IBM Security QRadar SOAR

Hi there,

Was using the old wiki app(integration server) for asset lookup, like we used to add the wiki page with csv file and created some rules on artifacts when an server name is added Rule would trigger and gives the value back in "users and systems" if it is a Key value asset. This was working fine until a new app supported for app host is installed which created one more message destination and unable to delete that. Due to this, neither of the apps are working now.

As per my knowledge, two things can be done to resolve this.

1 : Old wiki lookup function uses "wiki" as message destination, new app host supported uses "fn_wiki". How do I delete the later one.

2: In the new wiki lookup app, there is a mandatory field "wiki_path", what is the correct combination of values to enter here.

If anyone can help me with one of the above, it will be very helpful.

thanks in advance.

------------------------------
Srinivas Joshi
------------------------------

Hi Srinivas,

The changes made where to reflect a more comprehensive set of functions compared to the previous submission. You may not be able to delete the new message destination as it's part of the app package.

The documentation specifies that the wiki_path argument is used to specify the parent wiki relationship as wiki's now are multilevel. For a top level wiki, just indicate it's name. For a child wiki page, indicate a path such as: parent/sub parent/target_wiki.

Hope this helps.


------------------------------
Mark Scherfling
------------------------------

Original Message:
Sent: Wed March 17, 2021 12:22 AM
From: Srinivas Joshi
Subject: Duplicate Wiki Lookup Message destination

Hi there,

Was using the old wiki app(integration server) for asset lookup, like we used to add the wiki page with csv file and created some rules on artifacts when an server name is added Rule would trigger and gives the value back in "users and systems" if it is a Key value asset. This was working fine until a new app supported for app host is installed which created one more message destination and unable to delete that. Due to this, neither of the apps are working now.

As per my knowledge, two things can be done to resolve this.

1 : Old wiki lookup function uses "wiki" as message destination, new app host supported uses "fn_wiki". How do I delete the later one.

2: In the new wiki lookup app, there is a mandatory field "wiki_path", what is the correct combination of values to enter here.

If anyone can help me with one of the above, it will be very helpful.

thanks in advance.

------------------------------
Srinivas Joshi
------------------------------

Hello Mark,

Thank you for the reply. Here in my case, using the target page directly (please see the screen shot) and when I add this in workflow it doesnot return the values. Instead we will not be able to add any artifacts. gives the below error.




------------------------------
Srinivas Joshi
------------------------------

Original Message:
Sent: Fri March 19, 2021 03:35 PM
From: Mark Scherfling
Subject: Duplicate Wiki Lookup Message destination

Hi Srinivas,

The changes made where to reflect a more comprehensive set of functions compared to the previous submission. You may not be able to delete the new message destination as it's part of the app package.

The documentation specifies that the wiki_path argument is used to specify the parent wiki relationship as wiki's now are multilevel. For a top level wiki, just indicate it's name. For a child wiki page, indicate a path such as: parent/sub parent/target_wiki.

Hope this helps.


------------------------------
Mark Scherfling

Original Message:
Sent: Wed March 17, 2021 12:22 AM
From: Srinivas Joshi
Subject: Duplicate Wiki Lookup Message destination

Hi there,

Was using the old wiki app(integration server) for asset lookup, like we used to add the wiki page with csv file and created some rules on artifacts when an server name is added Rule would trigger and gives the value back in "users and systems" if it is a Key value asset. This was working fine until a new app supported for app host is installed which created one more message destination and unable to delete that. Due to this, neither of the apps are working now.

As per my knowledge, two things can be done to resolve this.

1 : Old wiki lookup function uses "wiki" as message destination, new app host supported uses "fn_wiki". How do I delete the later one.

2: In the new wiki lookup app, there is a mandatory field "wiki_path", what is the correct combination of values to enter here.

If anyone can help me with one of the above, it will be very helpful.

thanks in advance.

------------------------------
Srinivas Joshi
------------------------------

Hi Srinivas,

Your workflow should look look like this, where the wiki_path input field contains your wiki page or path, such as 'VIP_Users'. If your workflow does not have this view, the new function may not be correctly loaded.

