IBM Security QRadar SOAR

 View Only
  • 1.  Mod Con: Enforce Completion of Mandatory Tasks before Incident Closure

    Posted Thu December 19, 2019 02:37 PM
    Edited by Brenden Glynn Mon January 06, 2020 02:44 PM
    Below is a Resilient Mod Con that will allow you to Enforce the completion of Mandatory Tasks, before Incident Closure.

    Background: Currently the attribute of Mandatory on a Task only governs the change of Phase in an Incident. For Phases to transition to the next, all Mandatory Tasks in that Phase must first be complete. Optional Tasks are not evaluated for Phase change.

    Why: Tasks (detailed response actions and results!) that are prescribed by SOP/TTPs should be followed to completion as outlined. Tasks in a Playbook, are a description of actions/resources for the user. When Completed, are indication of work performed, and a historical reference. As such, they are auditable and can be used as an indication of the effectiveness of response, for lessons learned/tuning activities.

    How: The last Phase in every Incident is Complete. This is a system Phase that is not exposed or editable in Phases & Tasks. An Incident only ever reaches the Complete Phase when all Mandatory Tasks are complete! So the method shown below, checks that the Incident is in the Complete Phase before it allows a user to Close an Incident. Thus enforcing Mandatory Task Closure.

    Method: An Incident Rule is triggered when a user attempts to change the Incident (Status Field) to Closed, which runs an Incident Script that evaluates the current Phase, and checks to see if the Incident is in the Complete Phase. If not, it throws an error to the User, informing them of their attempted premature Incident Closure.

    Let me know what you think. This could be modified to allow for Conditionally Mandatory Tasks. For example on Incident Type, Group Member, Severity, etc.. Any Incident Field Value!

    Next I will post a Rule/Script Combo that allows a user to Mark Mandatory Tasks as Optional/Not Applicable (use these two Mod Cons together wisely)!

    Script:

    if incident.phase_id != 'Complete':
    helper.fail("You must complete all Mandatory Tasks before closing the Incident.")

    Screenshots:


    Incident Rule

    Incident Script



    ------------------------------
    Brenden Glynn
    CISSP, GCIH
    Incident Response Business Consultant
    IBM Resilient
    ------------------------------


  • 2.  RE: Mod Con: Enforce Completion of Mandatory Tasks before Incident Closure

    Posted Fri January 03, 2020 06:34 AM
    Hi Brenden, 
    Thank you writing this up and enabling this Mod Con for our users. I think this is a great idea which can and should be expanded on.

    >Next I will post a Rule/Script Combo that allows a user to mark a Mandatory Task Optional (use these two Mod Cons together wisely)!

    You can achieve this today by using the Task Utils extension found on the AppExchange. Provided is a number of workflows, one of which is used to mark any Mandatory Task as Optional. Here is a link to the App Exchange listing : https://exchange.xforce.ibmcloud.com/hub/extension/36ff15c1d9366036bd3c4ccbe93a0476


    ------------------------------
    Ryan Gordon
    Security Software Engineer
    IBM
    ------------------------------



  • 3.  RE: Mod Con: Enforce Completion of Mandatory Tasks before Incident Closure

    Posted Mon January 06, 2020 03:40 AM
    Thanks guys,

    For complete context we do have the customer idea covering this area as well.
    https://2e4ccba981d63ef83a875dad7396c9a0.ideas.aha.io/ideas/R-I-19

    ------------------------------
    MARTIN FEENEY
    IBM Resilient Product Manager
    IBM Security
    Galway
    ------------------------------