IBM Security QRadar SOAR

 View Only
Expand all | Collapse all

How to run a script asynchronously?

  • 1.  How to run a script asynchronously?

    Posted Wed October 06, 2021 08:18 PM
    Hi

    I am creating an incident using SOAR REST API.

    When the incident is created, there's a rule that triggers a workflow.

    If the 1st workflow step is a manual action,  the REST API returns normally.

    However, if the 1st workflow step is a script, the REST API blocks and waits until the script is done.

    Is there any way to create an incident and trigger any kind of asynchronous script?

    Does SOAR has the concept of a scheduled task or workflow?

    TIA

    Leo

    ------------------------------
    Leonardo Kenji Shikida
    ------------------------------


  • 2.  RE: How to run a script asynchronously?

    Posted Thu October 07, 2021 08:21 AM
    Currently functions are the only blocks that run asynchronously. So you would either have to use an existing function to do what the script does, write your own function (not simple). 

    Custom functions will be able to be written directly in the UI which makes this use case much easier. Don't have a release date for that.

    Can you share some details about what is driving this request? Is it that the scripts are running too slowly?

    Ben

    ------------------------------
    Ben Lurie
    ------------------------------