IBM QRadar SOAR

IBM QRadar SOAR

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only
  • 1.  'is added' Rule Condition

    Posted 06/13/22 09:08 AM
    All,

    I am trying to create a condition that will fire whenever a certain group is added as a member of an incident.

    I noticed the 'is added' option for the members field. I went to the documentation (here) and it states the following for the condition:

    Condition is True when the value [a] is added.

    I'm interpreting this (based on some of the other condition descriptions provided) that I should be able to specify a value and when that value is added to the field the rule will trigger. Is this the correct interpretation of this condition?

    When I go to configure the condition I am unable to specify a value (I've checked both rule conditions and playbook conditions):


    I want to make sure that this is expected. I was hoping another input box would appear to the right where I'd be able to specify a value that should trigger this rule when it's added to the members.

    Thanks!

    ------------------------------
    Liam Mahoney
    ------------------------------