IBM QRadar SOAR

IBM QRadar SOAR

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only
Expand all | Collapse all

In-system notifications for Notes - @mentioned users only ? + formatting issue

  • 1.  In-system notifications for Notes - @mentioned users only ? + formatting issue

    Posted Wed November 29, 2023 04:38 AM

    Hello, can somebody help out or did someone else have the same issues ?

    When posting Notes to an incident, one can use the @mention functionality (@username) that will trigger sending an email to those mentioned in the note.

    This means also that you need to set up a configuration of a "Notification" (with condition) in the Administrator Settings. 

    We tried using the following:

    with condition "Mentioned user" = "has a value"

    However, you need to tick one option in the box (3) - "Who should receive this" (Members / Owner / Parent Members / Parent Owner).

    The result is that upon creating a note, the "Owner" or "Members" of the incident or task ALSO receive a  (mail) notification on the note. (in the screenshot above, "the receive mail by default" is not activated, but we normally want to do this. 

    The Final goal would be to have a way to send a Notification ONLY to the "@mentioned users" in the note, and not having all members / owner also receiving this.

    Is there a way achieve this? 

    Another remark / question: 

    The in the received mail, the formatting (html) does not expand  in this case for the ${NOTE} . For any other Notifications (e.g. including  ${incident.description} - rich text format is "flattened") it works fine, no HTML visible.

    Also the "${incident.properties.priority}" is not "resolved" - in all other notifications we made, it shows the actual content of the (select) field, here it shows a "value"

    FYI using the on-prem version 46.1.52

    Kind regards and thanks already

    Guido Janssens



    ------------------------------
    Guido Janssens
    ------------------------------


  • 2.  RE: In-system notifications for Notes - @mentioned users only ? + formatting issue

    Posted Thu November 30, 2023 08:17 AM

    Hi Guido,

    Focusing on your observation regarding ${NOTE}. Change it to ${note} (lowercase) and you should find that the HTML tags do not appear.



    ------------------------------
    BEN WILLIAMS
    ------------------------------



  • 3.  RE: In-system notifications for Notes - @mentioned users only ? + formatting issue

    Posted Thu November 30, 2023 12:39 PM
    Edited by Guido Janssens Thu November 30, 2023 03:03 PM

    Hi Ben, thanks 

    indeed this was the solution for the formatting. 

    As a workaround to limit sending, we currently updated the "Who should receive this" to only "Owner" - that already limits the sending to only the @mentioned and the owner. To make the message clear, we added the text  (A copy of this mail is also sent to the Case owner).

    The remaining issue about the priority "${incident.properties.priority}" not being "resolved" is bizar, in all other notifications we made we use the same (nocaps ;) ) "${incident.properties.priority}" and it shows the actual content of the (select) field.

    -------------------
    Guido Janssens
    CERT - Information Risk Officer
    KBC Group NV
    ------------------------------