IBM Security QRadar SOAR

Our following Python Libraries have been updated to version 45.0.3150:

• https://pypi.org/project/resilient
• https://pypi.org/project/resilient-lib
• https://pypi.org/project/resilient-circuits
• https://pypi.org/project/resilient-sdk

Change Log

See https://ibm.biz/soar-python-docs for a detailed Change Log of each library.

What's New

resilient-sdk

We have added a new option --draft-playbook to the clone command that if specified with the --playbook option will clone the Playbook into a Draft state, allowing you to change it’s Activation Type.

For example:

$ resilient-sdk clone --playbook <playbook_to_be_cloned> <new_playbook_name> --draft-playbook

Then in your SOAR UI, you will see the cloned playbook and be able to change its Activation Type.

resilient-circuits

Added a new config trap_exception and if set to True a Function’s exception will be ignored with the error sent as a Status Message and a default payload returned like below, allowing the Workflow or Playbook to continue:

{
"success": False,
"reason": "Error message"
}

So for any App that is built with resilient-circuits >= 45.0, you can now add trap_exception=True to the App's app.config and if any Function in that App raises an exception - the Workflow or Playbook will continue to run.

resilient

The org config in your app.config file can now be any of the organization’s cloud_account, uuid or name

For example, if the Organization's UUID is: cf42e9ff-92f0-405a-91e1-d25e4fba78d5 the following app.config is valid:

[resilient]
host=my_soar_instance.ibm.com
org=cf42e9ff-92f0-405a-91e1-d25e4fba78d5
api_key_id=<id>
api_key_secret=<secret>
cafile=false

Checkout our Change Log and our docs at https://ibm.biz/soar-python-docs for more.