IBM Security QRadar SOAR

 View Only
  • 1.  Pretty printed JSON output

    Posted Tue November 13, 2018 09:12 AM
    If your function returns a string in JSON format that you wish to save to a Note in the post-processing script, you can use json.dumps() function with an indent argument, that automatically formats content, to make it more readable. If you add sort_keys=True the output of dictionaries will be sorted by key:
    import json
    ...
    results = json.dumps(person_list, sort_keys=True, indent=4, separators=(',', ': '))yield FunctionResult(results)

    In the post-processing script add the Note as a plain text:

    incident.addNote(noteText)


    Pretty printed JSON output:

    Pretty printed JSON result



    ------------------------------
    Tamara Zlender
    ------------------------------


  • 2.  RE: Pretty printed JSON output

    Posted Wed May 05, 2021 11:24 AM
    Is there a better way for doing this now on 38.x as I receive the following if I attempt to do that?

    Script contains the following illegal imports: json

    ------------------------------
    Mr Coco
    ------------------------------



  • 3.  RE: Pretty printed JSON output

    Posted Thu May 06, 2021 06:58 AM
    Hi Mr Coco,

    In order to import json your script needs to be running in Python 3 which was released in version 38.2. For more info see the documentation and our example scripts repo:

    https://www.ibm.com/docs/en/rsoa-and-rp/38?topic=scripts-python-2-python-3-differences
    https://github.com/ibmresilient/resilient-scripts/tree/master/python3

    ------------------------------
    Sean Mc Cann
    ------------------------------