IBM Security QRadar SOAR

 View Only
  • 1.  Outbound Email mail not properly work

    Posted Tue April 02, 2024 12:19 PM

    Good day Everyone

    I have designed a playbook and use outbound function to send an email to the concern user. I have used the below script but when playbook is running and move to outbound email phase it got stuck.

    Looking forward for a Positive Response

    inputs.mail_to= User Email
    inputs.mail_body_text=" Soar"
    inputs.mail_cc="abc@....."
    inputs.mail_from="test@soar.com"
    inputs.mail_subject ="Failure"
     
    inputs.mail_body_html = """{% set NOT_FOUND = ["Not Found!","-","None",None] %}
    {% macro get_row(label,field_name) -%}
    {% set value = template_helper.get_incident_value(incident,field_name) %}
    {% set style = "font-family: Calibri; color: rgb(31,73,125)" %}
        {% if value and value not in NOT_FOUND and not value.startswith('-') %}
        <tr>
            <td width="100" style="{{style}}; font-weight:bold">{{ label }}</td>
            <td style="{{style}}">{{ value | striptags }}</td>
        </tr>
        {% endif %}
    {%- endmacro %}
    <table width="100%" >
    <tr>
        <td colspan="2">
            <h3 style="color: rgb(68,114,196)">INCIDENT DETAILS</h3>
            <hr size="1" width="100%" noshade style="color:#FFDF57" align="center"/>
        </td>
    </tr>
        {{ get_row('Severity:','severity_code') }}
        {{ get_row('Status:','plan_status') }}<br>
        {{ get_row('Created:','create_date') }}<br>
        {{ get_row('Category:','incident_type_ids') }}
    <tr>
        <td colspan="2">
            <br><h3 style="color: rgb(68,114,196)">INCIDENT DESCRIPTION</h3>
            <hr size="1" width="100%" noshade style="color:#FFDF57" align="center"/>
        </td>
        {{ get_row('Description:','description') }}
    </tr>
    <tr>
        <td colspan="2">
            <h3 style="color: rgb(68,114,196)">INCIDENT LINK</h3>
            <hr size="1" width="100%" noshade style="color:#FFDF57" align="center"/>
        </td>
    </tr>
    <tr>
        <td colspan="2">
            {% set inc_url = template_helper.generate_incident_url(incident.id) %}
            <a target='_blank' href='{{ inc_url }}'>{{ incident.id }}: {{ incident.name }}</a>
        </td>
    </tr>
    </table>
    <br>
    """


    ------------------------------
    Ahmad Hassan Tariq
    ------------------------------


  • 2.  RE: Outbound Email mail not properly work

    Posted Wed April 03, 2024 08:39 AM
    Edited by Bo Bleckel Wed April 03, 2024 08:40 AM

    Hi,

    Have you confirmed that the app is properly configured and running? From the App page in Administrator Settings, please ensure that the 'Test Configuration' passes in the Outbound Email app.config page.

    Once that is confirmed, we can determine the next steps.



    ------------------------------
    Bo Bleckel
    ------------------------------



  • 3.  RE: Outbound Email mail not properly work

    Posted Wed April 17, 2024 12:45 AM

    Hi

    The app is properly configured and running, but during the test connection, it takes too much time and produces the following error.

    Secondly, emails are sent successfully from CLI tests, and user invitations are sent successfully from the GUI.

    selftest: failure
        selftest output:
        {'state': 'failure', 'reason': 'Failed to send test email with error:SMTP AUTH extension not supported by server.'}
        Elapsed time: 0.021000 seconds



    ------------------------------
    Ahmad Hassan Tariq
    ------------------------------



  • 4.  RE: Outbound Email mail not properly work

    Posted Thu April 18, 2024 04:21 AM

    The SMTP setting in CLI and Outbound Email app are independent, so from test result at least we can confirm the SMTP setting in CLI is working (user invitation is handled by CLI setting). 

    Would you please use "$ sudo resutil smtpshow" to print out the detailed server setting in CLI, and compare with the setting in Outbound Email app's app.config?



    ------------------------------
    Andy Su
    ------------------------------