Hello,

I wrote a custom script using API and python, which sends the URL of the offense to the Slack channel. Scrips works URL is sent. The problem is when a custom action runs it sends an incorrect URL. It sends the previous URL of the offense, not a valid offense URL. I try some custom rules, but the result is the same. I also try to add sleep time in the script, but the script did not run. I tried adding a custom action when creating an offense log, but the result is the same URL is incorrect. I also try the app in QIN-Incident-Notifier, but it has not to feature which I need. I need information on how to add a trigger when creating an offense URL and after running a custom script or any information which helps me to send offense URL to Slack channel

------------------------------
Nikoloz Tsiklauri
------------------------------

Nikoloz

you ran into a problem with offense response. When calling your script offense ID and URL does not exist yet.
so the only way to parse IDs and corresponding URLs is to search for your existing offenses first and parse data to your script.
when using offense names, magnitude or other values that apply you can identify the correct offense that just triggered.

regards 
Karl

------------------------------
[Karl] [Jaeger] [Business Partner]
[QRadar Specialist]
[pro4bizz]
[Karlsruhe] [Germany]
[4972190981722]
------------------------------

Karl,

thank you for your response.

But offense names, magnitude and other values are not unique and result is same

------------------------------
Nikoloz Tsiklauri
------------------------------

Original Message:
Sent: Fri January 06, 2023 06:22 AM
From: Karl Jaeger
Subject: Offense URL

Nikoloz

you ran into a problem with offense response. When calling your script offense ID and URL does not exist yet.
so the only way to parse IDs and corresponding URLs is to search for your existing offenses first and parse data to your script.
when using offense names, magnitude or other values that apply you can identify the correct offense that just triggered.

regards 
Karl

------------------------------
[Karl] [Jaeger] [Business Partner]
[QRadar Specialist]
[pro4bizz]
[Karlsruhe] [Germany]
[4972190981722]
------------------------------

Nikoloz
Im terribly sorry cause my explanation was misunderstood. I'll try again. Your script is ok. However while you walk trhough your response process you work on events identified in the 1st place, right? If that is the case your offense id shown in offense summary doesnt exist yet cause the offense isnt fully created yet.
So you have to wait for the offense id and URL be created in the first place. Of course all other offense attributes are not unique but you can use them to filter your offense search. Your custom offense description can be used for searching unique rules matching. When your rule index is source IP the offenses generated by that rule matching that source will be correlated automatically. You just need to make sure that your offense search runs "neartime" in order to grab the right offense id, e.g. during the next minute. The offense id found would be the one your script is executed on using the source IP found in your offense context.
Hope this helps.
Karl

------------------------------
[Karl] [Jaeger] [Business Partner]
[QRadar Specialist]
[pro4bizz]
[Karlsruhe] [Germany]
[4972190981722]
------------------------------

Original Message:
Sent: Fri February 03, 2023 04:30 AM
From: Nikoloz Tsiklauri
Subject: Offense URL

Karl,

thank you for your response.

But offense names, magnitude and other values are not unique and result is same

------------------------------
Nikoloz Tsiklauri
------------------------------


Original Message:
Sent: Fri January 06, 2023 06:22 AM
From: Karl Jaeger
Subject: Offense URL

Nikoloz

you ran into a problem with offense response. When calling your script offense ID and URL does not exist yet.
so the only way to parse IDs and corresponding URLs is to search for your existing offenses first and parse data to your script.
when using offense names, magnitude or other values that apply you can identify the correct offense that just triggered.

regards 
Karl

------------------------------
[Karl] [Jaeger] [Business Partner]
[QRadar Specialist]
[pro4bizz]
[Karlsruhe] [Germany]
[4972190981722]

Hi Nikoloz

I have seen strange failures in parameter handover and execution of custom action Scripts, when the script is written on a Windows-System. .
For some reason, which I can´t excplain it makes a difference if your custom action script has CR/LF line breaks like in Windows or jusr or just CR line breaks. 
Maybe you can give it a try to convert your script with dos2unix prior to uploading. 

One hint before adding delay: custom action scripts are killed automatically by Qradar if their execution time exceeds 15 seconds. 

As the chroot-environment for custom action scripts is very limited, we use our ca scripts only to store the received parameters and process the output later with an external application. 

Regards
Thomas

------------------------------
SIEM-2020
------------------------------