IBM Security QRadar SOAR

 View Only
  • 1.  Assign task when created in a playbook

    Posted Tue March 29, 2022 04:06 PM
    Hi all,

    I have a playbook automatically started at the creation of a specific incident type.  Inside this playbook, I want to add a global task and assign it to a specific group.
    Assigning the task could be done with a rule  but I am wondering how to do it from the playbook.
    In fact, I am wondering if it is a good practice to mix playbooks and rules?

    ------------------------------
    Pierre Dufresne
    ------------------------------


  • 2.  RE: Assign task when created in a playbook

    Posted Wed March 30, 2022 09:21 AM
    I'm uncertain what is meant by "global task". That said, it is possible to add tasks from a playbook.

    A task that shows up in the Tasks library can be added by dragging it onto the playbook canvas. It is possible to add a custom task, one that is specific to that incident by doing it from a script like this:

    incident.addTask(...)

    There is no problem with using both Rules and Playbooks. However, for most use cases, Playbooks are the way of the future. All new investment will be done in Playbooks.


    Ben

    ------------------------------
    Ben Lurie
    ------------------------------



  • 3.  RE: Assign task when created in a playbook

    Posted Wed March 30, 2022 01:16 PM
    Hi,
    By using "global task", i meant a task from the task library.

    By the way, this is exactly what I want to do: drag a task onto the playbook canvas.  Once this is done, how can I assign the task within the playbook?

    ------------------------------
    Pierre Dufresne
    ------------------------------



  • 4.  RE: Assign task when created in a playbook

    Posted Wed March 30, 2022 04:01 PM
    Hi Pierre,
    There are a number of example scripts for setting the task owner:
    https://github.com/ibmresilient/resilient-scripts/blob/master/3_orchestration/Set%20Task%20Owner%20When%20Closed.md
    It may be possible to do this when the task is created.

    ------------------------------
    Elizabeth Hecht
    ------------------------------



  • 5.  RE: Assign task when created in a playbook

    Posted Thu March 31, 2022 07:27 AM
    Unfortunately right now that isn't straightforward because the playbook doesn't have access to all the case tasks. You'll need to set up a separate playbook that runs when a task is created and assign it in that playbook using a script.

    Ben

    ------------------------------
    Ben Lurie
    ------------------------------



  • 6.  RE: Assign task when created in a playbook

    Posted Thu March 31, 2022 09:22 AM
    OK,
    Thanks Ben, your answer is clear.  I was not sure you could start a playbook from inside another playbook.

    So my options are:
    • Run a script triggered by a task rule
    • Run a script executed within a task playbook
    As you wrote earlier, playbooks are the way of the future so I will try to make it work with this solution.

    ------------------------------
    Pierre Dufresne
    ------------------------------