IBM QRadar SOAR

IBM QRadar

Join this online topic group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.


#Security
#QRadar
#SecuringhybridcloudandAI
 View Only

  • 1.  Merging incidents with REST API

    Posted 04/08/19 05:24 AM

    Hello team,

     I was wondering whether there were already available Resilient REST API functions capable of merging incidents between them based on some on fields, and if I decide to create one, is it feasable?

    Thanks in advance for your help. 

    Z.S.




  • 2.  RE: Merging incidents with REST API

    Posted 04/09/19 07:02 AM
    We've considered a function to provide this merge capability. Are there specific requirements you'd like to see supported?

    ------------------------------
    Mark Scherfling
    ------------------------------



  • 3.  RE: Merging incidents with REST API

    Posted 04/26/19 10:46 AM
    We are also interested to have such functionality.
    Expected behavior will be something like:
    - Create a new incident
    - Union all artifacts from the incidents
    - Fill in the incident field values as with the first incident of the set that contains a value. (Or the incident to copy value from can be selected)
    - For Severity/Priority, take the highest of all incidents
    - Close the all existing incidents
    - If possible, create a data table showing all incident that were merged


    ------------------------------
    Qing Lan
    ------------------------------

    Original Message


  • 4.  RE: Merging incidents with REST API

    Posted 04/29/19 08:01 AM
    Edited by Sean OGorman 04/29/19 08:01 AM
    Thanks for getting in touch through our Community Forum!

    Currently we do not have a set of Functions on our App Exchange capable of merging incidents together as described in your Discussion. But it is possible and is in our backlog.

    We do listen to requests from our Community and thank you for sharing your Use Case!

    ------------------------------
    Sean OGorman
    ------------------------------

    Original Message


  • 5.  RE: Merging incidents with REST API

    Posted 05/02/19 04:32 AM
    ​Hi team,

    I came across the following a few weeks ago:

    https://github.com/ibmresilient/resilient-python-examples/tree/master/export-to-json

    The github mentioned above contains two scripts: "resilient-export-to-json" and "resilient-merge-incident-json".

    I quote:

    "The "resilient-export-to-json" command takes in a filename which specifies what file to export to and exports incident data from Resilient into that file in JSON format. The command also features optional arguments allowing to limit what incidents are exported, ranging from specifying a last modified field name (allowing export for only modified incidents) to exporting incidents created after or before a date. When exporting, "resilient-export-to-json" overwrites the specified file."

    [...]

    The "resilient-merge-incident-json" command allows for two JSON files, containing incident data exported by "resilient-export-to-json" to be merged together. The command takes in the first filename, second filename, and an output filename which is where merged data is exported to. The second specified file always has priority over the first (i.e if an incident is in both files, it will go with the incident in the second file).
     
    The resilient-merge-incident-json can then do the job.

    Regards,

    Zohra


    ------------------------------
    Zohra SMAIL
    ------------------------------

    Original Message


  • 6.  RE: Merging incidents with REST API

    Posted 05/06/19 01:39 AM
    Interesting ! Thank you Zohra. I'll test this functionnality.

    ------------------------------
    Clément Fouque
    ------------------------------

    Original Message


Related Content