IBM Security QRadar SOAR

 View Only

  • 1.  Print a message from action component at incident page

    Posted Mon November 11, 2019 06:31 AM
    Hi,

    Is it possible show a message from action at incident page? 




    Best


    ------------------------------
    Jasmine
    ------------------------------


  • 2.  RE: Print a message from action component at incident page

    Posted Mon November 18, 2019 02:54 AM
    Is this an impossible action?

    ------------------------------
    Jasmine
    ------------------------------

    Original Message


  • 3.  RE: Print a message from action component at incident page

    Posted Tue November 19, 2019 09:52 AM
    Jasmine, 

    I'm not sure that I fully understand the requirement here, but the simplest way to force a popup to screen is via a script with the helper.fail syntax (see below), which you can run via the rule.

    helper.fail("This is the message that will be forced as  a pop-up to screen") 

    Colin 
    Colin

    ------------------------------
    Colin Mattholie
    ------------------------------

    Original Message


  • 4.  RE: Print a message from action component at incident page

    Posted Wed November 20, 2019 08:08 AM
    I too am uncertain what is being asked here, but if you want something to appear _before_ it runs you can add an HTML block to activity fields - this does however allow you to cancel if you like.

    ------------------------------
    Marty James
    ------------------------------

    Original Message


  • 5.  RE: Print a message from action component at incident page

    Posted Mon January 06, 2020 07:19 AM
    Hi,

    I can advice to use Resilients' rest_client() function on python to post whatever you need as a note to incident. You can figure out how to do by using interactive API.

    ------------------------------
    Burak Karaca
    ------------------------------

    Original Message