IBM Security QRadar SOAR

 View Only
Expand all | Collapse all

Incident Relation Sync. Notes Issue

  • 1.  Incident Relation Sync. Notes Issue

    Posted Mon November 16, 2020 12:47 PM
      |   view attached
    Hi Team 

    I installed the Incident Relation app (third party) and everything is working as it should except Parent's notes are not synced. with Child Incident notes but Child notes are syncs. with Parents' incident. I tested by adding a new rule which updating the child notes in parents incident but it takes the workflow in an infinite loop which I have to manually kill it. 

    What I think, both Rules 93. Example: Relations-Sync Notes with Parents & 108: Sync Parents Notes using the same workflow. 

    I was hoping someone come across this issue 

    I am attaching the rule's snapshot for you consideration



    ------------------------------
    Fawad Majid
    ------------------------------


  • 2.  RE: Incident Relation Sync. Notes Issue

    Posted Mon November 23, 2020 02:46 AM
    Lets Try:
    Child Note is sync :

    Parent note is not Sync. Lets investigate why.
    The Relation Table is good.


    The rule to Sync Parent Notes to Child is "Menu Item". It is not an automatic rule ! (I am discovering the app !)



    Lets run it :

    Seems good:


    is good :


    So just like me the first time, the parent notes are sync only by default on a menu item.
    You need to write a new rule to have it work by automation:


    Note, if you sync DOWN from Parent to Child, you need to update the up rule not to have the automatic upstream Child => Parent launched to with this "duplicate loop" result:


    Sync up update rule to break loop: text Does not Contain "Note from parent incident"









    ------------------------------
    BENOIT ROSTAGNI
    ------------------------------