IBM Security QRadar SOAR

Hello all,

I am trying to see if there is a way to prevent/remove duplicate entries in a data table based on a single column.

Example:

A Data table with the following Columns: "Filename, Filepath, Hash"

I want to avoid multiple entries of the same Hash being allowed to be entered into the data table.

Any help on this would be appreciated.

Tyler

------------------------------
Tyler Cole
------------------------------

There has been thoughts to supporting the ability to make a column be a "primary key" for a datatable. I'd suggest you add this as a request: https://2e4ccba981d63ef83a875dad7396c9a0.ideas.aha.io/ideas.

Just some random thoughts on how to accomplish this:

1) If you want to have the system actually block this you could create an incident field that contains all the hashes and then have a script that validates that the new hash is not already present. If the hash is already present the script would fail with a helper.fail() message.
2) If you want the duplicate data table row allowed to be created but removed after. Then create a workflow Function that checks all the rows in the datatable for the hashes and removes any that are duplicates (probably based on "create date").

Ben

------------------------------
Ben Lurie
------------------------------

Original Message:
Sent: Fri April 24, 2020 10:57 AM
From: Tyler Cole
Subject: Remove/Prevent Duplicate Entries in Data Table Based On a Single Column

Hello all,

I am trying to see if there is a way to prevent/remove duplicate entries in a data table based on a single column.

Example:

A Data table with the following Columns: "Filename, Filepath, Hash"

I want to avoid multiple entries of the same Hash being allowed to be entered into the data table.

Any help on this would be appreciated.

Tyler

------------------------------
Tyler Cole
------------------------------

Hi Ben,

We are interested in that primary key to avoid duplicated entries in datatables also.
Was the idea accepted and if so, do you have an estimated date for that feature? I've tried to reach the ideas page but I can't.


------------------------------
Didac Cornet
------------------------------

Original Message:
Sent: Mon April 27, 2020 07:30 AM
From: Ben Lurie
Subject: Remove/Prevent Duplicate Entries in Data Table Based On a Single Column

There has been thoughts to supporting the ability to make a column be a "primary key" for a datatable. I'd suggest you add this as a request: https://2e4ccba981d63ef83a875dad7396c9a0.ideas.aha.io/ideas.

Just some random thoughts on how to accomplish this:

1) If you want to have the system actually block this you could create an incident field that contains all the hashes and then have a script that validates that the new hash is not already present. If the hash is already present the script would fail with a helper.fail() message.
2) If you want the duplicate data table row allowed to be created but removed after. Then create a workflow Function that checks all the rows in the datatable for the hashes and removes any that are duplicates (probably based on "create date").

Ben

------------------------------
Ben Lurie

Original Message:
Sent: Fri April 24, 2020 10:57 AM
From: Tyler Cole
Subject: Remove/Prevent Duplicate Entries in Data Table Based On a Single Column

Hello all,

I am trying to see if there is a way to prevent/remove duplicate entries in a data table based on a single column.

Example:

A Data table with the following Columns: "Filename, Filepath, Hash"

I want to avoid multiple entries of the same Hash being allowed to be entered into the data table.

Any help on this would be appreciated.

Tyler

------------------------------
Tyler Cole
------------------------------

I have not heard about this being on the roadmap. Here is the link again without the period at the end:

https://2e4ccba981d63ef83a875dad7396c9a0.ideas.aha.io/ideas

Ben

------------------------------
Ben Lurie
------------------------------

Original Message:
Sent: Tue June 30, 2020 04:09 AM
From: Didac Cornet
Subject: Remove/Prevent Duplicate Entries in Data Table Based On a Single Column

Hi Ben,

We are interested in that primary key to avoid duplicated entries in datatables also.
Was the idea accepted and if so, do you have an estimated date for that feature? I've tried to reach the ideas page but I can't.


------------------------------
Didac Cornet

Original Message:
Sent: Mon April 27, 2020 07:30 AM
From: Ben Lurie
Subject: Remove/Prevent Duplicate Entries in Data Table Based On a Single Column

There has been thoughts to supporting the ability to make a column be a "primary key" for a datatable. I'd suggest you add this as a request: https://2e4ccba981d63ef83a875dad7396c9a0.ideas.aha.io/ideas.

Just some random thoughts on how to accomplish this:

1) If you want to have the system actually block this you could create an incident field that contains all the hashes and then have a script that validates that the new hash is not already present. If the hash is already present the script would fail with a helper.fail() message.
2) If you want the duplicate data table row allowed to be created but removed after. Then create a workflow Function that checks all the rows in the datatable for the hashes and removes any that are duplicates (probably based on "create date").

Ben

------------------------------
Ben Lurie

Original Message:
Sent: Fri April 24, 2020 10:57 AM
From: Tyler Cole
Subject: Remove/Prevent Duplicate Entries in Data Table Based On a Single Column

Hello all,

I am trying to see if there is a way to prevent/remove duplicate entries in a data table based on a single column.

Example:

A Data table with the following Columns: "Filename, Filepath, Hash"

I want to avoid multiple entries of the same Hash being allowed to be entered into the data table.

Any help on this would be appreciated.

Tyler

------------------------------
Tyler Cole
------------------------------