IBM QRadar SOAR

Hi,

After the latest SOAR upgrade, the "Run Actions" permission has been split for Workspace users and Global users. Unfortunately some of our workspace users were using EmailMessage rules triggered manually from the Inbox tab which is only under global roles. 

With the new upgrades, we are able to still assign the global role "Access inbox" to workspace users but they are not able to run any actions on them as they would need a global role "View incidents > Run actions" which is not possible.

Can anyone please suggest a workaround for them to wither be able to attach an email (after having seen it from the "inbox" global tab) to an incident, either from the incident or directly from the "inbox" tab without the global role "Run actions"?

Thanks,

Hi AP.
I'm trying to reproduce your issue, and I want to be sure that I'm understanding your issue correctly.

You have a "Workspace" user with:

"Workspace Roles" > "View Incidents" > "Run Actions"

"Global Roles" > "Inbox Permissions" > "Access Inbox"

Is that correct?
Does the user have any other permissions?

Thanks

Hi,

After the latest SOAR upgrade, the "Run Actions" permission has been split for Workspace users and Global users. Unfortunately some of our workspace users were using EmailMessage rules triggered manually from the Inbox tab which is only under global roles. 

With the new upgrades, we are able to still assign the global role "Access inbox" to workspace users but they are not able to run any actions on them as they would need a global role "View incidents > Run actions" which is not possible.

Can anyone please suggest a workaround for them to wither be able to attach an email (after having seen it from the "inbox" global tab) to an incident, either from the incident or directly from the "inbox" tab without the global role "Run actions"?

Thanks,

Yes, that is correct, no other permissions. These used to work prior to the upgrade which introduced the "Run actions" permission under "View incidents"

Hi AP.
I'm trying to reproduce your issue, and I want to be sure that I'm understanding your issue correctly.

You have a "Workspace" user with:

"Workspace Roles" > "View Incidents" > "Run Actions"

"Global Roles" > "Inbox Permissions" > "Access Inbox"

Is that correct?
Does the user have any other permissions?

Thanks

Hi,

After the latest SOAR upgrade, the "Run Actions" permission has been split for Workspace users and Global users. Unfortunately some of our workspace users were using EmailMessage rules triggered manually from the Inbox tab which is only under global roles. 

With the new upgrades, we are able to still assign the global role "Access inbox" to workspace users but they are not able to run any actions on them as they would need a global role "View incidents > Run actions" which is not possible.

Can anyone please suggest a workaround for them to wither be able to attach an email (after having seen it from the "inbox" global tab) to an incident, either from the incident or directly from the "inbox" tab without the global role "Run actions"?

Thanks,

Yes, that is correct, no other permissions. These used to work prior to the upgrade which introduced the "Run actions" permission under "View incidents"

Hi AP.
I'm trying to reproduce your issue, and I want to be sure that I'm understanding your issue correctly.

You have a "Workspace" user with:

"Workspace Roles" > "View Incidents" > "Run Actions"

"Global Roles" > "Inbox Permissions" > "Access Inbox"

Is that correct?
Does the user have any other permissions?

Thanks

Hi,

After the latest SOAR upgrade, the "Run Actions" permission has been split for Workspace users and Global users. Unfortunately some of our workspace users were using EmailMessage rules triggered manually from the Inbox tab which is only under global roles. 

With the new upgrades, we are able to still assign the global role "Access inbox" to workspace users but they are not able to run any actions on them as they would need a global role "View incidents > Run actions" which is not possible.

Can anyone please suggest a workaround for them to wither be able to attach an email (after having seen it from the "inbox" global tab) to an incident, either from the incident or directly from the "inbox" tab without the global role "Run actions"?

Thanks,

Hi AP.
Could I also ask, what version of SOAR are you using?

Thanks

Yes, that is correct, no other permissions. These used to work prior to the upgrade which introduced the "Run actions" permission under "View incidents"

Hi AP.
I'm trying to reproduce your issue, and I want to be sure that I'm understanding your issue correctly.

You have a "Workspace" user with:

"Workspace Roles" > "View Incidents" > "Run Actions"

"Global Roles" > "Inbox Permissions" > "Access Inbox"

Is that correct?
Does the user have any other permissions?

Thanks

Hi,

After the latest SOAR upgrade, the "Run Actions" permission has been split for Workspace users and Global users. Unfortunately some of our workspace users were using EmailMessage rules triggered manually from the Inbox tab which is only under global roles. 

