IBM QRadar SOAR

IBM QRadar

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only
  • 1.  any script or rule to close particular task in a phase

    Posted Wed December 09, 2020 03:57 PM
    Hello All,

    I would like to know any script or Rule to close a task automatically, Task is customized one and using properties.task.name is not helping.
    Create a automatic rule with conditions and when met the Sctipt should help me closing the task. Any example or reference would help, have gone through the github and KC as well.

    ------------------------------
    Regards
    Joshi 
    ------------------------------


  • 2.  RE: any script or rule to close particular task in a phase

    Posted Thu December 10, 2020 08:12 AM
    Under what circumstances does the task need to be closed automatically? Is it when the task changes? Or when something else happens?

    The following is a rule that will close a task when the task status is equal to open and the incident severity is equal to low and the task changes. But my guess is that your use case is a bit more involved.

    Ben



    ------------------------------
    Ben Lurie
    ------------------------------



  • 3.  RE: any script or rule to close particular task in a phase

    Posted Thu December 10, 2020 09:50 AM
    Hello Ben,

    My condition is, whenever any incident is "created by" a particular user, I need to close a particular task under a phase. Below is the screenshot of my condition.

    The phases are custom ones and has multiple tasks under them, so this one particular task alone has to be completed for the incidents created by this user. Actually, these are the auto escalated offenses and we have this task which acts as SLA to the incident response at the initial stages unless closed on time will impact a lot.



    ------------------------------
    Srinivas Joshi
    ------------------------------



  • 4.  RE: any script or rule to close particular task in a phase

    Posted Thu December 10, 2020 03:10 PM
    Srinivas,

    We use the functions that the community provided:https://exchange.xforce.ibmcloud.com/hub/extension/36ff15c1d9366036bd3c4ccbe93a0476

    We do something similar but we don't use rules and instead we do it in workflows and add notes to specific tasks or/and close out a specific task. Ours mostly focuses around the automation (we pull data from external sources and mark the task complete)

    ------------------------------
    Richard Giesige
    Security Engineer
    Oshkosh Corporation
    Oshkosh
    ------------------------------



  • 5.  RE: any script or rule to close particular task in a phase

    Posted Fri December 11, 2020 07:15 AM
    Hello Richard ,
    Thanks a lot for the info, hope this will solve my issue. However trying to install it on app host,but getting below error. Is there something need to do on the app.config.

    resilient.co3.SimpleHTTPException: Bad Request: {"success":false,"title":null,"message":"Invalid user name or password.","hints":[],"error_code":"generic"}

    Have changed the API key, regenerated etc.


    ------------------------------
    Srinivas Joshi
    ------------------------------



  • 6.  RE: any script or rule to close particular task in a phase

    Posted Fri December 11, 2020 11:29 AM
    You might want to open a support case, but that would definitely indicate an issue with the credentials you're using.

    ------------------------------
    Jared Fagel
    Cyber Security Analyst I
    Public Utility
    ------------------------------



  • 7.  RE: any script or rule to close particular task in a phase

    Posted Fri December 11, 2020 11:54 AM
    @Srinivas Joshi - did you update your API key permissions, you need to make sure you give it the appropriate permissions for accessing the API.

    Go into Administrator section --> Users --> API​ Keys
    Click on the API key that was created for this user and edit it.
    Once you figure out what permission you need to properly run that query with the API key then update the API key permissions file in the app you are writing.

    if you are in a testing environment grant it full access and then see if it works for your and then restrict down from there.

    I believe the API supports session authentication through the API Keys now but I could be wrong. @Ben Lurie or one of the other IBM guys to answer that.

    ------------------------------
    Richard Giesige
    Security Engineer
    Oshkosh Corporation
    Oshkosh
    ------------------------------



  • 8.  RE: any script or rule to close particular task in a phase

    Posted Mon December 14, 2020 12:41 AM
    Thanks Richard and Jared,

    Will try the permissions first, if not working will open up a support case.

    Thanks again for the app info.

    ------------------------------
    Srinivas Joshi
    ------------------------------