IBM Resilient Systems

Case management that enables visibility across your tools for continual IR improvement.

Case Management · IBM Security QRadar SOAR

Details

IDIBM Resilient Systems
ProviderIBM
CategoryCase Management
From Version5.0.0
Docker Imagedemisto/resilient:2.0.0.10133006
Supported ModulesAgentix XSIAM

README

Case management that enables visibility across your tools for continual IR improvement.

Configure IBM Resilient Systems in Cortex

Parameter Description Required
Server URL (e.g. 192.168.0.1)   True
Organization name   True
API key ID   False
API key secret   False
Trust any certificate (not secure)   False
Use system proxy settings   False
Incident type   False
Fetch incidents   False
Fetch closed incidents   False
Fetch notes    
Fetch tasks    
First fetch timestamp (YYYY-MM-DDTHH:MM:SSZ). For example: 2020-02-02T19:00:00Z   False
Maximum incidents to fetch. Maximum number of incidents per fetch. The maximum is 1000. False
Incident Mirroring Direction Cortex XSOAR only parameter. False
Close Mirrored XSOAR Incidents When selected, closing the IBM Resilient incident with a ‘Closed’ status, will close the Cortex XSOAR incident. False
Close Mirrored IBM Resilient Incidents When selected, closing the Cortex XSOAR incident will close the incident in IBM Resilient. False
Tag from IBM Qradar SOAR Add this tag to an entry to mirror it from IBM Qradar SOAR. False
Tag to IBM QRadar SOAR Add this tag to an entry to mirror it to IBM Qradar SOAR. False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

rs-search-incidents

Query for incidents

Base Command

rs-search-incidents

Input

Argument Name Description Required
page Indicates the starting point for the first record in the dataset. Starting from 1. Optional
page_size The maximum number of records to return in the response. Null or less than 1 to return all records, up to the server-configured maximum limit. When greater than 0, an error will be thrown if the length is greater than the server-configured maximum limit. Optional
limit Maximum number of incidents to retrieve. Default is 1000. Optional
severity Comma-separated list of incident severity, e.g., Low,Medium,High. Optional
date-created-before Created date of the incident before the given date in the format YYYY-MM-DDTHH:MM:SSZ, e.g., 2018-05-07T10:59:07Z. Optional
date-created-after Created date of the incident after the given date in the format YYYY-MM-DDTHH:MM:SSZ, e.g., 2018-05-07T10:59:07Z. Optional
date-created-within-the-last Created date of the incident within the last timeframe (days/hours/minutes). Should be given a number, along with the timeframe argument. Optional
timeframe Timeframe to search within for incident. Should be given with within-the-last/due-in argument. Possible values: “days”, “hours”, “minutes”. Possible values are: days, hours, minutes. Optional
date-occurred-within-the-last Occurred date of the incident within the last timeframe (days/hours/minutes). Should be given a number, along with the timeframe argument. Optional
date-occurred-before Occurred date of the incident before the given date in the format YYYY-MM-DDTHH:MM:SSZ, e.g., 2018-05-07T10:59:07Z. Optional
date-occurred-after Occurred date of the incident after the given date in the format YYYY-MM-DDTHH:MM:SSZ, e.g., 2018-05-07T10:59:07Z. Optional
incident-type Incident type. Possible values are: CommunicationError, DenialOfService, ImproperDisposal:DigitalAsset, ImproperDisposal:documents/files, LostDocuments/files/records, LostPC/laptop/tablet, LostPDA/smartphone, LostStorageDevice/media, Malware, NotAnIssue, Other, Phishing, StolenDocuments/files/records, StolenPC/laptop/tablet, StolenPDA/Smartphone, StolenStorageDevice/media, SystemIntrusion, TBD/Unknown, Vendor/3rdPartyError. Optional
nist NIST Attack Vectors. Possible values: “Attrition”, “E-mail”, “External/RemovableMedia”, “Impersonation”, “ImproperUsage”, “Loss/TheftOfEquipment”, “Other”, “Web”. Possible values are: Attrition, E-mail, External/RemovableMedia, Impersonation, ImproperUsage, Loss/TheftOfEquipment, Other, Web. Optional
status Incident status. Possible values: “Active” and “Closed”. Possible values are: Active, Closed. Optional
due-in Due date of the incident in given timeframe (days/hours/minutes). Should be given a number, along with the timeframe argument. Optional
return_level The incident data structure returned (“partial”, “normal”, “full”).’. Possible values are: partial, normal, full. Optional

Context Output

Path Type Description
Resilient.Incidents.CreateDate string Created date of the incident.
Resilient.Incidents.Name string Incident name.
Resilient.Incidents.Resolution string Incident resolution.
Resilient.Incidents.DiscoveredDate string Discovered date of the incident.
Resilient.Incidents.ResolutionSummary string Incident resolution summary.
Resilient.Incidents.Id string Incident ID.
Resilient.Incidents.Phase string Incident phase.
Resilient.Incidents.PlanStatus string Incident status.
Resilient.Incidents.Severity string Incident severity.
Resilient.Incidents.Description string Incident description.
Resilient.Incidents.Confirmed boolean Incident confirmation.
Resilient.Incidents.NegativePr boolean Whether negative PR is likely.
Resilient.Incidents.DateOccurred string Date incident occurred.
Resilient.Incidents.Reporter string Name of reporting individual.
Resilient.Incidents.NistAttackVectors Unknown Incident NIST attack vectors.
Resilient.Incidents.ExposureType string Incident exposure type.
Resilient.Incidents.ResolutionSummary string Incident resolution summary.

rs-update-incident

Updates incidents.

