IBM Security QRadar SOAR

 View Only
  • 1.  Artifact to field script

    Posted Mon February 10, 2020 10:25 AM
    hello,

    Looking for any assistance.  I'm trying to take the artifact value and populate a field value.  For example, take that artifact called Username, with a value of x1234 and populate a incident.properties.user_name field with x1234.

    I can do it the other way, create an artifact from a field name, but I can seem to get the logic for getting the value of an artifact.

    Thanks!

    ------------------------------
    Cheryl Lorei
    ------------------------------


  • 2.  RE: Artifact to field script

    Posted Tue February 11, 2020 07:17 AM
    This can only be done by using an Artifact script like this:



    You would have to set up a rule that triggers on an artifact object that runs this script.

    But I have a feeling that this may not fit your use case. If not, if you can describe it a bit more maybe there is a different way to accomplish your goal.

    Ben


    ------------------------------
    Ben Lurie
    ------------------------------



  • 3.  RE: Artifact to field script

    Posted Tue February 11, 2020 08:47 AM
    Hi Ben....I tried that exact way and got an error on the "artifact" not being defined.  BUT, your screen shot provided me one element I have over looked.  I had the Object type of Incident, and not ARTIFACT.   Changing that makes it work.

    Thanks you for providing the screen shot, that made the light bulb turn on!  LOL!!

    Cheryl

    ------------------------------
    Cheryl Lorei
    ------------------------------