IBM QRadar SOAR

IBM QRadar SOAR

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only
  • 1.  Update Datatable via Workflow Pre & Post Processing

    Posted Tue February 23, 2021 02:08 PM
    I am trying to run an automated workflow on a datatable.  I have everything running smoothly except for the ability to update that table in the "Pre Processing" script.  I am not sure if this can be done, but i have successfully updated the table in "Post Processing".

    Here is my code:

    PRE-PROCESSING:
    ##################################################
    ### Get Date Information
    ##################################################
    from datetime import datetime

    current_DateTime = datetime.now()
    current_DateTime_str = str(current_DateTime.strftime("%m-%d-%Y %H:%M:%S"))

    incident.row.imaging_status = "In Progress"
    incident.row.date_started = current_DateTime_str


    POST Processing:
    ##################################################
    ### Get Date Information
    ##################################################
    from datetime import datetime

    current_DateTime = datetime.now()
    current_DateTime_str = str(current_DateTime.strftime("%Y-%m-%d %H:%M:%S"))


    if results.exitcode == 0:
    note_text = u"Command succeeded: {}\nStandard Out: {}\nStandard Error: {}".format(results.commandline, results.stdout, results.stderr)
    #nuix_status = 'Completed'
    incident.addNote(note_text)
    row.imaging_status = "Finished"
    row.date_completed = current_DateTime_str
    else:
    note_text = u"Command failed: {}\nStandard Out: {}\nStandard Error: {}".format(results.commandline, results.stdout, results.stderr)
    incident.addNote(note_text)
    row.imaging_status = "Error"
    #nuix_status = 'Error'

    ------------------------------
    Brian Coleman
    ------------------------------


  • 2.  RE: Update Datatable via Workflow Pre & Post Processing

    Posted Wed February 24, 2021 05:31 AM
    Hi Brian,

    I am not sure but according to my experience, you cannot make any write process in pre-process. IBMers could give a more reliable answer about it.

    ------------------------------
    Burak Karaduman
    ------------------------------



  • 3.  RE: Update Datatable via Workflow Pre & Post Processing

    Posted Wed February 24, 2021 07:51 AM
    Burak is correct. Changes to data objects made in a pre-processing script do not affect any data in the system. The pre-processing script is intended only to set function inputs.

    Ben

    ------------------------------
    Ben Lurie
    ------------------------------