IBM Security QRadar SOAR

 View Only
  • 1.  SOAR Outboun Email Timezone

    Posted Fri September 09, 2022 03:27 AM
    Hi everyone,

    after installing the Outbound email app for SOAR I noticed that the field "Created" in the email-body is in UTC while the "Created Time" in the incident's summary is in my correct timezione

    is there a way to set the time-zone in the pre-process script?

    {{ get_row('Created:','create_date') }}<br>

    Thank you very much in advance

    ------------------------------
    Arben Alia
    ------------------------------


  • 2.  RE: SOAR Outboun Email Timezone

    Posted Mon September 12, 2022 08:10 AM
    Hi Arden,

    Thanks for the question. This is not possible at this time, but we will review for a future change. I believe it could be possible to introduce a timezone variable which would be used when translating any date related field in get_row.

    Regards,
    Mark

    ------------------------------
    Mark Scherfling
    ------------------------------



  • 3.  RE: SOAR Outboun Email Timezone

    Posted Wed September 21, 2022 05:50 AM

    if this very important for you there is a work around.
    you can create a date field and each time an incident is created you automatically run a script that modify this filed to your time zone.
    you can even not show the field in you incident view layout.
    you then pass this field in the email template.

    the script will be as flow.

    incident.properties.new_time = incident.create_date + int(390 * 60 ) * 1000 
    # replace 390 with number of minutes for the deference between your time zone and UTC


    let me know if more help is needed





    ------------------------------
    mohamad islam hamadieh
    ------------------------------



  • 4.  RE: SOAR Outboun Email Timezone

    Posted Mon September 26, 2022 04:35 AM
    Hi Mohamad,

    Thanks for the workaround, it worked.


    ------------------------------
    Arben Alia
    ------------------------------