IBM QRadar SOAR

IBM QRadar SOAR

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only
  • 1.  MX lookup function

    Posted 12/14/22 10:30 PM
    HI IBM community,

    I want to ask regarding the implementation of mx lookup for IBM SOAR Playbook. Using the function from app exchange below:

    The function from what I understand, called the mxtoolbox via API call and will return back output to the playbook (via post process script?). Currently I want to analyse email header via playbook and ask the mxtoolbox to communicate and return me the result. However, upon reading the documentation, I have not found example on how to configure it. What inputs should the mx function receives to work in my use-case.

    Thanks in advance.

    ------------------------------
    Luqman Nur
    ------------------------------


  • 2.  RE: MX lookup function

    Posted 12/15/22 10:54 AM
    You are going to have to go into the customization settings and edit the function input named `mx_command`. You will have to add a new option named, `emailheaders`, then save it. Now in your playbook your function input for `mx_command` will be emailheaders and your input for `mx_argument` will be the email header you want to analysis.

    ------------------------------
    Richard Swierk
    ------------------------------



  • 3.  RE: MX lookup function

    Posted 12/15/22 08:15 PM
    Edited by Luqman Nur 12/15/22 10:27 PM
    Hi Richard,

    Thanks for the guide. Just want to confirm that the script will be something along this line?



    Also I just edit the functions in the customisation tab where I add the "email_header" in the mx_command. I have encountered different error relating to the API call where the email_header is a bad request (status code: 400). I have look the mxtoolbox website for the API documentation, but it only links to the product page. Is it possible that the product only for paid customers



    ------------------------------
    Luqman Nur
    Techlab
    ------------------------------