IBM Security QRadar SOAR

$ resilient-sdk clone --playbook <playbook_to_be_cloned> <new_playbook_name> --draft-playbook​

$ resilient-sdk clone --playbook <playbook_to_be_cloned> <new_playbook_name> --draft-playbook​ -c <path_to_my_custom.config>​

$ resilient-sdk clone --playbook <playbook_to_be_cloned> <new_playbook_name> --draft-playbook​

$ python --version​

Ideally we want a version >= 3.6

And we kinda do not recommend installing directly on the App Host as some dependencies are required and we are increasing the "attack surface area" of the App Host unnecessarily

Python is easily installed on your laptop, whether its Windows, Linux or macOS: https://www.python.org/downloads/ - get a 3.9 version if possible. We recommend installing a virtual Python environment with pyenv also (if possible): https://github.com/pyenv/pyenv - tho not necessary and then update the base packages and install the resilient-sdk with pip:

$ pip install -U pip setuptools

$ pip install resilient-sdk

$ resilient-sdk -h
$ resilient-sdk -h
usage: 
    $ resilient-sdk <subcommand> ...
    $ resilient-sdk -v <subcommand> ...
    $ resilient-sdk codegen -p <name_of_package> -m 'fn_custom_md' -c '/usr/custom_app.config'
    $ resilient-sdk -h
    

Python SDK for developing IBM SOAR Apps that provides various subcommands to help with development

optional arguments:
  -h, --help     show this help message and exit
  -v, --verbose  Set the log level to DEBUG

subcommands:
  one of these subcommands must be provided

  
    validate     Tests the content of all files associated with the app, including code, before packaging it
    codegen      Generates boilerplate code used to begin developing an app.
    clone        Duplicate an existing Action related object (Function, Rule, Script, Message Destination, Workflow) or Playbook with a new
                 api or display name
    docgen       Generates boilerplate documentation for an app.
    extract      Extracts data needed to publish a .res file.
    package      Package your Python Package into a SOAR app format.

For support, please visit ibm.biz/soarcommunity

$ resilient-sdk clone --playbook <playbook_to_be_cloned> <new_playbook_name> --draft-playbook​ -c <path_to_my_custom.config>​

$ resilient-sdk clone --playbook <playbook_to_be_cloned> <new_playbook_name> --draft-playbook​