With the new upgrades, we are able to still assign the global role "Access inbox" to workspace users but they are not able to run any actions on them as they would need a global role "View incidents > Run actions" which is not possible.

Can anyone please suggest a workaround for them to wither be able to attach an email (after having seen it from the "inbox" global tab) to an incident, either from the incident or directly from the "inbox" tab without the global role "Run actions"?

Thanks,

Hi AP.
Could I also ask, what version of SOAR are you using?

Thanks

Yes, that is correct, no other permissions. These used to work prior to the upgrade which introduced the "Run actions" permission under "View incidents"

Hi AP.
I'm trying to reproduce your issue, and I want to be sure that I'm understanding your issue correctly.

You have a "Workspace" user with:

"Workspace Roles" > "View Incidents" > "Run Actions"

"Global Roles" > "Inbox Permissions" > "Access Inbox"

Is that correct?
Does the user have any other permissions?

Thanks

Hi,

After the latest SOAR upgrade, the "Run Actions" permission has been split for Workspace users and Global users. Unfortunately some of our workspace users were using EmailMessage rules triggered manually from the Inbox tab which is only under global roles. 

With the new upgrades, we are able to still assign the global role "Access inbox" to workspace users but they are not able to run any actions on them as they would need a global role "View incidents > Run actions" which is not possible.

Can anyone please suggest a workaround for them to wither be able to attach an email (after having seen it from the "inbox" global tab) to an incident, either from the incident or directly from the "inbox" tab without the global role "Run actions"?

Thanks,

User with global permissions if emails are selected:

User with local permissions don't have the actions options at all.

Hi AP.
Could I also ask, what version of SOAR are you using?

Thanks

Yes, that is correct, no other permissions. These used to work prior to the upgrade which introduced the "Run actions" permission under "View incidents"

Hi AP.
I'm trying to reproduce your issue, and I want to be sure that I'm understanding your issue correctly.

You have a "Workspace" user with:

"Workspace Roles" > "View Incidents" > "Run Actions"

"Global Roles" > "Inbox Permissions" > "Access Inbox"

Is that correct?
Does the user have any other permissions?

Thanks

Hi,

After the latest SOAR upgrade, the "Run Actions" permission has been split for Workspace users and Global users. Unfortunately some of our workspace users were using EmailMessage rules triggered manually from the Inbox tab which is only under global roles. 

With the new upgrades, we are able to still assign the global role "Access inbox" to workspace users but they are not able to run any actions on them as they would need a global role "View incidents > Run actions" which is not possible.

Can anyone please suggest a workaround for them to wither be able to attach an email (after having seen it from the "inbox" global tab) to an incident, either from the incident or directly from the "inbox" tab without the global role "Run actions"?

Thanks,

Hi AP

I was able to reproduce your issue, and have opened a bug.

I was unable to find a workaround at this time.

Thanks

User with global permissions if emails are selected:

User with local permissions don't have the actions options at all.

Hi AP.
Could I also ask, what version of SOAR are you using?

Thanks

Yes, that is correct, no other permissions. These used to work prior to the upgrade which introduced the "Run actions" permission under "View incidents"

Hi AP.
I'm trying to reproduce your issue, and I want to be sure that I'm understanding your issue correctly.

You have a "Workspace" user with:

"Workspace Roles" > "View Incidents" > "Run Actions"

"Global Roles" > "Inbox Permissions" > "Access Inbox"

Is that correct?
Does the user have any other permissions?

Thanks

Hi,

After the latest SOAR upgrade, the "Run Actions" permission has been split for Workspace users and Global users. Unfortunately some of our workspace users were using EmailMessage rules triggered manually from the Inbox tab which is only under global roles. 

With the new upgrades, we are able to still assign the global role "Access inbox" to workspace users but they are not able to run any actions on them as they would need a global role "View incidents > Run actions" which is not possible.

Can anyone please suggest a workaround for them to wither be able to attach an email (after having seen it from the "inbox" global tab) to an incident, either from the incident or directly from the "inbox" tab without the global role "Run actions"?

Thanks,

Hi Christian,

Thanks for looking into this. Can you share the bug ID please?

Thanks,

Hi AP

I was able to reproduce your issue, and have opened a bug.

I was unable to find a workaround at this time.

