IBM QRadar SOAR

IBM QRadar SOAR

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only
  • 1.  Outbound Email Body Text

    Posted Mon August 14, 2023 06:23 AM

    Good day Everyone

    I am busy setting up our SOAR to use outbound email and so far it is working. I am just struggling getting the email body to work correctly.

    I have included the script below if some one can please advise what am I missing.

    inputs.mail_to = "My Email is here"
    inputs.mail_cc = ""
    inputs.mail_attachments = ""
    inputs.mail_incident_id = incident.id
    inputs.mail_from = "Company email is here"
    inputs.mail_subject =  u"Soar Incident - {0} {1}".format(incident.id, incident.name)

    inputs.mail_body_html = "{% set NOT_FOUND = ["Not Found!","-","None",None] %}
    {% macro get_row(label,field_name) -%}
        {% set value = template_helper.get_incident_value(incident,field_name) %}
        {% set style = "font-family: Calibri; color: rgb(31,73,125)" %}
        {% if value and value not in NOT_FOUND and not value.startswith('-') %}
        <tr>
            <td width="100" style="{{style}}; font-weight:bold">{{ label }}</td>
            <td style="{{style}}">{{ value | striptags }}</td>
        </tr>
        {% endif %}
    {%- endmacro %}
    <table width="100%" >
    <tr>
        <td colspan="2">
            <h3 style="color: rgb(68,114,196)">INCIDENT DETAILS</h3>
            <hr size="1" width="100%" noshade style="color:#FFDF57" align="center"/>
        </td>
    </tr>
        {{ get_row('Severity:','severity_code') }}
        {{ get_row('Status:','plan_status') }}<br>
        {{ get_row('Created:','create_date') }}<br>
        {{ get_row('Category:','incident_type_ids') }}
    <tr>
        <td colspan="2">
            <br><h3 style="color: rgb(68,114,196)">INCIDENT DESCRIPTION</h3>
            <hr size="1" width="100%" noshade style="color:#FFDF57" align="center"/>
        </td>
        {{ get_row('Description:','description') }}
    </tr>
    </table>
    <br>
    "



    ------------------------------
    Arno Pretorius
    ------------------------------


  • 2.  RE: Outbound Email Body Text

    Posted Mon August 14, 2023 06:46 AM

    This is the error I am getting when I try to email the Case

    Case 13791 failed to update

    Customer Email has not been executed. Pre-processing script for Function 'Outbound Email: Send Email' from Workflow 'Customer Email' was unable to complete because: SyntaxError: invalid syntax


    ------------------------------
    Arno Pretorius
    ------------------------------



  • 3.  RE: Outbound Email Body Text

    Posted Tue August 15, 2023 04:41 PM

    Looks like there is an issue with your body input field. 

    Try using the mail_inline_template input field. You will also want to wrap the template using three single quotes instead of double quotes. 

    like so...

    mail_inline_template = "'{% set NOT_FOUND = ["Not Found!","-","None",None] %}
    {% macro get_row(label,field_name) -%}
        {% set value = template_helper.get_incident_value(incident,field_name) %}
        {% set style = "font-family: Calibri; color: rgb(31,73,125)" %}
        {% if value and value not in NOT_FOUND and not value.startswith('-') %}
        <tr>
            <td width="100" style="{{style}}; font-weight:bold">{{ label }}</td>
            <td style="{{style}}">{{ value | striptags }}</td>
        </tr>
        {% endif %}
    {%- endmacro %}
    <table width="100%" >
    <tr>
        <td colspan="2">
            <h3 style="color: rgb(68,114,196)">INCIDENT DETAILS</h3>
            <hr size="1" width="100%" noshade style="color:#FFDF57" align="center"/>
        </td>
    </tr>
        {{ get_row('Severity:','severity_code') }}
        {{ get_row('Status:','plan_status') }}<br>
        {{ get_row('Created:','create_date') }}<br>
        {{ get_row('Category:','incident_type_ids') }}
    <tr>
        <td colspan="2">
            <br><h3 style="color: rgb(68,114,196)">INCIDENT DESCRIPTION</h3>
            <hr size="1" width="100%" noshade style="color:#FFDF57" align="center"/>
        </td>
        {{ get_row('Description:','description') }}
    </tr>
    </table>
    <br>
    '''



    ------------------------------
    Nik B
    ------------------------------



  • 4.  RE: Outbound Email Body Text

    Posted Tue August 15, 2023 04:57 PM

    Hi Nik 

    Thank you for the info.. I did manage to get it working but right now I need to add more info to the email.

