IBM Security QRadar SOAR

Hello all,

I had a problem installing the artifact object playbook activation. The value field "True Positive" is the value of the incident. I have configured this value field to be editable in the task. My wish is for the "True Positive" value to be "Yes" then it will activate the playbook. But it didn't work as I expected. Can someone explain to me these playbook trigger values. #artifact #activation_condition

Do you want this to be activated when the artifact was added or when the value "true positive" was changed? You have "True Positive is changed" and "artifact is created", I think they cancel each other out. The value can't change if the artifact was just created and if the value has changed then the artifact wasn't just created. Try removing one of them and see if it works then

Hello Maria Czapkowska,

"true positive" is a Field of Incident, it is not related to the value of Artifact. I also encountered the above problem when activating a playbook with an artifact object when the Field of Incident changed with the corresponding value. For example, in the above case "true positive has the value Yes", the playbook with the artifact object will be activated to execute with the incident artifacts.