IBM Security QRadar SOAR

Hi Everyone,

I am trying to create one script but I am getting error while running that the Incident Id is not correct. 

But the Incident ID is correct only. Still that is not able to get the incident ID.

Please see the error snap.

Thanks,

Shashi.

Hi Shashi -

You are trying to run the script as a test here. This will work for testing purposes, but shouldn't be used for actual production use of the script.

To run the script simulation, you have to enter a valid incident ID from the incidents that are open in your system. I think that incident 11111 doesn't exist in your system. Check the incident list and try again with a valid incident. If this continues and you think that you are using a valid incident ID, then please share the incident details in your response so we can further look in to this.

Bo

Hi Shashi,

Do you use MSSP? If so, are you running this from the configuration organisation using an incident ID from a child organisation? If yes, the configuration organisation has no access to incidents in any of the child organisations in the same way one child organisation cannot access incidents in another.

If you are using MSSP and you want to test a script against an incident you can create a standard org, create the script in the new standard org, create an incident and then run the script again the incident. Make changes to the script until it works as expected and then recreate the script in the configuration org to be pushed down to the child organisations.