IBM Security QRadar SOAR

 View Only
  • 1.  Start a playbook by a script conditions

    Posted Mon May 23, 2022 02:02 AM
    Hello,

    Is it a way how I can start a playbook by a script conditions? For instance I need to start a playbook if some task will be closed, by through wizard I can do it only if a task created.



    ------------------------------
    Alexey Fedorov
    ------------------------------


  • 2.  RE: Start a playbook by a script conditions

    Posted Tue May 24, 2022 06:57 AM
    Can't you trigger the playbook based on the task field values?

    ------------------------------
    []

    Leonardo Kenji Shikida
    ------------------------------



  • 3.  RE: Start a playbook by a script conditions

    Posted Tue May 24, 2022 07:44 AM
    Hello Leonardo,

    I'm sorry. Of course I can do it. But what about a script? Like "Script builder" conditions.

    ------------------------------
    Alexey Fedorov
    ------------------------------



  • 4.  RE: Start a playbook by a script conditions

    Posted Tue May 24, 2022 08:44 AM
    I see. You want to trigger a playbook from some logic inside your script.

    One way to do that is to link your playbook to an event, let's say, add a datatable row, for example.

    Then, from inside your script, you can just add a new datatable row.

    This way is useful because you can even use the datatable row you've added as input to your playbook.

    I don't think there's a way, from inside the workflow, to perform polling on some task status. 

    However, you can do it from outside SOAR, using Cron for example, and checking every minute if some incident task is closed.

    Or, if your condition is specifically to trigger a playbook when a user task is closed (remember, there's only one user task of each kind per incident, even if you call subworkflows that adds the same user task), you can just keep this script after the user task in the workflow, because only when the user task is closed, that branch of the workflow will proceed.

    Not sure if this is what you need. I hope it helps.

    ------------------------------
    []

    Leonardo Kenji Shikida
    ------------------------------