IBM QRadar SOAR

IBM QRadar

Join this online topic group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.


#Security
#QRadar
#SecuringhybridcloudandAI
 View Only
  • 1.  Patching incident closed through REST API

    Posted 05/17/21 10:16 AM
    Hi All,

    Trying to write a script to help me close 10,000+ incidents automatically. Having issues with the actual patching stage.
    Below is my code - eventually everything below the for loop will be included in the loop but just whilst testing it only patches one at a time.

    I've also tried adding the snippet below but this didn't work either. I've been receiving either a 500 HTTP status code or "TypeError: 'Patch' object is not iterable". Any suggestions on how to go about doing this?
    resolution_id = {
        "name": "Escalated"
    }
    
    resolution_summary = {
        "format": "text",
        "content": "Closed in QRadar"
    }
    ​


    import datetime
    import time
    import resilient
    import logging
    import requests
    import json as jsonlib
    
    try:
            userCredentials={
           "email" : "",
           "password" : '' }
            newSession = requests.Session()
            response = newSession.post('https://.com/rest/session',json=userCredentials,verify=False)
    
    except Exception as e:
            print("Error connecting to Resilient.")
            print(repr(e))
    
    time_from = datetime.datetime.now() - datetime.timedelta(days=7)
    time_from = int(time_from.timestamp())
    
    payload={
      "filters": [
        {
          "conditions": [
            {
              "field_name":"create_date",
              "method": "gt",
              "value": time_from
            },
            {
              "field_name":"plan_status",
              "method": "equals",
              "value": "A"
            }
          ]
        }
      ],
      "sorts": [
        {
          "field_name": "create_date",
          "type": "asc"
        }
      ]
    }
    
    uri = "https://.com/rest/orgs/201/incidents/query_paged?field_handle=-1"
    response = newSession.post(uri,json=payload,verify=False)
    
    uri_closed = 'https://.com/rest/orgs/201/incidents/'
    
    
    
    content = jsonlib.loads(response.content)
    
    for x in content['data']:
        url = "https://.com/rest/orgs/201/incidents/{}".format(x['id'])
    
    data = newSession.get(url)
    
    patch = resilient.Patch(data)
    
    patch.add_value("plan_status", "C")
    patch.add_value("resolution_id", 'Escalated')
    patch.add_value("resolution_summary", 'Closed in QR')
    
    result = newSession.patch(url, patch, overwrite_conflict=True)
    ​



    ------------------------------
    Thanks,
    Gareth
    ------------------------------


  • 2.  RE: Patching incident closed through REST API

    Posted 05/18/21 08:45 AM
    The message 'TypeError: 'Patch' object is not iterable' would happen if
    patch = resilient.Patch(data)​
    doesn't return incident data. Most likely when there is a 500 error returned. The 500 error probably means that the Patch data is incorrect in some way.

    The code to get the incident list from query paged looks ok. But I'm not certain about the remainder of the code. Not sure what is going on here:
    for x in content['data']:
        url = "https://.com/rest/orgs/201/incidents/{}".format(x['id'])​

    Are you trying to get all the ids? This seems like it would just reset the url for each incident?

    Are you trying to patch each incident at a time? Or using multipatch?

    It would be interesting to see what the values of url and patch are here:

    result = newSession.patch(url, patch, overwrite_conflict=True)



    Ben




    ------------------------------
    Ben Lurie
    ------------------------------



  • 3.  RE: Patching incident closed through REST API

    Posted 05/18/21 04:28 PM
    Edited by Gareth Pearson 05/18/21 04:29 PM
    Hey Ben!

    Basically, this part:
    for x in content['data']:
        url = "https://.com/rest/orgs/201/incidents/{}".format(x['id'])​​

    Is just a safety net whilst I test the code and get it working. Instead of updating all of the incidents and potentially breaking something. This just means that it'll only update one at a time. This is just setting the URL to the last incident ID so that the incident can be pulled via a get request and then patched.

    Currently, I'm just patching each at a time. There doesn't seem to be much in the way of clear-cut documentation on how to patch the incidents. All I can find are scripts that do this amongst a number of other actions.

    The values of url and patch end up as:
    url - https://[redacted].com/rest/orgs/201/incidents/41518
    patch - <resilient.patch.Patch object at 0x7f2e2cdb0208>


    What may also give more questions than answers is that it also errors when using overwrite_conflict. It returns that "request() got an unexpected keyword argument 'overwrite_conflict' "

    ------------------------------
    Thanks,
    Gareth
    ------------------------------



  • 4.  RE: Patching incident closed through REST API

    Posted 05/19/21 08:19 AM
    Edited by Ben Lurie 05/20/21 06:52 AM
    I not as familiar with the resilient_lib patch capabilities so I won't have as much information there.

    I find useful information on using the API by seeing how the UI does patching:


    curl 'https://staging2/rest/orgs/202/incidents/28508?return_dto=true' -X PATCH --data-raw '
    { "changes": [ { "field": "addr", "old_value": { "text": null }, "new_value": { "text": "Cambridge, MA" } }, { "field": "workspace", "old_value": { "id": 405 }, "new_value": { "id": 390 } } ] }'
    Basically a change list. You'll need the old value to use the patching mechanism.

    Ben

    ------------------------------
    Ben Lurie
    ------------------------------