IBM Security QRadar SOAR

 View Only
Expand all | Collapse all

How to achieve loop in Resilient Workflow?

  • 1.  How to achieve loop in Resilient Workflow?

    Posted Mon July 22, 2019 08:50 AM
    I want to achieve loop in Resilient workflow. For example, I want to call a function repeatedly for 'n' times, the value of 'n' will vary dynamically.

    When I use workflow property to store the loop count, it doesn't allow me to overwrite workflow property value to maintain the loop counter variable for iteration.

    So I just want to know, is there any way to achieve loop in workflow?

    Regards,
    Anbalagan R

    ------------------------------
    Anbalagan Rajagopal
    ------------------------------


  • 2.  RE: How to achieve loop in Resilient Workflow?

    IBM Champion
    Posted Mon July 22, 2019 11:50 AM
    I have not tried this, but what if you created a "middle-man" function that serves as a counter (returning simply n+1 ... results.n), and then use an exclusive gateway to either:

    1.) End the loop (go to next item in workflow / end workflow) if  n = loop_max
    2.) Return to original function (before "middle-man" function) if n< loop_max


    The condition applied to the gateway would be (for end condition arrow):

    Script condition: continue
    Advanced Scripting Options:
    continue = True
    if(workflow.properties.workflow_middle_man_results['n'] = 100):
       continue= False

    Flip True/False order for other condition.

    ------------------------------
    Jared Fagel
    Cyber Security Analyst Intern
    Public Utility
    ------------------------------



  • 3.  RE: How to achieve loop in Resilient Workflow?

    Posted Tue July 23, 2019 05:15 AM
    Hello,

    Just wanted to let both of you know that my team and I have tried this before and works.

    Regards,

    ------------------------------
    Carlos Ortigoza
    ------------------------------



  • 4.  RE: How to achieve loop in Resilient Workflow?

    Posted Tue December 31, 2019 12:55 AM
    Hi Carlos,

    I have tried the same logic mentioned by 'Jared Fagel'. In order to make the condition check in the gateway I need to store the counter variable in workflow property, but I am unable to update the workflow property (counter variable) in the next iteration as it throws "read only" error.

    Could you tel me how you have tried this with some sample code.

    Regards,
    Anbalagan R

    ------------------------------
    Anbalagan Rajagopal
    ------------------------------



  • 5.  RE: How to achieve loop in Resilient Workflow?

    Posted Thu January 02, 2020 11:01 AM
    Hi Anbalagan,

    Sadly, workflow properties are read-only. I have used the following trick to overcome this. I create a new workflow property for the next counter value. Then, get the latest workflow property to retrieve the counter value. This technique is expensive for workspace resources and certainly not useful for large counters. But it achieves the purpose.  I've used this also to iterate through a list in a property as well.

    Mark

    # this technique works for counters < 100, add move zeros for larger lists
    workflow.addProperty('alist', {'list': [ 'a', 'b', 'c']})
    workflow.addProperty('z01', { 'counter': 0 })
    workflow.addProperty('z02', { 'counter': 1 })
    workflow.addProperty('z03', { 'counter': 2 })
    
    # since 'z' is last in alphabet, will get that key sorted
    maxkey = max(workflow.properties.keys())
    counter = workflow.properties[maxkey]['counter']
    log.debug('counter: {}'.format(counter))
    incident.description = workflow.properties['alist']['list'][counter]


    ------------------------------
    Mark Scherfling
    ------------------------------



  • 6.  RE: How to achieve loop in Resilient Workflow?

    IBM Champion
    Posted Thu January 02, 2020 11:27 AM
    I was just about to push this to the Aha since I was not aware of this limitation, but I now see this is an idea already:
    https://2e4ccba981d63ef83a875dad7396c9a0.ideas.aha.io/ideas/R-I-700

    I wonder if @Carlos Ortigoza used an incident field to achieve this instead (and assumed only one instance of the workflow would be run at a time per given incident)? @Mark Scherfling's workaround is interesting too!
    ​​

    ------------------------------
    Jared Fagel
    Cyber Security Analyst Intern
    Public Utility
    ------------------------------



  • 7.  RE: How to achieve loop in Resilient Workflow?

    Posted Thu January 02, 2020 12:12 PM
    Hi Mark,

    Thanks for your prompt reply, exactly the same technique I am using currently. Everytime I create a new workflow property for counter variable and comparing them with main list property. And it's working fine.

    And I hope all the workflow memory (allocated for propertied) will be released as soon as the workflow ends the execution.

    It would be very helpful if you provide an option to modify the properties.
    Thanks & Regards,
    Anbalagan R




    On Thu, Jan 2, 2020 at 9:33 PM +0530, "Mark Scherfling via IBM Community"





  • 8.  RE: How to achieve loop in Resilient Workflow?

    Posted Thu January 02, 2020 12:43 PM
    Memory is freed when then workflow is complete. We do have outstanding enhancements to support updates to workflow properties. Not that enhancement is currently not scheduled.

    Regards,
    Mark

    ------------------------------
    Mark Scherfling
    ------------------------------



  • 9.  RE: How to achieve loop in Resilient Workflow?

    Posted Mon November 23, 2020 09:51 AM
    Hi Rajagopal,

    Were you able to achieve the same, we have a similar requirement f looping a function "n" times.

    We take the output from a function which is an array, we would want to loop through the array and pass each value to a different function in a loop.


    Please kindly suggest the best way possible.

    ------------------------------
    Rambatla Venkat Rao
    ------------------------------



  • 10.  RE: How to achieve loop in Resilient Workflow?

    Posted Wed November 15, 2023 03:36 PM
    #set initial value
    workflow.addProperty('counter', {'value': 0})
    #increment
    counter = workflow.properties.counter.value + 1
    workflow.addProperty('counter', {'value': counter})


    ------------------------------
    Mike Beaver
    ------------------------------