IBM QRadar SOAR

IBM QRadar SOAR

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only
Expand all | Collapse all

Joining Parallel Playbooks Paths That Have Conditions

  • 1.  Joining Parallel Playbooks Paths That Have Conditions

    Posted Wed January 25, 2023 11:44 AM
    Edited by Liam Mahoney Wed January 25, 2023 12:01 PM

    All,

    I've been experiencing hung playbooks when attempting to design a playbook that has parallel paths that I'm trying to join. I think the issue is that each of the parallel paths within the playbook have a condition. Once the condition is made there are now two possible paths per original path. If I link all 4 of these paths up to a wait point it won't work because two of those paths will never be traveled down. However, I need a wait point to ensure all the functions are complete in each of the paths before the next step starts.

    Here are three example configurations I've tested that all result in the playbook remaining in a 'running' state. The playbooks appear to be hung because the note at the bottom of the playbook (the last 'Task Utils: Add Note' function) never appears on 'Task 1'. I have also tested closing the task that's added in the playbook to verify that's not what is causing the playbook to hang. Hopefully these screenshots explain what I meant above better:




    Here's another configuration I tried without wait points. Once the first function completes the 'Automation error' condition is evaluated. I need the playbook to wait until all upstream functions are complete before evaluating the 'Automation error' condition because the condition checks if errors occurred in all of the upstream functions. If the condition runs before all functions have completed the condition script errors out - it attempts to check the content of a function that isn't complete, the results aren't defined yet.



    ---

    The goal of the sub-playbook is to add a task and then automate that task. If an error occurs in a step of the automation it should add a note to the task so the analyst working the incident knows what error happened and what they need to do manually. If the automation completes successfully it should close the task which would allow the sub-playbook to complete.

    I'm thinking the only solution right now is to take these parallel paths and convert them into one singular path, so one function happens after the other. This is an ok solution, but I used to do a similar process as this in workflows and it worked.

    Does anyone have any other ideas on how to get this to work? Or is there a better process to follow when wanting to run paths / functions in parallel?

    Thank you!



    ------------------------------
    Liam Mahoney
    ------------------------------


  • 2.  RE: Joining Parallel Playbooks Paths That Have Conditions

    Posted Wed February 15, 2023 05:17 PM

    Hi Liam,

    Unfortunately, I don't have a solution for your problem.

    I came across your post while researching a similar situation: multiple path, wait point, end point, ...

    I f you found a solution, it would be nice of you to post it.

    But I may also have a suggestion:  On your second schema, where the Yes and Else condition enter the Wait point, maybe you could create a "No operation" script with one line that does nothing, like Noop=True.  Then instead of entering into the Wait point, both path would go into the Noop script.  You then connect the Noop script to the Wait point.  I am not sure if that would work better.  It is just something you could try.

    HTH



    ------------------------------
    Pierre Dufresne
    ------------------------------