IBM Security SOAR

Expand all | Collapse all

Issue with Conditional Task Sections

  • 1.  Issue with Conditional Task Sections

    Posted Thu September 02, 2021 12:42 PM
    All,

    We're trying to add a conditional section to a task for the first time and we're running into some issues. We only want a certain field to show up on the task if it's an incident that originated from Azure Sentinel, which would be signaled by the incident having a value for the field 'Azure Sentinel Incident Name'.

    We configured the task as follows:



    with the task section condition as this:



    However, when I click into the task in an incident (that I have verified has a value for the field 'Azure Sentinel Incident Name') that field does not appear in the task:



    We noticed that if we add the field in the condition, 'Azure Sentinel Incident Name', to the section within the task:



    this makes the field show up within the task:



    Is this expected?

    I was thinking I could use the field 'Azure Sentinel Incident Name' in the condition of a task section without having to have that field in the task.

    Thanks!

    ------------------------------
    Liam Mahoney
    ------------------------------


  • 2.  RE: Issue with Conditional Task Sections

    Posted Fri September 03, 2021 07:36 AM
    Definitely seems like a defect.

    ------------------------------
    Ben Lurie
    ------------------------------



  • 3.  RE: Issue with Conditional Task Sections

    Posted Fri September 03, 2021 08:57 AM
    Hi Liam,
    Thank you for using the Community. What version are you on? It sounds like a known issue that was recently addressed in v41.1
    https://www.ibm.com/docs/en/rsoa-and-rp/41?topic=v411-corrected-issues
    Regards,
    Liz Hecht

    ------------------------------
    Elizabeth Hecht
    ------------------------------



  • 4.  RE: Issue with Conditional Task Sections

    Posted Fri September 03, 2021 09:15 AM
    We are on Version: 40.2.73. We have an upgrade planned for the near future so hopefully that takes care of it

    Thank you!


    ------------------------------
    Liam Mahoney
    ------------------------------