IBM QRadar SOAR

IBM QRadar

Join this online topic group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  Workflow Timer

    Posted 11/21/19 09:00 AM
    Hello,

    I have been using a workflow with a timer on a specific task that executes a script on a weekly bases (repeatable forever while the task is open) to change a field value that triggers a notification to the incident owner reminding them that the task is still open. This was working until one of the recent Resilient version changes when someone noticed & reported that they were no longer getting their reminder . Here is some background: I have tested changing the field value manually in the incident and changing the value using an API and the notification is triggered/sent with both of these methods. However, if the field value is changed with the script (via the workflow) the the notification is not triggered. When the workflow/script is executed the incident 'Details History' shows that field value is changed (by the user 'System User') the notification is not triggered. Is there something specific with the user 'System User' that does not trigger notifications? Any suggestions on what may be happening?

    ------------------------------
    Thanks
    Paul
    ------------------------------


  • 2.  RE: Workflow Timer

    Posted 11/21/19 06:42 PM
    So your issue is that 'System User' changed fields no longer trigger notifications with condition of incident field "is changed" ... is this right?

    If so, you'll want to report this via the IBM Support Cases Portal.

    ------------------------------
    Jared Fagel
    Cyber Security Analyst Intern
    Public Utility
    ------------------------------



  • 3.  RE: Workflow Timer

    Posted 11/22/19 09:22 AM
    Thanks.

    ------------------------------
    PAUL FORMOSA
    ------------------------------

    Original Message


  • 4.  RE: Workflow Timer

    Posted 11/24/19 05:15 PM
    Hello Paul

    You may have change your integration server authentication from a "Technical User" (Type = User) to an API Key (Type = System User)
    They do not have the same behavior.

    ------------------------------
    BENOIT ROSTAGNI
    ------------------------------



  • 5.  RE: Workflow Timer

    Posted 11/25/19 08:57 AM
    They should have the same behavior in this regards.

    ------------------------------
    Ben Lurie
    ------------------------------

    Original Message


Related Content