IBM QRadar SOAR

IBM QRadar SOAR

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  SOAR - Playbook stattus "In Progress" no details of the error are observed

    Posted Wed March 26, 2025 11:22 AM 
    Greetings to everyone on the team.

I'm having trouble identifying errors in my REST API script.

When I check the events, it doesn't show anything related to the error in my script.

I'm trying to send a JSON file to an API and I can't see the source of the problem.

    ################################
    details of the error.

    ################################



    

     
    

    09:56:29.847 [qtp1291480295-40] INFO  v=unknown  c.r.s.c.p.CPythonProcessBuilder - Going to make RESILIENT_PYTHON3_LATEST_MILLIS equal to 1743000994847
    

    09:56:29.848 [qtp1291480295-40] INFO  v=unknown  c.r.s.c.CPythonScriptingService - CPython process starting
    

    09:56:29.886 [LogReaderThread for qtp1291480295-40] INFO  v=unknown  c.r.s.cpython.process.CPythonProcess - pid 3003575: python3-runtime - Starting runtime
    

    09:56:29.976 [LogReaderThread for qtp1291480295-40] INFO  v=unknown  c.r.s.cpython.process.CPythonProcess - pid 3003575: python3-runtime - CPython process starting
    

    09:56:29.977 [LogReaderThread for qtp1291480295-40] INFO  v=unknown  c.r.s.cpython.process.CPythonProcess - pid 3003575: ScriptRunner - Going to disable any runtime logging below INFO level
    

    09:56:29.981 [LogReaderThread for qtp1291480295-40] INFO  v=unknown  c.r.s.cpython.process.CPythonProcess - pid 3003575: LoggerContext - None
    

    09:56:29.982 [LogReaderThread for qtp1291480295-40] INFO  v=unknown  c.r.s.cpython.process.CPythonProcess - pid 3003575: ScriptRunner - Finished running script. 2 script lines executed in 0.089408 seconds.
    

    09:56:29.982 [LogReaderThread for qtp1291480295-40] INFO  v=unknown  c.r.s.cpython.process.CPythonProcess - pid 3003575: ScriptRunner - RAM max RSS 20100, CPU usage 0.126969 seconds
    

    09:56:29.982 [LogReaderThread for qtp1291480295-40] INFO  v=unknown  c.r.s.cpython.process.CPythonProcess - pid 3003575: python3-runtime - CPython process ending
    

    09:56:29.983 [qtp1291480295-40] INFO  v=unknown  c.r.s.c.CPythonScriptingService - CPython process is ended
    

    09:56:30.152 [qtp1291480295-43] INFO  v=unknown  c.r.s.c.p.CPythonProcessBuilder - Going to make RESILIENT_PYTHON3_LATEST_MILLIS equal to 1743000995151
    

    09:56:30.152 [qtp1291480295-43] INFO  v=unknown  c.r.s.c.CPythonScriptingService - CPython process starting
    

    09:56:30.190 [LogReaderThread for qtp1291480295-43] INFO  v=unknown  c.r.s.cpython.process.CPythonProcess - pid 3003581: python3-runtime - Starting runtime
    

    09:56:30.289 [LogReaderThread for qtp1291480295-43] INFO  v=unknown  c.r.s.cpython.process.CPythonProcess - pid 3003581: python3-runtime - CPython process starting
    

    09:56:30.290 [LogReaderThread for qtp1291480295-43] INFO  v=unknown  c.r.s.cpython.process.CPythonProcess - pid 3003581: ScriptRunner - Going to disable any runtime logging below INFO level
    

    09:56:30.299 [qtp1291480295-43] INFO  v=unknown  c.r.s.c.CPythonScriptingService - CPython process is ended
    

    09:56:30.299 [LogReaderThread for qtp1291480295-43] INFO  v=unknown  c.r.s.cpython.process.CPythonProcess - pid 3003581: ScriptRunner - Finished running script. 9 script lines executed in 0.097968 seconds.
    

    09:56:30.300 [LogReaderThread for qtp1291480295-43] INFO  v=unknown  c.r.s.cpython.process.CPythonProcess - pid 3003581: ScriptRunner - RAM max RSS 20336, CPU usage 0.133442 seconds
    

    09:56:30.300 [LogReaderThread for qtp1291480295-43] INFO  v=unknown  c.r.s.cpython.process.CPythonProcess - pid 3003581: python3-runtime - CPython process ending





    ------------------------------
    jose g
    ------------------------------


  • 2.  RE: SOAR - Playbook stattus "In Progress" no details of the error are observed

    Posted Thu March 27, 2025 02:05 AM

    Hello Jose,

    Is that happening every single time when this playbook triggered? Did you try to cancel and rerun it? What's result of rerun?



    ------------------------------
    Erkam Çetiner
    Principal SOC Specialist
    erkamcetinerwork@gmail.com
    ------------------------------

    Original Message


  • 3.  RE: SOAR - Playbook stattus "In Progress" no details of the error are observed

    Posted Fri March 28, 2025 08:01 AM

    Suggest making sure your API call is working first outside of SOAR e.g. via CURL command or Postman. Good luck!



    ------------------------------
    ken ching
    ------------------------------

    Original Message