Hello!

I'd like to write a script where the fields of a task are filled up automatically. 

But when I try somthing like this:

fields.incident.email_contains_link = u"Yes"

I get the error

email_contains_link is a readonly attribute on line ....

How can I set or amend field values?

------------------------------
Achim Quehenberger
------------------------------

First, your field is very strange and does not look like a real test sample.
if it is an OOTB Field, you will work on it using:
incident.ootb_field_name
like in a script:
incident.description = "My description"
if it is a field you have created yourself, it will be
it will be:
incident.properties.my_field_name
like in a script:
incident.properties.tlp = "RED"

here I create a tasck script that change the value of a field existing in a task :


------------------------------
BENOIT ROSTAGNI
------------------------------

Hi Benoit!

Thank you for this information. It worked perfectly!

You're right. This is not an ootb field but a self created one.

Is there any summarized documentation about information like this? 
I don't want to bother this community with simple questions which could easily be answered by reading the manual.
I wouldn't have hit the idea to use "properties" in this. I didn't even know that there is something like properties here.

Am I searching for the wrong things or were is this information stored?

Best,
Achim

------------------------------
Achim Quehenberger
------------------------------

Original Message:
Sent: Wed April 15, 2020 04:47 AM
From: BENOIT ROSTAGNI
Subject: Set field values

First, your field is very strange and does not look like a real test sample.
if it is an OOTB Field, you will work on it using:
incident.ootb_field_name
like in a script:
incident.description = "My description"
if it is a field you have created yourself, it will be
it will be:
incident.properties.my_field_name
like in a script:
incident.properties.tlp = "RED"

here I create a tasck script that change the value of a field existing in a task :

------------------------------
BENOIT ROSTAGNI
------------------------------

I really suggest you check the online training,  for example here with a filter on "artifact":

https://www.securitylearningacademy.com/local/navigator/index.php?search=artifact&level=inir01

or the general documentation , also with a filter on "artifact":
https://www.ibm.com/support/knowledgecenter/search/artifact?scope=SSBRUQ_36.0.0

------------------------------
BENOIT ROSTAGNI
------------------------------

Original Message:
Sent: Wed April 15, 2020 05:01 AM
From: Achim Quehenberger
Subject: Set field values

Hi Benoit!

Thank you for this information. It worked perfectly!

You're right. This is not an ootb field but a self created one.

Is there any summarized documentation about information like this? 
I don't want to bother this community with simple questions which could easily be answered by reading the manual.
I wouldn't have hit the idea to use "properties" in this. I didn't even know that there is something like properties here.

Am I searching for the wrong things or were is this information stored?

Best,
Achim

------------------------------
Achim Quehenberger
------------------------------


Original Message:
Sent: Wed April 15, 2020 04:47 AM
From: BENOIT ROSTAGNI
Subject: Set field values

First, your field is very strange and does not look like a real test sample.
if it is an OOTB Field, you will work on it using:
incident.ootb_field_name
like in a script:
incident.description = "My description"
if it is a field you have created yourself, it will be
it will be:
incident.properties.my_field_name
like in a script:
incident.properties.tlp = "RED"

here I create a tasck script that change the value of a field existing in a task :

------------------------------
BENOIT ROSTAGNI

Thank you for the advice. But I already watched some videos and it is sometimes hard to see if that video contains the information I am looking for. 
Further, it is not very handy if I have to watch videos or search the general docs for scripting topics.

I imagine somthing like this:
https://docs.python.org/3/library/index.html

Or at least a first good documentation is:
https://www.ibm.com/support/knowledgecenter/SSBRUQ_35.0.0/com.ibm.resilient.doc/playbook/resilient_playbook_configscripts_writing_incident.html
A nice overview of all the functions that the object type provides. 

But docs like this are not a great help ( is this still under construction?)
https://www.ibm.com/support/knowledgecenter/SSBRUQ_35.0.0/com.ibm.resilient.doc/playbook/resilient_playbook_configscripts_writing_fields.html

Unfortunately I stand in front of the next issue.
Now that I know how to set the value of the field "fields.incident.email_contains_link"
I would like to use an if statement if there is an artifact in this incident with artifact.type == "URL"

But as I am in an object type "Task" and not "Artifact" I can't use artifact.

