IBM QRadar SOAR

IBM QRadar

Join this online topic group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.


#Security
#QRadar
#SecuringhybridcloudandAI
 View Only

  • 1.  I'm trying to create a custom action module.

    Posted 11/14/19 09:43 AM
    Hi,
    I'm trying to create a custom action module by referring to the post.


    <Reference code>
    Content: Constructing a function that repeats the make_api_call contents every 30 seconds

    image.png
    Based on this code, I created a message destination to connect to the custom action module.

    < message destination >
    image.png
    When I run a custom action module with the rule applied, I get complete from the action status. However, the information "No handler returned a result for this action" is written as follows.

    <action status>
    timer test action status.PNG
    <Confirmed that connection with timer is confirmed in resilient-circuits run>
    image.png
    In the circuit, no error is found, but the function is not executed, which means that there is a problem with the handler. I would like to share if there is any material how to solve it. Or let me know if you know how to fix it.




    ------------------------------
    IM HEEJIN
    ------------------------------


  • 2.  RE: I'm trying to create a custom action module.

    Posted 11/15/19 09:34 AM
    Your images did not work, but I recommend you work with a member of IBM Resilient Support for this, they're really good at troubleshooting and getting you off to the right start!

    ------------------------------
    Jared Fagel
    Cyber Security Analyst Intern
    Public Utility
    ------------------------------



Related Content