IBM Security QRadar SOAR

 View Only
  • 1.  IBM Security QRadar SOAR" plugin problem with upload attachment to Resilient

    Posted Thu February 02, 2023 10:19 AM
    Dear Community,

    We have a problem with SNOW intergation. We would like to upload attachment from SNOW to Resilient, but the related function is not finished or partly missing:

    Description:
    Affected integration: ServiceNow Store

    The problem is that sending an attachment from Servicenow does not work and shows a half-finished status.

    The plugin includes:
    - Deactivated Business Rule on a sys_attachment table: Add Attachment to Resilient
    - Which calls a Workflow: RES_WF_UploadAttachment
    - Which WF Run Script step calls a function: ResilientHelper().addAttachment(resReferenceId, attachSysId, fileName, contentType);
    - However, this function no longer exists in the affected script Include.

    Could you please help resolve the issue? 

    Thanks, Csaba

    ------------------------------
    Kádár Csaba
    ------------------------------


  • 2.  RE: IBM Security QRadar SOAR" plugin problem with upload attachment to Resilient

    Posted Fri February 03, 2023 09:02 AM
    Hi Csaba - I'm glad you're using our ServiceNow integration.

    Unfortunately, at this time, we've disabled attachment uploads for a reason. They are not supported from ServiceNow out to SOAR given their attachment infrastructure. This is why the Business Rule is disabled and not intended to be turned back on.

    We do hope to implement this in the future with the help of ServiceNow, however, there is no timeline on that as every time that we revisit the issue we hit the same technical blocks.

    I'm sorry I can't help more.

    Best,
    Bo

    ------------------------------
    Bo Bleckel
    ------------------------------



  • 3.  RE: IBM Security QRadar SOAR" plugin problem with upload attachment to Resilient

    Posted Tue February 07, 2023 05:03 AM
    HI Bo,

    Thanks for your answer. Could you please write something about the technical problem and - if any - add some hints or a part of the code how to implement it (what we need in the body of the call etc)?
    Maybe we would like to delevope something for that if it is possible.

    Thanks, Csaba

    ------------------------------
    Kádár Csaba
    ------------------------------



  • 4.  RE: IBM Security QRadar SOAR" plugin problem with upload attachment to Resilient

    Posted Tue February 07, 2023 01:55 PM
    Hi Csaba - I'm so sorry that I can't help more, but there is no code to provide as we were never able to get it working with ServiceNow. I hope that's a satisfactory answer as that's all I can provide.

    Best,
    Bo

    ------------------------------
    Bo Bleckel
    ------------------------------