Base Command

rs-update-incident

Input

Argument Name Description Required
incident-id Incident ID to update. Required
severity Severity to update. Possible value: “Low”, “Medium”, and “High”. Possible values are: Low, Medium, High. Optional
owner User full name to set as incident owner, e.g., Steve Jobs. Optional
incident-type Incident type (added to the current incident types list). Possible values are: CommunicationError, DenialOfService, ImproperDisposal:DigitalAsset, ImproperDisposal:documents/files, LostDocuments/files/records, LostPC/laptop/tablet, LostPDA/smartphone, LostStorageDevice/media, Malware, NotAnIssue, Other, Phishing, StolenDocuments/files/records, StolenPC/laptop/tablet, StolenPDA/Smartphone, StolenStorageDevice/media, SystemIntrusion, TBD/Unknown, Vendor/3rdPartyError. Optional
resolution Incident resolution. Possible value: “Unresolved”, “Duplicate”, “NotAnIssue”, and “Resolved”. Possible values are: Unresolved, Duplicate, NotAnIssue, Resolved. Optional
resolution-summary Incident resolution summary. Optional
description Incident description. Optional
name Incident name. Optional
nist NIST Attack Vectors (added to the current list of NIST attack vectors). Possible values: “Attrition”, “E-mail”, “External/RemovableMedia”, “Impersonation”, “ImproperUsage”, “Loss/TheftOfEquipment”, “Other”, “Web”. Possible values are: Attrition, E-mail, External/RemovableMedia, Impersonation, ImproperUsage, Loss/TheftOfEquipment, Other, Web. Optional
other-fields A JSON object of the form: {field_name: new_field_value}. For example: {"description": {"textarea": {"format": "html", "content": "The new description"}}, "name": {"text": "The new name"}}. The name should be the path to it in the incident separated by “.” For example: `{“properties.incident_summary”: {“text”: “The new name”}}”. Because of API limitations we currently support only fields of the following types: ID, list of IDS, Number, Boolean, Text, Data, Textarea. For more information, refer to https://xsoar.pan.dev/docs/reference/integrations/ibm-resilient-systems. In case of conflicts between the other-fields argument and the regular fields arguments, the other-fields value will be used. Optional

Context Output

There is no context output for this command.

Command Example

!rs-update-incident incident-id=1234 severity=High incident-type=Malware

Human Readable Output

Incident 1234 was updated successfully.

rs-incidents-get-members

Gets members of the incident.

Base Command

rs-incidents-get-members

Input

Argument Name Description Required
incident-id Incident ID to get members of. Required

Context Output

Path Type Description
Resilient.Incidents.ID string Incident ID.
Resilient.Incidents.Members.FirstName string Member’s first name.
Resilient.Incidents.Members.LastName string Member’s last name.
Resilient.Incidents.Members.ID number Member’s ID.
Resilient.Incidents.Members.Email string Member’s email address.

Command Example

!rs-incidents-get-members incident-id=1234

Context Example

{
    "Resilient": {
        "Incidents": {
            "Id": "1234",
            "Members": [
                {
                    "Email": "example@example.com",
                    "FirstName": "example",
                    "ID": 1,
                    "LastName": "example"
                }
            ]
        }
    }
}

Human Readable Output

Members of incident 1234

ID LastName FirstName Email
1 example example example@example.com

rs-get-incident

Gets an individual incident by ID.

Base Command

rs-get-incident

Input

Argument Name Description Required
incident-id ID of incident to get. Required

Context Output

Path Type Description
Resilient.Incidents.CreateDate string Created date of the incident.
Resilient.Incidents.Name string Incident name.
Resilient.Incidents.Resolution string Incident resolution.
Resilient.Incidents.DiscoveredDate string Discovered date of the incident.
Resilient.Incidents.ResolutionSummary string Incident resolution summary.
Resilient.Incidents.Id string Incident ID.
Resilient.Incidents.Phase string Incident phase.
Resilient.Incidents.PlanStatus string Incident status.
Resilient.Incidents.Severity string Incident severity.
Resilient.Incidents.Description string Incident description.
Resilient.Incidents.Confirmed boolean Incident confirmation.
Resilient.Incidents.NegativePr boolean Whether negative PR is likely.
Resilient.Incidents.DateOccurred string Date incident occurred.
Resilient.Incidents.Reporter string Name of reporting individual.
Resilient.Incidents.NistAttackVectors Unknown Incident NIST attack vectors.
Resilient.Incidents.ExposureType string Incident exposure type.

rs-get-incident

Gets an individual incident by ID.

Base Command

rs-get-incident

Input

Argument Name Description Required
incident-id ID of incident to get. Required

Context Output

Path Type Description
Resilient.Incidents.CreateDate string Created date of the incident.
Resilient.Incidents.Name string Incident name.
Resilient.Incidents.Resolution string Incident resolution.
Resilient.Incidents.DiscoveredDate string Discovered date of the incident.
Resilient.Incidents.ResolutionSummary string Incident resolution summary.
Resilient.Incidents.Id string Incident ID.
Resilient.Incidents.Phase string Incident phase.
Resilient.Incidents.PlanStatus string Incident status.
Resilient.Incidents.Severity string Incident severity.
Resilient.Incidents.Description string Incident description.
Resilient.Incidents.Confirmed boolean Incident confirmation.
Resilient.Incidents.NegativePr boolean Whether negative PR is likely.
Resilient.Incidents.DateOccurred string Date incident occurred.
Resilient.Incidents.Reporter string Name of reporting individual.
Resilient.Incidents.NistAttackVectors Unknown Incident NIST attack vectors.
Resilient.Incidents.ExposureType string Incident exposure type.
Resilient.Incidents.ResolutionSummary string Incident resolution summary. 
    "Incidents": {
        "Id": "1234",
        "Members": {
            "Email": "example@exampe.com",
            "FirstName": "example",
            "ID": 2,
            "LastName": "example",
            "members": [],
            "vers": 10
        }
    }
} }


#### Human Readable Output

>### Members of incident 1234
>|Email|FirstName|ID|LastName|members|vers|
>|---|---|---|---|---|---|
>| example@example.com | example | 2 | example |  | 10 |


### rs-get-users
***
Gets a list of all users in the system.


#### Base Command

`rs-get-users`
#### Input

There are no input arguments for this command.

#### Context Output

There is no context output for this command.

#### Command Example
```!rs-get-users```

#### Human Readable Output

>### IBM Resilient Systems Users
>|ID|LastName|FirstName|Email|
>|---|---|---|---|
>| 1 | example | example | example@example.com |
>| 2 | example1 | example1 | example1@example.com |


### rs-close-incident
***
Closes an incident.


#### Base Command

`rs-close-incident`
#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| incident-id | ID of the incident to close. | Required | 


#### Context Output

There is no context output for this command.

#### Command Example
```!rs-close-incident incident-id=1234```

#### Human Readable Output

>Incident 1234 was closed.

### rs-create-incident
***
Creates an incident.


#### Base Command

`rs-create-incident`
#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| name | Incident name. | Required | 


#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| Resilient.Incidents.Id | string | Incident ID. | 
| Resilient.Incidents.Name | string | Incident name. | 


#### Command Example
```!rs-create-incident name=IncidentName```

#### Context Example
```json
{
    "Resilient": {
        "Incidents": {
            "Id": "1235",
            "Name": "IncidentName"
        }
    }
}

Human Readable Output

Incident IncidentName was created

ID Name
1235 IncidentName

rs-incident-artifacts

Gets incident artifacts.

