As you may be aware we've recently replaced the rich text editor in V51.0.0.0.

While we've made every effort to ensure parity with the previous editor, that hasn't been possible in all scenarios.

One change we've noted is the rich text content has changed the html DOM structure. The major change is that the default tag for each line is changed from <div> to <p>. This only applies to the rich text content which is generated by new rich text editor (SOAR version later than V51.0.0.0). That means for new generated content or edited content from the new rich text editor. For those of you with automations around rich text content, you might need to review those automations to see are they impacted by this structure change.

For example, if you have a script looking for a certain string to do some manipulation of the content. In the example below, the pattern of the substring relies on the html structure from old rich text editor. This would now fail.

import re

pattern_str = '<div><strong>&lt;replace-me-here&gt;</strong></div>'
replaced_str = '<div><strong>127.0.0.1</strong></div>'

# Broken! Because the content is now: <p><strong>&lt;replace-me-here&gt;</strong></p>
if pattern_str in note.text.content:
  note.text.content = note.text.content.replace(pattern_str, replaced_str)

We recommend you should not rely on patterns like the above that contain the html structure, instead use something like the below.

import re

preferred_pattern_str = '<replace-me-here>'
replaced_str = '<strong>127.0.0.1</strong>'

if pattern_str in note.text.content:
  note.text.content = note.text.content.replace(preferred_pattern_str, replaced_str)

------------------------------
Martin Feeney
Product Manager, IBM Security QRadar SOAR
martin.feeney@ie.ibm.com
------------------------------