IBM QRadar SOAR

IBM QRadar

Join this online topic group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.


#Security
#QRadar
#SecuringhybridcloudandAI
 View Only
  • 1.  Notification substitution values

    Posted 09/07/20 07:00 AM

    Hello everyone, 

    I'm trying to configure a mail notification that fires upon a rule trigger.

    It is an incident closure mail notification in which I'd like to show some critical aspects of the incident. For example, I'm running a workflow that does an IP Lookup and prints it on the artifact's description, I'd like to have that result in the mail.

    Following the IBM Knowledge Center, I ran into an article that explains the Substitution Values ( https://www.ibm.com/support/knowledgecenter/SSBRUQ_35.0.0/com.ibm.resilient.doc/admin/resilient_m_admin_settings_org_substitution_values.html)

    I didn't find a compete list of possible values tough and my attempt to guess the right variable has failed.

    My goal is to have notes, description and basically workflows outputs into the mail, is it possible?



    ------------------------------
    Alessandro Di Liberto
    ------------------------------


  • 2.  RE: Notification substitution values

    Posted 09/08/20 10:07 AM
    The only data available for notification substitution is the actual data for the object of the notification (incident, task, datatable, etc) and the properties of it's parent (note->task->incident, artifact->incident).

    Therefore it is not possible to get workflow properties, nor is it possible to get a full list of notes.

    In this case, it sounds like you are creating a notification for an incident close. Therefore, only the incident properties are available. You mention description, so it would be ${incident.description}. If you were interested in custom incident properties it would be ${incident.properties.custom_boolean} for example.

    Ben

    ------------------------------
    Ben Lurie
    ------------------------------



  • 3.  RE: Notification substitution values

    Posted 09/08/20 11:52 AM

    Hello Ben, 

    Thanks for the detailed answer.

    So, basically, I should be able to create a custom property where to "route" the output of the function that I want to show on the mail.

    e.g, in my case, I do an IP Lookup and I want that lookup to be on the closure notification mail.

    Is that correct?



    ------------------------------
    Alessandro Di Liberto
    ------------------------------



  • 4.  RE: Notification substitution values

    Posted 09/09/20 07:14 AM
    That is correct. 

    Ben

    ------------------------------
    Ben Lurie
    ------------------------------