IBM Security QRadar SOAR

 View Only
  • 1.  Close task using action artifact

    Posted Mon February 11, 2019 01:39 PM
    Is it possible to close a specific task through an action from the artifact associated with the incident?

    for example:
    The incident has a task called "check blocked user", also has a artifact type "User Accoun". Configure an automatic action for the artifact where you consult in a system, of third parties, if it is blocked and after this verification, I would like to be able to close the task "check blocked user".

    It's possible? as?
    Maybe from a script?

    Thank you!

    ------------------------------
    Juan Cruz Del Col
    ------------------------------


  • 2.  RE: Close task using action artifact
    Best Answer

    Posted Tue February 12, 2019 04:34 AM
      |   view attached
    Hi Juan, 

    I have previously written a function which achieves this, I haven't put it up on App Exchange yet but attached is a "prerelease" of it. 

    Hopefully that should help address your use case, 

    Let me know if you have any issues with it,

    ------------------------------
    CRAIG ROBERTS
    ------------------------------

    Attachment(s)