IBM QRadar SOAR

IBM QRadar SOAR

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only
  • 1.  Patch update not commited

    Posted Wed June 03, 2020 01:47 PM
    Hi,
    I have attempted updating an incident field "plan_status". Though there is no error response, the update does not reflect.

    def mark_incident_closed(inc_id):
    try:
    inc_url = "/incidents/{0}".format(inc_id)
    incident = client.get(inc_url)
    patch = resilient.Patch(incident)
    close_value="C"
    patch.add_value("plan_status",close_value) #original value is "A"
    patch_result = client.patch(inc_url, patch)
    print(client.get(inc_url)["plan_status"]) #patch_result: <Response [200]>
    return {"msg": "patched"}

    except Exception as e:
    print("patch failed")
    return e

    I am however able to update some other fields.

    Thanks.

    ------------------------------
    Apronti Gilbert
    ------------------------------


  • 2.  RE: Patch update not commited

    Posted Wed June 03, 2020 02:51 PM
    Hi Apronti

    To close an incident you have to also update the other "mandatory" fields:
    "resolution_id": { "name": "string" },
    "resolution_summary": { "format": "text", "content": "string" }

    resolution_id would be one of select fields : "Resolved", Unresolved","Duplicate" or "Not an Issue"
    resolution_summary "content" can be any string you want to supply.




    ------------------------------
    AnnMarie Norcross
    ------------------------------



  • 3.  RE: Patch update not commited

    Posted Thu June 04, 2020 05:54 AM
    Hi AnnMarie,
    I am very grateful for your response. I have updated my code to reflect.
    I have been able to update the fields "resolution_id", and "resolution_summary", however the field "plan_status" still remains "A", and from the UI status is still "Active".

    def mark_incident_closed(inc_id):
    try:
    inc_url = "/incidents/{0}".format(inc_id)
    incident = client.get(inc_url)
    patch = resilient.Patch(incident)
    close_value="C"
    patch.add_value("plan_status",close_value) #original value is "A"

    patch.add_value("resolution_id","Resolved")
    patch.add_value("resolution_summary""case notification closure")
    patch_result = client.patch(inc_url, patch)
    print(client.get(inc_url)["plan_status"]) #patch_result: <Response [200]>
    return {"msg": "patched"}

    except Exception as e:
    print("patch failed")
    return e



    ------------------------------
    Apronti Gilbert
    ------------------------------



  • 4.  RE: Patch update not commited

    Posted Thu June 04, 2020 07:23 AM
    Hi Apronti

    The patch should look something like this:
    def mark_incident_closed(inc_id):
    
    try:
        inc_url = "/incidents/{0}".format(inc_id)
        incident = client.get(inc_url)
        patch = resilient.Patch(incident)
        close_value="C"
        patch.add_value("plan_status",close_value) #original value is "A"
    
        resolution_id = {
            "name": "Resolved"
          }
    
        resolution_summary = {
            "format": "text",
            "content": "case notification closure."
          }
        patch.add_value("resolution_id", resolution_id)
    
        patch.add_value("resolution_summary", resolution_summary)
    
        patch_result = client.patch(inc_url, patch)
        print(client.get(inc_url)["plan_status"]) #patch_result: <Response [200]>
        return {"msg": "patched"}
    
    except Exception as e:
        print("patch failed")
        return e​


    ------------------------------
    AnnMarie Norcross
    ------------------------------



  • 5.  RE: Patch update not commited

    Posted Thu June 04, 2020 08:05 AM
    Dear AnnMarie,
    I have updated the code, but the outcome is the same, "plan_status" was not updated. I have produced the field "plan_status" properties below, perhaps the update requires a specific payload.

