IBM QRadar SOAR

IBM QRadar SOAR

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only
  • 1.  Set top-level Incident from with an Incident script.

    Posted 07/26/24 03:19 AM

    Do we have something similar but from within an Incident script:

    I just want to set the top-level incident to an incident that I got as result of an incident query.



    ------------------------------
    mohamad islam hamadieh
    ------------------------------


  • 2.  RE: Set top-level Incident from with an Incident script.

    Posted 07/26/24 10:18 AM

    Hi Mohamad,

    Unfortunately, there is not an equivalent script method once in an incident. We do have an app, fn_soar_utils.search_incidents which can be used in a similar way. I think this is a good idea which would be a good enhancement if you'd like to request it in our ideas portal:  https://ideas.ibm.com/

    Regards,

    Mark



    ------------------------------
    Mark Scherfling
    ------------------------------



  • 3.  RE: Set top-level Incident from with an Incident script.

    Posted 08/01/24 05:32 AM

    Thank @Mark Scherfling .

    I have created the idea.

    IBM Ideas

    please whoever think it's useful , vote on it.



    ------------------------------
    mohamad islam hamadieh
    ------------------------------