IBM QRadar SOAR

IBM QRadar

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  Assign Workspace via In-product Script

    Posted Tue January 07, 2020 10:01 AM
    Hey, 

    We're trying to assign workspaces via in product scripts but when trying the following code it threw the error: "The value NameObjectHandle: null/workspace_api_name is not valid for the field workspace" 

    incident.workspace = "workspace_api_name"


    When I change it to the workspace ID it doesn't throw an error however it requires an API call to know which ID matches to which name. 

    Is there a way via the in-product scripts I can assign a workspace via it's name and not id? 

    Thanks, 



    ------------------------------
    Adina Bodkins
    ------------------------------


  • 2.  RE: Assign Workspace via In-product Script

    Posted Wed January 08, 2020 03:50 AM
    Adina, 

    You can simply use the syntax you have above but use the workspace name i.e.

    incident.workspace="SOC"

    but remember that you also have group access on workspace so if you move workspace you many need to ammend / add group permissions for the workspace at the same time.  You can update via a script with 

    incident.members = incident.members + [groupname]

    You could also use a rule the condition triggering an activity to Set Field Incident:Workspace and the workspace name. 

    Colin 








    ------------------------------
    Colin Mattholie
    ------------------------------

    Original Message


  • 3.  RE: Assign Workspace via In-product Script

    Posted Wed January 08, 2020 09:34 AM
    As was pointed out by Colin, you want to use the "display name". In general, when working with in product scripts you want to use the "display name" for object references. The only one that current does not support that is artifact type. But we will fix that shortly.

    ------------------------------
    Ben Lurie
    ------------------------------

    Original Message


Related Content