IBM QRadar SOAR: Working with Incident Properties with Playbooks

From Wiki

Simple playbook to close a Incident

Configuring the Playbook

In your playbook:

1) add or edit the Define Properties script.

Provide the following code:

x_var= {}
x_var['value'] = 'Blablabla'


my_vars = {
"id": 4,
"default_inc_type": "Phishing",
"username": "John Connor"
}

playbook.addProperty('x_var', x_var)

playbook.addProperty('my_vars', my_vars)

1) add or edit the Read Properties script.

Provide the following code:

valor = playbook.properties['x_var']['value']

incident.addNote("x_var = |{}| ".format(valor))

my_id = playbook.properties['my_vars']['id']
inc_type = playbook.properties['my_vars']['default_inc_type']
username = playbook.properties['my_vars']['username']

incident.addNote("my_vars:  my_id={}, inc_type:{}, username:{}    ".format(my_id, inc_type, username))



Ver também