IBM QRadar SOAR

IBM QRadar SOAR

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only
Back to discussions
Expand all | Collapse all

[Question] IBM SOAR Scheduler App Error - playbooks and actions fields are empty

  • 1.  [Question] IBM SOAR Scheduler App Error - playbooks and actions fields are empty

    Posted Mon May 05, 2025 09:26 AM

    Hi community,

    I'm facing a technical issue with the Scheduler app in IBM SOAR, and I'd really appreciate it if anyone has experienced something similar or managed to get this app working properly in the past year.

    Context

    The Scheduler app is designed to trigger rules or playbooks on a scheduled basis (using cron, intervals, specific dates, etc.). In my case, I'm using the built-in playbook "Scheduler: Schedule a Job (PB)" that comes with the app installation. The goal is to delay and later execute a custom playbook called "Scheduled Note", which meets the following conditions:

    • Type: incident
    • Trigger: manual
    • Status: enabled and working

    The Issue

    When trying to execute the scheduled playbook, I get the following error:

    ValueError("Rule/Playbook '%s' for this %s not found or not enabled", scheduler_rule_name, object_type_name)

    The error message suggests that the playbook cannot be found or is not enabled, which we have verified is not the case. I've also tested this with both playbooks and workflows (rules), but the error persists in both scenarios.

    Source code investigation

    Since IBM Support hasn't provided a clear answer yet, I decided to review the app's source code-specifically the create_a_scheduled_rule.py script. I discovered that the error is caused by the validate_actions method returning None for rule_id:

    Looking deeper, I found that validate_actions uses a method called get_id, which tries to look up the rule or playbook ID from the incident object's playbooks or actions fields. The issue is that both fields are empty or missing, so id_lookup.get(...) returns None:

    This behavior can be confirmed with the following simple logging lines inside a script:

    log.info(incident.playbooks)
log.info(incident.actions)

    Both fields return empty or None, which prevents the Scheduler app from validating and executing the scheduled action.

    Questions for the community

    • Has anyone managed to get the Scheduler app working in recent IBM SOAR environments?
    • Under what conditions should the incident.playbooks and incident.actions fields be populated?
    • Are these fields still actively used, or have they been deprecated or altered in recent versions?
    • Is there a recommended workaround to achieve similar scheduling functionality without relying on these fields?

    Any insights or experiences would be greatly appreciated. I'm trying to determine whether this is a bug, a misconfiguration, or a compatibility issue with newer SOAR versions.

    Best regards,
    Rodrigo Hormazabal

    SOAR Engineer



    ------------------------------
    Rodrigo Hormazabal Rebolledo
    ------------------------------


Related Content