IBM Security QRadar SOAR

 View Only
  • 1.  Function Timeout

    IBM Champion
    Posted Tue November 12, 2019 09:52 AM
    Hello,

    I am wondering if functions need to return to the Resilient platform within a certain amount of time?

    I'm thinking about the best way to handle an action that takes a long time to complete. Would it be best to:

    1) have a function that kicks off the action, periodically updates the status of the action it until it reaches the finished state, and then returns the results

    or

    2) have the function kick off the action and returns the ID. Create menu item actions that will update the status of the action, and if it's complete return the results

    My hesitation with 1 is that this action could take multiple hours. I don't want the function to timeout while I'm waiting to update the status.

    Thank you!

    ------------------------------
    Liam Mahoney
    ------------------------------


  • 2.  RE: Function Timeout

    IBM Champion
    Posted Tue November 12, 2019 11:20 AM
    Hey Liam,

    Functions never actually timeout (they technically run forever). The UI just calls them "Timed Out" when nothing is returned within a certain duration (24 hours). So, even if your function switches to "Timed Out" - realize that it is still running on the integration server, and will switch to "Completed" in the UI upon the FunctionResult yield (or "Pending" when a new StatusMessage yield occurs).

           "If an acknowledgement is not received within a day, the status for the action changes to Timed Out." See here.

    So, this means that if you want to see the status show as "Pending" continuously (without switching to "Timed Out") your first solution will work, if you have it perform a status message at least every 24 hours (probably more like 23.95 hours to account for the slight delay between run and execution). This is not really required though, as I mentioned, it will run as you want it to until script completion.

    ------------------------------
    Jared Fagel
    Cyber Security Analyst Intern
    Public Utility
    ------------------------------



  • 3.  RE: Function Timeout

    IBM Champion
    Posted Tue November 12, 2019 11:36 AM
    Thank you Jared, I appreciate the information!

    ------------------------------
    Liam Mahoney
    ------------------------------