IBM QRadar SOAR

All,

We're trying to add a conditional section to a task for the first time and we're running into some issues. We only want a certain field to show up on the task if it's an incident that originated from Azure Sentinel, which would be signaled by the incident having a value for the field 'Azure Sentinel Incident Name'.

We configured the task as follows:



with the task section condition as this:



However, when I click into the task in an incident (that I have verified has a value for the field 'Azure Sentinel Incident Name') that field does not appear in the task:



We noticed that if we add the field in the condition, 'Azure Sentinel Incident Name', to the section within the task:



this makes the field show up within the task:



Is this expected?

I was thinking I could use the field 'Azure Sentinel Incident Name' in the condition of a task section without having to have that field in the task.

Thanks!

------------------------------
Liam Mahoney
------------------------------

Definitely seems like a defect.

------------------------------
Ben Lurie
------------------------------

Original Message:
Sent: Thu September 02, 2021 12:41 PM
From: Liam Mahoney
Subject: Issue with Conditional Task Sections

All,

We're trying to add a conditional section to a task for the first time and we're running into some issues. We only want a certain field to show up on the task if it's an incident that originated from Azure Sentinel, which would be signaled by the incident having a value for the field 'Azure Sentinel Incident Name'.

We configured the task as follows:



with the task section condition as this:



However, when I click into the task in an incident (that I have verified has a value for the field 'Azure Sentinel Incident Name') that field does not appear in the task:



We noticed that if we add the field in the condition, 'Azure Sentinel Incident Name', to the section within the task:



this makes the field show up within the task:



Is this expected?

I was thinking I could use the field 'Azure Sentinel Incident Name' in the condition of a task section without having to have that field in the task.

Thanks!

------------------------------
Liam Mahoney
------------------------------

Hi Liam,
Thank you for using the Community. What version are you on? It sounds like a known issue that was recently addressed in v41.1
https://www.ibm.com/docs/en/rsoa-and-rp/41?topic=v411-corrected-issues
Regards,
Liz Hecht

------------------------------
Elizabeth Hecht
------------------------------

Original Message:
Sent: Thu September 02, 2021 12:41 PM
From: Liam Mahoney
Subject: Issue with Conditional Task Sections

All,

We're trying to add a conditional section to a task for the first time and we're running into some issues. We only want a certain field to show up on the task if it's an incident that originated from Azure Sentinel, which would be signaled by the incident having a value for the field 'Azure Sentinel Incident Name'.

We configured the task as follows:



with the task section condition as this:



However, when I click into the task in an incident (that I have verified has a value for the field 'Azure Sentinel Incident Name') that field does not appear in the task:



We noticed that if we add the field in the condition, 'Azure Sentinel Incident Name', to the section within the task:



this makes the field show up within the task:



Is this expected?

I was thinking I could use the field 'Azure Sentinel Incident Name' in the condition of a task section without having to have that field in the task.

Thanks!

------------------------------
Liam Mahoney
------------------------------

We are on Version: 40.2.73. We have an upgrade planned for the near future so hopefully that takes care of it

Thank you!

------------------------------
Liam Mahoney
------------------------------

Original Message:
Sent: Fri September 03, 2021 08:56 AM
From: Elizabeth Hecht
Subject: Issue with Conditional Task Sections

Hi Liam,
Thank you for using the Community. What version are you on? It sounds like a known issue that was recently addressed in v41.1
https://www.ibm.com/docs/en/rsoa-and-rp/41?topic=v411-corrected-issues
Regards,
Liz Hecht

------------------------------
Elizabeth Hecht

Original Message:
Sent: Thu September 02, 2021 12:41 PM
From: Liam Mahoney
Subject: Issue with Conditional Task Sections

All,

We're trying to add a conditional section to a task for the first time and we're running into some issues. We only want a certain field to show up on the task if it's an incident that originated from Azure Sentinel, which would be signaled by the incident having a value for the field 'Azure Sentinel Incident Name'.

We configured the task as follows:



with the task section condition as this:



However, when I click into the task in an incident (that I have verified has a value for the field 'Azure Sentinel Incident Name') that field does not appear in the task:



We noticed that if we add the field in the condition, 'Azure Sentinel Incident Name', to the section within the task:



this makes the field show up within the task:



Is this expected?

I was thinking I could use the field 'Azure Sentinel Incident Name' in the condition of a task section without having to have that field in the task.

Thanks!

------------------------------
Liam Mahoney
------------------------------