IBM QRadar SOAR

IBM QRadar SOAR

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only
  • 1.  Unable to view playbook function or task output

    Posted Mon July 29, 2024 06:36 PM

    Hi,

    I'm trying to check my playbook function/task output after playbook run, but i can just see status of that particular task/function as completed.It's not showing any outputs.Please let me know how i can view these outputs.

    Regards,

    Sindhu



    ------------------------------
    Sindhu G
    ------------------------------


  • 2.  RE: Unable to view playbook function or task output

    Posted Tue July 30, 2024 05:37 AM
    Edited by Walter Higgins Tue July 30, 2024 05:51 AM

    If you want to see a function's result, one approach is to add a local script to the playbook (after the function) with code like the following...

    incident.addNote( str( playbook.functions.results.timer_result ) )

    The playbook.functions.results object has properties for each of the named function outputs (in the above example I used the Timer function from App Exchange  and gave it the output name 'timer_result') .

    Once the function and script node have completed you should see a new note added to the incident - e.g. (the result will vary depending on the function)

    {'version': 2.0, 'success': True, 'reason': None, 'content': {'Workflow Status': {'instance_id': 44, 'status': 'running', 'start_date': 1722331588944, 'end_date': None, 'reason': None, 'is_terminated': False}}, 'raw': None, 'inputs': {'timer_time': '10s', 'timer_epoch': None}, 'metrics': {'version': '1.0', 'package': 'fn-timer', 'package_version': '1.0.0', 'host': '6edf412c-fa0d-48e0-b61a-edb78520ad94-79f56c8d74-hm7sd', 'execution_time_ms': 10301, 'timestamp': '2024-07-30 09:26:40'}}

    When editing scripts, clicking the 'View playbook schema' button will show a data navigator sidepane from which you can choose which of the many playbook or incident properties you'd like to insert into the script (click + button to insert the property at the cursor point in the script)

    The built in python str() function will convert any object to a string so you can see all of its properties and values. This can be useful for debugging functions in playbooks.

    ------------------------------
    WALTER HIGGINS
    ------------------------------



  • 3.  RE: Unable to view playbook function or task output

    Posted Tue July 30, 2024 08:22 AM

    Hi,

    Instead of using the str() function, I would recommend using json.dumps like this:

    import json
    incident.addNote(json.dumps(playbook.functions.results.timer_result,indent=2))

    The displayed result is easier to read



    ------------------------------
    Pierre Dufresne
    ------------------------------



  • 4.  RE: Unable to view playbook function or task output

    Posted Thu August 01, 2024 05:37 AM

    @Pierre Dufresne

    nice tip , thanks for sharing



    ------------------------------
    mohamad islam hamadieh
    ------------------------------