It says:




------------------------------
Achim Quehenberger
------------------------------

Original Message:
Sent: Wed April 15, 2020 05:09 AM
From: BENOIT ROSTAGNI
Subject: Set field values

I really suggest you check the online training,  for example here with a filter on "artifact":

https://www.securitylearningacademy.com/local/navigator/index.php?search=artifact&level=inir01

or the general documentation , also with a filter on "artifact":
https://www.ibm.com/support/knowledgecenter/search/artifact?scope=SSBRUQ_36.0.0

------------------------------
BENOIT ROSTAGNI
------------------------------


Original Message:
Sent: Wed April 15, 2020 05:01 AM
From: Achim Quehenberger
Subject: Set field values

Hi Benoit!

Thank you for this information. It worked perfectly!

You're right. This is not an ootb field but a self created one.

Is there any summarized documentation about information like this? 
I don't want to bother this community with simple questions which could easily be answered by reading the manual.
I wouldn't have hit the idea to use "properties" in this. I didn't even know that there is something like properties here.

Am I searching for the wrong things or were is this information stored?

Best,
Achim

------------------------------
Achim Quehenberger


Original Message:
Sent: Wed April 15, 2020 04:47 AM
From: BENOIT ROSTAGNI
Subject: Set field values

First, your field is very strange and does not look like a real test sample.
if it is an OOTB Field, you will work on it using:
incident.ootb_field_name
like in a script:
incident.description = "My description"
if it is a field you have created yourself, it will be
it will be:
incident.properties.my_field_name
like in a script:
incident.properties.tlp = "RED"

here I create a tasck script that change the value of a field existing in a task :

------------------------------
BENOIT ROSTAGNI

At this moment, you can't look for the "upper level"  into a "lower level", from incident into artifact or attachment or notes or tasks. It will be possible in a future release if dev plan goes well.

So in order to answer your questions today, you need to look and solve the problem from the other end : the artifact level.

1. Create an incident field : "Artifact Has URL" type Boolean
2. Create a new automatic rule, on artifact, conditions Artifact Type is equal to URL and Artifact is Created and Artifact Value has a Value with the Ordered action Set Field on field  Incident: Artifact Has URL to Yes

Then you can re-use this incident.properties.artifact_has_url == True test in any scripts...




------------------------------
BENOIT ROSTAGNI
------------------------------

Original Message:
Sent: Wed April 15, 2020 08:07 AM
From: Achim Quehenberger
Subject: Set field values

Thank you for the advice. But I already watched some videos and it is sometimes hard to see if that video contains the information I am looking for. 
Further, it is not very handy if I have to watch videos or search the general docs for scripting topics.

I imagine somthing like this:
https://docs.python.org/3/library/index.html

Or at least a first good documentation is:
https://www.ibm.com/support/knowledgecenter/SSBRUQ_35.0.0/com.ibm.resilient.doc/playbook/resilient_playbook_configscripts_writing_incident.html
A nice overview of all the functions that the object type provides. 

But docs like this are not a great help ( is this still under construction?)
https://www.ibm.com/support/knowledgecenter/SSBRUQ_35.0.0/com.ibm.resilient.doc/playbook/resilient_playbook_configscripts_writing_fields.html

Unfortunately I stand in front of the next issue.
Now that I know how to set the value of the field "fields.incident.email_contains_link"
I would like to use an if statement if there is an artifact in this incident with artifact.type == "URL"

But as I am in an object type "Task" and not "Artifact" I can't use artifact.

It says:

------------------------------
Achim Quehenberger
------------------------------


Original Message:
Sent: Wed April 15, 2020 05:09 AM
From: BENOIT ROSTAGNI
Subject: Set field values

I really suggest you check the online training,  for example here with a filter on "artifact":

https://www.securitylearningacademy.com/local/navigator/index.php?search=artifact&level=inir01

or the general documentation , also with a filter on "artifact":
https://www.ibm.com/support/knowledgecenter/search/artifact?scope=SSBRUQ_36.0.0

------------------------------
BENOIT ROSTAGNI


Original Message:
Sent: Wed April 15, 2020 05:01 AM
From: Achim Quehenberger
Subject: Set field values

Hi Benoit!

Thank you for this information. It worked perfectly!

You're right. This is not an ootb field but a self created one.

Is there any summarized documentation about information like this? 
I don't want to bother this community with simple questions which could easily be answered by reading the manual.
I wouldn't have hit the idea to use "properties" in this. I didn't even know that there is something like properties here.

Am I searching for the wrong things or were is this information stored?

