IBM Security QRadar SOAR

 View Only
Expand all | Collapse all

Pre populate the activity fields of a Menu Item rule with incident fields data

  • 1.  Pre populate the activity fields of a Menu Item rule with incident fields data

    Posted Thu February 04, 2021 03:50 PM
    Hello,

    I would like to create a Menu Item rule with Activity Fields.  Some of the Activity Fields could be pre-filled with suggestions based on incident fields like "Hostname" or "Username".

    In the documentation, I was not able to find any information about this.  Anyone tried to do this?

    Thanks in advance,

    ------------------------------
    Mathieu Desrochers
    ------------------------------


  • 2.  RE: Pre populate the activity fields of a Menu Item rule with incident fields data

    Posted Fri February 05, 2021 07:07 AM
    Hi Mathieu,
    Unfortunately you can't pre-populate the activity field.

    There is an enhancement request for this functionality:
    https://2e4ccba981d63ef83a875dad7396c9a0.ideas.aha.io/ideas/R-I-211

    This developers corner video (starting at 7 min) might help understand a use case for using activity fields:
    https://www.securitylearningacademy.com/enrol/index.php?id=4698

    Along with this post from the Community which provides the user instructions in the rule and activity field which confirms that the analyst wants to run a script which you could use to populate a field:
    https://community.ibm.com/community/user/security/communities/community-home/digestviewer/viewthread?MessageKey=180af55c-5083-4df4-9eae-c9dd82e67f26&CommunityKey=d2f71e8c-108e-4652-b59c-29d61af7163e&tab=digestviewer#bm180af55c-5083-4df4-9eae-c9dd82e67f26

    Our documentation explains activity fields can only be populated by the values which the user enters:
    If an end user does not provide a value, the value for the rule property is None.
    https://www.ibm.com/support/knowledgecenter/SSBRUQ_37.0.0/doc/playbook/resilient_playbook_configscripts_writing_rule.html

    I hope this helps.


    ------------------------------
    Elizabeth Hecht
    ------------------------------



  • 3.  RE: Pre populate the activity fields of a Menu Item rule with incident fields data

    Posted Fri February 05, 2021 08:10 AM
    Thank you, very helpful!

    ------------------------------
    Mathieu Desrochers
    ------------------------------