IBM QRadar SOAR

IBM QRadar SOAR

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only
  • 1.  Message Queues - Expect Acknowledgement

    Posted 07/26/22 10:05 AM
    Greetings!

    I would like to know how does exactly the "Expect Acknowledgement" options work, specially, what happens if I set it to No. 

    Is an ACK inmediately presented if the option is set to No? Does it still wait until MQ returns something?

    When sending +1000 ACKs in a short time, the platform seems to behave weird. ACKs will then take more (sometimes a lot) time to process those ACKs, which affects workflows.

    Does setting ACK to no fix this issues?

    Thanks for your help and have a nice day,

    ------------------------------
    -------------------------
    Pol Estecha
    SOAR Development @ Deloitte
    -------------------------
    ------------------------------


  • 2.  RE: Message Queues - Expect Acknowledgement

    Posted 08/15/22 09:55 AM
    From https://www.ibm.com/docs/en/sqsp/45?topic=destinations-message

    • Expect Acknowledgement. When set to Yes, the destination expects the script to return an acknowledgment after it processes the message. Set the field to No if you do not require an acknowledgment or you expect the scripts to silently process messages without returning any indication of progress or status.

      The Action Status for the action is listed as Pending until the acknowledgment is received. If an acknowledgment is not received within a day, the status for the action changes to Timed Out.


    So if the message destination is used by a workflow function, and the function won't interact with SOAR after processing, setting it to No may save some processing when the message acknowledged.

    ------------------------------
    VINCENT DENG
    ------------------------------