IBM QRadar SOAR

IBM QRadar SOAR

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only
  • 1.  How to control stateful data in a playbook instance

    Posted Fri February 23, 2024 02:08 AM
    Edited by Yohji Amano Mon February 26, 2024 12:44 AM

    Hi SOAR community members.

    I have a question how to control stateful data in a playbook instance.
    I tried the following playbook, which aims to control the loop number but it does not work as expected. 

    +----------------------------------------------+
    | local-script: Initialize loop as {"count": 0}|
    +----------------------------------------------+
    playbook.addProperty("loop",{"count":0})                |
    +----------------------------------------------+
          |
          V
    +---------+
    | Task1   |<-----------------+
    +---------+                  |
          |                      |
          V                      |
    +---------+                  |
    | Task2   |                  |
    +---------+                  |
          |                      |
          V                      |
    +------------------------+   |
    | Condition (first true) | --+
    +-------------------------------------------------------+
    loop = playbook.properties["loop"]
    count = loop["count"]
    log.info(f'1. {loop} :: {count}')
    if count < 3:
        count = count + 1
        loop = {"count": count}
        log.info(f'2. {loop} :: {count}')
        playbook.properties["loop"] = loop
        log.info(f'3. {playbook.properties["loop"]}')
        result = True
    else:
        result = False 
    +-------------------------------------------------------+

    From the log, playbook.properties["loop"] is updated with {'count': 1} in the single node scope. In the 2nd loop, however, playbook.properties["loop"] is back to {'count': 0}.

    15:48:13.256 [LogReaderThread for qtp-1590458674-44] INFO  v=unknown  c.r.s.cpython.process.CPythonProcess - pid 17963: LoggerContext - 1. {'count': 0} :: 0
    15:48:13.257 [LogReaderThread for qtp-1590458674-44] INFO  v=unknown  c.r.s.cpython.process.CPythonProcess - pid 17963: LoggerContext - 2. {'count': 1} :: 1
    15:48:13.258 [LogReaderThread for qtp-1590458674-44] INFO  v=unknown  c.r.s.cpython.process.CPythonProcess - pid 17963: LoggerContext - 3. {'count': 1}
       :
    15:48:24.115 [LogReaderThread for qtp-1590458674-47] INFO  v=unknown  c.r.s.cpython.process.CPythonProcess - pid 17995: LoggerContext - 1. {'count': 0} :: 0
    15:48:24.116 [LogReaderThread for qtp-1590458674-47] INFO  v=unknown  c.r.s.cpython.process.CPythonProcess - pid 17995: LoggerContext - 2. {'count': 1} :: 1
    15:48:24.116 [LogReaderThread for qtp-1590458674-47] INFO  v=unknown  c.r.s.cpython.process.CPythonProcess - pid 17995: LoggerContext - 3. {'count': 1}



    ------------------------------
    Yohji Amano
    ------------------------------



  • 2.  RE: How to control stateful data in a playbook instance

    Posted Mon February 26, 2024 03:25 AM

    Hi Yohji,

    Looks like you are trying to increase the count and then save it to playbook.properties["loop"] in a condition node. Unfortunately it won't work because the condition node only evaluate the script's result is True or False, it won't do update, so you will need to add a script node before the condition node for count increment.

    You will also need to use playbook.addProperty() to update the playbook properties rather than playbook.properties["loop"]=xxx . See https://www.ibm.com/docs/en/sqsp/51?topic=scripts-playbook-operations

    Hope this help!!



    ------------------------------
    Gilbert Liao
    ------------------------------



  • 3.  RE: How to control stateful data in a playbook instance

    Posted Mon February 26, 2024 07:32 AM

    Hi Gilbert

    Thank you for your advice.

    By adding the local script to update the loop count and add it to the playbook properties before condition script to check loop count, I could control the loop count in the playbook as expected.

    Through this issue, I could see the different behavior of script types, condition script or local script.

    Anyway thanks a lot again!!



    ------------------------------
    Yohji Amano
    ------------------------------