IBM Security QRadar SOAR

 View Only
  • 1.  Update Artifacts from Incident type playbook

    Posted Fri June 10, 2022 08:52 AM
    Hello,

    I have a playbook with type of an Incident. I run a GET REST API Call "/rest/orgs/201/incidents/{0}/artifacts/" to get a list of artifacts related to the incident and their values. Than I check it trough another function and want to update description and Artifacts hits. How I see I can't do it through artifact.description and artifact.addHit. I think only possible way is use UPDATE/PATCH REST API Call. Can somebody share a syntax for this REST API Calls? How I can use it?

    ------------------------------
    Alexey Fedorov
    ------------------------------


  • 2.  RE: Update Artifacts from Incident type playbook

    IBM Champion
    Posted Mon June 13, 2022 09:27 AM

    Alexey,

    You are correct, you won't be able to use the artifact object within a script that is in a playbook with the object type of incident.

    You'll need to create a partial ArtifactDTO object with an updated description and send that to the PUT /orgs/{org_id}/incidents/{inc_id}/artifacts/{artifact_id} endpoint.

    To update the description of an artifact you'd need to send the API endpoint a payload that looks something like this:

    ```
    {
      "description": {
        "format": "text",
        "content": "Hello, from the API"
      }
    }
    ```

    This will completely override the description of the artifact. If you want to append to the artifact's description, you need to use the existing description value from your GET call in the string supplied for the 'content' key.

    Here's some pseudo-code for that:

    ```
    artifact = http_request.get('<resilient_url>/rest/orgs/201/incidents/{0}/artifacts/')

    update_payload = {
       "description": {
        "format": "text",
        "content": f"{artifact.get('description').get('content')}\nThis is my new value from the API"
      }
    }

    update_response = http_request.put(f"<resilient_url>/rest/orgs/201/incidents/{0}/artifacts/{artifact.get('id')}", update_payload)
    ```

    Hopefully this helps



    ------------------------------
    Liam Mahoney
    ------------------------------



  • 3.  RE: Update Artifacts from Incident type playbook

    Posted Tue June 14, 2022 04:11 AM
    Hello Liam,

    Thank you for the example! How I should describe hits key?

    ------------------------------
    Alexey Fedorov
    ------------------------------