IBM QRadar SOAR

 View Only
Expand all | Collapse all

Using Else Condition Points in Playbooks

  • 1.  Using Else Condition Points in Playbooks

    Posted Fri February 04, 2022 11:51 AM
    My team is on V43.1.49 and attempting to utilize Playbook Designer's Condition Points. My goal is to create a condition point that includes an object select field or multiselect field, and if the value of that field is null when the task is closed, the playbook will refuses to move forward without a value. This was an option in Workflows, but I am unable to replicate so far due to the lack of an "Else" default option. Does anyone have the documentation source that can assist me in addressing this issue?

    ------------------------------
    Patrick Conroy
    ------------------------------


  • 2.  RE: Using Else Condition Points in Playbooks

    Posted Mon February 07, 2022 08:18 AM
    This is definitely possible with playbooks. Here is an example:


    Ben

    ------------------------------
    Ben Lurie
    ------------------------------



  • 3.  RE: Using Else Condition Points in Playbooks

    Posted Mon February 07, 2022 03:20 PM
    Hi Ben,

    This issue isn't the usage of Else as a condition, but my need to not use it. I want to force a user down a path in a task. That task will have a incident object field that needs a value input. I'd prefer a conditional requirement that makes the user perform an input. Without that however I create a condition that states Field "Example" Needs Value "A," or "B." The field is optional  but in this playbook it is not. I have done the same with gateways in Workflows previously. However if my condition is A or B, that's all I want to put down. It appears I am forced as well to add an out clause for Else as a default, which I don't want to do. How would that instance be resolved?

    ------------------------------
    Patrick Conroy
    ------------------------------



  • 4.  RE: Using Else Condition Points in Playbooks

    Posted Tue February 08, 2022 07:55 AM
    I would have the else flow meet up with the node after the add task node like this:



    Ben

    ------------------------------
    Ben Lurie
    ------------------------------



  • 5.  RE: Using Else Condition Points in Playbooks

    Posted Tue February 08, 2022 10:18 AM
    Wouldn't that cause the same issue though that I'm trying to avoid, which is force a user down a path and to ensure they complete the task as I intend prior to its exit? I don't want an Else option as I don't have a default route. I have route A, B, and nothing else.

    ------------------------------
    Patrick Conroy
    ------------------------------



  • 6.  RE: Using Else Condition Points in Playbooks

    Posted Tue February 08, 2022 10:35 AM
    If the condition is not met and the playbook takes the else flow the next node is the end point. The playbook ends at that point. Since the other condition flow is not true then that path is not taken in the playbook and the task is not added to the incident.

    Ben

    ------------------------------
    Ben Lurie
    ------------------------------



  • 7.  RE: Using Else Condition Points in Playbooks

    Posted Tue February 08, 2022 11:53 AM
    That is what would happen, but I do not want that to occur. I do not want the playbook to end until the user takes the action I have designated as necessary. In the case I'm describing the task is already on the playbook and then the user must take action. If they don't take that action, then they can't move forward.

    ------------------------------
    Patrick Conroy
    ------------------------------



  • 8.  RE: Using Else Condition Points in Playbooks

    Posted Tue February 08, 2022 01:26 PM
    You mentioned you had a way to do this with workflows. If you can share the workflow configuration diagram and how the conditions are applied it may help identify how to accomplish this with Playbooks.

    Ben

    ------------------------------
    Ben Lurie
    ------------------------------



  • 9.  RE: Using Else Condition Points in Playbooks

    Posted Tue February 08, 2022 02:08 PM
    See Below. What I'm doing here is starting with a task and then using an exclusive gateway. This could be a script, function, task, or other object in the workflow. Then I use an Exclusive gateway (could also be a parallel gateway) to define what will provide a valid passthrough option. The condition is "if value is present in field then it is true." Otherwise it is not true. It still follows the First True principle, but if this does not work, then the workflow pauses until the correct value is present. If the task is attempted to be closed, it fails without that value. If there is no value, it does not move forward. The only way for it to move forward correctly is with the value being completed in the manner I expect.




    ------------------------------
    Patrick Conroy
    ------------------------------



  • 10.  RE: Using Else Condition Points in Playbooks

    Posted Wed February 09, 2022 11:10 AM
    One thing that isn't clear from the diagram. Is one of the flows from the gateway marked as the default flow? When I tried to create a similar diagram it requires the configuration of a default flow:


    Ben

    ------------------------------
    Ben Lurie
    ------------------------------



  • 11.  RE: Using Else Condition Points in Playbooks

    Posted Thu February 10, 2022 07:29 AM
    Default conditions are not required in Workflows. What version are you using? We have a few dozen workflows, very few of which have a default workflow.

