an online encoder, then stored the encoded value in a secret file and retrieved it from there.

    To make it easier to understand, I've also attached an image!

    Once again, thank you to everyone who took the time to respond.



    ------------------------------
    Yongwon Song
    ------------------------------



Related Content