IBM Security QRadar SOAR

Hello Experts,

How do i create dialog box in playbook, just like using activity fields in rule?. I have the below playbook, but when I initiate it from an artifact( type mac address) it gives the error message:

Please assist

------------------------------
benlinux
------------------------------

Hi benlinux,

This kind of dialogbox (Activation Form, in SOAR's term) is only available for manually triggered playbook as it requires user's input.

Here is the SOAR's online doc on how to create a such playbook

https://www.ibm.com/docs/en/sqsp/51?topic=playbooks-creating-playbook-that-is-activated-manually

and more specifically , how to create the activation form including a demo video.

https://www.ibm.com/docs/en/sqsp/51?topic=manually-activation-form

Cheers,

------------------------------
Gilbert Liao

Original Message:
Sent: Fri November 24, 2023 08:37 PM
From: benlinux
Subject: Dialog box for playbook

Hello Experts,

How do i create dialog box in playbook, just like using activity fields in rule?. I have the below playbook, but when I initiate it from an artifact( type mac address) it gives the error message:

Please assist

------------------------------
benlinux
------------------------------

Hello Experts,

How do i create dialog box in playbook, just like using activity fields in rule?. I have the below playbook, but when I initiate it from an artifact( type mac address) it gives the error message:

Please assist

I'm not familiar with the function you're using, but the error says that the "ciso_ise_mac_address" input field doesn't exist. Check that your input field is not misspelled. If by dialog box you mean a form where you can type something in - click the blob 'artifact activated' and there you can create an activation form, but this won't solve the problem if the input field you're trying to set doesn't exist.

Hello Experts,

How do i create dialog box in playbook, just like using activity fields in rule?. I have the below playbook, but when I initiate it from an artifact( type mac address) it gives the error message:

Please assist