IBM QRadar SOAR

IBM QRadar

Join this online topic group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.


#Security
#QRadar
#SecuringhybridcloudandAI
 View Only
  • 1.  Incident field visible only on certain incident types

    Posted 06/04/20 12:59 PM
    Hi everyone!

    I was curious if anyone knows how (or if it's possible) to create a custom incident field that is only visible when a certain incident type is selected. I know tab visibility can be managed this way, but wasn't sure about fields. It's not mandatory for the field to be an option in the wizard but would like to have it as a mandatory upon incident closure.

    Ex: Incident type of Malware - I would like to create a field for Malware Delivery Method with a select/multi option for deriving metrics, but only want the Malware Delivery Method field to be displayed when Incident Type = Malware.

    Thanks in advance!

    ------------------------------
    Jason Jemmott
    Cyber Security Analyst
    ------------------------------


  • 2.  RE: Incident field visible only on certain incident types
    Best Answer

    Posted 06/04/20 10:51 PM
    Edited by Jason Jemmott 06/05/20 09:38 AM
    Hey @Jason Jemmott,

    Yes, you can!

    Here's how:
    1. Go the the Layouts section under "Customization Settings" and locate the layout you want this in.
    2. Create your "Malware Delivery Method" field as you wish (start by clicking "Add Field").
    3. Add your new "Malware Delivery Method" field to the layout wherever you wish it to go.
    4. On the right side at the very bottom you'll see the "Blocks" section, add a "Section" block.
    5. Slide/move the "Section" block above/below where you placed the "Malware Delivery Method" field.
    6. Slide/move the "Malware Delivery Method" field inside the section block you added.
    7. Edit the "Section" block - Add condition of "Incident Type" and select "is equal to" "Malware"
    8. Save your layout.
    9. It will now show when the incident type changes or has been selected within the editor.

    Cheers!

    ------------------------------
    Jared Fagel
    Cyber Security Analyst I
    Public Utility
    ------------------------------



  • 3.  RE: Incident field visible only on certain incident types

    Posted 06/05/20 09:42 AM
    Thanks Jared! This worked perfectly, now I can have my workflows trigger off the value of this field :) - I've never used the blocks section before, is there a particular piece of e-literature or a good video lecture on securitylearningacademy.com that may help me with better understanding the usage of the other Blocks?

    ------------------------------
    Jason Jemmott
    Cyber Security Analyst
    ------------------------------



  • 4.  RE: Incident field visible only on certain incident types

    Posted 06/05/20 11:03 AM
    Hey @Jason Jemmott,

    I couldn't find anything on layouts unfortunately, other than the really basic KnowledgeCenter blurb:
    https://www.ibm.com/support/knowledgecenter/en/SSBRUQ_37.0.0/doc/playbook/resilient_playbook_configlayouts_blocks.html


    Best,


    ------------------------------
    Jared Fagel
    Cyber Security Analyst I
    Public Utility
    ------------------------------



  • 5.  RE: Incident field visible only on certain incident types

    Posted 06/08/20 05:05 PM
    So for the $10M answer - can you set the requirement of these fields to Always and still have them only be visible and required  when they meet the criteria specified in the Section block?

    ------------------------------
    Jason Jemmott
    Cyber Security Analyst
    ------------------------------



  • 6.  RE: Incident field visible only on certain incident types

    Posted 06/09/20 08:20 AM
    This is not currently possible out of the box. I think this can be done with a script. There are two options in this way:

    1) Create  a rule for each field which has conditions that check to see if the field is set when required. If not run a script that uses helper.fail to provide an error message that is useful for the user.
    2) Create a rule that always runs a single script. The script has "if" blocks that checks each field is set when required and if not, then use helper.fail to provide an error message that is useful for the user.

    Here is a very simple example of a script that does something like this:

    if task.at_id == 'determine_if_inappropriate_internal_involvement': if incident.employee_involved is None: helper.fail("'Employee Involved' field must be set to Yes or No") 

    Ben

    ------------------------------
    Ben Lurie
    ------------------------------



  • 7.  RE: Incident field visible only on certain incident types

    Posted 06/09/20 12:40 PM
    See the feature request idea here: https://2e4ccba981d63ef83a875dad7396c9a0.ideas.aha.io/ideas/R-I-67

    To add to @Ben Lurie's first idea. You can also create an automatic rule to re-open a closed incident if it's missing the field and matches the conditions. You can even use the same automatic rule for all missing requirement conditions to keep your rules list clean.​​

    ------------------------------
    Jared Fagel
    Cyber Security Analyst I
    Public Utility
    ------------------------------