IBM QRadar SOAR

IBM QRadar SOAR

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only
  • 1.  MX lookup function

    Posted Wed December 14, 2022 10:30 PM
    HI IBM community,

    I want to ask regarding the implementation of mx lookup for IBM SOAR Playbook. Using the function from app exchange below:

    The function from what I understand, called the mxtoolbox via API call and will return back output to the playbook (via post process script?). Currently I want to analyse email header via playbook and ask the mxtoolbox to communicate and return me the result. However, upon reading the documentation, I have not found example on how to configure it. What inputs should the mx function receives to work in my use-case.

    Thanks in advance.

    ------------------------------
    Luqman Nur
    ------------------------------


  • 2.  RE: MX lookup function

    Posted Thu December 15, 2022 10:54 AM
    You are going to have to go into the customization settings and edit the function input named `mx_command`. You will have to add a new option named, `emailheaders`, then save it. Now in your playbook your function input for `mx_command` will be emailheaders and your input for `mx_argument` will be the email header you want to analysis.

    ------------------------------
    Richard Swierk
    ------------------------------



  • 3.  RE: MX lookup function

    Posted Thu December 15, 2022 08:15 PM
    Edited by Luqman Nur Thu December 15, 2022 10:27 PM
    Hi Richard,

    Thanks for the guide. Just want to confirm that the script will be something along this line?



    Also I just edit the functions in the customisation tab where I add the "email_header" in the mx_command. I have encountered different error relating to the API call where the email_header is a bad request (status code: 400). I have look the mxtoolbox website for the API documentation, but it only links to the product page. Is it possible that the product only for paid customers



    ------------------------------
    Luqman Nur
    Techlab
    ------------------------------