------------------------------
Mark Scherfling
------------------------------

Original Message:
Sent: Mon March 22, 2021 05:34 AM
From: Srinivas Joshi
Subject: Duplicate Wiki Lookup Message destination

Hello Mark,

Thank you for the reply. Here in my case, using the target page directly (please see the screen shot) and when I add this in workflow it doesnot return the values. Instead we will not be able to add any artifacts. gives the below error.




------------------------------
Srinivas Joshi

Original Message:
Sent: Fri March 19, 2021 03:35 PM
From: Mark Scherfling
Subject: Duplicate Wiki Lookup Message destination

Hi Srinivas,

The changes made where to reflect a more comprehensive set of functions compared to the previous submission. You may not be able to delete the new message destination as it's part of the app package.

The documentation specifies that the wiki_path argument is used to specify the parent wiki relationship as wiki's now are multilevel. For a top level wiki, just indicate it's name. For a child wiki page, indicate a path such as: parent/sub parent/target_wiki.

Hope this helps.


------------------------------
Mark Scherfling

Original Message:
Sent: Wed March 17, 2021 12:22 AM
From: Srinivas Joshi
Subject: Duplicate Wiki Lookup Message destination

Hi there,

Was using the old wiki app(integration server) for asset lookup, like we used to add the wiki page with csv file and created some rules on artifacts when an server name is added Rule would trigger and gives the value back in "users and systems" if it is a Key value asset. This was working fine until a new app supported for app host is installed which created one more message destination and unable to delete that. Due to this, neither of the apps are working now.

As per my knowledge, two things can be done to resolve this.

1 : Old wiki lookup function uses "wiki" as message destination, new app host supported uses "fn_wiki". How do I delete the later one.

2: In the new wiki lookup app, there is a mandatory field "wiki_path", what is the correct combination of values to enter here.

If anyone can help me with one of the above, it will be very helpful.

thanks in advance.

------------------------------
Srinivas Joshi
------------------------------

Hello Mark,

Yes, I have done the same in the workflow. Below is the screenshot. However once we do it, unable to add any artifact. It says "Following fields are required-wiki_path"


Please try to add something once you have this in workflow.



------------------------------
Srinivas Joshi
------------------------------

Original Message:
Sent: Mon March 22, 2021 08:07 AM
From: Mark Scherfling
Subject: Duplicate Wiki Lookup Message destination

Hi Srinivas,

Your workflow should look look like this, where the wiki_path input field contains your wiki page or path, such as 'VIP_Users'. If your workflow does not have this view, the new function may not be correctly loaded.

------------------------------
Mark Scherfling

Original Message:
Sent: Mon March 22, 2021 05:34 AM
From: Srinivas Joshi
Subject: Duplicate Wiki Lookup Message destination

Hello Mark,

Thank you for the reply. Here in my case, using the target page directly (please see the screen shot) and when I add this in workflow it doesnot return the values. Instead we will not be able to add any artifacts. gives the below error.




------------------------------
Srinivas Joshi

Original Message:
Sent: Fri March 19, 2021 03:35 PM
From: Mark Scherfling
Subject: Duplicate Wiki Lookup Message destination

Hi Srinivas,

The changes made where to reflect a more comprehensive set of functions compared to the previous submission. You may not be able to delete the new message destination as it's part of the app package.

The documentation specifies that the wiki_path argument is used to specify the parent wiki relationship as wiki's now are multilevel. For a top level wiki, just indicate it's name. For a child wiki page, indicate a path such as: parent/sub parent/target_wiki.

Hope this helps.


------------------------------
Mark Scherfling

Original Message:
Sent: Wed March 17, 2021 12:22 AM
From: Srinivas Joshi
Subject: Duplicate Wiki Lookup Message destination

Hi there,

Was using the old wiki app(integration server) for asset lookup, like we used to add the wiki page with csv file and created some rules on artifacts when an server name is added Rule would trigger and gives the value back in "users and systems" if it is a Key value asset. This was working fine until a new app supported for app host is installed which created one more message destination and unable to delete that. Due to this, neither of the apps are working now.

As per my knowledge, two things can be done to resolve this.

1 : Old wiki lookup function uses "wiki" as message destination, new app host supported uses "fn_wiki". How do I delete the later one.

2: In the new wiki lookup app, there is a mandatory field "wiki_path", what is the correct combination of values to enter here.

If anyone can help me with one of the above, it will be very helpful.

thanks in advance.

------------------------------
Srinivas Joshi
------------------------------