Base Command

rs-incident-artifacts

Input

Argument Name Description Required
incident-id Incident ID to get artifacts of. Required

Context Output

Path Type Description
Resilient.Incidents.Id string Incident ID.
Resilient.Incidents.Name string Incident name.
Resilient.Incidents.Artifacts.CreatedDate string Artifact created date.
Resilient.Incidents.Artifacts.Creator string Artifact creator.
Resilient.Incidents.Artifacts.Description string Artifact description.
Resilient.Incidents.Artifacts.ID number Artifact ID.
Resilient.Incidents.Artifacts.Type string Artifact type.
Resilient.Incidents.Artifacts.Value string Artifact value.
Resilient.Incidents.Artifacts.Attachments.ContentType string Attachment content type.
Resilient.Incidents.Artifacts.Attachments.CreatedDate string Attachment created date.
Resilient.Incidents.Artifacts.Attachments.Creator string Attachment creator.
Resilient.Incidents.Artifacts.Attachments.ID number Attachment ID.
Resilient.Incidents.Artifacts.Attachments.Name string Attachment name.
Resilient.Incidents.Artifacts.Attachments.Size number Attachment size.

Command Example

!rs-incident-artifacts incident-id=1234

Context Example

{
    "Resilient": {
        "Incidents": {
            "Artifacts": [
                {
                    "CreatedDate": "2000-00-00T00:00:00Z",
                    "Creator": "example example",
                    "Description": "example",
                    "ID": 1,
                    "Type": "IP Address",
                    "Value": "1.1.1.1"
                },
                {
                    "CreatedDate": "2000-00-00T00:00:00Z",
                    "Creator": "example example",
                    "Description": "example",
                    "ID": 2,
                    "Type": "IP Address",
                    "Value": "2.2.2.2"
                }
             ],
            "Id": "1234",
            "Name": "example"
        }
    }
}

Human Readable Output

Incident 1234 artifacts

ID Value Description CreatedDate Creator
1 1.1.1.1 example 2000-00-00T00:00:00Z example example
2 2.2.2.2 example 2000-00-00T00:00:00Z example example

rs-incident-attachments

Gets incident attachments.

Base Command

rs-incident-attachments

Input

Argument Name Description Required
incident-id Incident ID to get attachments from. Required

Context Output

Path Type Description
Resilient.Incidents.Id string Incident ID.
Resilient.Incidents.Name string Incident name.
Resilient.Incidents.Owner string Incident owner.
Resilient.Incidents.Attachments.ContentType string Attachment content type.
Resilient.Incidents.Attachments.CreatedDate string Attachment created date.
Resilient.Incidents.Attachments.Creator string Attachment creator.
Resilient.Incidents.Attachments.ID number Attachment ID.
Resilient.Incidents.Attachments.Name string Attachment name.
Resilient.Incidents.Attachments.Size number Attachment size.

Command Example

!rs-incident-attachments incident-id=1234

Context Example

{
    "Resilient": {
        "Incidents": {
            "Attachments": [
                {
                    "ContentType": "example",
                    "CreatedDate": "2000-00-00T00:00:00Z",
                    "Creator": "example example",
                    "ID": 1,
                    "Name": "example",
                    "Size": 10
                }
            ],
            "Id": "1234",
            "Name": "example",
            "Owner": "example example"
        }
    }
}

Human Readable Output

Incident 1234 attachments

ContentType CreatedDate Creator ID Name Size
example 2000-00-00T00:00:00Z example example 1 example 10

rs-related-incidents

Gets related incidents.

Base Command

rs-related-incidents

Input

Argument Name Description Required
incident-id Incident ID to get related incidents of. Required

Context Output

Path Type Description
Resilient.Incidents.Id string Incident ID.
Resilient.Incidents.Related.CreatedDate string Created date of the related incident.
Resilient.Incidents.Related.Name string Name of the related incident.
Resilient.Incidents.Related.ID number ID of the related incident.
Resilient.Incidents.Related.Status string Status (Active/Closed) of the related incident.
Resilient.Incidents.Related.Artifacts.CreatedDate string Created date of the artifact.
Resilient.Incidents.Related.Artifacts.ID number ID of the artifact.
Resilient.Incidents.Related.Artifacts.Creator string Creator of the artifact.

Command Example

!rs-related-incidents incident-id=1234

Context Example

{
    "Resilient": {
        "Incidents": {
            "Id": "1234",
            "Related": [
                {
                    "Artifacts": [
                        {
                            "CreatedDate": "2000-00-00T00:00:00Z",
                            "Creator": "example example",
                            "ID": 1
                        },
                        {
                            "CreatedDate": "2000-00-00T00:00:00Z",
                            "Creator": "example example",
                            "Description": "example",
                            "ID": 2
                        }
                    ],
                    "CreatedDate": "2000-00-00T00:00:00Z",
                    "ID": 1235,
                    "Name": "example",
                    "Status": "Closed"
                }
            ]
        }
    }
}

Human Readable Output

Incident 1234 related incidents

Artifacts CreatedDate ID Name Status
ID: 1
Created Date: 2000-00-00T00:00:00Z
Creator: example example
ID: 2
Created Date: 2000-00-00T00:00:00Z
Description: example

Creator: example example
 2000-00-00T00:00:00Z 1234 example Closed

rs-incidents-get-tasks

Gets tasks of incidents.

Base Command

rs-incidents-get-tasks

Input

Argument Name Description Required
incident-id Incident ID to get tasks of. Required

Context Output

Path Type Description
Resilient.Incidents.Id string Incident ID.
Resilient.Incidents.Name string Incident name.
Resilient.Incidents.Tasks.Category string Task category.
Resilient.Incidents.Tasks.Creator string Task creator.
Resilient.Incidents.Tasks.DueDate string Task due date.
Resilient.Incidents.Tasks.Form string Task form.
Resilient.Incidents.Tasks.ID string Task ID.
Resilient.Incidents.Tasks.Name string Task name.
Resilient.Incidents.Tasks.Required boolean Whether the task is required.
Resilient.Incidents.Tasks.Status string Task status (Open/Closed).

