IBM Security QRadar SOAR

 View Only

Python2 Scripting to be removed in QRadar SOAR v49

By Mark Scherfling posted Tue April 04, 2023 10:05 AM


Since the introduction of the Python3 scripting engine in QRadar SOAR, the utility and practicality of the existing Python2 scripting engine has diminished. The reasons to develop and migrate your scripts to Python3 are numerous, including increased package support and a more robust Python environment for your script logic.

But now the imperative to migrate your Python2 scripts is upon us. IBM QRadar SOAR V49 (expected in Q2 2023) will no longer run Python2 scripts. The good news is: converting your existing scripts to Python3 is straightforward. This article will provide guidance on the conversation effort and offer a few hints about where Python2 logic needs to be modified.


Thankfully, it's easy to identify which scripts are running Python2. Navigate to the Scripts tab under Customizations Settings. The list view shows which scripts are running Python2.

View of scripts running Python2
In most cases, changing the Language setting to Python3 is all that's needed. There are a few language differences to be aware of. But for the most part, your scripts will just run in Python3. In the Conversion Hints section below, I'll present a few language differences to be aware of. 
Changing the Language setting to Python3

Workflows and Playbooks

Unfortunately, there is no easy way to determine which workflows or playbooks with function pre-processing and post-processing scripts are running Python2. This review will need to be performed manually by accessing each function and reviewing the scripting engine used. Again, changing the language to Python3 in most cases will be the only change you'll need to make.

Changing language for function scripts in workflows

Conversion Hints

There are a few language differences to be aware of. I have not encountered a lot of differences. But here are a few to review.


This java package is used in scripts to get the current date and time either as an epoch value such as 1679755201000 or in string format, such as 'Fri 24 14:38:16 GMT 2023'. In either case, this package does not exist in Python3 and will need to be changed to either the Python time or datetime packages. Below are a few examples of the equivalent logic:

Producing the current epoch value in Python2:

import java.util.Date as Date
now = Date()


now = Date().getTime()


now = Date().time

Should become:

from time import time
now = int(time()*1000) # milliseconds

Note the multiplication by 1000 to produce the equivalent epoch value in milliseconds.

Producing a string representation of the current date and time is possible using datetime as follows:

from datetime import datetime
now ="%Y-%m-%d %H:%M:%S") # '2023-03-24 11:28:34'

Converting a string representation of a date and time to epoch value is possible as follows:

start_time = int(datetime.strptime("2023-03-25 14:00:20", "%Y-%m-%d %H:%M:%S").strftime('%s'))*1000 # epoch in milliseconds


The iteritems() method provides the ability to iterate over a dictionary using a syntax such as:

for k, v in results['content'].iteritems():

This syntax should be changed to items() for Python3:

for k, v in results[‘content’].items():


The syntax for the print state changed in Python3 to conform to all other functions, using parenthesis to enclose arguments.

This syntax:

print 'something'

Should be changed to:

print('something') # new syntax with parenthesis

The print statement is largely unused in workflow/playbook scripts. In general, if you're using print for debugging, use the or log.debug() statements instead.


One of the biggest differences between Python2 and 3 is the way strings and unicode strings are handled. In Python2, one needed to specifically identify unicode strings using the u' ' prefix. And string and unicode variable concatenation was not possible. 

In Python3, all strings are unicode. So there's no need to distinguish between unicode strings and normal strings. Luckily, Python3 accepts strings using the u' ' prefix and ignores its interpretation. 

However, the unicode function:

unicode_str = unicode(’something’)

will need to be removed:

unicode_str = 'somthing' # removed unicode conversion

Syntax such as this:

if isinstance(value, unicode):
    entries.append(json_entry.format(unicode(key), unicode(value)))
should change to:
if isinstance(value, str): # test for string
   entries.append(json_entry.format(key,value)) #removed the unicode() conversion
Finally, similar to tests using isinstance(value, unicode), tests using isinstance(value, basestring) will cause errors in Python3 and should also change to isinstance(value, str).

Support for Workflows

Although there are no plans to sunset the use of workflows at this time, the SOAR team is shifting focus towards enhancing the breadth and depth of our playbooks and investing more in feature enhancements/capabilities in future releases


Hopefully, this information will assist you in your conversion efforts and ensure your workflows and playbooks continue to run unaffected. Please use the blog's comments section if there are other conversion issues you face so the entire community will benefit.
For additional information regarding the differences between the scripting engines, refer this documentation.



22 days ago

A Python based SOAR Python2 search utility is available via the below Git link for users to locate Python2 Scripts, Workflows, and Playbooks that are still in SOAR.

Thu April 06, 2023 09:19 AM

To clarify, the first phase of changes will affect the creation of new Python 2 scripts. Existing workflows and playbooks with Python 2 scripts *will* continue to run. 
The IBM SOAR team is evaluation apps which use Python 2 scripts and converting them. This will be an extended process as we update apps on the AppExchange to both playbooks and Python 3.

Wed April 05, 2023 08:28 PM

Hi Mark,

For clarification, does the following statement mean any existing python2 scripts will seize to function once upgraded to v49?

"IBM QRadar SOAR V49 (expected in Q2 2023) will no longer run Python2 scripts."