IBM QRadar SOAR

IBM QRadar SOAR

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only
Expand all | Collapse all

Behaviour of Wait Point

  • 1.  Behaviour of Wait Point

    Posted Wed January 24, 2024 03:02 PM

    Hi everybody,

    I am writing a playbook like the one below.  I created a multiselect field called "Action" which can take one or more values: Action1, Action2, Action3, Action4.

    The condition is configured with "Any true condition".

    For each value selected, there is an associated script that needs to be executed.  When all the selected srcipt(s) have been executed, there is a Wait point to make sure each script has finished.  The problem is: because not all the scripts may need to be performed, the wait point will wait forever for those not run  and the playbook will never terminate.

    Does anyone can suggest a way around this situation?



    ------------------------------
    Pierre Dufresne
    ------------------------------


  • 2.  RE: Behaviour of Wait Point

    Posted Thu January 25, 2024 05:48 AM

    Hi Pierre 

    have shared your query with the team.

    Should have a response shortly.

    Regards

    John



    ------------------------------
    John Quirke
    ------------------------------



  • 3.  RE: Behaviour of Wait Point

    Posted Thu January 25, 2024 08:58 AM

    Hi Pierre -

    Can you elaborate on when "not all the scripts may need to be performed" and what would determine that? It sounds to me like you need a more involved condition point with more branches.

    In general, the wait point is designed to do exactly what you're observing -- gather all incoming branches of the playbook and wait until those branches have complete.

    You could consider making multiple endpoints in the playbook, one for each path through the conditions and scripts. Or else, like I suggested above, expand your conditional node to be more specific.

    If you share with me more details of the condition and when you want what to happen, I'd be happy to give feedback on that.



    ------------------------------
    Bo Bleckel
    ------------------------------



  • 4.  RE: Behaviour of Wait Point

    Posted Thu January 25, 2024 11:34 AM

    Hi Bo,

    Thanks for your feedback.

    The first task presented to the analyst is Select Action.  Before completing the task, he must edit the field  multiselect field called "Action" to specify which actions need to be performed.  For example, if he selects Action1 and Action3, the corresponding scripts (Action1 and Action3) will be executed but the other two (Action2 and Action4) will not. This will make the Wait point wait forever.

    The only solution I could come up with is the one below.  The Noop script does nothing: it is just there to make the paths converge before entering the Wait point.

    But the playbook looks less simple.  If you have any other idea, I would be glad to hear them.  Thanks



    ------------------------------
    Pierre Dufresne
    ------------------------------



  • 5.  RE: Behaviour of Wait Point

    Posted Thu January 25, 2024 01:36 PM

    Hi Pierre - 

    This is the right idea. I think you could simply send those "Else" (Si-non in the French translation) directly to the wait point, rather than going through the noop script. 

    I do agree that having those four condition points is clunky -- but I think that it is necessary to achieve the goal that you have.



    ------------------------------
    Bo Bleckel
    ------------------------------



  • 6.  RE: Behaviour of Wait Point

    Posted Thu January 25, 2024 01:44 PM

    Also - you can define multiple conditions for one condition point. So that would allow you to simplify it to one condition point with four conditions, each pointing to a different script, and the "Else" going to the wait point. Then each script would also send to the wait point.

    I've achieved this by clicking "Create condition" as many times as needed, and using the setting: "First true condition". Then when attaching the script node from the condition node, I select the condition that is appropriate for my script



    ------------------------------
    Bo Bleckel
    ------------------------------



  • 7.  RE: Behaviour of Wait Point

    Posted Thu January 25, 2024 01:46 PM

    Apologies for the multiple replies. You should actually use "Any true condition" for your case so that all the applicable paths are followed, based on their conditions. Read more on this here: https://www.ibm.com/docs/en/sqsp/51?topic=points-condition



    ------------------------------
    Bo Bleckel
    ------------------------------



  • 8.  RE: Behaviour of Wait Point

    Posted Thu January 25, 2024 04:02 PM

    The solution you are describing is similar to my first post.  The condition point there is also "Any true condition".  Each condition reads like "If Action contains Action1",  "If Action contains Action2", ...