Command Example

!rs-incidents-get-tasks incident-id=1234

Context Example

{
    "Resilient": {
        "Incidents": {
            "Id": "1234",
            "Name": "example",
            "Tasks": [
                {
                    "Category": "Respond",
                    "Creator": "example example",
                    "Form": "data_compromised, determined_date",
                    "ID": 1,
                    "Name": "example",
                    "Required": true,
                    "Status": "Open"
                }
            ]
        }
    }
}

Human Readable Output

Incident 1234 tasks

ID Name Category Form Status DueDate Instructions UserNotes Required Creator
1 example Respond data_compromised, determined_date Open       true example example

rs-add-note

Add a note to an incident.

Base Command

rs-add-note

Input

Argument Name Description Required
incident-id The ID of the incident. Required
note The text of the note. Required

Context Output

Path Type Description
Resilient.IncidentNote.type String The type of the note (incident or task).
Resilient.IncidentNote.id Number The note’s ID.
Resilient.IncidentNote.parent_id Number The ID of the parent note (null for top-level note)..
Resilient.IncidentNote.user_id Number The ID of the user who created the note.
Resilient.IncidentNote.user_fname String The user’s first name.
Resilient.IncidentNote.user_lname String The user’s last name.
Resilient.IncidentNote.text String The note text.
Resilient.IncidentNote.create_date Date The date the note was created.
Resilient.IncidentNote.modify_date Date The date the note was modified.
Resilient.IncidentNote.is_deleted Boolean The flag indicating if the note is deleted. Generally, note objects are removed from the database when the user deletes them. However, if the user deletes a parent note, the parent is just marked as deleted (and its text is cleared).
Resilient.IncidentNote.modify_user.id Number The ID of the user who last modified the note.
Resilient.IncidentNote.modify_user.first_name String The first name of the user who last modified the note.
Resilient.IncidentNote.modify_user.last_name String The last name of the user who last modified the note.
Resilient.IncidentNote.inc_id Number The ID of the incident to which this note belongs.
Resilient.IncidentNote.inc_name String The name of the incident to which this note belongs.
Resilient.IncidentNote.task_id Number The ID of the task to which this note belongs. Will be null on incident notes.
Resilient.IncidentNote.task_name String The name of the task to which this note belongs. Will be null on incident notes.
Resilient.IncidentNote.task_custom Booolean For a task note, whether that task is a custom task. Null for incident notes.
Resilient.IncidentNote.task_members Unknown For a task note, the list of that task’s members, if any. Null for incident notes.
Resilient.IncidentNote.task_at_id Unknown For a task note, whether that task is an automatic task. Null for incident notes and task notes that are not automatically generated.
Resilient.IncidentNote.inc_owner Number The owner of the incident to which this note belongs.
Resilient.IncidentNote.user_name String The name of the owner of the incident to which this note belongs.
Resilient.IncidentNote.modify_principal.id Number The ID of the principal.
Resilient.IncidentNote.modify_principal.type String The type of the principal. Currently only user or group.
Resilient.IncidentNote.modify_principal.name String The name of the principal.
Resilient.IncidentNote.modify_principal.display_name String The display name of the principal.
Resilient.IncidentNote.comment_perms.update Boolean Whether the current user has permission to update this note.
Resilient.IncidentNote.comment_perms.delete Boolean Whether the current user has permission to delete this note.

Command Example

!rs-add-note incident-id=1234 note="This is a note"

Context Example

{
    "Resilient": {
        "incidentNote": {
            "actions": [],
            "children": [],
            "comment_perms": {
                "delete": true,
                "update": true
            },
            "create_date": 1600000000000,
            "id": 10,
            "inc_id": 1234,
            "inc_name": "example",
            "inc_owner": 1,
            "is_deleted": false,
            "mentioned_users": [],
            "modify_date": 1600000000000,
            "modify_principal": {
                "display_name": "example example",
                "id": 1,
                "name": "example@example.com",
                "type": "user"
            },
            "modify_user": {
                "first_name": "example",
                "id": 1,
                "last_name": "example"
            },
            "parent_id": null,
            "task_at_id": null,
            "task_custom": null,
            "task_id": null,
            "task_members": null,
            "task_name": null,
            "text": "<div>This is a note</div>",
            "type": "incident",
            "user_fname": "example",
            "user_id": 1,
            "user_lname": "example",
            "user_name": "example example"
        }
    }
}

Human Readable Output

The note was added successfully to incident 1234

rs-add-artifact

Add an artifact to an incident.

Base Command

rs-add-artifact

Input

Argument Name Description Required
incident-id The ID of the incident. Required
artifact-type The type of the artifact. Possible values are: DNS Name, Email Attachment, Email Attachment Name, Email Body, Email Recipient, Email Sender, Email Sender Name, Email Subject, File Name, File Path, HTTP Request Header, HTTP Response Header, IP Address, Log File, MAC Address, Malware Family/Variant, Malware MD5 Hash, Malware Sample, Malware Sample Fuzzy Hash, Malware SHA-1 Hash, Malware SHA-256 Hash, Mutex, Network CIDR Range, Observed Data, Other File, Password, Port, Process Name, Registry Key, RFC 822 Email Message File, Service, String, System Name, Threat CVE ID, URI Path, URL, URL Referer, User Account, User Agent, X509 Certificate File. Required
artifact-value The value of the artifact. Required
artifact-description The description of the artifact. Optional

