IBM Security QRadar SOAR

 View Only
Expand all | Collapse all

Is it possible to create a UI layout for a function's input fields?

  • 1.  Is it possible to create a UI layout for a function's input fields?

    Posted Mon February 24, 2020 05:13 AM
    Hi all,

    So I have a Menu Item Rule that shows up when the type of an artifact is IP Address or DNS Name. Upon, clicking the Menu Item Rule, my workflow is triggered which runs my function and passes the value of the IP Address/DNS Name as an input to the function. The other input of the function is a "limit" value which is a text number and controls the amount of results to fetch. I am currently hard-coding the value of "limit" input in the pre-process script but ideally what I want is:

    Upon clicking on the Menu Item Rule in the Incidents' Artifacts tab, there should be a UI that pops up and asks the user a value for the "limit" input and then invokes the function in my Workflow with that value. In this way, the user can have control over the number of results to fetch without hard-coding anything.

    Can someone suggest any way to achieve the above or anything else close to what I want? Your help will be highly appreciated.

    Thanks!

    ------------------------------
    Umair Ahmed
    ------------------------------


  • 2.  RE: Is it possible to create a UI layout for a function's input fields?

    IBM Champion
    Posted Mon February 24, 2020 01:33 PM
    Yes,

    Use a "rule activity field" in your rule's configuration. Then, assign the activity field to the function parameters in the pre-processor.

    See the KC documentation on this here.


    ------------------------------
    Jared Fagel
    Cyber Security Analyst I
    Public Utility
    ------------------------------