IBM QRadar SOAR

If your function returns a string in JSON format that you wish to save to a Note in the post-processing script, you can use json.dumps() function with an indent argument, that automatically formats content, to make it more readable. If you add sort_keys=True the output of dictionaries will be sorted by key:

import json
...
results = json.dumps(person_list, sort_keys=True, indent=4, separators=(',', ': '))​
yield FunctionResult(results)

In the post-processing script add the Note as a plain text:

incident.addNote(noteText)

Pretty printed JSON output:

------------------------------
Tamara Zlender
------------------------------

Is there a better way for doing this now on 38.x as I receive the following if I attempt to do that?

Script contains the following illegal imports: json

------------------------------
Mr Coco
------------------------------

Original Message:
Sent: Tue November 13, 2018 09:12 AM
From: Tamara Zlender
Subject: Pretty printed JSON output

If your function returns a string in JSON format that you wish to save to a Note in the post-processing script, you can use json.dumps() function with an indent argument, that automatically formats content, to make it more readable. If you add sort_keys=True the output of dictionaries will be sorted by key:

import json...results = json.dumps(person_list, sort_keys=True, indent=4, separators=(',', ': '))​yield FunctionResult(results)

In the post-processing script add the Note as a plain text:

incident.addNote(noteText)

Pretty printed JSON output:

------------------------------
Tamara Zlender
------------------------------

Hi Mr Coco,

In order to import json your script needs to be running in Python 3 which was released in version 38.2. For more info see the documentation and our example scripts repo:

https://www.ibm.com/docs/en/rsoa-and-rp/38?topic=scripts-python-2-python-3-differences
https://github.com/ibmresilient/resilient-scripts/tree/master/python3

------------------------------
Sean Mc Cann
------------------------------

Original Message:
Sent: Wed May 05, 2021 11:23 AM
From: Mr Coco
Subject: Pretty printed JSON output

Is there a better way for doing this now on 38.x as I receive the following if I attempt to do that?

Script contains the following illegal imports: json

------------------------------
Mr Coco

Original Message:
Sent: Tue November 13, 2018 09:12 AM
From: Tamara Zlender
Subject: Pretty printed JSON output

If your function returns a string in JSON format that you wish to save to a Note in the post-processing script, you can use json.dumps() function with an indent argument, that automatically formats content, to make it more readable. If you add sort_keys=True the output of dictionaries will be sorted by key:

import json...results = json.dumps(person_list, sort_keys=True, indent=4, separators=(',', ': '))​yield FunctionResult(results)

In the post-processing script add the Note as a plain text:

incident.addNote(noteText)

Pretty printed JSON output:

------------------------------
Tamara Zlender
------------------------------