Context Output

Path Type Description
Resilient.IncidentArtifact.id Number The ID of the artifact.
Resilient.IncidentArtifact.type Number The type of the artifact.
Resilient.IncidentArtifact.value String The value of the artifact. For example, the IP address for an IP address artifact.
Resilient.IncidentArtifact.description String The description of the artifact.
Resilient.IncidentArtifact.attachment Unknown The files attached to the artifact.
Resilient.IncidentArtifact.parent_id Number The parent artifact ID.
Resilient.IncidentArtifact.creator.id Number The ID of the artifact creator.
Resilient.IncidentArtifact.creator.fname String The first name of the artifact creator.
Resilient.IncidentArtifact.creator.lname String The last name of the artifact creator.
Resilient.IncidentArtifact.creator.display_name String The display name of the artifact creator.
Resilient.IncidentArtifact.creator.status String The status of the artifact creator.
Resilient.IncidentArtifact.creator.email String The email of the artifact creator.
Resilient.IncidentArtifact.creator.phone String The phone number of the artifact creator.
Resilient.IncidentArtifact.creator.cell String The cellphone number of the artifact creator.
Resilient.IncidentArtifact.creator.title String The user’s job title (e.g., Incident Response Manager).
Resilient.IncidentArtifact.creator.locked Boolean The status of the creator’s account. (True if locked. false otherwise).
Resilient.IncidentArtifact.creator.password_changed Boolean Whether the user’s password has changed. (True if changed, false otherwise).
Resilient.IncidentArtifact.creator.is_external Boolean Whether the user’s account is authenticated externally.
Resilient.IncidentArtifact.creator.ui_theme String The UI theme the user has selected. The Resilient UI recognizes the following values (darkmode, lightmode, verydarkmode).
Resilient.IncidentArtifact.inc_id Number The incident ID.
Resilient.IncidentArtifact.inc_name String The incident name.
Resilient.IncidentArtifact.inc_owner Number The incident owner.
Resilient.IncidentArtifact.created Date The date when the artifact is created.
Resilient.IncidentArtifact.last_modified_time Date The last date on which the artifact changed.
Resilient.IncidentArtifact.last_modified_by.id Number The ID of the user who last changed the artifact.
Resilient.IncidentArtifact.last_modified_by.type String The type of user who last changed the artifact.
Resilient.IncidentArtifact.last_modified_by.name String The name of the user who last changed the artifact.
Resilient.IncidentArtifact.last_modified_by.display_name String The display name of the user who last changed the artifact.
Resilient.IncidentArtifact.perms.read Boolean Whether the current user has permission to read this artifact.
Resilient.IncidentArtifact.perms.write Boolean Whether the current user has permission to write to this artifact.
Resilient.IncidentArtifact.perms.delete Boolean Whether the current user has permission to delete this artifact.
Resilient.IncidentArtifact.properties Unknown The additional artifact properties.
Resilient.IncidentArtifact.hash String The hash of the incident.
Resilient.IncidentArtifact.relating Boolean Whether this artifact should be used for relating to other incidents. Null means use the default specified by the type. True means to always relate. False means to never relate.
Resilient.IncidentArtifact.creator_principal.id Number The ID of the principal.
Resilient.IncidentArtifact.creator_principal.type String The type of the principal. Currently only user or group.
Resilient.IncidentArtifact.creator_principal.name String The API name of the principal.
Resilient.IncidentArtifact.creator_principal.display_name String The display name of the principal.
Resilient.IncidentArtifact.ip.source Boolean Whether the IP address is a source.
Resilient.IncidentArtifact.ip.destination Boolean Whether the IP address is a destination.

Command Example

!rs-add-artifact artifact-type="IP Address" artifact-value=1.1.1.1 incident-id=1234 artifact-description="This is a description"

Context Example

{
    "Resilient": {
        "incidentArtifact": {
            "actions": [],
            "attachment": null,
            "created": 1600000000000,
            "creator": {
                "cell": "",
                "display_name": "example example",
                "email": "example@example.com",
                "fname": "example",
                "id": 9,
                "is_external": false,
                "lname": "example",
                "locked": false,
                "password_changed": false,
                "phone": "",
                "status": "A",
                "title": "",
                "ui_theme": "darkmode"
            },
            "creator_principal": {
                "display_name": "example example",
                "id": 1,
                "name": "example@example.com",
                "type": "user"
            },
            "description": "example",
            "hash": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
            "hits": [],
            "id": 1,
            "inc_id": 1234,
            "inc_name": "example",
            "inc_owner": 1,
            "ip": {
                "destination": null,
                "source": null
            },
            "last_modified_by": {
                "display_name": "example example",
                "id": 1,
                "name": "example@example.com",
                "type": "user"
            },
            "last_modified_time": 1600000000000,
            "parent_id": null,
            "pending_sources": [],
            "perms": {
                "delete": true,
                "read": true,
                "write": true
            },
            "properties": null,
            "relating": null,
            "type": 1,
            "value": "1.1.1.1"
        }
    }
}

Human Readable Output

The artifact was added successfully to incident 1234

rs-delete-incidents

Delete multiple incidents.

Base Command

rs-delete-incidents

Input

Argument Name Description Required
incident_ids A comma-separated list of incident IDs to be deleted. Required

Context Output

There is no context output for this command.

rs-list-incident-notes

Gets all of the top-level comments for an incident.

Base Command

rs-list-incident-notes

Input

Argument Name Description Required
incident_id Incident ID to update. Required

Context Output

Path Type Description
Resilient.IncidentNote Dictionary Top-level comments for incident.

rs-update-task

Update an incident’s task fields.

Base Command

rs-update-task

Input

Argument Name Description Required
task_id ID of task to update. Required
name Task name. Technically required, copy original task name if no changes are desired. Required
owner_id User ID of the new owner. Optional
due_date Task due date in ISO format e.g,. “2020-02-02T19:00:00Z. Empty date indicates that the task has no assigned due date. Optional
phase The phase to which this task belongs. Possible values are: Initial, Engage, Detect/Analyze, Respond, Post-Incident, Custom, Complete. Optional
status Changing the status field, completes or re-openes the task. Possible values are: Open, Completed. Optional

Context Output

There is no context output for this command.

rs-add-custom-task

Adds a custom task to the specified incident.

Base Command

rs-add-custom-task

Input

Argument Name Description Required
incident_id ID of incident to add a task to. Required
name Task name. Required
description Task description. Required
instructions Textual instructions for the task. This will override the default instructions for the task. Required
due_date Task due date in ISO format e.g., “2020-02-02T19:00:00Z. Empty date indicates that the task has no assigned due date. Required
owner_id The owner of the task (ID or name as appears in IBM QRadar SOAR). Leave empty if the task has no owner. Optional
phase Task to be added to the IBM QRadar incident. Possible values are: Initial, Engage, Detect/Analyze, Respond, Post-Incident, Custom, Complete. Default is task. Required

Context Output

There is no context output for this command.

rs-delete-task-members

Delete a task’s member. This effectively changes the task from a “private” task to a non-private task (to one where any incident member can operate on it).

Base Command

rs-delete-task-members

Input

Argument Name Description Required
task_id ID of the task to delete its members. Required

Context Output

There is no context output for this command.

rs-list-tasks

Gets an array of open tasks to which the current user is assigned.

Base Command

rs-list-tasks

Input

There are no input arguments for this command.

Context Output

Path Type Description
Resilient.Tasks Dictionary List of open tasks.

rs-list-scripts

Retrieves the specified script’s information or a list of all organization’s scripts.

Base Command

rs-list-scripts

Input

Argument Name Description Required
script_id Internal ID/name of the script. Optional

Context Output

Path Type Description
Resilient.Scripts Dictionary Retrieved script or list of scripts with metadata.

rs-delete-tasks

Deletes a specified list of tasks. Note that only custom tasks can be deleted.

