IBM QRadar SOAR

IBM QRadar SOAR

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only
  • 1.  Using post processed variables as Inputs in other function on the playbook

    Posted Mon December 19, 2022 12:18 AM
    Hi all,

    I am fairly new to this IBM playbook development environment and stumbled across a problem. Currently I have a functions in the playbook that is processed in a local script (applied regex and sort it into artifact), I intend to use this processed variables as the other functions parameter. The first function being an email parser and breaksdown into multiple different dictionary keys and I want to parse the dns keys of it to the mx_lookup function specifically in the mx_argument parameter.

    Below are the structure/flow of the playbook:


    I hope the details provided is enough.


    ------------------------------
    Luqman Nur
    Techlab
    ------------------------------


  • 2.  RE: Using post processed variables as Inputs in other function on the playbook

    Posted Tue December 20, 2022 03:22 PM
    Hi Luqman,
    I do not know if I understand you well but one thing you could do is delete the email_parse_info script and move its code  directly into the input script of the MXToolbox function.
    Or you could also use the playbook.addProperty playbook operation.  This allows you to build a result-like dictionnary where you can store any information you want and access it from any other script of your playbook.  See the documentation at https://www.ibm.com/docs/en/sqsp/47?topic=scripts-playbook-operations

    HTH



    ------------------------------
    Pierre Dufresne
    ------------------------------



  • 3.  RE: Using post processed variables as Inputs in other function on the playbook

    Posted Tue December 20, 2022 09:42 PM
    Hi Pierre,

    Thanks I have implemented the steps and get it to successfully working as intended

    ------------------------------
    Luqman Nur
    Techlab
    ------------------------------