IBM Security QRadar SOAR

 View Only
  • 1.  Playbooks not visible in "Actions" drop down

    Posted Sat November 18, 2023 03:18 PM
    Edited by benlinux Sat November 18, 2023 03:25 PM

    Hello Experts,

    I successfully installed the Ldap integration app on my IBM QRadar SOAR, but i cant see the Playbooks in the "Actions" drop down for Artifact object.

    List of playbooks for object type "Artifact"

    "Action" drop down for object type "Artifact" does not show these playbooks:

    However the playbook for the object type "incident" is visible and works fine:


    I will really appreciate a help.

    Thanks



    ------------------------------
    benlinux
    ------------------------------



  • 2.  RE: Playbooks not visible in "Actions" drop down

    Posted Mon November 20, 2023 08:52 AM

    Those artifact playbooks have conditions for the artifact type it will run on. The artifact that you are using do not meet the playbook conditions, so you do not see the playbooks for that artifact. If you open a playbook you can see the conditions that the playbook has.



    ------------------------------
    Richard Swierk
    ------------------------------



  • 3.  RE: Playbooks not visible in "Actions" drop down

    Posted Mon November 20, 2023 10:19 AM

    Hello Richard,

    Thank you for your response. I believe i created the right artifact type for the playbook i want to use.

    For example, the below playbook should speak to artifact type "user account".





    ------------------------------
    benlinux
    ------------------------------



  • 4.  RE: Playbooks not visible in "Actions" drop down

    Posted Mon November 20, 2023 11:22 AM

    That playbook requires an artifact with type string.



    ------------------------------
    Richard Swierk
    ------------------------------



  • 5.  RE: Playbooks not visible in "Actions" drop down

    Posted Mon November 20, 2023 12:04 PM

    Thank you Richard. It works :)

    Regards,



    ------------------------------
    benlinux
    ------------------------------