IBM Security QRadar SOAR

 View Only
  • 1.  Error exception handling of multiselect type field value input

    Posted Tue August 25, 2020 01:27 AM
    Hello,
    I found out that when I input wrong value to multiselect type field in script,
    I can't error-handle it.

    Like, for example "hl11_policy_violations" is a multiselect type field.
    there is no preset value named "lorem ipsum", so an error will occur. I tried to error exception handle it like this,
    try:
      incident.properties.hl11_policy_violations="lorem ipsum"
    except:
      pass

    but it seems it doesn't handle the error, just puts an error log.
    Is there any way to handle this error?
    (Error Running Script: Unable to set value Lorem Ipsum for Field HL11. Policy Violations)

    Thank you.

    ------------------------------
    Hanyu Lee
    ------------------------------


  • 2.  RE: Error exception handling of multiselect type field value input

    IBM Champion
    Posted Tue August 25, 2020 04:01 PM
    Great question, it would be awesome if there was, but I do not believe this is an existing capability.


    ------------------------------
    Jared Fagel
    Cyber Security Analyst I
    Public Utility
    ------------------------------



  • 3.  RE: Error exception handling of multiselect type field value input

    Posted Wed August 26, 2020 08:08 AM
    That is because when the script is evaluated in the sandbox, all possible known values are not known. The value is applied to the incident after the script is run as a result of potential changes made by the script. At that point, python is no longer involved so there is no opportunity to catch an error like this.

    Ben

    ------------------------------
    Ben Lurie
    ------------------------------