IBM QRadar SOAR

IBM QRadar SOAR

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only
Back to discussions
Expand all | Collapse all

Set top-level Incident from with an Incident script.

  • 1.  Set top-level Incident from with an Incident script.

    Posted Fri July 26, 2024 03:19 AM

    Do we have something similar but from within an Incident script:

    I just want to set the top-level incident to an incident that I got as result of an incident query.



    ------------------------------
    mohamad islam hamadieh
    ------------------------------


  • 2.  RE: Set top-level Incident from with an Incident script.

    Posted Fri July 26, 2024 10:18 AM

    Hi Mohamad,

    Unfortunately, there is not an equivalent script method once in an incident. We do have an app, fn_soar_utils.search_incidents which can be used in a similar way. I think this is a good idea which would be a good enhancement if you'd like to request it in our ideas portal:  https://ideas.ibm.com/

    Regards,

    Mark



    ------------------------------
    Mark Scherfling
    ------------------------------

    Original Message


  • 3.  RE: Set top-level Incident from with an Incident script.

    Posted Thu August 01, 2024 05:32 AM

    Thank @Mark Scherfling .

    I have created the idea.

    IBM Ideas

    please whoever think it's useful , vote on it.



    ------------------------------
    mohamad islam hamadieh
    ------------------------------

    Original Message