Original Message:
Sent: Mon March 24, 2025 09:03 AM
From: Matt
Subject: Automatically add note (mention someone) to incident
Thank you so much for the tip @Mohamad!
I slightly modified your script (i save the api token in a secret which i refer to by using ${...}) and the solution is working!
For anyone else who is trying to achieve something similar:
- Install the "REST API Functions for IBM QRadar SOAR" App from App Exchange
- Create an API Key with these permissions: "Incidents > Read" and "Edit Incidents > Notes"
- Build the following string and convert it into base64 and store it as a secret in the App configuration (Click on "app.config" > "Add Secret"): "API Key:API Secret" (without double quotes)
- Create a new Playbook of "Activation type = Automatic" and "Object type = Note"
- Define the Automatic Activation Condition as needed
- Add the function "Call REST API" of the App to the canvas and change Function inputs from "Fields" to "Script" and adjust the following script as needed by you:
import jsonimport re #api_token_base64 = "API KEY ID:API SECRET" // the whole string is base64 encoded and saved in the app.config as a secretapi_token_base64 = "${API_KEY_SECRET_B64}" inputs.rest_api_url = f"https://<YourURL>/rest/orgs/<YourOrgID>/incidents/{incident.id}/comments"inputs.rest_api_method = "POST"inputs.rest_api_verify = 'False'inputs.incident_id = incident.idinputs.rest_api_headers = """Content-Type: application/jsonAuthorization : Basic {}""".format(api_token_base64)notetype = note.get('type')noteid = note.get('id')taskid = note.get('task_id') body = { "parent_id": f"{noteid}", "text": { "format": "html", "content": "<div class=\"soar-rte-content\"><p><span style=\"font-family: IBM Plex Sans , sans-serif;\"><span style=\"font-size: 14.0px;\"><span style=\"color: rgb(244,244,244);\"><span style=\"background-color: rgb(22,22,22);\">Notifying </span></span></span></span><span class=\"mention-at-user\">@{53|UserName}</span> </p></div>" }, "is_deleted": False, "mentioned_users": [ { "id": 53 } ]}if (notetype == "task"): inputs.rest_api_url = f"https://<YourURL>/rest/orgs/<YourOrgID>/tasks/{taskid}/comments" rtask = {"task_id": f"{taskid}"} body.update(rtask)inputs.rest_api_body = json.dumps(body) # this converts the dict to a json string; taken from: https://ibmresilient.github.io/resilient-community-apps/fn_rest_api/README.html#function---call-rest-api
- Connect the function to an Endpoint and enable the playbook. It should work now. For me it adds an answer note that mentions specific persons based on a specific condition automatically. This works for incident notes as well as for task notes.
Original Message:
Sent: Thu March 13, 2025 02:15 AM
From: Mohamad islam Hamadieh
Subject: Automatically add note (mention someone) to incident
Hi @Matt & @Erkam ,
Any reason you don't want to use API for that ?
Its actually not hard to use and experimenting in that can help you in future integrations.
you can use SOAR REST API from within SOAR playbook GUI , just install REST API app and use its function.
here is a sample function script.
for base64 encoding you can use
Base64 Encode and Decode - Online
import jsonimport re api_token_base64 = "api_key_id:api_key_secret encoded in base64" inputs.rest_api_url = f"https://yourSOARIP/rest/orgs/yourOrgID/dependsOnWhichAPiYouWantToUse"inputs.rest_api_method = "POST"inputs.rest_api_verify = 'False'inputs.incident_id = incident.idinputs.rest_api_headers = """Authorization : Basic {}""".format(api_token_base64) body = {}
------------------------------
mohamad islam hamadieh
I post SOAR content and tips on linkedIn , follow me :)
https://linkedin.com/in/mohamadislam
Original Message:
Sent: Wed March 12, 2025 11:16 AM
From: Matt
Subject: Automatically add note (mention someone) to incident
Unfortunately i havent found a working solution for this either.
It is very sad that this is not possible.
If anyone reading this has another idea: any help is much appreciated.
Thank you very much in advance!
Original Message:
Sent: Tue March 11, 2025 09:29 AM
From: Erkam Çetiner
Subject: Automatically add note (mention someone) to incident
I tried helper.createRichText for you with different types of texts but it does not work too. I think only way to do that is API. I already analyzed and used note creation and note search payload and responses from developer tools but it does not working too. Also checked apps and there is only one function about it in Task Utils but it does not work.
If you find a way to do that except API, please inform us here.
------------------------------
Erkam Çetiner
Principal SOC Specialist
erkamcetinerwork@gmail.com
Original Message:
Sent: Tue March 11, 2025 07:32 AM
From: Matt
Subject: Automatically add note (mention someone) to incident
Actually i ran the script on a different (newly created) incident and it is working now.
However, mentioning someone does not work via script. Simply adding "@matt" does not trigger the notification mail to be sent out even though its setup in the settings of the user.
What i have tried so far:
answernote = note.addNote('@matt <div class="soar-rte-content"><p>mentioning <span class="mention-at-user">@{20|Matt}</span> </p></div> and <span class="l-user-span__name" title="Matt">Matt</span> <span class="username" style="display: inline-block;" data-user_id="20" data-name="" data-org="" data-original-title="" title=""><span>Matt</span></span> and <div class="popover-parent"><span class="username" style="display: inline-block;" data-user_id="20" data-name="" data-org="" data-original-title="" title=""><span>Matt</span></span></div> and <span class="l-user-span"><span class="l-user-span__tooltip"><div id="__carbon-tooltip-trigger_8ijtiul78kb" class="bx--tooltip__label" role="button" tabindex="0" aria-labelledby="__carbon-tooltip-trigger_8ijtiul78kb"><span class="l-user-span__name" title="Matt">Matt</span></div></span></span>')answernote.update({"mentioned_users": ["matt@matt.com"]})
Has anyone figured out this maybe? Is there maybe an app that could help with this?
Thanks again!
Original Message:
Sent: Tue March 11, 2025 02:02 AM
From: Erkam Çetiner
Subject: Automatically add note (mention someone) to incident
Hello Matt,
Do you have so many rules or playbooks which have been triggered when you are trying to test that script from rules or playbooks? Can you modify your incident to it would trigger only one rule or playbook? I think it can solve your issue.
------------------------------
Erkam Çetiner
Senior SOC Specialist
erkamcetinerwork@gmail.com
Original Message:
Sent: Mon March 10, 2025 11:18 AM
From: Matt
Subject: Automatically add note (mention someone) to incident
Hi everyone,
i am trying to automatically add a note to some incidents in order to mention specific people automatically.
According to this site: Note operations for scripts - IBM Documentation it should be possible to use this code "note.addNote("text here")" on a Script object of type "note". This is what i am trying to do. However, it is not working. It runs for some time and then throws this error:
"Rule 'Test' is unable to update the Incident 'Test' because: the maximum number of new objects created by rules and playbooks has been exceeded":
I want to add a note like "@emailHere" in order to mention some people automatically as i dont see a better way of doing that (notifications cannot be used with specific conditions).
Any help is much appreciated!
Thank you very much in advance!