IBM Security QRadar SOAR

 View Only
  • 1.  task removal from within a script possible?

    Posted Wed January 04, 2023 05:01 AM
    hello,


    is it possible to remove incident tasks from within a script? I couldn't find the counterpart of "incident.addTask" and using the REST API for this simple operation would require the overhead of deploying an AppHost application ...


    thanks,

    petre

    ------------------------------
    petre b
    ------------------------------


  • 2.  RE: task removal from within a script possible?

    Posted Thu January 05, 2023 08:29 AM
    Hi Petre,

    Unfortunately, this is not possible. Our Task Utils app has some useful task actions, but not remove task. And that would also need an Integration Server or App Host as you mentioned. 

    What use case is there for removing a task? Understanding this may be useful to see if there are any alternatives to task removal.

    Regards,
    Mark

    ------------------------------
    Mark Scherfling
    ------------------------------



  • 3.  RE: task removal from within a script possible?

    Posted Fri January 06, 2023 10:58 AM
    Hi Mark,

    I think we have found a workaround by making use of the "hidden" property

    ```
    When an automatic rule creates a task, that task is an "auto-activated" task. This means that if the rule is re-evaluated and the rule condition is false, then its tasks are deactivated and hidden. This behavior is useful in many situations. For example, an automatic rule creates tasks in response to a malware event, which is later determined to not be malware; those tasks are subsequently deactivated.
    ```
    our use case requires adding/deleting tasks based on the content of a multiselect field (is the incident relevant for the compliance to some standards?); we have changed oour approach to make use of the above feature and defined an automatic rule for each entry in the multiselect list (if <field> has one of <standard_string>) - the tasks are added when the rule is triggered and disabled, when the string is removed from the field's value. 

    best regards,
    petre

    ------------------------------
    petre b
    ------------------------------