IBM QRadar SOAR: Handling Incident Artifacts with Playbooks
IBM QRadar SOAR allows automated email sending through the fn_task_utils app.
This app allowing you to interact with SOAR Artifacts for use with other automations.
More details here: Task Utilities
The code is provided in my GitHub IBM QRadar Samples
Prerequisites
- IBM QRadar SOAR configured.
- fn_task_utils app installed.
Configuring the Playbook
In your playbook, add or edit the Outbound Email: Send Email 2 component. Set the mail_template_label input to match the label defined in app.config.
Example:
inputs.mail_template_label = 'sample_email'
With this configuration, the app will send an email using the sample_email template, which points to:
/data/templates/sample_email.jinja