Base Command

rs-delete-tasks

Input

Argument Name Description Required
task_ids A comma-separated list of task IDs to be deleted. Required

Context Output

There is no context output for this command.

rs-list-task-instructions

Lists the task’s instructions.

Base Command

rs-list-task-instructions

Input

Argument Name Description Required
task_id ID of the task to list its instructions. Required

Context Output

Path Type Description
Resilient.Task Dictionary Task instructions.

rs-update-incident-note

Updates an incident’s note.

Base Command

rs-update-incident-note

Input

Argument Name Description Required
incident_id Incident ID to update its note. Required
note_id Note ID to update. Required
note Text of the note. Required

Context Output

There is no context output for this command.

rs-upload-incident-attachment

Upload an attachment for an incident.

Base Command

rs-upload-incident-attachment

Input

Argument Name Description Required
incident_id Incident ID to update. Required
entry_id EntryID of the file to upload. Required

Context Output

There is no context output for this command.

rs-get-task-members

Get the members of a task. Private tasks will have the returned “members” property set. Non-private tasks will have a null “members” property.

Base Command

rs-get-task-members

Input

Argument Name Description Required
task_id ID of task to get its members. Required

Context Output

Path Type Description
Resilient.Task Dictionary Task members.

rs-get-attachment

Gets incident attachment’s name and contents as a file by its ID.

Base Command

rs-get-attachment

Input

Argument Name Description Required
incident_id Incident ID to get attachments from. Required
attachment_id Attachment ID to get. Required

Context Output

There is no context output for this command.

rs-incidents-update-member

Updates incident’s members.

Base Command

rs-incidents-update-member

Input

Argument Name Description Required
incident-id ID of the incident for which to update its members. Required
members A comma-separated list of members to add, e.g., 1,2,3. Required

Context Output

There is no context output for this command.

Configuration parameters

  • server — Server URL (e.g. 192.168.0.1) (required)
  • org — Organization name (required)
  • api_key_id — API key ID
  • api_key_secret — API key secret
  • credentials_api_key — API key ID
  • credentials — Credentials (Deprecated - use API Key authentication instead)
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • incidentType — Incident type
  • incidentFetchInterval — Incidents Fetch Interval
  • isFetch — Fetch incidents
  • fetch_closed — Fetch closed incidents
  • fetch_notes — Fetch notes
  • fetch_tasks — Fetch tasks
  • fetch_time — First fetch timestamp (YYYY-MM-DDTHH:MM:SSZ). For example: 2020-02-02T19:00:00Z
  • max_fetch — Maximum incidents to fetch.
  • mirror_direction — Incident Mirroring Direction
  • close_xsoar_incident — Close Mirrored XSOAR Incidents
  • close_ibm_incident — Close Mirrored IBM Resilient Incidents
  • tag_from_ibm — Tag from IBM Qradar SOAR
  • tag_to_ibm — Tag to IBM QRadar SOAR

Commands (31)

  • get-mapping-fields

    Returns the list of fields to map in outgoing mirroring. This command is only used for debugging purposes.

  • get-modified-remote-data

    Returns the list of incidents IDs that were modified since the last update time. Note that this method is for debugging purposes. The get-modified-remote-data command is used as part of the mirroring feature, which is available from version 6.1.

  • get-remote-data

    Get remote data from a remote incident. This method does not update the current incident, and should be used for debugging purposes only.

  • rs-add-artifact

    Add an artifact to an incident.

  • rs-add-custom-task

    Adds a custom task to the specified incident.

  • rs-add-note

    Add a note to an incident.

  • rs-close-incident

    Closes an incident.

  • rs-create-incident

    Creates an incident.

  • rs-delete-incidents

    Delete multiple incidents.

  • rs-delete-task-members

    Delete a task's member. This effectively changes the task from a "private" task to a non-private task (to one where any incident member can operate on it).

  • rs-delete-tasks

    Deletes a specified list of tasks. Note that only custom tasks can be deleted.

  • rs-get-attachment

    Gets incident attachment's name and contents as a file by its ID.

  • rs-get-incident

    Gets an individual incident by ID.

  • rs-get-task-members

    Get the members of a task. Private tasks will have the returned "members" property set. Non-private tasks will have a null "members" property.

  • rs-get-users

    Gets a list of all users in the system.

  • rs-incident-artifacts

    Gets incident artifacts.

  • rs-incident-attachments

    Gets incident attachments.

  • rs-incidents-get-members

    Gets members of the incident.

  • rs-incidents-get-tasks

    Gets tasks of incidents.

  • rs-incidents-update-member

    Updates the incident's members.

  • rs-list-incident-notes

    Gets all of the top-level comments for an incident.

  • rs-list-scripts

    Retrieves the specified script's information or a list of all organization's scripts.

  • rs-list-task-instructions

    Get the task's instructions.

  • rs-list-tasks

    Gets an array of open tasks to which the current user is assigned.

  • rs-related-incidents

    Gets related incidents.

  • rs-search-incidents

    Query for incidents.

  • rs-update-incident

    Updates incidents.

  • rs-update-incident-note

    Updates an incident's note.

  • rs-update-task

    Update an incident's task fields.

  • rs-upload-incident-attachment

    Upload an attachment for an incident.

  • update-remote-system

    Updates the remote incident with local incident changes. This method is only used for debugging purposes and will not update the current incident.

Source

IBMResilientSystems.py IBMResilientSystems_test.py IBMResilientSystems.yml IBMResilientSystems_description.md command_examples.txt test-requirements.txt
Download History Raw 
category: Case Management
sectionorder:
- Connect
- Collect
provider: IBM
commonfields:
  id: IBM Resilient Systems
  version: -1
configuration:
- display: Server URL (e.g. 192.168.0.1)
  name: server
  required: true
  type: 0
  hidden: false
  section: Connect
- display: Organization name
  name: org
  type: 0
  required: true
  section: Connect
- display: API key ID
  name: api_key_id
  required: false
  type: 4
  hidden: true
  section: Connect
- display: API key secret
  name: api_key_secret
  type: 4
  required: false
  hidden: true
  section: Connect
- display: API key ID
  name: credentials_api_key
  type: 9
  required: false
  displaypassword: API key secret
  section: Connect
- display: Credentials (Deprecated - use API Key authentication instead)
  name: credentials
  type: 9
  required: false
  hiddenusername: true
  hiddenpassword: true
  section: Connect
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
  section: Connect
  advanced: true
- display: 'Use system proxy settings'
  name: proxy
  type: 8
  required: false
  advanced: true
  section: Connect
- display: Incident type
  name: incidentType
  type: 13
  required: false
  section: Connect
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: '1'
  required: false
  type: 19
  section: Collect
  advanced: true
- display: Fetch incidents
  name: isFetch
  type: 8
  required: false
  section: Collect
- display: Fetch closed incidents
  name: fetch_closed
  type: 8
  section: Collect
  required: false
- display: Fetch notes
  name: fetch_notes
  type: 8
  section: Collect

