IBM Security QRadar SOAR

 View Only
  • 1.  Datatypes in QRadar SOAR

    Posted Thu November 24, 2022 04:50 AM
    Hello everyone,

    i'm struggling with understanding Datatypes in scripting for QRadar SOAR. Is there a List of all built in Datatypes and their Attributes?
    For example TextObject is no built-in data type in Python and when I try to access a Text Area Field (Datatype: TextObject) to write in it via script, I always get Errors that for example append is not an Attribute of TextObject or that the Operator + is not compatible.
    I want to understand all other Datatypes as well. Unfortunatly i'm not allowed to use dir() inside SOAR.

    Thank for your help!

    Benjamin Walden

  • 2.  RE: Datatypes in QRadar SOAR

    Posted Tue November 29, 2022 09:58 AM
    Hi Bejamin,
    I also struggled with this TextArea field concept. For this type in particular, you must know it is not a simple string: it comes in the form of:
    {'format': 'html', 'content': 'Description of incident'}
    So if you want to change the text of the field, you must use the "content" part, like this:
    incident.description.content = "new description of incident"


    Pierre Dufresne

  • 3.  RE: Datatypes in QRadar SOAR

    Posted Wed November 30, 2022 01:04 AM
    Hi Pierre,

    thank you very much. It would be great to know if this Datatype not only looks like a Dictionary but if it has the same Methods as well. Sometimes i try out some Methods but don't know if they are even in the Spectrum of this Datatype.
    It's not that this is a problem that keeps me from coding, but it would be nice to have an Overview of possible Datatypes plus their Methods somewhere, for getting some Inspiration.
    I found this through the Script help resilient-scripts/1_basics at master · ibmresilient/resilient-scripts · GitHub. It is a good start but lacks the mentioned Methods or Reference to Pyton built-in Datatypes.
    Maybe i'm overthinking things.

    Benjamin Walden