[Summary]

As you all are already aware, support for Python 2 was deprecated sometime ago. We now need to completely remove it from the product, and will discontinue the Python 2 scripting engine in an upcoming release. Any legacy Python 2 scripts that may still exist in your environments will no longer run, potentially impacting your workflows and playbooks. We are providing tools to assist in identifying and migrating scripts, workflows and playbooks to use the Python 3 scripting engine, and we ask all customers to run these to identify and plan any required remediation.

[Details]

In 2023, we announced the start to the removal of the Python 2 scripting engine in QRadar SOAR. From then until now, Python 2 execution for existing workflows, playbooks and scripts has continued, but creating new Python 2 scripts has been restricted. The time has finally come, and in the 2025 summer release of SOAR, the in-product Python 2 scripting engine will be removed. This is necessary for several reasons including efforts to modernize the SOAR architecture, and the end-of-life nature of Python 2. Now, with this upcoming release, these workflows, playbooks, and scripts using Python 2 will fail to execute.

To be clear, this announcement does not affect Integration Servers running app integrations running in a Python 2 environment. Although ongoing compatibility for Python 2 is not possible with our IBM supported apps and run-time packages, such as resilient-circuits, legacy apps and packages will continue running unchanged.

Upgrading workflows, playbooks, and scripts is a relatively straightforward process. In most cases, just editing the scripting engine settings from Python 2 to Python 3 is all that's needed. But identifying all the Python 2 workflows, playbooks and scripts can be a significant undertaking. In addition, the use of Python 2 may not be straightforward to find. For example, consider workflow conditions, function pre and post-processing scripts, and sub-playbooks.

To help with this effort, an app has been published to the AppExchange, Search for Python 2, to help identify the uses of Python 2 in your SOAR environment. It works in two modes. First, when installed in SOAR, and run through the App Host, it will query all your workflows, playbooks, and scripts, and present a datatable of the Python 2 findings. Information about the findings will include notes on whether unicode syntax is used or non-Python 3 packages (ex. java.util.Date) are present.

For those scripts determined to be easily fixable, a datatable action is available to convert the workflow, playbook, or script in-place. More complex scripts will require manual conversion. But, again, these should be straightforward to convert. This tool can be run iteratively, converting and rescanning until all are converted.

The second mode for this tool is installing it on a computer with Python 3, and running the same scans from a terminal command prompt against an export.res or export.resz file. In this mode, it's not possible to perform in-line changes. But at least you'll have information on the workflows, playbooks and scripts which need manual conversion. 

For those customers who require additional help converting scripts, consider IBM Expert Labs. They are equipped with the skills to assist in this operation. 

In the end, modernizing your workflows, playbooks, and scripts to Python 3 will provide the 'refresh' needed to ensure long term execution, and to take advantage of new features to come.

Regards,
Mark