- display: Fetch tasks
  name: fetch_tasks
  type: 8
  section: Collect

- name: fetch_time
  display: 'First fetch timestamp (YYYY-MM-DDTHH:MM:SSZ). For example: 2020-02-02T19:00:00Z'
  type: 0
  required: false
  section: Collect

- name: max_fetch
  display: Maximum incidents to fetch.
  additionalinfo: Maximum number of incidents per fetch. The maximum is 1000.
  defaultvalue: 50
  type: 0
  required: false
  section: Collect

- display: Incident Mirroring Direction
  name: mirror_direction
  section: Collect
  required: false
  type: 15
  options:
  - None
  - In
  - Out
  - Both
  defaultvalue: None
  hidden:
  - marketplacev2
  - platform
  additionalinfo: Cortex XSOAR only parameter.

- display: Close Mirrored XSOAR Incidents
  name: close_xsoar_incident
  type: 8
  section: Collect
  advanced: true
  required: false
  additionalinfo: When selected, closing the IBM Resilient incident with a 'Closed' status, will close the Cortex XSOAR incident.

- display: Close Mirrored IBM Resilient Incidents
  name: close_ibm_incident
  type: 8
  section: Collect
  advanced: true
  required: false
  additionalinfo: When selected, closing the Cortex XSOAR incident will close the incident in IBM Resilient.

- display: Tag from IBM Qradar SOAR
  name: tag_from_ibm
  additionalinfo: Add this tag to an entry to mirror it from IBM Qradar SOAR.
  defaultvalue: 'FROM IBM'
  type: 0
  required: false
  section: Collect
  advanced: true

- display: Tag to IBM QRadar SOAR
  name: tag_to_ibm
  additionalinfo: Add this tag to an entry to mirror it to IBM Qradar SOAR.
  defaultvalue: 'FROM XSOAR'
  type: 0
  required: false
  section: Collect
  advanced: true

description: Case management that enables visibility across your tools for continual IR improvement.
display: IBM Security QRadar SOAR
name: IBM Resilient Systems
script:
  commands:
  - description: Updates the remote incident with local incident changes. This method is only used for debugging purposes and will not update the current incident.
    name: update-remote-system

  - description: Returns the list of fields to map in outgoing mirroring. This command is only used for debugging purposes.
    name: get-mapping-fields

  - arguments:
    - description: The remote incident ID.
      name: id
      required: true
    - name: lastUpdate
      description: The UTC timestamp in seconds of the last update. The incident is only updated if it was modified after the last update time.
      defaultValue: '0'
      required: false

    description: Get remote data from a remote incident. This method does not update the current incident, and should be used for debugging purposes only.
    name: get-remote-data

  - arguments:
    - description: Date string in local time representing the last time the incident was updated. The incident is only returned if it was modified after the last update time.
      name: lastUpdate
    description: Returns the list of incidents IDs that were modified since the last update time. Note that this method is for debugging purposes. The get-modified-remote-data command is used as part of the mirroring feature, which is available from version 6.1.
    name: get-modified-remote-data

  - arguments:
    - description: Indicates the starting point for the first record in the dataset. Starting from 1.
      name: page
      defaultValue: 0
    - description: The maximum number of records to return in the response. Null or less than 1 to return all records, up to the server-configured maximum limit. When greater than 0., an error will be thrown if the length is greater than the server-configured maximum limit.
      name: page_size
      defaultValue: 0
    - name: limit
      defaultValue: 1000
      description: Maximum number of incidents to retrieve.
    - name: severity
      description: Comma-separated list of incident severity, e.g., Low,Medium,High.
    - name: date-created-before
      description: Created date of the incident before the given date in the format YYYY-MM-DDTHH:MM:SSZ, e.g., 2018-05-07T10:59:07Z.
    - name: date-created-after
      description: Created date of the incident after the given date in the format YYYY-MM-DDTHH:MM:SSZ, e.g., 2018-05-07T10:59:07Z.
    - name: date-created-within-the-last
      description: Created date of the incident within the last timeframe (days/hours/minutes). Should be given a number, along with the timeframe argument.
    - name: timeframe
      description: 'Timeframe to search within for incident. Should be given with within-the-last/due-in argument. Possible values: "days", "hours", "minutes".'
      auto: PREDEFINED
      predefined:
      - days
      - hours
      - minutes
    - name: date-occurred-within-the-last
      description: Occurred date of the incident within the last timeframe (days/hours/minutes). Should be given a number, along with the timeframe argument.
    - name: date-occurred-before
      description: Occurred date of the incident before the given date in the format YYYY-MM-DDTHH:MM:SSZ, e.g., 2018-05-07T10:59:07Z.
    - name: date-occurred-after
      description: Occurred date of the incident after the given date in the format YYYY-MM-DDTHH:MM:SSZ, e.g., 2018-05-07T10:59:07Z.
    - name: incident-type
      description: Incident type.
      auto: PREDEFINED
      predefined:
      - CommunicationError
      - DenialOfService
      - ImproperDisposal:DigitalAsset
      - ImproperDisposal:documents/files
      - LostDocuments/files/records
      - LostPC/laptop/tablet
      - LostPDA/smartphone
      - LostStorageDevice/media
      - Malware
      - NotAnIssue
      - Other
      - Phishing
      - StolenDocuments/files/records
      - StolenPC/laptop/tablet
      - StolenPDA/Smartphone
      - StolenStorageDevice/media
      - SystemIntrusion
      - TBD/Unknown
      - Vendor/3rdPartyError
    - name: nist
      auto: PREDEFINED
      description: 'NIST Attack Vectors. Possible values: "Attrition", "E-mail", "External/RemovableMedia", "Impersonation", "ImproperUsage", "Loss/TheftOfEquipment", "Other", "Web".'
      predefined:
      - Attrition
      - E-mail
      - External/RemovableMedia
      - Impersonation
      - ImproperUsage
      - Loss/TheftOfEquipment
      - Other
      - Web
    - name: status
      auto: PREDEFINED
      description: 'Incident status. Possible values: "Active" and "Closed".'
      predefined:
      - Active
      - Closed
    - name: due-in
      description: Due date of the incident in given timeframe (days/hours/minutes). Should be given a number, along with the timeframe argument.
    - name: return_level
      description: The incident data structure returned ("partial", "normal", "full").'
      auto: PREDEFINED
      predefined:
      - partial
      - normal
      - full
    description: Query for incidents.
    name: rs-search-incidents
    outputs:
    - contextPath: Resilient.Incidents.CreateDate
      description: Created date of the incident.
      type: string
    - contextPath: Resilient.Incidents.Name
      description: Incident name.
      type: string
    - contextPath: Resilient.Incidents.Resolution
      description: Incident resolution.
      type: string
    - contextPath: Resilient.Incidents.DiscoveredDate
      description: Discovered date of the incident.
      type: string
    - contextPath: Resilient.Incidents.ResolutionSummary
      description: Incident resolution summary.
      type: string
    - contextPath: Resilient.Incidents.Id
      description: Incident ID.
      type: string
    - contextPath: Resilient.Incidents.Phase
      description: Incident phase.
      type: string
    - contextPath: Resilient.Incidents.PlanStatus
      description: Incident status.
      type: string
    - contextPath: Resilient.Incidents.Severity
      description: Incident severity.
      type: string
    - contextPath: Resilient.Incidents.Description
      description: Incident description.
      type: string
    - contextPath: Resilient.Incidents.Confirmed
      description: Incident confirmation.
      type: boolean
    - contextPath: Resilient.Incidents.NegativePr
      description: Whether negative PR is likely.
      type: boolean
    - contextPath: Resilient.Incidents.DateOccurred
      description: Date incident occurred.
      type: string
    - contextPath: Resilient.Incidents.Reporter
      description: Name of reporting individual.
      type: string
    - contextPath: Resilient.Incidents.NistAttackVectors
      description: Incident NIST attack vectors.
      type: Unknown
    - contextPath: Resilient.Incidents.ExposureType
      description: Incident exposure type.
      type: string
    - contextPath: Resilient.Incidents.ResolutionSummary
      description: Incident resolution summary.
      type: string

