IBM Security QRadar SOAR

Hi all,

I am fairly new to this IBM playbook development environment and stumbled across a problem. Currently I have a functions in the playbook that is processed in a local script (applied regex and sort it into artifact), I intend to use this processed variables as the other functions parameter. The first function being an email parser and breaksdown into multiple different dictionary keys and I want to parse the dns keys of it to the mx_lookup function specifically in the mx_argument parameter.

Below are the structure/flow of the playbook:


I hope the details provided is enough.


------------------------------
Luqman Nur
Techlab
------------------------------

Hi Luqman,
I do not know if I understand you well but one thing you could do is delete the email_parse_info script and move its code  directly into the input script of the MXToolbox function.
Or you could also use the playbook.addProperty playbook operation.  This allows you to build a result-like dictionnary where you can store any information you want and access it from any other script of your playbook.  See the documentation at https://www.ibm.com/docs/en/sqsp/47?topic=scripts-playbook-operations

HTH



------------------------------
Pierre Dufresne
------------------------------

Original Message:
Sent: Mon December 19, 2022 12:17 AM
From: Luqman Nur
Subject: Using post processed variables as Inputs in other function on the playbook

Hi all,

I am fairly new to this IBM playbook development environment and stumbled across a problem. Currently I have a functions in the playbook that is processed in a local script (applied regex and sort it into artifact), I intend to use this processed variables as the other functions parameter. The first function being an email parser and breaksdown into multiple different dictionary keys and I want to parse the dns keys of it to the mx_lookup function specifically in the mx_argument parameter.

Below are the structure/flow of the playbook:


I hope the details provided is enough.


------------------------------
Luqman Nur
Techlab
------------------------------

Hi Pierre,

Thanks I have implemented the steps and get it to successfully working as intended

------------------------------
Luqman Nur
Techlab
------------------------------

Original Message:
Sent: Tue December 20, 2022 03:22 PM
From: Pierre Dufresne
Subject: Using post processed variables as Inputs in other function on the playbook

Hi Luqman,
I do not know if I understand you well but one thing you could do is delete the email_parse_info script and move its code  directly into the input script of the MXToolbox function.
Or you could also use the playbook.addProperty playbook operation.  This allows you to build a result-like dictionnary where you can store any information you want and access it from any other script of your playbook.  See the documentation at https://www.ibm.com/docs/en/sqsp/47?topic=scripts-playbook-operations

HTH



------------------------------
Pierre Dufresne

Original Message:
Sent: Mon December 19, 2022 12:17 AM
From: Luqman Nur
Subject: Using post processed variables as Inputs in other function on the playbook

Hi all,

I am fairly new to this IBM playbook development environment and stumbled across a problem. Currently I have a functions in the playbook that is processed in a local script (applied regex and sort it into artifact), I intend to use this processed variables as the other functions parameter. The first function being an email parser and breaksdown into multiple different dictionary keys and I want to parse the dns keys of it to the mx_lookup function specifically in the mx_argument parameter.

Below are the structure/flow of the playbook:


I hope the details provided is enough.


------------------------------
Luqman Nur
Techlab
------------------------------