IBM QRadar SOAR: Working with Incident Properties with Playbooks
Simple playbook to close a Incident
Configuring the Playbook
In your playbook:
1) add or edit the Define Properties script.
Provide the following code:
x_var= {} x_var['value'] = 'Blablabla' my_vars = { "id": 4, "default_inc_type": "Phishing", "username": "John Connor" } playbook.addProperty('x_var', x_var) playbook.addProperty('my_vars', my_vars)
1) add or edit the Define Properties script.
Provide the following code:
valor = playbook.properties['x_var']['value'] incident.addNote("x_var = |{}| ".format(valor)) my_id = playbook.properties['my_vars']['id'] inc_type = playbook.properties['my_vars']['default_inc_type'] username = playbook.properties['my_vars']['username'] incident.addNote("my_vars: my_id={}, inc_type:{}, username:{} ".format(my_id, inc_type, username))