IBM Security QRadar SOAR

 View Only
  • 1.  Multiple variables in one Note

    Posted Fri March 08, 2019 11:31 AM

    Hi Resilient users,

    I need a confirmation as to whether or not one can insert multiple variables in a Note?

    I am trying to execute the following request:

    ********** 

        incident.addNote(helper.createRichText("<b>Summary</b>:\

                                                                                       <br><br>\

                                                                                        The website <b>%s</b> contacted <b>%s</b> IP in <b>%s</b> countries" %results.report.task.url %results.report.task.count % results.report.task.CountriesCount))

     **********

    I am trying to display 3 values I fetch from a Json result. When I perform some tests and display the values one by one in multiple notes, the values in question are displayed just fine. But when I try to gather the values in one note, I have Nothing displayed.

     
    Is it possible to gather multiple fields in one note?

     

    Thanks in advance for your help.



    ------------------------------
    Zohra SMAIL
    ------------------------------


  • 2.  RE: Multiple variables in one Note
    Best Answer

    Posted Fri March 08, 2019 12:57 PM
    Hi Zohra!

    Thanks for reaching out!

    You can indeed. We make use of string.format()

    See here for a code example: https://github.com/ibmresilient/resilient-community-apps/tree/master/fn_pastebin#post-process-script

    if (results.success):
      noteText = """<br><b>Pastebin Created</b>
                    <b>Name:</b> {0}
                    <b>Link:</b> <a href='{1}'>{1}</a>""".format(results.inputs.pastebin_name, results.pastebin_link)
      incident.addNote(helper.createRichText(noteText))


    ------------------------------
    Shane Curtin
    Integrations Engineer - IBM Resilient
    ------------------------------



  • 3.  RE: Multiple variables in one Note

    Posted Mon March 11, 2019 09:44 AM
    Hi Shane,

    In fact, it worked like a charm. Thanks!

    Zohra SMAIL​

    ------------------------------
    Zohra SMAIL
    ------------------------------