IBM QRadar SOAR

IBM QRadar

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only
Expand all | Collapse all

How to clean up suspended workflows?

  • 1.  How to clean up suspended workflows?

    Posted Tue September 21, 2021 03:01 PM
    I have almost 1,400 incidents with workflows that are in suspended state, mostly do to what I suspect is the artifact is as SOAR describes "Artifact  <Object Deleted>".
    Thing is, the only way I know to terminate these suspended workflows is to go into each incident and manually close them which obviously going to take a long time.
    Is there an automated way to do this?

    Thanks in advance.

    ------------------------------
    Tim Gray
    ------------------------------


  • 2.  RE: How to clean up suspended workflows?

    Posted Thu October 21, 2021 01:00 AM
    Hello Tim,

    I think, suspended workflows do not affect the system because there is a description in workflow section like below.

    A Suspended workflow can occur when the incident closes before the workflow completes. Reopening an incident resumes the workflow. You can permanently terminate a workflow if it is suspended and you do not plan to reopen the incident.

    But if you already want to terminate them all periodically, you could write a script which uses SOAR rest functions and could be scheduled in cron. You need to use below rest endpoints.

    To get workflow instances

    To terminate workflow instances


    ------------------------------
    Burak Karaduman
    ------------------------------



  • 3.  RE: How to clean up suspended workflows?

    This message was posted by a user wishing to remain anonymous
    Posted Mon November 27, 2023 07:10 AM
    This post was removed