    I think I will go with my second solution.

    Thanks for your insights.



    ------------------------------
    Pierre Dufresne
    ------------------------------



  • 9.  RE: Behaviour of Wait Point

    Posted Thu January 25, 2024 04:11 PM

    This is the solution I will use.

    I think the Noop scripts are necessary though.  When leaving the condition point, you cannot directly go into a wait point: The condition is either true or not. If both branches enter a wait point, only one of them will have been taken, either the true branch or the else branch and the wait point will wait indefinitely.  At least this is my comprehension of the behaviour of a wait point.



    ------------------------------
    Pierre Dufresne
    ------------------------------



  • 10.  RE: Behaviour of Wait Point

    Posted Fri January 26, 2024 11:01 AM

    I have had to do this many times where I put a script that basically did nothing after both the conditioned and else path before going to the Wait Point as the Wait Points are essentially dumb (meaning no true logic to them) and just say "I cannot move forward without all the paths that are connected to me being completed". Because of this I am in agreeance with you that your first method and Bo's method will not work as if some of those paths are not finishing then it will not move on. You have corrected this with your second method in breaking each condition out to its own pathway and adding the nothing script to the end of it.



    ------------------------------
    Nick Mumaw, GPEN, GPYC
    Cyber Security Specialist - SOAR
    IBM - Security
    ------------------------------



  • 11.  RE: Behaviour of Wait Point

    Posted Fri January 26, 2024 05:07 AM

    What I would do in your place is change the conditional block into a function. The output would be a dict, action names are the keys and the values would be true or false. If you need to run action1 and action2 the dict would be {"action1": True, "action2": True, "action3": False, "action4":False} then in each action script check if it should run the whole code or pass. This way all the actions would technically run but only the ones that need to do something would do it and the wait point won't wait forever. 



    ------------------------------
    Maria Czapkowska
    ------------------------------



  • 12.  RE: Behaviour of Wait Point

    Posted Fri January 26, 2024 11:08 AM

    I like this option. I will have to try this out!

    The only place where I see this failing and having to go back to the second post the OP did was if you are performing functions and not just internal scripts. This would be because the internal scripts could have the logic built in, do this if this is true and like you said script always completes. If you have a function in there instead you would then need to fall back to the option of the decision point and needing that useless script on the end to bring it back together before moving forward to the wait point. Do you potentially have a solution I am not seeing for that?



    ------------------------------
    Nick Mumaw, GPEN, GPYC
    Cyber Security Specialist - SOAR
    IBM - Security
    ------------------------------



  • 13.  RE: Behaviour of Wait Point

    Posted Mon January 29, 2024 02:39 AM

    If you're using functions you would still need to use a script in the function to set all the variables so the if would be there too.



    ------------------------------
    Maria Czapkowska
    ------------------------------



  • 14.  RE: Behaviour of Wait Point

    Posted Fri February 02, 2024 01:28 PM

    What I was referring too was if I wanted to run a function or not. I think you would still need the decision point there.



    ------------------------------
    Nick Mumaw, GPEN, GPYC
    Cyber Security Specialist - SOAR
    IBM - Security
    ------------------------------



  • 15.  RE: Behaviour of Wait Point

    Posted Mon January 29, 2024 08:35 AM

    Hi Maria,

    Your post had me thinking.  Maybe I could dispense with the the condition, the function and the Noop script with this new version.

    As you explained, each script could begin with an If statement like:

    If "action1" in playbook.properties.action:

      do what the script has to do

    Else:

      do nothing and end the script

    It's even simpler than the original version!  Using a condition point seemed so natural but it just complicated things.

    Thnaks



    ------------------------------
    Pierre Dufresne
    ------------------------------



  • 16.  RE: Behaviour of Wait Point

    Posted Mon January 29, 2024 08:37 AM

    So this should be the new solution:



    ------------------------------
    Pierre Dufresne
    ------------------------------