IBM QRadar SOAR

IBM QRadar SOAR

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only
  • 1.  Reference variables from pre-process script in post-process script

    Posted 03/22/22 02:27 PM
    Suppose I create a a list values with 'values = [1,2,4,8]' in the pre-process script. How would I reference it in the post-process script? I initially assumed it would be results["values"] but
    KeyError: 'Invalid field name: values'.

    Any idea on how to fix this error?


    ------------------------------
    Mark Aksen
    ------------------------------


  • 2.  RE: Reference variables from pre-process script in post-process script

    Posted 03/23/22 08:25 AM
    Edited by Leonardo Kenji Shikida 03/23/22 08:25 AM
    I believe you can store your variable in the workflow scope.

    I think every piece of python code is sent separately to local process in the same SOAR console machine and processed as a snippet. In this case, you can't think on pre-process and post-process as part of the same processing unit. That's probably why SOAR has this concept of storing things in the workflow scope.

    Please someone correct me if I am wrong. This is just the feeling I have about how things work behind the curtains.

    []

    Leonardo Kenji Shikida
    ------------------------------



  • 3.  RE: Reference variables from pre-process script in post-process script

    Posted 03/23/22 08:55 AM
    Access to data in a script follows typical programming concepts. Any local variables defined in the script are only available to that instance of the script while it is running. If you want shared/global data you should store the data in the global data context.

    In a workflow:

    workflow.addProperty() / workflow.properties.<propertyname>

    In a playbook:

    playbook.addProperty() / playbook.properties.<propertyname>

    These are available from the time they are first added to the time the workflow/playbook ends.

    Ben

    ------------------------------
    Ben Lurie
    ------------------------------



  • 4.  RE: Reference variables from pre-process script in post-process script

    Posted 03/24/22 06:11 AM
    Here is an example in markdown https://github.com/ibmresilient/resilient-scripts/tree/master/python3/workflow#workflow of storing and accessing workflow properties. As ben says, replace workflow for playbook if you're running in that context.

    ------------------------------
    Sean Mc Cann
    ------------------------------