IBM Security QRadar SOAR

 View Only
  • 1.  How to automatically mark a task as completed ?

    Posted Thu September 16, 2021 10:23 AM
    Hello everyone.

    I want to ask that how to automatically mark a task as completed as the incident progresses.

    ------------------------------
    Asad Aftab
    ------------------------------


  • 2.  RE: How to automatically mark a task as completed ?

    Posted Thu September 16, 2021 10:43 AM

    It depends on who and where is the action is launched.

    A) The playbook is started because the Task is presented:
    - Task "Automated Task" is added to the task list by a playbook
    - a rule is fired (task created, task name = "Automated Task") and lauch a automation playbook (workflow action A + B  + C ....)
    - because we started from the task, at the end of the playbook, a simple script changing the value of task.status = "C" will do the job:


    B) if the playbook is an action launched by another level in the tree (incident top level of artifact level) than we could use the Task Utils App and close task feature;
    - Task "Automated Task" is added to the task list by a playbook
    - after some time, an action is run (by automation or by a menu item) for example at top action level or artifact level
    - because we have no idea of the task ID of the task to be closed, we will use the IBM SOAR Task Helper Functions  and call the Close Task workflow to close the task by its name when it needs to be shown closed in the automation process.



    ------------------------------
    BENOIT ROSTAGNI
    ------------------------------



  • 3.  RE: How to automatically mark a task as completed ?

    Posted Sun September 19, 2021 10:59 AM
    Hello Benoit, 
     
    My use case is  the second one and I am using IBM SOAR Task Helper functions.  I tried to run the Built-in menu item rule but I see a popup asking for the task name 

    Do we need to manually type the task name each time when we want to close the task?

    ------------------------------
    Mohsin Ali
    ------------------------------



  • 4.  RE: How to automatically mark a task as completed ?

    Posted Mon September 20, 2021 07:31 AM
    Hi BENOIT

    Could send us steps with screenshot for B solution.

    Thanks

    ------------------------------
    M Ramadan
    ------------------------------



  • 5.  RE: How to automatically mark a task as completed ?

    Posted Mon September 20, 2021 03:18 PM

    I have created a WF that is adding a task, and using the timer, after 15 minutes, running the Task helper app "Close Task" Functions to close the task named "Change device/application passwords"

    Pre process:

    post process:


    When I run this WF, the task is created at 18:56 UTC:



    after 15 minutes the task is closed


    and the note is written showing the task is closed by the automation:



    ------------------------------
    BENOIT ROSTAGNI
    ------------------------------



  • 6.  RE: How to automatically mark a task as completed ?

    Posted Mon September 20, 2021 05:15 PM
    Thanks BENOIT

    ------------------------------
    M Ramadan
    ------------------------------