IBM QRadar SOAR

IBM QRadar

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

Sharing code with resilient-circuits extract

  • 1.  Sharing code with resilient-circuits extract

    Posted Wed July 03, 2019 02:50 PM
    Let's say you wrote a workflow or script which you'd like to share with others in the Resilient Community. You can do this using the extract capability of resilient-circuits. It references a .res file already exported from Resilient and based on the elements you specify, will produce a new .res file with only those parts included. 

    For instance, let's say you design a workflow referencing scripts and tasks. Once complete and you produce an export .res file, your workflow can be extracted into a new .res file through the command:

    resilient-circuits extract --workflow workflow_api_name -o extract.res

    Since the workflow already references the specific scripts and tasks, they are already included in the resulting file. Add additional elements such as --rule or --field if more elements are needed to complete your package. The resulting .res file can now be shared with other Resilient instances. Be aware that the version of Resilient you will importing to must be the same version or later than the one which produced it. 

    This capability is available in the v32.0.140 version of resilient-circuits.

    ------------------------------
    Mark Scherfling
    ------------------------------