List of Contributions

Juan Cruz Del Col

Contact Details

My Content

1 to 20 of 48 total

RE: Remove all attachments from an incident

Posted By Juan Cruz Del Col Wed December 07, 2022 01:54 PM
Found In Egroup: IBM Security QRadar SOAR \ view thread
Any suggestions? ------------------------------ Juan Cruz Del Col ------------------------------

Remove all attachments from an incident

Posted By Juan Cruz Del Col Wed November 30, 2022 12:42 PM
Found In Egroup: IBM Security QRadar SOAR \ view thread
Friends, I am needing to remove all attachments from an incident when running a playbook. The only way I can think of is to do it using the REST API towards the same SOAR searching by attached id and incident id first a GET and then a DEL. Any better ideas? ------------------------------ Juan ...

RE: Encoding Issues in v38.2

Posted By Juan Cruz Del Col Wed November 18, 2020 09:21 PM
Found In Egroup: IBM Security QRadar SOAR \ view thread
Do you know when v39 is released? ------------------------------ Juan Cruz Del Col ------------------------------

RE: Workflow calls another workflow

Posted By Juan Cruz Del Col Tue November 17, 2020 07:21 AM
Found In Egroup: IBM Security QRadar SOAR \ view thread
Thank you very much for the quick answer. A member of my team thought something similar with a "Table" to send by mail. The truth is that every time we think about doing something, we notice that both the new AppHost and the development of workflos lack a lot of maturity!!!! Regards, Juan Cruz ...

Workflow calls another workflow

Posted By Juan Cruz Del Col Mon November 16, 2020 08:42 PM
Found In Egroup: IBM Security QRadar SOAR \ view thread
I have a workflow that has 3 workflows inside and at the end one works to send mail. Each of the workflows, performs a task and at the end write a note, but each of those outputs I need to send by mail in the final function. How can I achieve this? Try to use "workflow.addProperty (String ...

Notification when a workflow fails

Posted By Juan Cruz Del Col Mon September 28, 2020 09:40 AM
Found In Egroup: IBM Security QRadar SOAR \ view thread
Hi team, Is it possible to generate a notification when a workflow is missing? Inside Resilient, it is possible to see the fault in "Actions -> Workflow status", but how could I send this fault by mail? Regards, ------------------------------ Juan Cruz Del Col --------------------------- ...

Integration with Telegram

Posted By Juan Cruz Del Col Thu September 10, 2020 08:44 AM
Found In Egroup: IBM Security QRadar SOAR \ view thread
Hi team, My client needs to notify via Telegram, to a specific group, when there is a "critical" incident for example. Someone performed an integration with Telegram? Regards ------------------------------ Juan Cruz Del Col ------------------------------

Read attachments

Posted By Juan Cruz Del Col Tue September 24, 2019 12:38 PM
Found In Egroup: IBM Security QRadar SOAR \ view thread
I need to be able to read the contents of an attachment and generate "DNS" artifacts for each line. Ex: dns.txt is attached and its content: server.com server2.com server3.com ... How could I generate it? ------------------------------ Juan Cruz Del Col ------------------------------

RE: Generate a notification

Posted By Juan Cruz Del Col Fri September 20, 2019 03:15 PM
Found In Egroup: IBM Security QRadar SOAR \ view thread
@Venkatesh Siddi thank you It works perfectly ​ ------------------------------ Juan Cruz Del Col ------------------------------

RE: Attached incidents?

Posted By Juan Cruz Del Col Wed August 14, 2019 01:18 PM
Found In Egroup: IBM Security QRadar SOAR \ view thread
Lily, it will be possible to use "Utilities: Resilient Search"? Sorry, but I don't know how to use "attachments = self.rest_client.post (" / incidents / () / attachments / query ".format (incident_id), (" conditions ": []))" ------------------------------ Juan Cruz Del Col ------------------ ...

RE: Attached incidents?

Posted By Juan Cruz Del Col Tue August 13, 2019 10:13 AM
Found In Egroup: IBM Security QRadar SOAR \ view thread
Lily, thank you very much for the answer. I have tried this, but I had no answer. Look: DEBUG Log: 2019-08-13 11:08:45,199 DEBUG [actions_component] Task: 2019-08-13 11:08:45,200 DEBUG [decorators] Thread-3: _call_the_task 2019-08-13 11:08:45,200 INFO [utilities_call_rest_api] rest_method: ...

Attached incidents?

Posted By Juan Cruz Del Col Mon August 12, 2019 04:29 PM
Found In Egroup: IBM Security QRadar SOAR \ view thread
I need to know if an incident has attachments or not. Im using "IncidentAttachmentREST" but not seenumber of attach /orgs/(org_id)/incidents/(inc_id)/attachments/(attach_id) ------------------------------ Juan Cruz Del Col ------------------------------

RE: Upgrade Python 2.7 to 3.x

Posted By Juan Cruz Del Col Tue July 16, 2019 10:07 AM
Found In Egroup: IBM Security QRadar SOAR \ view thread
Thank you very much for the reply. The most serious problem is that the "geniuses" of IBM Resilient, provide functions that only work with python3 and the appliance works with python2.7 .... applause to the geniuses! After the sarcasm! When I try to run the "./configure" it always gives me the ...

RE: Upgrade Python 2.7 to 3.x

Posted By Juan Cruz Del Col Mon July 15, 2019 01:08 PM
Found In Egroup: IBM Security QRadar SOAR \ view thread
@Alexander Saulenko I have reviewed the links that you passed, but I can not do the Python version upgrade. I understand what you mention about having a virtual environment so as not to affect the core of Resilient. But I do not understand how resilient-circuits would work with it.​ ------- ...

Upgrade Python 2.7 to 3.x

Posted By Juan Cruz Del Col Fri July 12, 2019 02:14 PM
Found In Egroup: IBM Security QRadar SOAR \ view thread
I need to upgrade Python 2.7 that has the Resilient appliance. Although it is not supported or recommended, there are many functions that require it and the client is not willing to have a resilient-circuit in another server. Suggestion or steps to follow? Thank you ------------------------------ ...

RE: Generate a notification

Posted By Juan Cruz Del Col Mon June 17, 2019 11:05 PM
Found In Egroup: IBM Security QRadar SOAR \ view thread
Lily, is there any function for sending mail? or some Python script that can be used? ------------------------------ Juan Cruz Del Col ------------------------------

Generate a notification

Posted By Juan Cruz Del Col Fri June 14, 2019 10:24 AM
Found In Egroup: IBM Security QRadar SOAR \ view thread
Is it possible to generate a notification when a task happened 2 hours from the moment of its opening and was not closed? ------------------------------ Juan Cruz Del Col ------------------------------

RE: Resilient REST API

Posted By Juan Cruz Del Col Tue May 14, 2019 09:01 AM
Found In Egroup: IBM Security QRadar SOAR \ view thread
Lily, my apologies ... I was using GET and it should be POST. It works perfect! ------------------------------ Juan Cruz Del Col ------------------------------

RE: Resilient REST API

Posted By Juan Cruz Del Col Mon May 13, 2019 09:36 AM
Found In Egroup: IBM Security QRadar SOAR \ view thread
Lily, what you are mentioning I already tested it and I have the following error: "Internal Server Error" ------------------------------ Juan Cruz Del Col ------------------------------

RE: Resilient REST API

Posted By Juan Cruz Del Col Fri May 10, 2019 04:59 PM
Found In Egroup: IBM Security QRadar SOAR \ view thread
@Afflospark .com How can I customize the API? @LILY WANG ​​I'm using the API through script in visual basic or the Postman application ------------------------------ Juan Cruz Del Col ------------------------------