IBM QRadar SOAR

IBM QRadar SOAR

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only
  • 1.  Script - Process inbound email

    Posted Sun February 18, 2024 04:05 PM

    Hello Expert,

    I want to modify the highlighted script to create an incident based on a particular incident type. The incident created by the script is empty.

    Regards,



    ------------------------------
    benlinux
    ------------------------------


  • 2.  RE: Script - Process inbound email

    Posted Mon February 19, 2024 12:58 AM

    Hi,
    Did you try create automated rule with condition incident type ="your type" then it will run the mentioned script 



    ------------------------------
    Khaled Nasr
    ------------------------------



  • 3.  RE: Script - Process inbound email

    Posted Mon February 19, 2024 05:58 AM

    Hello Khaled,

    Thank you for your response. 

    I dont want to create an incident when the incident type is of a particular value. I want the script to create an incident with a particular type. Th reason I want the incident to be created with a particular incident type, is because I have a custom phishing playbook that only triggered when an incident of a particular incident type is created.

    As i previously mentioned i already have a rule that generates an incident from an incoming email based on this script, but the incident type is empty, causing my custom playbook not to be triggered.

    Hope this explain my use case.



    ------------------------------
    benlinux
    ------------------------------



  • 4.  RE: Script - Process inbound email

    Posted Tue February 20, 2024 03:02 AM

    You have to set the incident type in your code, it won't set on it's own that's why it's empty. If you need a custom incident type go to Customization Settings > Incident Type and add Type then use that in your code



    ------------------------------
    Maria Czapkowska
    ------------------------------



  • 5.  RE: Script - Process inbound email

    Posted Thu February 22, 2024 10:44 AM
    Edited by benlinux Thu February 22, 2024 10:49 AM

    Hello Maria,

    Thanks, but i know how to create an incident type, infact i have done that. My question is how do i set the incident type in my code ?.

    Regards,



    ------------------------------
    benlinux
    ------------------------------



  • 6.  RE: Script - Process inbound email

    Posted Fri February 23, 2024 08:05 AM

    Usually, I have second script with:

    incident.incident_type_ids = [u'my incident type']

    that I run in the email rule, just after the generic email script.



    ------------------------------
    BENOIT ROSTAGNI
    ------------------------------