Just in case you want to search incidents from the hostname value in artifacts, REST API "/rest/search_ex" might be used.
Refer to the discussion.
Search word is annotated with "query" in the filter.
{
"query": "<search-value-in-artifacts>",
"org_id": <org-id>,
"filters": {
"incident": [
{
"conditions": [
]
}
],
"artifact": [
{
"conditions": [
]
}
]
},
"types": [
"artifact"
]
}
To use REST API in the playbook, "REST API Functions for IBM QRadar SOAR" can be used.
------------------------------
Yohji Amano
------------------------------
Original Message:
Sent: Thu December 14, 2023 03:42 AM
From: Yohji Amano
Subject: Resilient Query Builder Assistance
Hello, though I'm not the script speciallist, I hope the following may become a hint.
In your script (line 19), query_builder.hasValue(host)....
host seems a variable to represent a hostname.
On the other hand query_builder.hasValue(,,,) should have field name rather than value as argument. For example, fields.incident.addr.
query_builder.hasValue(arg) is the query for returning the incidents whose arg field has some values. (rather than value search)
------------------------------
Yohji Amano
Original Message:
Sent: Wed December 13, 2023 11:04 AM
From: Austin Thomas
Subject: Resilient Query Builder Assistance
I am getting hung up on using Query Builder on a Resilient script. Basically, I am taking system name artifacts and putting them in a reportable custom field in Resilient. I then extract the values of that custom field and iterate through them to query related incidents based on the hostnames available. The query builder seems to return a result (line 19 in script) but line 21 throws the error attached in the screenshot. The string in question, as stated in the error, is test1.bestbuy.com. I have been working on this for weeks and simply am stuck and have no clue what exactly this error means and how to fix it. From my summation, the syntax of the query seems correct. Thanks for the assistance.
------------------------------
Austin Thomas
------------------------------