IBM QRadar SOAR

IBM QRadar SOAR

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  IBM SOAR PLaybook Issue

    Posted 03/29/23 01:11 AM

    Hi all! I am facing an issue while running SOAR playbook. 

    When I run the playbook manually, it does not run beyond one of the wait points in the playbook. 

    Appreciate your help.

    Thanks!



    ------------------------------
    Dushan Dissanayake Information Security Engineer
    ------------------------------


  • 2.  RE: IBM SOAR PLaybook Issue

    Posted 03/30/23 03:27 PM

    Hi Dushan,

    Can you share some information on what is happening before and what is meant to happen after the wait point? Additionally, if there is an error message that comes up, please share that as well.



    ------------------------------
    Priya Sapra
    ------------------------------



  • 3.  RE: IBM SOAR PLaybook Issue

    Posted 03/31/23 07:17 AM

    Hi Priya,

    Thank you for the response. 

    Please refer to the screenshot below which was taken from the playbook I've mentioned. The playbook only runs till the Wait Point 2 and shows the 100% completion of the tasks. 

    This is a demo playbook created to simulate the issue.
    Appreciate your help.

    Thanks!


    ------------------------------
    Dushan Dissanayake Information Security Engineer
    ------------------------------

    Original Message


  • 4.  RE: IBM SOAR PLaybook Issue
    Best Answer

    Posted 04/03/23 08:42 AM
    Edited by Dushan Dissanayake 04/06/23 11:37 PM

    Hi Dushan,

    I didn't try it but I think the Wait point 2 is useless. You point waits for both branches to continue which will never happen because you have a condition before who runs only one of the two paths.
    You should remove the Wait Point 2 and link the paths directly to the following task.

    Hope I helped.



    ------------------------------
    Jonathan BULACH
    ------------------------------

    Original Message


  • 5.  RE: IBM SOAR PLaybook Issue

    Posted 04/06/23 11:39 PM

    Hi Jonathan,

    Yes you're correct. I tried the same and it seems the playbook can continue without the wait point 2. Thanks for the input. It was really helpful. 



    ------------------------------
    Dushan Dissanayake Information Security Engineer
    ------------------------------

    Original Message


Related Content