IBM QRadar SOAR

IBM QRadar

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  Handling Artifact Creation Errors in Scripts

    Posted Thu February 13, 2020 10:59 AM
    Edited by Liam Mahoney Thu February 13, 2020 11:18 AM

    All,

    I'm trying to create URL artifacts in the post-process script of one of my functions, but some of the URLs that are being returned are junk (e.g. 'http://').

    When I try to add 'http://' as a URL artifact I get an error. I'm fine with 'http://' not getting added as an artifact, but the error causes the rest of the script/workflow to stop executing.

    I could use regex to validate that the URL follows a URL pattern before attempting to add it as a URL artifact, but I feel handling the artifact error would be more robust.

    I tried using this try/except:

    try:
    incident.addArtifact("URL", "http://", "description")
except Exception:
    log.info("Artifact creation failed")
    pass

    but it didn't catch the "Error Running Script: The Script is unable to update the Incident <name> because: The specified URL is invalid: 'http://'" error.

    Is there any way to catch/handle the artifact creation error and continue script execution?

    Thanks,



    ------------------------------
    Liam Mahoney
    ------------------------------


  • 2.  RE: Handling Artifact Creation Errors in Scripts

    Posted Mon February 24, 2020 04:56 PM
    Unfortunately the actual artifact creation is done later on in the process so it won't show up as a python exception.

    Ben

    ------------------------------
    Ben Lurie
    ------------------------------

    Original Message


Related Content