IBM QRadar SOAR

IBM QRadar SOAR

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only
  • 1.  Unable to post sub-playbook results to parent playbook

    Posted Thu September 28, 2023 05:02 PM

    Hey Community,

    I'm looking for a bit of assistance with creating an "end point" script to produce a result for the parent playbook i'm working on. 

    This sub-playbook leverages the network utilities: Linux shell command function and needs to return that output into the form of a note within an incident. I've attempted to adopt the example output script used for the linux shell command function but i'm running into a syntax error. The script editor doesn't specify exactly where that error is. 

    # Example: playbook with output:
    #
    # outbound_email_results = playbook.functions.results.outbound_email_results
    # if outbound_email_results.success:
    #   playbook.results = {
    #     "success": True,
    #     "message": u"Notification was sent successfully."
    #   }
    # else:
    #   playbook.results = {
    #     "success": False,
    #     "message": u"Notification was sent unsuccessfully. Reason: {0}".format(outbound_email_results.reason)
    #   }
    
    content = playbook.functions.results.dailyhealthcheckoutput.content
    if content.get("exitcode") == 0:
      playbook.results = {
        "note_text": u"Command succeeded: {}\nStandard Out: {}\nStandard Error: {}".format(content.get("commandline"), content.get("stdout"), content.get("stderr"))
       }
    else:
      playbook.results = {
        "note_text": u"Command failed: {}\nStandard Out: {}\nStandard Error: {}".format(content.get("commandline"), content.get("stdout"), content.get("stderr"))
       }

    Any suggestions would be greatly appreciated!



    ------------------------------
    Nick B
    ------------------------------


  • 2.  RE: Unable to post sub-playbook results to parent playbook

    Posted Thu September 28, 2023 05:19 PM

    Solution to the issue. Was as simple as: 

    playbook.results = playbook.functions.results.dailyhealthcheckoutput


    ------------------------------
    Nick B
    ------------------------------