IBM QRadar SOAR

IBM QRadar SOAR

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only
  • 1.  Playbook Execution ID

    Posted Wed October 18, 2023 10:29 AM

    Hello all,

    My team and I are trying to eventually be able to use the Playbook Execution API to get the status of a playbook after it runs (if it has errored or successful), and then do further automation based on that. We have found this endpoint which seems to be helpful:
    `rest/orgs/{orgId}/playbooks/execution/{execution_id}/activities` but I cannot figure out a way to get the execution id from within the playbook. 

    I know there is an endpoint `rest/orgs/{orgId}/playbooks/execution/query_paged` that does have execution ids in it, but rather than having to call this every time and see if a new execution id exists, it would be better if we could get the execution id from within the playbook, and make the api call based on that. 

    I have tried printing the entire playbook object from within the playbook, and this is all I got: `{'functions': {'results': {}}, 'subplaybooks': {'results': {}}, 'properties': {}, 'inputs': {}}`

    Is the execution ID hidden somewhere else within the playbook, or is there a different way to access it? I don't understand how we are supposed to use this API Endpoint without this information being more available - and if the only way to get it is by looking at the playbook screen itself, it isn't very helpful for automation. 

    Thanks in advance!



    ------------------------------
    Isaac Eichelberger
    ------------------------------


  • 2.  RE: Playbook Execution ID

    Posted Thu October 19, 2023 01:03 PM

    Hi Isaac -

    As far as I know, your suggested use of the /playbooks/execution/query_paged endpoint is the only way to achieve this. If you're trying to do this all through a Playbook, I would recommend hitting that endpoint using our REST API Function app. If you're writing a custom function, you could hit it pretty easily with the provided rest_client in the function.

    Let me know if I can help in any other ways!

    Bo



    ------------------------------
    Bo Bleckel
    ------------------------------



  • 3.  RE: Playbook Execution ID

    Posted 10 days ago

    Hi Bo,

    Could you help me to get the list of playbooks in SOAR using /playbooks/execution/query_paged 
    Can you give example  for request body for this REST API :
    {
      "filters": [
        {
          "conditions": [
            {
              "method": "...",
              "field_name": "...",
              "value": {},
              "type": "...",
              "evaluation_id": 12345
            },
            {
              "method": "...",
              "field_name": "...",
              "value": {},
              "type": "...",
              "evaluation_id": 12345
            }
          ],
          "logic_type": "...",
          "type_handle": {
            "id": {},
            "name": "..."
          }
        },
        {
          "conditions": [
            {
              "method": "...",
              "field_name": "...",
              "value": {},
              "type": "...",
              "evaluation_id": 12345
            },
            {
              "method": "...",
              "field_name": "...",
              "value": {},
              "type": "...",
              "evaluation_id": 12345
            }
          ],
          "logic_type": "...",
          "type_handle": {
            "id": {},
            "name": "..."
          }
        }
      ],
      "logic_type": "...",
      "sorts": [
        {
          "field_name": "...",
          "type": "...",
          "type_handle": {
            "id": {},
            "name": "..."
          }
        },
        {
          "field_name": "...",
          "type": "...",
          "type_handle": {
            "id": {},
            "name": "..."
          }
        }
      ],
      "start": 12345,
      "length": 12345,
      "recordsTotal": 12345
    }


    can you help to get all fields in above json request body and explain what are that fields and where to get the values for that fields.

    Thank you,

    Sai



    ------------------------------
    Sai Kumar Reddy Dhubbaka
    ------------------------------