    ------------------------------
    Patrick Conroy
    ------------------------------



  • 12.  RE: Using Else Condition Points in Playbooks

    Posted Thu February 10, 2022 12:06 PM
    I was using version 44.

    Ben

    ------------------------------
    Ben Lurie
    ------------------------------



  • 13.  RE: Using Else Condition Points in Playbooks

    Posted Thu February 10, 2022 12:51 PM
    In that case, getting back to my point. How can I avoid default conditions in Playbooks?

    ------------------------------
    Patrick Conroy
    ------------------------------



  • 14.  RE: Using Else Condition Points in Playbooks

    Posted Thu February 10, 2022 01:58 PM
    All condition points in playbooks must have an Else flow. At this point we didn't see a use case where that would cause a problem. That is why I was trying to show by creating the same workflow with a default flow.

    It looks like at some point additional validation was added to workflows in later versions to require the default flow as well.

    Ben

    ------------------------------
    Ben Lurie
    ------------------------------



  • 15.  RE: Using Else Condition Points in Playbooks

    Posted Fri February 11, 2022 11:03 AM
    Hi Ben,

    There definitely is a use case for this based on the reasons I've described. Furthermore is an additional missing feature regarding a lack of conditionally required fields. Fields are either Required or Optional, and not able to be defined by circumstance. Without that, and without our ability to bypass an Else functionality, playbooks cannot be a fully realized resource. Is there a workaround so we can continue to build a playbook that works for us?

    ------------------------------
    Patrick Conroy
    ------------------------------



  • 16.  RE: Using Else Condition Points in Playbooks

    Posted Wed February 09, 2022 07:03 AM
    Hi Patrick

    Just as Ben, I also think an example would help us to understand your demand.

    If i've got it right, the key here is

    "The field is optional  but in this playbook it is not"

    It seems that you want to control if a task field is mandatory or not based on some logic. 

    And then, you can make it work using a workflow, but not using a playbook.

    Is that correct?



    ------------------------------
    []

    Leonardo Kenji Shikida
    ------------------------------



  • 17.  RE: Using Else Condition Points in Playbooks

    Posted Wed February 09, 2022 08:52 AM
    Hi Leonardo yes that's right. Conditional Required Fields. I've had an RFE open for that for a few years, but it was a bit moot since Workflows give you a de facto way to resolve my concern. With Playbooks I'm trying to figure out how to do that as well.

    ------------------------------
    Patrick Conroy
    ------------------------------



  • 18.  RE: Using Else Condition Points in Playbooks

    Posted Mon February 14, 2022 09:04 AM
    Edited by Ben Lurie Mon February 14, 2022 09:04 AM
    I wanted to see what happens with a workflow with no default flow out of a condition point. I went back to v36 (which is the oldest I can access) and still that version requires a default flow out of the workflow. What version are you using?

    I still believe that workflow/playbook with a default condition can meet the use case. Unfortunately I don't have a system to test the old behavior on.
    What is the behavior on your system when the task is closed but none of the conditions match?

    You can export the settings and send them to me or post them and I can try that.

    Ben

    ------------------------------
    Ben Lurie
    ------------------------------



  • 19.  RE: Using Else Condition Points in Playbooks

    Posted Mon February 14, 2022 09:20 AM
    Hi Ben. We've been on Resilient since prior to Workflows introduction and are on V43.1.49 now as a SaaS userbase. Once WF were added we started using them this way.

    See below for an example of what we previously used in Workflows and what I'm trying to replicate. Default conditions aren't required.

    1) Exclusive gateway with two options. Within the first task is an Incident Object field.
    2) The condition emanating from each branch has 3 total options but I only want 2 valid ones. Yes or No. "-" is not applicable.
    3) If the task is attempted closed before the field is populated as needed, the "Error during Workflow" comes up. This is what we use to turn an optional field to a conditional requirement within a Workflow.

    A version of this is what we need in Playbooks. Otherwise I'd be forced to have blank options as a valid option. This is not applicable to many use cases. Rather than rewrite those to accommodate the application, the Playbooks should allow for that modification. A use case requiring an answer prior to movement is a common occurrence.

    If I can't do this by inherently created functionality, I'd like to know why and what I can do about it.





    ------------------------------
    Patrick Conroy
    ------------------------------



  • 20.  RE: Using Else Condition Points in Playbooks

    Posted Tue February 15, 2022 11:20 AM
    Ok, I finally understand the use case with the error message screenshot.

    Here is what I believe is an equivalent playbook:


    The script "Fail if not set" causes an error when the other flows are not taken:




    Ben

    ------------------------------
    Ben Lurie
    ------------------------------