IBM QRadar SOAR

IBM QRadar SOAR

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only
  • 1.  Suspended playbook

    Posted Wed May 25, 2022 11:42 AM
    HI,
    I have built an incident playbook which under certain conditions within a script can automatically close the incident.
    When this happens, the playbook stays in a "Suspended" state as indicated by a yellow dot just besides the "Playbook progress" link.

    This happens even though the next step in the playbook, after the script that closes the incident, is an end point.

    According to the documentation, "You can permanently terminate a workflow if it is suspended and you do not plan to reopen the incident.".  But to do this, you have to reopen the incident which defeats the whole purpose of the automation.

    Is there a way around this?  ie terminate the playbook when the incident is closed by a script within the playbook.

    Thanks

    ------------------------------
    Pierre Dufresne
    ------------------------------


  • 2.  RE: Suspended playbook

    Posted Fri May 27, 2022 12:18 PM
    This is the current behavior of the playbook for close incident. If the incident has more than one playbook is running and one of the playbooks closes the incident via script and, it is the last node in the playbook, then playbook is marked as completed and all other running playbooks get suspended. Otherwise, all running playbooks get suspended. Unfortunately, there is no workaround for this yet.

    Thanks

    ------------------------------
    Ram Badvelu
    ------------------------------



  • 3.  RE: Suspended playbook

    Posted Mon May 30, 2022 01:05 PM
    Hi Ram,

    Thank you for your answer.  It is very clear.
    But it leaves me wondering if many playbooks get suspended and this number increases over time, will this consume resources and eventually have an impact on performance?
    Do you plan to modify this behaviour in the future?

    ------------------------------
    Pierre Dufresne
    ------------------------------



  • 4.  RE: Suspended playbook

    Posted Tue May 31, 2022 09:58 AM
    Hi Pierre, 

    We have not seen any major impact on performance. However, this is some overhead over a period of time with regards to the database space. 

    Currently, there is no plan to change this behavior as it would break the re-open incident functionality.  i.e, re-opening of the incident will resume all suspended playbooks. this is not possible if we cancel the playbooks on closing the incident.


    Thanks

    ------------------------------
    Ram Badvelu
    ------------------------------



  • 5.  RE: Suspended playbook

    Posted Wed June 01, 2022 10:38 AM
    Hi Ram,
    I understand your point.  But when an incident is closed as the last step in the playbook, it means it is supposed to be closed.  Even though the incident is reopened, the playbook should not restart because it was already at the end.

    At least, you should consider adding an action in the Actions menu of the Incidents tab saying something like "terminate suspended playbooks for  selected incidents".   As I wrote earlier, it makes no sense to automate tasks, if one has to go over each incident one by one to terminate the playbooks.

    ------------------------------
    Pierre Dufresne
    ------------------------------



  • 6.  RE: Suspended playbook

    Posted Wed June 01, 2022 12:18 PM

    Hi Pierre,

    Thanks for your feedback.

    In v45, we have added an option for cancelling all running and suspended playbook instances in the playbook designer. However, it does not have option to cancel only the suspended instances of a playbook or a given incident(s). 

    yeah. It is a good idea to have option for cancelling all suspended playbooks for a given incident or a selected incidents.  Please feel free to create RFE and we will track this idea for future releases.

    Having said that you can use the following endpoints if you want to automate the same:

    POST: /orgs/{org_id}/playbooks/execution/query_paged
    POST : /orgs/{org_id}/playbooks/execution/cancel

    Thanks 




    ------------------------------
    Ram Badvelu
    ------------------------------