IBM QRadar SOAR

 View Only

  • 1.  Export Playbook via API

    Posted Fri September 01, 2023 11:51 AM
    Reply

    I am trying to write a script exporting playbooks created within IBM QRadar SOAR. So far I failed ot achieve my gloal.

    I am using the following Python packages:

    resilient                    49.1.51
    resilient-app-config-plugins 1.0.0

    I am able to retrieve a list of all playbooks

    __payload = {
        'filters': [
        ]
    }
    __playbooks = res_client.post('/playbooks/query_paged?return_level=full', payload=__payload)['data']
    Further I am able to initiate the export
    __playbook_id = 77
    __playbook_name = '<name>'
    __playbook_display_name = '<name>'
    __payload = {
        'id': __playbook_id,
        'name': __playbook_name
    }
    __exportable = res_client.post('/playbooks/exports', payload=__payload)
    What is the next command to actually download the playbook? What ever I tried so far failed.
    Thank you very much for your support.


    ------------------------------
    Michael Herren
    Security Analyst
    PostFinance AG
    Bern
    ------------------------------


  • 2.  RE: Export Playbook via API

    Posted Wed September 06, 2023 06:04 PM
    Reply

    Hey Michael,

    I have never done this before, but I think what you would be looking for is the post command for export extracting. This would allow you to grab the export that you just completed by supplying the export_id from the previously run command.

    /orgs/{org_id}/playbooks/exports/{export_id}

    I can do some further testing if you need it!



    ------------------------------
    Nick Mumaw, GPEN, GPYC
    Cyber Security Specialist - SOAR
    IBM - Security
    ------------------------------

    Original Message


  • 3.  RE: Export Playbook via API

    Posted Fri September 08, 2023 02:10 AM
    Reply

    Thank you very much for your response. That is what I was expecting as well.

    When I run the commands

    __playbook_id = 77
    __playbook_name = '<name>'
    __payload = {
        'id': __playbook_id,
        'name': __playbook_name
    }
    __exportable = res_client.post('/playbooks/exports', payload=__payload)
    __export_id = __exportable['export_id']
    __export_id
    The value of variable __export_id is 172 (for example). When I then execute
    __payload = {

    }

    res_client.post('/playbooks/exports/172', __payload)
    I get the error
    RetryHTTPException: 'resilient' API Request Retry: Response Code: 500 Reason: Unknown Reason. {"success":false,"title":null,"message":"Internal Server Error","hints":[],"error_code":"generic"}


    ------------------------------
    Michael Herren
    Security Analyst
    PostFinance AG
    Bern
    ------------------------------

    Original Message


  • 4.  RE: Export Playbook via API
    Best Answer

    Posted Fri September 08, 2023 02:58 PM
    Reply

    Ok so I did some more testing and found that basically you can't just do this with the rest_client from the Resilient Python Module just yet. Hopefully with my findings this will be added in the future. I had to use requests as well. Here is my code to get this to work.

    import resilient, requests

# Create the client.
parser = resilient.ArgumentParser(config_file=resilient.get_config_file())
opts = parser.parse_args()
rest_client = resilient.get_client(opts)

# Establish Auth for Request.
soar_fqdn = 'soar.company.com'
api_key_id = 'API_KEY_ID'
api_key_secret = 'API_KEY_SECRET'
org_id = {org_num}

# Collect All Playbook Data.
filters = {
    'filters': [
    ]
}

playbooks = rest_client.post('/playbooks/query_paged?return_level=full', payload=filters)['data']

# Iterated through each Playbook and Export them individually.
for playbook in playbooks:
    # Collect Playbook Info.
    playbook_id = playbook['id']
    playbook_name = playbook['name']
    playbook_filename = playbook['display_name']
    
    #Initiate Playbook Export.
    export_data = {'id': playbook_id, 'name': playbook_name}
    export_id = rest_client.post('/playbooks/exports', payload=export_data)['export_id']
    
    # Pull resulting Playbook Export down.
    files = {'file_name': (None, playbook_filename)}
    
    response = requests.post(
        'https://{}/rest/orgs/{}/playbooks/exports/{}'.format(soar_fqdn,org_id,export_id),
        auth=(api_key_id, api_key_secret),
        files=files,
        verify=False
    )
    
    # Write data to file.
    open(playbook_filename+'.resz', 'wb').write(response.content)

    Using this code I am able to automate exporting every single playbook within my environment. 

    I might also point out that resilient-sdk has this capability too by using the Extract function, however it is limited on what all can be pulled like it doesn't also pull the integration and add the integration to your server when importing back in. This will actually pull the playbooks specified itself and allow you to import all playbooks at 1 time using the Admin -> Settings Import option. See the command below to understand how that command will work.

    resilient-sdk extract -n "PREPENDED_NAME" -o "OUTPUT/PATH" -pb PLAYBOOK1 PLAYBOOK2 PLAYBOOK3

    More on Extract can be found here as you can extract a lot more as well. https://ibmresilient.github.io/resilient-python-api/pages/resilient-sdk/resilient-sdk.html#extract



    ------------------------------
    Nick Mumaw, GPEN, GPYC
    Cyber Security Specialist - SOAR
    IBM - Security
    ------------------------------

    Original Message


  • 5.  RE: Export Playbook via API

    Posted Tue September 12, 2023 02:59 AM
    Edited by Michael Herren Tue September 12, 2023 03:06 AM
    Reply

    Thank you very much for your response.

    I will soon test your code but don't see a reason it will not work for me as well.

    Once more thank you



    ------------------------------
    Michael Herren
    Security Analyst
    PostFinance AG
    Bern
    ------------------------------

    Original Message


  • 6.  RE: Export Playbook via API

    Posted Mon October 09, 2023 01:05 PM
    Reply

    Hey Mike,

    Just wanted to supply an update here. You can now do this all from the resilient client. Below is the updated code that should allow you to do this on 50.1 of the python module for Resilient.

    import resilient

# Create the client.
parser = resilient.ArgumentParser(config_file=resilient.get_config_file())
opts = parser.parse_args()
rest_client = resilient.get_client(opts)

# Collect All Playbook Data.
filters = {
    'filters': [
    ]
}

playbooks = rest_client.post('/playbooks/query_paged?return_level=full', payload=filters)['data']

# Iterated through each Playbook and Export them individually.
for playbook in playbooks:
    # Collect Playbook Info.
    playbook_id = playbook['id']
    playbook_name = playbook['name']
    playbook_filename = playbook['display_name']
    
    #Initiate Playbook Export.
    export_data = {'id': playbook_id, 'name': playbook_name}
    export_id = rest_client.post('/playbooks/exports', payload=export_data)['export_id']
    
    # Pull resulting Playbook Export down.
    files = {'file_name': (None, playbook_filename)}
    
    response = rest_client.post(
        '/playbooks/exports/{}'.format(export_id),
        headers={"content-type": None},
        files=files,
        payload=None,
        get_response_object=True)
    
    # Write data to file.
    open(playbook_filename + '.resz', 'wb').write(response.content)


    ------------------------------
    Nick Mumaw, GPEN, GPYC
    Cyber Security Specialist - SOAR
    IBM - Security
    ------------------------------

    Original Message


Related Content