IBM Security QRadar SOAR

 View Only

'is added' Rule Condition

  • 1.  'is added' Rule Condition

    IBM Champion
    Posted Mon June 13, 2022 09:08 AM
    All,

    I am trying to create a condition that will fire whenever a certain group is added as a member of an incident.

    I noticed the 'is added' option for the members field. I went to the documentation (here) and it states the following for the condition:

    Condition is True when the value [a] is added.

    I'm interpreting this (based on some of the other condition descriptions provided) that I should be able to specify a value and when that value is added to the field the rule will trigger. Is this the correct interpretation of this condition?

    When I go to configure the condition I am unable to specify a value (I've checked both rule conditions and playbook conditions):


    I want to make sure that this is expected. I was hoping another input box would appear to the right where I'd be able to specify a value that should trigger this rule when it's added to the members.

    Thanks!

    ------------------------------
    Liam Mahoney
    ------------------------------