IBM QRadar SOAR

IBM QRadar SOAR

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  Script to set incident ownership based on creator users group.

    Posted Mon July 01, 2019 09:21 AM
    Hi, we're looking to set the incident owner based on the group the creator user is a member of. I have created the script below based on the guidelines in the scripting documents but can't seem to get it to work properly, would appreciate some pointers if possible.
    Cheers

    group = groups.findByName ("Cyber Operations")
log.info (incident.owner_id)
log.info (group)
if incident.owner_id in group:
  incident.owner_id = group​


    ------------------------------
    Leon Goodwin
    ------------------------------


  • 2.  RE: Script to set incident ownership based on creator users group.

    Posted Mon July 01, 2019 08:58 PM
    Hi Leon,

    Refer to https://www.ibm.com/support/knowledgecenter/SSBRUQ_32.0.0/com.ibm.resilient.doc/playbook/resilient_playbook_configscripts_writing_groups.htm, "groups.findByName" is used to check whether the current logged in user is a member of the group. 
    It's not possible to check if the incident's owner is a member of a group using in-product script. You need to consider using REST API with Python instead of in-product script.

    Or if the script is run when incident is created and if the creator (current user" is belong to a group, you can use:
    group = groups.findByName("GroupName")
    if group is not None:
       incident.owner_id="GroupName"

    ------------------------------
    LILY WANG
    ------------------------------

    Original Message


  • 3.  RE: Script to set incident ownership based on creator users group.

    Posted Tue July 02, 2019 03:48 AM
    Thanks Lily, the second option on incident creation is perfect for our needs.
    Cheers
    Original Message