IBM Security QRadar SOAR

 View Only
Expand all | Collapse all

"Internal field resolution_id cannot be set in this manner

  • 1.  "Internal field resolution_id cannot be set in this manner

    Posted Mon October 10, 2022 09:19 AM
    Trying to update ticket with these. It errors out {"success":false,"title":null,"message":"Internal field resolution_id cannot be set in this manner.","hints":[],"error_code":"generic"} until I comment out resolution_idand resolution_summary 
     payload = {
    "inc_training": True,
    "description": {
        "format": "html",
        "content": "<div class=\"rte\"><div>"+description+"</div></div>"
    },
    "name":  name,
    "discovered_date":time_now,
    "org_id":  ORG_ID,
    "owner_id": "m@example.com",
    "properties": {
        "incident_severity": "Low",
        "incident_family": "Application Security Monitoring",
        "location": "Corp",
        "soc_vendor_id": "Cloudflare",
        # "resolution_id": "Not an Issue",
        # "resolution_summary": "Lookup table updated",
        "remediation_plan":"No Action Required",
        "business_unit":"GT - Information Security",
        "escalation":"None", 
        "location":"Corp",
        "confidence":"Low"
    },
    "workspace": "XYZ"
    }​


    ------------------------------
    Irek Romaniuk
    ------------------------------


  • 2.  RE: "Internal field resolution_id cannot be set in this manner
    Best Answer

    Posted Tue October 11, 2022 08:22 AM
    Hi Irek,

    resilient_id and resilient_summary are standard incident fields, whereas any field in the 'properties' dictionary is a custom added incident field. Just move those fields out from 'properties'.

    Regards,
    Mark

    ------------------------------
    Mark Scherfling
    ------------------------------

    Original Message