Thanks

User with global permissions if emails are selected:

User with local permissions don't have the actions options at all.

Hi AP.
Could I also ask, what version of SOAR are you using?

Thanks

Yes, that is correct, no other permissions. These used to work prior to the upgrade which introduced the "Run actions" permission under "View incidents"

Hi AP.
I'm trying to reproduce your issue, and I want to be sure that I'm understanding your issue correctly.

You have a "Workspace" user with:

"Workspace Roles" > "View Incidents" > "Run Actions"

"Global Roles" > "Inbox Permissions" > "Access Inbox"

Is that correct?
Does the user have any other permissions?

Thanks

Hi,

After the latest SOAR upgrade, the "Run Actions" permission has been split for Workspace users and Global users. Unfortunately some of our workspace users were using EmailMessage rules triggered manually from the Inbox tab which is only under global roles. 

With the new upgrades, we are able to still assign the global role "Access inbox" to workspace users but they are not able to run any actions on them as they would need a global role "View incidents > Run actions" which is not possible.

Can anyone please suggest a workaround for them to wither be able to attach an email (after having seen it from the "inbox" global tab) to an incident, either from the incident or directly from the "inbox" tab without the global role "Run actions"?

Thanks,

Hi AP,

The bug has an internal bug ID, so I'm not able to share it publicly.
Thanks

Hi Christian,

Thanks for looking into this. Can you share the bug ID please?

Thanks,

Hi AP

I was able to reproduce your issue, and have opened a bug.

I was unable to find a workaround at this time.

Thanks

User with global permissions if emails are selected:

User with local permissions don't have the actions options at all.

Hi AP.
Could I also ask, what version of SOAR are you using?

Thanks

Yes, that is correct, no other permissions. These used to work prior to the upgrade which introduced the "Run actions" permission under "View incidents"

Hi AP.
I'm trying to reproduce your issue, and I want to be sure that I'm understanding your issue correctly.

You have a "Workspace" user with:

"Workspace Roles" > "View Incidents" > "Run Actions"

"Global Roles" > "Inbox Permissions" > "Access Inbox"

Is that correct?
Does the user have any other permissions?

Thanks

Hi,

After the latest SOAR upgrade, the "Run Actions" permission has been split for Workspace users and Global users. Unfortunately some of our workspace users were using EmailMessage rules triggered manually from the Inbox tab which is only under global roles. 

With the new upgrades, we are able to still assign the global role "Access inbox" to workspace users but they are not able to run any actions on them as they would need a global role "View incidents > Run actions" which is not possible.

Can anyone please suggest a workaround for them to wither be able to attach an email (after having seen it from the "inbox" global tab) to an incident, either from the incident or directly from the "inbox" tab without the global role "Run actions"?

Thanks,

Hi Christian,

How will we know when and if it gets resolved, as it is impacting our users, if we don't have the ID?

Thanks,

Hi AP,

The bug has an internal bug ID, so I'm not able to share it publicly.
Thanks

Hi Christian,

Thanks for looking into this. Can you share the bug ID please?

Thanks,

Hi AP

I was able to reproduce your issue, and have opened a bug.

I was unable to find a workaround at this time.

Thanks

User with global permissions if emails are selected:

User with local permissions don't have the actions options at all.

Hi AP.
Could I also ask, what version of SOAR are you using?

Thanks

Yes, that is correct, no other permissions. These used to work prior to the upgrade which introduced the "Run actions" permission under "View incidents"

Hi AP.
I'm trying to reproduce your issue, and I want to be sure that I'm understanding your issue correctly.

You have a "Workspace" user with:

"Workspace Roles" > "View Incidents" > "Run Actions"

"Global Roles" > "Inbox Permissions" > "Access Inbox"

Is that correct?
Does the user have any other permissions?

Thanks

Hi,

After the latest SOAR upgrade, the "Run Actions" permission has been split for Workspace users and Global users. Unfortunately some of our workspace users were using EmailMessage rules triggered manually from the Inbox tab which is only under global roles. 

With the new upgrades, we are able to still assign the global role "Access inbox" to workspace users but they are not able to run any actions on them as they would need a global role "View incidents > Run actions" which is not possible.

Can anyone please suggest a workaround for them to wither be able to attach an email (after having seen it from the "inbox" global tab) to an incident, either from the incident or directly from the "inbox" tab without the global role "Run actions"?

Thanks,