IBM Security QRadar SOAR

 View Only

  • 1.  Generate IBM Security QRadar SOAR Incident Link

    IBM Champion
    Posted Thu March 17, 2022 10:35 AM
    All,

    We've found it's pretty common to want to generate a link for a given IBM Security QRadar SOAR incident link within an in-product script.

    Our use-case: when an incident is generated from another security tool we like to leave a comment on the alert / ticket in that tool that contains the link to the associated IBM Security QRadar SOAR incident.

    Right now I am hardcoding the link which causes headaches when moving workflows between our test and production environments.

    Does anyone have a more dynamic way of generating incident links within the in-product scripts?

    Thanks,

    ------------------------------
    Liam Mahoney
    ------------------------------


  • 2.  RE: Generate IBM Security QRadar SOAR Incident Link

    Posted Fri March 18, 2022 11:48 AM
    Hi Liam,

    I don't know how to manage that from a script. From apps, we have common methods you can use from resilient-lib: build_incident_url and build_resilient_url. I've used  them like this:

    url = build_incident_url(build_resilient_url(res_options.get('host'), res_options.get('port')), incidentID)

    Where res_options is a dictionary of the [resilient] section from the app.config file.

    You can see all the common functions documented here: https://ibmresilient.github.io/resilient-python-api/pages/resilient-lib/resilient-lib.html

    Hope this helps
    Mark


    ------------------------------
    Mark Scherfling
    ------------------------------

    Original Message


  • 3.  RE: Generate IBM Security QRadar SOAR Incident Link

    IBM Champion
    Posted Mon March 21, 2022 10:00 AM
    Mark,

    I appreciate the response. Sounds like I'll refactor the workflows to call a function that uses the build_incident_url function before posting the note.

    The documentation on the common functions is going to be a very helpful resource, thank you guys for making it!

    Thanks again!


    ------------------------------
    Liam Mahoney
    ------------------------------

    Original Message


  • 4.  RE: Generate IBM Security QRadar SOAR Incident Link

    Posted Fri March 08, 2024 10:48 PM

    Hi Mark

    I tried the above in apps code and I'm getting an error as to res_options not defined.
    Would you have any other suggestions ?

    Thanks

    Preetham



    ------------------------------
    Fnu Preetham Nagesh
    ------------------------------

    Original Message


  • 5.  RE: Generate IBM Security QRadar SOAR Incident Link

    Posted Mon March 11, 2024 07:43 AM

    Hi Preetham,

    `res_options` in my example is a variable you've already set. Depending on your code, you may need to create that variable like this:

    @app_function(FN_NAME)
    def _app_function(self, fn_inputs):
        ...
        res_options = self.options.get("resilient", {})
        url = build_incident_url(build_resilient_url(res_options.get('host'), res_options.get('port')), incidentID)

    Hope this helps.



    ------------------------------
    Mark Scherfling
    ------------------------------

    Original Message