IBM QRadar SOAR

IBM QRadar SOAR

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only
  • 1.  How to use the logging functions in playbooks

    Posted Mon January 08, 2024 04:57 AM

    When exploring playbooks available online and the documentation I saw that there are log operations that could be used. Does anyone know how they work exactly? I tried using log.info() in my playbooks with a format string as a message, but I didn't see it displayed anywhere in the playbook progress. If the playbook completes without error I know it passed through the spot where the call was made, so why don't I see it? I end up using addNote to see the progress of a playbook when developing, but that feels very messy. 

    For anyone curious here's the documentation page 



    ------------------------------
    Maria Czapkowska
    ------------------------------


  • 2.  RE: How to use the logging functions in playbooks

    Posted Tue January 09, 2024 11:40 PM

    Hi Maria

    You can try "grep Context /var/log/resilient-scripting/resilient-scripting.log" on SOAR terminal session.



    ------------------------------
    Yohji Amano
    ------------------------------



  • 3.  RE: How to use the logging functions in playbooks

    Posted Thu January 11, 2024 05:09 AM

    Hi Yohji,

    Thanks for replying. I did manage to find that. I personally find that very uncomfortable to have to connect to the server every time I need to debug something, as that would be pretty much all the time while developing a playbook. I'm wondering if I'm the only one who thinks so?



    ------------------------------
    Maria Czapkowska
    ------------------------------



  • 4.  RE: How to use the logging functions in playbooks

    Posted Wed January 17, 2024 06:59 PM

    I concur. Competing products are miles ahead in this department. 



    ------------------------------
    Nick B
    ------------------------------



  • 5.  RE: How to use the logging functions in playbooks

    Posted Thu January 18, 2024 10:50 AM

    Good question. This is kind of a gap. Scripting don't have this capability. You can return with custom errors via:

    helper.fail("Message")

    You could also write to an incident field as a workaround. It is possible to create a logger field, and append to it as execution occurs.

    From the functions themselves, you can certainly do logging with StatusMessage/FunctionError.



    ------------------------------
    Jared Fagel
    Cyber Security Analyst
    ALLETE Inc.
    ------------------------------