IBM Security QRadar SOAR

Currently I am developing playbook to utilise the IOC parser function while following the guide linked below:

https://www.securitylearningacademy.com/course/view.php?id=6810

At the minute (31.58), the author created a local playbook script "close task". Here is where the problem happen:

Before adding the fn_utility "Call Rest API" function, the script runs without error, after adding it, error logs as below is outputted:

"An error occurred while processing the action acknowledgement. Additional information: Script 'close_task' from Playbook 'ioc_analysis_playbook' was unable to complete because: NameError: name 'inputs' is not defined
Completed IOC Parsing on artifact/attachment data
Extracting IOCs from given Artifact/attachment data"

The function "IOC parser" itself able to extract the details from attachment but the playbook overall have error.

I have tried to remove the close task function, but the problem is that without it the string to attachment function run without stopping

------------------------------
Luqman Nur
------------------------------

The issue is that it is not a local script called "Close Task". That is a function named "Task Utils: Close Task". The variable "inputs" is only used in function scripts

------------------------------
Richard Swierk
------------------------------

Original Message:
Sent: Tue December 13, 2022 04:26 AM
From: Luqman Nur
Subject: Error with custom script (followed from webinars)

Currently I am developing playbook to utilise the IOC parser function while following the guide linked below:

https://www.securitylearningacademy.com/course/view.php?id=6810

At the minute (31.58), the author created a local playbook script "close task". Here is where the problem happen:

Before adding the fn_utility "Call Rest API" function, the script runs without error, after adding it, error logs as below is outputted:

"An error occurred while processing the action acknowledgement. Additional information: Script 'close_task' from Playbook 'ioc_analysis_playbook' was unable to complete because: NameError: name 'inputs' is not defined
Completed IOC Parsing on artifact/attachment data
Extracting IOCs from given Artifact/attachment data"

The function "IOC parser" itself able to extract the details from attachment but the playbook overall have error.

I have tried to remove the close task function, but the problem is that without it the string to attachment function run without stopping

------------------------------
Luqman Nur
------------------------------

Thanks Richard,

Manage to understand and get the function utils: close task to work.

------------------------------
Luqman Nur
------------------------------

Original Message:
Sent: Tue December 13, 2022 08:30 AM
From: Richard Swierk
Subject: Error with custom script (followed from webinars)

The issue is that it is not a local script called "Close Task". That is a function named "Task Utils: Close Task". The variable "inputs" is only used in function scripts

------------------------------
Richard Swierk

Original Message:
Sent: Tue December 13, 2022 04:26 AM
From: Luqman Nur
Subject: Error with custom script (followed from webinars)

Currently I am developing playbook to utilise the IOC parser function while following the guide linked below:

https://www.securitylearningacademy.com/course/view.php?id=6810

At the minute (31.58), the author created a local playbook script "close task". Here is where the problem happen:

Before adding the fn_utility "Call Rest API" function, the script runs without error, after adding it, error logs as below is outputted:

"An error occurred while processing the action acknowledgement. Additional information: Script 'close_task' from Playbook 'ioc_analysis_playbook' was unable to complete because: NameError: name 'inputs' is not defined
Completed IOC Parsing on artifact/attachment data
Extracting IOCs from given Artifact/attachment data"

The function "IOC parser" itself able to extract the details from attachment but the playbook overall have error.

I have tried to remove the close task function, but the problem is that without it the string to attachment function run without stopping

------------------------------
Luqman Nur
------------------------------