    {
    "id": 11,
    "name": "plan_status",
    "text": "Status",
    "prefix": None,
    "type_id": 0,
    "input_type": "select",
    "hide_notification": False,
    "chosen": False,
    "default_chosen_by_server": False,
    "blank_option": False,
    "internal": True,
    "uuid": "2df00085-f5f2-4289-844b-6ea014f77ac3",
    "operations": [
    "equals",
    "not_equals",
    "in",
    "not_in",
    "changed",
    "changed_to",
    "not_changed_to",
    "has_a_value",
    "not_has_a_value"
    ],
    "operation_perms": {
    "in": {
    "show_in_manual_actions": True,
    "show_in_auto_actions": True,
    "show_in_notifications": True
    },
    "changed": {
    "show_in_manual_actions": False,
    "show_in_auto_actions": True,
    "show_in_notifications": True
    },
    "equals": {
    "show_in_manual_actions": True,
    "show_in_auto_actions": True,
    "show_in_notifications": True
    },
    "not_equals": {
    "show_in_manual_actions": True,
    "show_in_auto_actions": True,
    "show_in_notifications": True
    },
    "changed_to": {
    "show_in_manual_actions": False,
    "show_in_auto_actions": True,
    "show_in_notifications": True
    },
    "not_in": {
    "show_in_manual_actions": True,
    "show_in_auto_actions": True,
    "show_in_notifications": True
    },
    "not_changed_to": {
    "show_in_manual_actions": False,
    "show_in_auto_actions": True,
    "show_in_notifications": True
    },
    "has_a_value": {
    "show_in_manual_actions": True,
    "show_in_auto_actions": True,
    "show_in_notifications": True
    },
    "not_has_a_value": {
    "show_in_manual_actions": True,
    "show_in_auto_actions": True,
    "show_in_notifications": True
    }
    },
    "values": [
    {
    "value": "A",
    "label": "Active",
    "enabled": True,
    "properties": None,
    "uuid": None,
    "hidden": False,
    "default": False
    },
    {
    "value": "C",
    "label": "Closed",
    "enabled": True,
    "properties": None,
    "uuid": None,
    "hidden": False,
    "default": False
    }
    ],
    "perms": {
    "delete": False,
    "modify_name": False,
    "modify_values": False,
    "modify_blank": False,
    "modify_required": False,
    "modify_operations": False,
    "modify_chosen": False,
    "modify_default": False,
    "show_in_manual_actions": True,
    "show_in_auto_actions": True,
    "show_in_notifications": True,
    "show_in_scripts": True,
    "modify_type": ["select"],
    "sort": True
    },
    "read_only": False,
    "changeable": True,
    "rich_text": False,
    "templates": [],
    "deprecated": False,
    "tags": [],
    "calculated": False,
    "is_tracked": False,
    "allow_default_value": False
    }


    ------------------------------
    Apronti Gilbert
    ------------------------------



  • 6.  RE: Patch update not commited

    Posted Thu June 04, 2020 08:20 AM
    Edited by Ben Lurie Thu June 04, 2020 08:21 AM
    Your original code should work. This is exactly the same thing that the Resilient UI does:

    curl 'https://staging1-02/rest/orgs/230/incidents/6063?return_dto=true' -X PATCH --data-raw '{"changes":[{"field":"plan_status","old_value":{"text":"A"},"new_value":{"text":"C"}}]}'​

    It sounds like the API is return a 200 status. It would be unexpected for a PATCH to return 200 but not apply the changes. My suspicion is that there is a RULE that is running a script or workflow or function that is changing the status.

    My suggestion is to use the UI to close an incident. See if it works. If it does then reopen it and try to close it from your program. That will give you insight into where to look next.

    Ben


    dfdf

    ------------------------------
    Ben Lurie
    ------------------------------



  • 7.  RE: Patch update not commited

    Posted Thu June 04, 2020 08:38 AM
    Edited by Apronti Gilbert Ofoe Thu June 04, 2020 09:30 AM
    Dear Ben,
    Thanks for the suggestion.

    I closed from the UI and received a confirmation dialog. The status however remains "Active". I am investigating if there is a rule or logic preventing it. Will update soon

    Edit
    @Ben Lurie, my admin just confirmed there are rules preventing accidental closure.
    I need to satisfy the rules before closure.

    Thank you for your generous contribution.

    ------------------------------
    Apronti Gilbert
    ------------------------------