IBM Security SOAR

Expand all | Collapse all

Error handling within Resilient Workflows

  • 1.  Error handling within Resilient Workflows

    Posted Tue May 25, 2021 10:05 AM
    Hi all,

    Is there a graceful way to handle Function errors within Resilient workflows? Currently my workflows seem to be terminating with a Failed state whenever a Function returns a FunctionError in its code, ideally I'd like to be able to handle that situation in the course of the workflow without it (relatively) silently aborting instead.

    Thanks

    ------------------------------
    Robert Kemp
    ------------------------------


  • 2.  RE: Error handling within Resilient Workflows

    Posted Tue May 25, 2021 01:51 PM
    Kind of, but not natively from the workflow. A FunctionError() is fatal is it is today, but it might be worth an idea in the ideas portal to change that.

    We updated all our functions to yield with a FunctionResult(results) when an exception is caught, rather than a FunctionError() as is default.

    Then, we have a results["was_successful"] = False at the top of the function code, and results["was_successful"] = True at the end of the code, if was_successful is False when received by the workflow, we know there was an error and can gracefully handle it. We can pass errors as well to results, etc, etc ... depends on the function use.




    ------------------------------
    Jared Fagel
    Cyber Security Analyst I
    Public Utility
    ------------------------------



  • 3.  RE: Error handling within Resilient Workflows

    Posted Tue May 25, 2021 02:33 PM
    +1 on this. We follow a very similar method.

    The only issue with it that we've run into is that we use some community integrations that still use the `FunctionError()` within them, so we aren't able to handle errors from those functions gracefully. Other then that it's been working well

    ------------------------------
    Liam Mahoney
    ------------------------------