IBM Security QRadar SOAR

 View Only
Expand all | Collapse all

I'm trying to create a custom action module.

  • 1.  I'm trying to create a custom action module.

    Posted Thu November 14, 2019 09:43 AM
    Hi,
    I'm trying to create a custom action module by referring to the post.


    <Reference code>
    Content: Constructing a function that repeats the make_api_call contents every 30 seconds

    image.png
    Based on this code, I created a message destination to connect to the custom action module.

    < message destination >
    image.png
    When I run a custom action module with the rule applied, I get complete from the action status. However, the information "No handler returned a result for this action" is written as follows.

    <action status>
    timer test action status.PNG
    <Confirmed that connection with timer is confirmed in resilient-circuits run>
    image.png
    In the circuit, no error is found, but the function is not executed, which means that there is a problem with the handler. I would like to share if there is any material how to solve it. Or let me know if you know how to fix it.




    ------------------------------
    IM HEEJIN
    ------------------------------


  • 2.  RE: I'm trying to create a custom action module.

    IBM Champion
    Posted Fri November 15, 2019 09:34 AM
    Your images did not work, but I recommend you work with a member of IBM Resilient Support for this, they're really good at troubleshooting and getting you off to the right start!

    ------------------------------
    Jared Fagel
    Cyber Security Analyst Intern
    Public Utility
    ------------------------------