IBM QRadar SOAR

IBM QRadar

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only
  • 1.  Workflow function still running after terminating workflow

    Posted Mon August 26, 2019 04:05 PM
    Edited by Liam Mahoney Mon August 26, 2019 04:07 PM
    All,

    I'm wondering if there's a way to terminate a running function within a workflow? I have terminated a workflow but the function(s) the workflow uses are still running. I would like to terminate / cancel the running functions.

    Thank you!

    ------------------------------
    Liam Mahoney
    ------------------------------


  • 2.  RE: Workflow function still running after terminating workflow

    Posted Tue August 27, 2019 08:20 AM

    Hi Liam,

    There's no automatic way to cancel a function for a terminated workflow. But, long running functions can interrogate Resilient to determine if the workflow is still active or not. It's up to the function developer to add this logic.

    We've added a helper routine to resilient_lib to facilitate this interrogation. It's resilient_lib.get_workflow_status(), which takes the workflow_id (passed to an executing function through the event object) and returns a data structure containing the workflow status. Here's what the logic would look like:

    from resilient_lib import get_workflow_status

    wf_instance_id = event.message["workflow_instance"]["workflow_instance_id"]
    res_client = self.rest_client()

    wf_status = get_workflow_status(res_client, wf_instance_id)

    if wf_status.is_terminated:
    yield StatusMessage('Workflow was terminated.')


    ------------------------------
    Mark Scherfling
    ------------------------------



  • 3.  RE: Workflow function still running after terminating workflow

    Posted Tue August 27, 2019 09:15 AM
    Mark,

    Thank you! I'll look into implementing this in the functions I create going forward

    ------------------------------
    Liam Mahoney
    ------------------------------