IBM QRadar SOAR

 View Only
  • 1.  Modify an incident within a playbook

    Posted Fri July 26, 2024 03:16 AM

    Hi all ,

    Is there a way to modify an incident (other incident that has ran the playbook) from the playbook itself.

    also, anyone has expirees using the patch : /orgs/{org_id}/incidents/{inc_id} RESTapi , its requesting a version number as part of input and I'm not sure how to get that.

    Thanks.



    ------------------------------
    mohamad islam hamadieh
    ------------------------------


  • 2.  RE: Modify an incident within a playbook
    Best Answer

    Posted Mon July 29, 2024 09:44 AM

    Hi Mohamad,

    Unfortunately it is not possible to modify another incident from within an incident playbook. 

    Regarding using the PATCH incident API, you can get the latest version number (vers) from GET incident api that you can use in PATCH api request.



    ------------------------------
    DillipNath
    ------------------------------



  • 3.  RE: Modify an incident within a playbook

    Posted Tue July 30, 2024 08:10 AM

    Hi Mohamad,

    Dilip is right: there is no "native" operation that will allow you to  modify another incident from within an incident playbook.

    But since you seem familiar with REST APIs, maybe you could use the REST API Functions for SOAR.

    Just a thought



    ------------------------------
    Pierre Dufresne
    ------------------------------



  • 4.  RE: Modify an incident within a playbook

    Posted Thu August 01, 2024 05:24 AM

    Thanks @Dillip Nath and @Pierre Dufresne , yes I will look into using the RestAPI function now that I know where to get the version number from.



    ------------------------------
    mohamad islam hamadieh
    ------------------------------