IBM QRadar SOAR

IBM QRadar

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  Workflow Termination

    Posted Mon April 08, 2019 12:56 PM
    Hi All,

    Is there a way to terminate a running workflow with either a rule or script?

    Thanks

    ------------------------------
    Paul Formosa
    ------------------------------


  • 2.  RE: Workflow Termination

    Posted Mon April 08, 2019 01:23 PM
    Hi Paul, 

    You need <g class="gr_ gr_341 gr-alert gr_gramm gr_inline_cards gr_run_anim Grammar multiReplace" id="341" data-gr-id="341">a rule</g> to trigger your workflow, as long as workflow contains your script you can terminate it by going to the Actions menu on an incident > Workflow Status > and Terminate Workflow under the Action column.

    ------------------------------
    Brian Walsh
    Resilient Software Engineer
    ------------------------------

    Original Message


  • 3.  RE: Workflow Termination

    Posted Mon April 08, 2019 01:42 PM
    Hi Brian, thanks for the quick response.

    I am aware of the manual termination method.  I am wondering if there's a way to terminate the workflow through rules or scripts.  The scenario is that I want to start a new/different workflow when a certain condition is met and stop/terminate the 'original' workflow without the incident owner intervening to do the termination.

    ------------------------------
    PAUL FORMOSA
    ------------------------------

    Original Message


  • 4.  RE: Workflow Termination

    Posted Mon April 08, 2019 03:28 PM
    Hi Paul,

    You could do it within the workflow by using the following code but I'm not sure it would work "outside" of the workflow:
    helper.fail("Error Message")

    It seems possible to do it through the REST API. You can use the REST API function from fn_utilities package.
    PUT /orgs/{org_id}/workflow_instances/{wi_id}
    Update a workflow instance. Currently a workflow is allowed to updated from "running" to "terminated" only.

    ------------------------------
    Clément Fouque
    ------------------------------

    Original Message


  • 5.  RE: Workflow Termination

    Posted Mon April 08, 2019 04:04 PM
    You can also set an exclusive gateway in your workflow and if a certain condition is met you could have your workflow call a sub-workflow. This won't terminate the current workflow but you could have that path of your workflow only perform the sub-workflow.

    ------------------------------
    Brian Walsh
    Resilient Software Engineer
    ------------------------------

    Original Message


Related Content