IBM QRadar SOAR

IBM QRadar SOAR

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only
Expand all | Collapse all

Trigger Playbook when Task added to Incident Field Has Value

  • 1.  Trigger Playbook when Task added to Incident Field Has Value

    Posted Thu February 24, 2022 02:21 PM

    All,

    I'm having some issues triggering a playbook properly and I'm wondering if anyone on the community has feedback for me.

    I'm trying to trigger a playbook when task 'x' is added to the incident and field 'y' has a value. My issue is that data isn't added to field 'y' until after task 'x' is added to the incident, which prevents the condition from ever evaluating to true. When the field value changes (has a value) it doesn't appear to reevaluate the condition.

    Ideally I'd like to create a condition that triggers once field 'y' has a value and task 'x' is on the incident.

    Is a condition for this situation possible? I've tried quite a few iterations of conditions with no luck yet. I'm thinking I'll need to refactor when the task gets added to wait for the field to have a value parsed into it.

    Thanks




    ------------------------------
    Liam Mahoney
    ------------------------------


  • 2.  RE: Trigger Playbook when Task added to Incident Field Has Value

    Posted Fri February 25, 2022 09:44 AM
    I assume the field 'y' is an incident field? Changes to incident fields only allow Incident-level playbooks/rules to run. Currently there is no mechanism to evaluate incident sub-objects, like tasks, in an Incident-level playbook/workflow. It is definitely a gap that we would like to fill.

    It may be possible to build an incident-level playbook that runs on changes to field 'y'. Then use Functions to see if there are any of Task 'X'. If so, change a property on the task which will then trigger a Task-level playbook.

    Alternatively, if it is possible to wait adding task 'x' until after field 'y' value is present, may be an option.

    Ben

    ------------------------------
    Ben Lurie
    ------------------------------