IBM Security QRadar SOAR

 View Only
  • 1.  Playbook error notification

    Posted Wed July 06, 2022 11:12 AM
    Hi all!

    Is there a way to be notified when a playbook falls in error?
    The Playbooks screen has no indication about errors.
    The Notification tab in the Administrator Settings does not contain such a notification type.
    I also looked in the analytics dashboard but there is nothing about playbooks.

    The only solution I could come up with now would be to send the logs of our SOAR SaaS platform to our QRadar SaaS platform.

    Any other ideas?

    Thanks for your time

    ------------------------------
    Pierre Dufresne
    ------------------------------


  • 2.  RE: Playbook error notification

    Posted Thu July 07, 2022 01:07 PM
    Hi Pierre, 

    Currently, there is no such notification available in the product.  You might be able to leverage the scheduler app and PlaybookExecution REST endpoint -> orgs/{org_id}/playbooks/execution/queryPaged to get the list of failed playbooks and then send notification.  Having said this would be very expensive if scheduler is configured to invoke this call for every minute or seconds.

    what is the use case ? 

    Thanks

    ------------------------------
    Ram Badvelu
    ------------------------------