IBM QRadar SOAR

 View Only

 Playbook with basic search function stuck

Roi Mazar's profile image
Roi Mazar posted Thu August 21, 2025 08:19 AM
Hey, everyone.
 
I am new at Soar. 
I designed a basic playbook with a simple AQL query, but when the playbook is triggered, it appears to get stuck at the search function query step and remains In Progress.
The AQL query is very minimal and basic.
The Apphost and apps are running and healthy.
Does someone have an idea about? What am I missing?
I am attaching pictures.
Many thanks for considering my request for help.
Mohamad islam Hamadieh's profile image
Mohamad islam Hamadieh posted Fri August 22, 2025 01:59 AM

check the app logs.

you can download them from the app conf page in apphost UI.

Sai Kumar Reddy Dhubbaka's profile image
Sai Kumar Reddy Dhubbaka posted Mon August 25, 2025 01:21 AM

hi rio,

can you serach this query in Qradar --> log activity --> advanced search --> paste this and select time and date .If it works there it will work here .
I suggest this is a good practice if you are beginner .

It is in progress due to it need to went all the offenses in Qradar to check the condition where it meet , it may take long time .

Thanks,

Sai

Related Content