IBM Security QRadar SOAR

 View Only

  • 1.  Updating Incident field with Artifact value

    Posted Mon December 05, 2022 12:43 PM
    Edited by Shubham Agarwal Mon December 05, 2022 12:43 PM
    Hi All, 

    We are working on building a playbook where we will be enriching artifacts like Hostname, Username, IP Address using 3rd party tools. 

    If playbook is an incident activated playbook than how can we take different artifacts inside our playbook task. 

    For example : 1st task inside playbook will be used for enriching Hostname. Than how do we pass only hostname inside 1st task.


    ------------------------------
    Shubham Agarwal
    ------------------------------


  • 2.  RE: Updating Incident field with Artifact value

    Posted Mon December 05, 2022 02:24 PM
    In order to access artifact data the playbook has to an artifact activated playbook.

    ------------------------------
    Richard Swierk
    ------------------------------

    Original Message


  • 3.  RE: Updating Incident field with Artifact value

    Posted Tue December 06, 2022 01:45 AM
    Hi Richard, 

    Thanks for your response. We tried your solution and created one artifact activated playbook. But inside the playbook each task need a different artifact. 
    For example :  1st task inside playbook will be used for enriching System Name. Than how do we pass only System Name inside 1st task.
                             2nd task inside playbook will be used for enriching mac address. Than how do we pass only mac address. 

    We know "artifact.value" used for taking value of an artifact inside script but how we can pass different artifact value in different tasks.

    ------------------------------
    Shubham Agarwal
    ------------------------------

    Original Message


  • 4.  RE: Updating Incident field with Artifact value

    Posted Tue December 06, 2022 09:19 AM
    This is currently not possible from playbooks. You are only able to use the artifact that the playbook is run off of.
    To enrich these artifacts using playbooks you would have to have multiple playbooks that would have an activation condition for the type of artifact it would enrich. For example, one playbook would enrich artifacts that are type System Name and another playbook would enrich artifacts that are type Mac Address.
    The only way I can think of to do this all at once would be to create a new integration with a function that would enrich these fields. The function would have to make an API call to the incident on SOAR to get all the artifacts associated with that incident. It would get more data for each artifact and then make another API call updating the artifacts on SOAR.

    ------------------------------
    Richard Swierk
    ------------------------------

    Original Message


  • 5.  RE: Updating Incident field with Artifact value

    Posted Wed December 07, 2022 10:53 AM
    Would you try artifact activated playbook, and leverage a condition point which uses artifact type to determine different paths. Or if your enrichment function can handle different artifact types, you pass both artifact.type and artifact.value as function input?

    ------------------------------
    Leo Kuo
    ------------------------------

    Original Message