IBM QRadar SOAR

IBM QRadar

Join this online topic group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.


#Security
#QRadar
#SecuringhybridcloudandAI
 View Only
  • 1.  Referencing custom activity field on a rule from pre-process script

    Posted 07/30/19 02:11 PM
    How do I reference a rule's custom activity field from a function's pre-process script in a workflow? I thought I had this working at one point, but it's not working now, and I (a) can't find any documentation on it and (b) can't seem to find anything that works. If it matters, my rule is for an artifact, as is my workflow.

    My custom field's API access name is 'test_field'.

    In the pre-process script for my function, I've tried the following (and many others):
    • incident.properties.test_field
    • workflow.properties.test_field
    • rule.properties.test_field

    All of these evaluate to 'None'.

    This seems like it should be simple, but I can't for the life of me figure it out.

    ------------------------------
    Jeremy Haberman
    ------------------------------


  • 2.  RE: Referencing custom activity field on a rule from pre-process script

    Posted 07/30/19 02:19 PM
    You did it correctly in your third example. Be sure you used the right API name!

    rule.properties.activity_field_api_name

    How do you know it's evaluating to None? I bet it's actually an issue with the function / how you created the function.

    Check to see if you missed a step-- see my internal notes here for better guidance:
    https://github.com/jjfallete/resilient/blob/master/Development%20Self-Help%20Guide.txt


    Additionally, when you restart circuits, look at each info message that is printed in the console with the function name, you may notice it's either not loading or not loading correctly.

    ------------------------------
    Jared Fagel
    Cyber Security Analyst Intern
    Public Utility
    ------------------------------



  • 3.  RE: Referencing custom activity field on a rule from pre-process script

    Posted 07/30/19 02:33 PM
    I was wrong in my initial message. rule.properties.test_field is not evaluating to 'None'. 'rule' is not defined.

    Here's my test.

    1. Create a rule for object type 'Incident' with a custom Text field with an API name of 'test_field'.

    2. Create a workflow for object type 'Incident', with one function, and in the pre-process script for the function, do this:

    test_field_value = rule.properties.test_field
    message = "{0} {1}".format(test_field_value, type(test_field_value))
    helper.fail(message)

    When I run it and supply a value for the field, the message displayed says, "Pre-processing script for Function...was unable to complete because: name 'rule' is not defined."

    ------------------------------
    Jeremy Haberman
    ------------------------------



  • 4.  RE: Referencing custom activity field on a rule from pre-process script

    Posted 07/30/19 02:47 PM
    Try this and see what the error changes to. I bet the compiler is just confused as to where the issue is!
    test_field_value = 'This is a String'

    From memory (could be wrong), I seem to recall .format() not working in the pre/post processors (Jython incompatibility) and reporting odd errors. If that's the issue use concatenation instead, like:
    message = str(test_field_value) + ' ' + str(type(test_field_value))


    ------------------------------
    Jared Fagel
    Cyber Security Analyst Intern
    Public Utility
    ------------------------------



  • 5.  RE: Referencing custom activity field on a rule from pre-process script

    Posted 07/30/19 04:52 PM
    We figured out that Jeremy was running V30 of Resilient and rule activity fields were not supported until V31

    ------------------------------
    AnnMarie Norcross
    ------------------------------



  • 6.  RE: Referencing custom activity field on a rule from pre-process script

    Posted 07/31/19 01:25 PM
    Edited by Jared Fagel 07/31/19 01:26 PM
    Hi @AnnMarie Norcross that's great. I'm not surprised that @Jeremy Haberman or I didn't know this.

    This is part of a bigger issue related to poor developer documentation for Resilient.
    See my aha.io idea on this issue here.​

    Searching Resilient resources, I found only the IBM Knowledge Center documentation on the rule object:
    Rule operations - Present for V32.0.0 and V33.0.0 documentation, not V31 (nor below).
           + The guides here and here are cluttered, outdated, and do not include rule operations (that I could find).
           + This IBM KC documentation does not include a "This features was introduced in V31.0.0" note.


    Just my 2¢ ... hoping to shed more light on this problem that integration developers face. 


    ------------------------------
    Jared Fagel
    Cyber Security Analyst Intern
    Public Utility
    ------------------------------



  • 7.  RE: Referencing custom activity field on a rule from pre-process script

    Posted 07/31/19 08:01 PM
    Hi Jared

    Here is a link to the documentation for Resilient V28 through V33 in the Knowledge Center.

    If you select the V31 link and click (on the left side of the page) Table of Contents -> What's new in V31
    it will take you to this V31 What's new page  which has information on the Activity Fields rule.properties dictionary.

    Here is a link to Resilient Reference guides.

    I hope these documentation pointers help!  I'm sure our tech writers will take your aha.io suggestions
    into consideration.

    ------------------------------
    AnnMarie Norcross
    ------------------------------