IBM Security QRadar SOAR

 View Only
Expand all | Collapse all

Handling Artifact Creation Errors in Scripts

  • 1.  Handling Artifact Creation Errors in Scripts

    IBM Champion
    Posted Thu February 13, 2020 10:59 AM
    Edited by Liam Mahoney Thu February 13, 2020 11:18 AM

    All,

    I'm trying to create URL artifacts in the post-process script of one of my functions, but some of the URLs that are being returned are junk (e.g. 'http://').

    When I try to add 'http://' as a URL artifact I get an error. I'm fine with 'http://' not getting added as an artifact, but the error causes the rest of the script/workflow to stop executing.

    I could use regex to validate that the URL follows a URL pattern before attempting to add it as a URL artifact, but I feel handling the artifact error would be more robust.

    I tried using this try/except:

    try:
    incident.addArtifact("URL", "http://", "description")
except Exception:
    log.info("Artifact creation failed")
    pass

    but it didn't catch the "Error Running Script: The Script is unable to update the Incident <name> because: The specified URL is invalid: 'http://'" error.

    Is there any way to catch/handle the artifact creation error and continue script execution?

    Thanks,



    ------------------------------
    Liam Mahoney
    ------------------------------


  • 2.  RE: Handling Artifact Creation Errors in Scripts

    Posted Mon February 24, 2020 04:56 PM
    Unfortunately the actual artifact creation is done later on in the process so it won't show up as a python exception.

    Ben

    ------------------------------
    Ben Lurie
    ------------------------------

    Original Message