IBM Security SOAR

Expand all | Collapse all

Conditions based on Incident Type

  • 1.  Conditions based on Incident Type

    Posted 10 days ago
    I am writing a function where the conditions will be as following 

    If incident type = malware then perform X action . How to get this working as I am unable to get the incident type in python code / scripts / and pre processing script .

    ------------------------------
    Mohsin Ali
    ------------------------------


  • 2.  RE: Conditions based on Incident Type

    Posted 9 days ago
    It sounds like you are writing a custom Function? If so, you want to create a Text input field for the function that would have the list of incident types as a string. Then, when the Function is used in a Playbook the function inputs are set using a script.

    Ben

    ------------------------------
    Ben Lurie
    ------------------------------



  • 3.  RE: Conditions based on Incident Type

    Posted 8 days ago
    Go to the customisation>field
    in the search bar look for incident and select incident type
    You can see the api name used when you run scripts

    to run your action, go to customization > rule > new > menu item and select on which object type you want to run the rule (incident, artifact...)
    on condiction, select the field incident type  + has one off and the types you want malware for example;
    and run the script or the workflow you wich

    if the action is in a script (or use python list conditions):
    if incident.incident_type_ids == "Malware":










    ------------------------------
    BENOIT ROSTAGNI
    ------------------------------



  • 4.  RE: Conditions based on Incident Type

    Posted 7 days ago
    hello @BENOIT ROSTAGNI

    As you said the we can use API name of incident type id. so we can try to used that but still facing the same issue. I have attached the screenshot of the script.​



    ------------------------------
    Asad Aftab
    ------------------------------



  • 5.  RE: Conditions based on Incident Type

    Posted 7 days ago
    The value of incident.incident_type_ids is a list, not a singular value. So use '==' won't work. Use the 'in' keyword instead:

    if 'bentest' in incident.incident_type_ids:

    Ben

    ------------------------------
    Ben Lurie
    ------------------------------



  • 6.  RE: Conditions based on Incident Type

    Posted 7 days ago

    Opps!  Sorry guys, I was too quick when I answer

    Thanks Ben :)



    ------------------------------
    BENOIT ROSTAGNI
    ------------------------------