IBM QRadar SOAR

IBM QRadar

Join this online topic group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.


#Security
#QRadar
#SecuringhybridcloudandAI
 View Only
  • 1.  Script Replacing 'From' with 'Sender'

    Posted 12/09/20 05:42 PM
    Hi all,

    I came across some interesting behavior with scripts in Resilient this afternoon.

    If I try to create a string with the word "From" in it, I notice that the output of the script replaces "From" with "Sender".

    I'm not sure if this is intended or not? 

    e.g.

    ```
    note = "Testing.. From from FROM fRoM From end test"
    log.info(note)
    incident.addNote(note)
    ```

    Will write the note

    > Testing.. Sender from FROM fRoM Sender end test
     
    on the incident.

    Any thoughts? 


    ------------------------------
    Liam Mahoney
    ------------------------------


  • 2.  RE: Script Replacing 'From' with 'Sender'

    Posted 12/10/20 08:01 AM
    It looks like this is a bug with the new Python 3 language support. This works fine using Python 2 language support.

    I will let the team know. Thank you for your findings.

    Ben

    ------------------------------
    Ben Lurie
    ------------------------------



  • 3.  RE: Script Replacing 'From' with 'Sender'

    Posted 12/11/20 09:19 AM
    Hi Liam,

    Thanks again for raising this issue, we will work on getting this fixed as soon as possible and i'll let you know when I can confirm the fix version.

    Just for some context on why this happens, from is a reserved keyword in Python 3 so we had to make some changes in order to accommodate our EmailMessage object, which also contained an attribute named from. We did this by replacing from with sender behind the scenes. This is an unintended side effect of that.

    Thanks,

    ------------------------------
    Sean Mc Cann
    ------------------------------