IBM QRadar SOAR

Hello,

We have several workspaces in our Resilient instance which we use to isolate incidents by sensitivity and we want to honor these workspaces when using Circuits integrations like the Data Feeder. However, we cannot see a way to assign workspaces to an API key and it we choose to use an user account to run this integration, it won't work unless it has the "Master Administrator" account (which IIRC, it's one of the main reasons why the API keys where implemented in the first place).

Are you aware of any way to solve this situation?

@IBM TechXchange Community Team is this a feature you have in your roadmap already?

Regards,​

------------------------------
Carlos Ortigoza
------------------------------

This is not on the roadmap to my knowledge (I am not in Offering Management).  I'd suggest opening an Idea for this on the Aha portal.

You might be able to do something with scripts the causing changes to fail if the api key is not in the correct workspace:

if (incident.workspace = "workspace1" and principal.name = "apikey1")
    helper.fail("Principal is not allowed to make changes in workspace")

------------------------------
Ben Lurie
------------------------------

Original Message:
Sent: Fri November 15, 2019 11:22 AM
From: Carlos Ortigoza
Subject: Workspaces with API Keys

Hello,

We have several workspaces in our Resilient instance which we use to isolate incidents by sensitivity and we want to honor these workspaces when using Circuits integrations like the Data Feeder. However, we cannot see a way to assign workspaces to an API key and it we choose to use an user account to run this integration, it won't work unless it has the "Master Administrator" account (which IIRC, it's one of the main reasons why the API keys where implemented in the first place).

Are you aware of any way to solve this situation?

@IBM TechXchange Community Team is this a feature you have in your roadmap already?

Regards,​

------------------------------
Carlos Ortigoza
------------------------------