IBM QRadar SOAR

IBM QRadar SOAR

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  Grab incident ID in playbook

    Posted Wed April 13, 2022 03:43 PM
    How is incident ID encoded in a playbook that is triggered upon incident activation? I am trying to call a function 'Exchange Online: Query Messages' (from fn_exchange_online version 1.3.0 app) and incident_id is a requirement parameter.

    ------------------------------
    Mark Aksen
    ------------------------------


  • 2.  RE: Grab incident ID in playbook

    Posted Thu April 14, 2022 03:11 AM
    Edited by Alexander Saulenko Thu April 14, 2022 03:16 AM
    HI, 
    take a look at the documentation here: https://www.ibm.com/docs/en/sqsp/42?topic=playbook-function-input-script

    BR,
    Alex

    ------------------------------
    Alexander Saulenko
    ------------------------------

    Original Message


  • 3.  RE: Grab incident ID in playbook

    Posted Fri April 15, 2022 09:09 AM
    You want to use a 'Script' to configure the function inputs. It will look something like this:



    All the other inputs need to be filled in as appropriate as well in the script.

    Ben

    ------------------------------
    Ben Lurie
    ------------------------------

    Original Message


Related Content