    Here we add the discription and I want to add more info like Domain and Magnitude 

    <tr>
        <td colspan="2">
            <br><h3 style="color: rgb(68,114,196)">INCIDENT DESCRIPTION</h3>
            <hr size="1" width="100%" noshade style="color:#FFDF57" align="center"/>
        </td>
        {{ get_row('Description:','description') }}
    </tr>



    ------------------------------
    Arno Pretorius
    ------------------------------



  • 5.  RE: Outbound Email Body Text

    Posted Tue August 15, 2023 05:50 PM

    If you already have these fields mapped to your incidents, you will just need to use their corresponding API name found in the 'fields' section of Customization settings > layouts

    If you choose to display these fields in the Incident Description section of the email, just add new rows

    <tr>
        <td colspan="2">
            <br><h3 style="color: rgb(68,114,196)">INCIDENT DESCRIPTION</h3>
            <hr size="1" width="100%" noshade style="color:#FFDF57" align="center"/>
        </td>
        {{ get_row('Description:','description') }}

        {{ get_row('Domain:','API_NAME) }}

        {{ get_row('Magnitude:','API_NAME') }}
    </tr>



    ------------------------------
    Nik B
    ------------------------------



  • 6.  RE: Outbound Email Body Text

    Posted Tue August 15, 2023 06:07 PM

    Hi Nik

    Thank you for the update.. I will test and let you know



    ------------------------------
    Arno Pretorius
    ------------------------------



  • 7.  RE: Outbound Email Body Text

    Posted Tue August 15, 2023 06:38 PM

    Okay it is working like a charm.. Thank you so much..

    May I please ask another question?

    I am using the outbound email function with the same script as what I am using here but my workflow just keeps running and doesnt complete..

    Pre Script:

    inputs.mail_to = "My email Here"
    inputs.mail_cc = ""
    inputs.mail_attachments = ""
    inputs.mail_incident_id = incident.id
    inputs.mail_from = "From email here"
    inputs.mail_subject =  u"Soar Incident - {0} {1}".format(incident.id, incident.name)

    inputs.mail_body_html ="""{% set NOT_FOUND = ["Not Found!","-","None",None] %}
    {% macro get_row(label,field_name) -%}
        {% set value = template_helper.get_incident_value(incident,field_name) %}
        {% set style = "font-family: Calibri; color: rgb(31,73,125)" %}
        {% if value and value not in NOT_FOUND and not value.startswith('-') %}
        <tr>
            <td width="100" style="{{style}}; font-weight:bold">{{ label }}</td>
            <td style="{{style}}">{{ value | striptags }}</td>
        </tr>
        {% endif %}
    {%- endmacro %}
    <table width="100%" >
    <tr>
        <td colspan="2">
            <h3 style="color: rgb(68,114,196)">INCIDENT DETAILS</h3>
            <hr size="1" width="100%" noshade style="color:#FFDF57" align="center"/>
        </td>
    </tr>
        {{ get_row('Severity:','severity_code') }}
        {{ get_row('Status:','plan_status') }}<br>
        {{ get_row('Created:','create_date') }}<br>
        {{ get_row('Category:','incident_type_ids') }}
    <tr>
        <td colspan="2">
            <br><h3 style="color: rgb(68,114,196)">INCIDENT DESCRIPTION</h3>
            <hr size="1" width="100%" noshade style="color:#FFDF57" align="center"/>
        </td>
        {{ get_row('Description:','description') }}
    </tr>
    </table>
    <br>
    """

    Post Script: 

    if results.success:
      noteText = u"""Email Sent if mail server is valid/authenticated\n 
      <br>From: {0}<br> To: {1}<br> CC: {2}<br> BCC: {3}<br> Subject: {4} <br> 
      Body: {5} <br>""".format(results.content.inputs[0].strip("u\"[]"), results.content.inputs[1].strip("u\"[]"), results.content.inputs[2].strip("u\"[]"), results.content.inputs[3].strip("u\"[]"), results.content.inputs[4].strip("u\""), results.content.text)
    else:
      noteText = u"Email NOT Sent\n From: {0}\n To: {1}".format(results.content.inputs[0].strip("u\"[]"), results.content.inputs[1].strip("u\"[]"))
    incident.addNote(helper.createRichText(noteText))



    ------------------------------
    Arno Pretorius
    ------------------------------



  • 8.  RE: Outbound Email Body Text

    Posted Wed August 16, 2023 12:51 PM

    Have you declared an output name in your function? This is what you will need to refer to in the output script. 