Best,
Achim

------------------------------
Achim Quehenberger


Original Message:
Sent: Wed April 15, 2020 04:47 AM
From: BENOIT ROSTAGNI
Subject: Set field values

First, your field is very strange and does not look like a real test sample.
if it is an OOTB Field, you will work on it using:
incident.ootb_field_name
like in a script:
incident.description = "My description"
if it is a field you have created yourself, it will be
it will be:
incident.properties.my_field_name
like in a script:
incident.properties.tlp = "RED"

here I create a tasck script that change the value of a field existing in a task :

------------------------------
BENOIT ROSTAGNI

I submitted an idea in the ideas portal for this functionality here:

https://2e4ccba981d63ef83a875dad7396c9a0.ideas.aha.io/ideas/R-I-464

Basically, the query_builder() should have been implemented to allow this functionality.

------------------------------
Jared Fagel
Cyber Security Analyst I
Public Utility
------------------------------

Original Message:
Sent: Wed April 15, 2020 08:39 AM
From: BENOIT ROSTAGNI
Subject: Set field values

At this moment, you can't look for the "upper level"  into a "lower level", from incident into artifact or attachment or notes or tasks. It will be possible in a future release if dev plan goes well.

So in order to answer your questions today, you need to look and solve the problem from the other end : the artifact level.

1. Create an incident field : "Artifact Has URL" type Boolean
2. Create a new automatic rule, on artifact, conditions Artifact Type is equal to URL and Artifact is Created and Artifact Value has a Value with the Ordered action Set Field on field  Incident: Artifact Has URL to Yes

Then you can re-use this incident.properties.artifact_has_url == True test in any scripts...




------------------------------
BENOIT ROSTAGNI
------------------------------


Original Message:
Sent: Wed April 15, 2020 08:07 AM
From: Achim Quehenberger
Subject: Set field values

Thank you for the advice. But I already watched some videos and it is sometimes hard to see if that video contains the information I am looking for. 
Further, it is not very handy if I have to watch videos or search the general docs for scripting topics.

I imagine somthing like this:
https://docs.python.org/3/library/index.html

Or at least a first good documentation is:
https://www.ibm.com/support/knowledgecenter/SSBRUQ_35.0.0/com.ibm.resilient.doc/playbook/resilient_playbook_configscripts_writing_incident.html
A nice overview of all the functions that the object type provides. 

But docs like this are not a great help ( is this still under construction?)
https://www.ibm.com/support/knowledgecenter/SSBRUQ_35.0.0/com.ibm.resilient.doc/playbook/resilient_playbook_configscripts_writing_fields.html

Unfortunately I stand in front of the next issue.
Now that I know how to set the value of the field "fields.incident.email_contains_link"
I would like to use an if statement if there is an artifact in this incident with artifact.type == "URL"

But as I am in an object type "Task" and not "Artifact" I can't use artifact.

It says:

------------------------------
Achim Quehenberger


Original Message:
Sent: Wed April 15, 2020 05:09 AM
From: BENOIT ROSTAGNI
Subject: Set field values

I really suggest you check the online training,  for example here with a filter on "artifact":

https://www.securitylearningacademy.com/local/navigator/index.php?search=artifact&level=inir01

or the general documentation , also with a filter on "artifact":
https://www.ibm.com/support/knowledgecenter/search/artifact?scope=SSBRUQ_36.0.0

------------------------------
BENOIT ROSTAGNI


Original Message:
Sent: Wed April 15, 2020 05:01 AM
From: Achim Quehenberger
Subject: Set field values

Hi Benoit!

Thank you for this information. It worked perfectly!

You're right. This is not an ootb field but a self created one.

Is there any summarized documentation about information like this? 
I don't want to bother this community with simple questions which could easily be answered by reading the manual.
I wouldn't have hit the idea to use "properties" in this. I didn't even know that there is something like properties here.

Am I searching for the wrong things or were is this information stored?

Best,
Achim

------------------------------
Achim Quehenberger


Original Message:
Sent: Wed April 15, 2020 04:47 AM
From: BENOIT ROSTAGNI
Subject: Set field values

First, your field is very strange and does not look like a real test sample.
if it is an OOTB Field, you will work on it using:
incident.ootb_field_name
like in a script:
incident.description = "My description"
if it is a field you have created yourself, it will be
it will be:
incident.properties.my_field_name
like in a script:
incident.properties.tlp = "RED"

here I create a tasck script that change the value of a field existing in a task :

------------------------------
BENOIT ROSTAGNI