IBM QRadar SOAR

IBM QRadar

Join this online topic group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.


#Security
#QRadar
#SecuringhybridcloudandAI
 View Only
  • 1.  Workflow function still running after terminating workflow

    Posted 08/26/19 04:05 PM
    Edited by Liam Mahoney 08/26/19 04:07 PM
    All,

    I'm wondering if there's a way to terminate a running function within a workflow? I have terminated a workflow but the function(s) the workflow uses are still running. I would like to terminate / cancel the running functions.

    Thank you!

    ------------------------------
    Liam Mahoney
    ------------------------------


  • 2.  RE: Workflow function still running after terminating workflow

    Posted 08/27/19 08:20 AM

    Hi Liam,

    There's no automatic way to cancel a function for a terminated workflow. But, long running functions can interrogate Resilient to determine if the workflow is still active or not. It's up to the function developer to add this logic.

    We've added a helper routine to resilient_lib to facilitate this interrogation. It's resilient_lib.get_workflow_status(), which takes the workflow_id (passed to an executing function through the event object) and returns a data structure containing the workflow status. Here's what the logic would look like:

    from resilient_lib import get_workflow_status

    wf_instance_id = event.message["workflow_instance"]["workflow_instance_id"]
    res_client = self.rest_client()

    wf_status = get_workflow_status(res_client, wf_instance_id)

    if wf_status.is_terminated:
    yield StatusMessage('Workflow was terminated.')


    ------------------------------
    Mark Scherfling
    ------------------------------



  • 3.  RE: Workflow function still running after terminating workflow

    Posted 08/27/19 09:15 AM
    Mark,

    Thank you! I'll look into implementing this in the functions I create going forward

    ------------------------------
    Liam Mahoney
    ------------------------------