    If you check the example out of the box workflow, the output is workflow.properties.outbound_email_results. You'll want to handle the exception, so you'll want to have something like --

    results = workflow.properties.outbound_email_results

    except:

    helper. Fail("unable to read outbound_email_results property")

    if results:

    noteText = u"""Email Sent if mail server is valid/authenticated\n 
      <br>From: {0}<br> To: {1}<br> CC: {2}<br> BCC: {3}<br> Subject: {4} <br> 
      Body: {5} <br>""".format(results.content.inputs[0].strip("u\"[]"), results.content.inputs[1].strip("u\"[]"), results.content.inputs[2].strip("u\"[]"), results.content.inputs[3].strip("u\"[]"), results.content.inputs[4].strip("u\""), results.content.text)
    else:
      noteText = u"Email NOT Sent\n From: {0}\n To: {1}".format(results.content.inputs[0].strip("u\"[]"), results.content.inputs[1].strip("u\"[]"))
    incident.addNote(helper.createRichText(noteText))



    ------------------------------
    Nik B
    ------------------------------



  • 9.  RE: Outbound Email Body Text

    Posted Thu August 17, 2023 07:10 PM

    HI Nik

    Thank you for the info.. It is working..



    ------------------------------
    Arno Pretorius
    ------------------------------



  • 10.  RE: Outbound Email Body Text

    Posted Tue April 02, 2024 11:30 AM

    HI Arno

    I hope you are find and doing well.

    I have designed a playbook and use outbound function to send an email to the concern user. I have used the below script but when playbook is running and move to outbound email phase it got stuck. Can you help me regarding in this matter.

    Looking forward for a Positive Response

    inputs.mail_to= User Email
    inputs.mail_body_text=" Soar"
    inputs.mail_cc="abc@....."
    inputs.mail_from="test@soar.com"
    inputs.mail_subject ="Failure
    "
     
    inputs.mail_body_html = """{% set NOT_FOUND = ["Not Found!","-","None",None] %}
    {% macro get_row(label,field_name) -%}
    {% set value = template_helper.get_incident_value(incident,field_name) %}
    {% set style = "font-family: Calibri; color: rgb(31,73,125)" %}
        {% if value and value not in NOT_FOUND and not value.startswith('-') %}
        <tr>
            <td width="100" style="{{style}}; font-weight:bold">{{ label }}</td>
            <td style="{{style}}">{{ value | striptags }}</td>
        </tr>
        {% endif %}
    {%- endmacro %}
    <table width="100%" >
    <tr>
        <td colspan="2">
            <h3 style="color: rgb(68,114,196)">INCIDENT DETAILS</h3>
            <hr size="1" width="100%" noshade style="color:#FFDF57" align="center"/>
        </td>
    </tr>
        {{ get_row('Severity:','severity_code') }}
        {{ get_row('Status:','plan_status') }}<br>
        {{ get_row('Created:','create_date') }}<br>
        {{ get_row('Category:','incident_type_ids') }}
    <tr>
        <td colspan="2">
            <br><h3 style="color: rgb(68,114,196)">INCIDENT DESCRIPTION</h3>
            <hr size="1" width="100%" noshade style="color:#FFDF57" align="center"/>
        </td>
        {{ get_row('Description:','description') }}
    </tr>
    <tr>
        <td colspan="2">
            <h3 style="color: rgb(68,114,196)">INCIDENT LINK</h3>
            <hr size="1" width="100%" noshade style="color:#FFDF57" align="center"/>
        </td>
    </tr>
    <tr>
        <td colspan="2">
            {% set inc_url = template_helper.generate_incident_url(incident.id) %}
            <a target='_blank' href='{{ inc_url }}'>{{ incident.id }}: {{ incident.name }}</a>
        </td>
    </tr>
    </table>
    <br>
    """


    ------------------------------
    Ahmad Hassan Tariq
    ------------------------------