  - description: Updates incidents.
    name: rs-update-incident
    arguments:
    - description: Incident ID to update.
      name: incident-id
      required: true
    - auto: PREDEFINED
      description: 'Severity to update. Possible value: "Low", "Medium", and "High".'
      name: severity
      predefined:
      - Low
      - Medium
      - High
    - description: User full name to set as incident owner, e.g., Steve Jobs.
      name: owner
    - auto: PREDEFINED
      description: Incident type (added to the current incident types list).
      name: incident-type
      predefined:
      - CommunicationError
      - DenialOfService
      - ImproperDisposal:DigitalAsset
      - ImproperDisposal:documents/files
      - LostDocuments/files/records
      - LostPC/laptop/tablet
      - LostPDA/smartphone
      - LostStorageDevice/media
      - Malware
      - NotAnIssue
      - Other
      - Phishing
      - StolenDocuments/files/records
      - StolenPC/laptop/tablet
      - StolenPDA/Smartphone
      - StolenStorageDevice/media
      - SystemIntrusion
      - TBD/Unknown
      - Vendor/3rdPartyError
    - auto: PREDEFINED
      description: 'Incident resolution. Possible value: "Unresolved", "Duplicate", "NotAnIssue", and "Resolved".'
      name: resolution
      predefined:
      - Unresolved
      - Duplicate
      - NotAnIssue
      - Resolved
    - description: Incident resolution summary.
      name: resolution-summary
    - description: Incident description.
      name: description
    - description: Incident name.
      name: name
    - auto: PREDEFINED
      description: 'NIST Attack Vectors (added to the current list of NIST attack vectors). Possible values: "Attrition", "E-mail", "External/RemovableMedia", "Impersonation", "ImproperUsage", "Loss/TheftOfEquipment", "Other", "Web".'
      name: nist
      predefined:
      - Attrition
      - E-mail
      - External/RemovableMedia
      - Impersonation
      - ImproperUsage
      - Loss/TheftOfEquipment
      - Other
      - Web
    - description: 'A JSON object of the form: {field_name: new_field_value}. For example: `{"description": {"textarea": {"format": "html", "content": "The new description"}}, "name": {"text": "The new name"}}`. The name should be the path to it in the incident separated by "." For example: `{"properties.incident_summary": {"text": "The new name"}}". Because of API limitations we currently support only fields of the following types: ID, list of IDS, Number, Boolean, Text, Data, Textarea. For more information, refer to https://xsoar.pan.dev/docs/reference/integrations/ibm-resilient-systems. In case of conflicts between the other-fields argument and the regular fields arguments, the other-fields value will be used.'
      name: other-fields

  - arguments:
    - description: Incident ID to get members of.
      name: incident-id
      required: true
    description: Gets members of the incident.
    name: rs-incidents-get-members
    outputs:
    - contextPath: Resilient.Incidents.ID
      description: Incident ID.
      type: string
    - contextPath: Resilient.Incidents.Members.FirstName
      description: Member's first name.
      type: string
    - contextPath: Resilient.Incidents.Members.LastName
      description: Member's last name.
      type: string
    - contextPath: Resilient.Incidents.Members.ID
      description: Member's ID.
      type: number
    - contextPath: Resilient.Incidents.Members.Email
      description: Member's email address.
      type: string

  - arguments:
    - description: ID of incident to get.
      name: incident-id
      required: true
    description: Gets an individual incident by ID.
    name: rs-get-incident
    outputs:
    - contextPath: Resilient.Incidents.CreateDate
      description: Created date of the incident.
      type: string
    - contextPath: Resilient.Incidents.Name
      description: Incident name.
      type: string
    - contextPath: Resilient.Incidents.Resolution
      description: Incident resolution.
      type: string
    - contextPath: Resilient.Incidents.DiscoveredDate
      description: Discovered date of the incident.
      type: string
    - contextPath: Resilient.Incidents.ResolutionSummary
      description: Incident resolution summary.
      type: string
    - contextPath: Resilient.Incidents.Id
      description: Incident ID.
      type: string
    - contextPath: Resilient.Incidents.Phase
      description: Incident phase.
      type: string
    - contextPath: Resilient.Incidents.PlanStatus
      description: Incident status.
      type: string
    - contextPath: Resilient.Incidents.Severity
      description: Incident severity.
      type: string
    - contextPath: Resilient.Incidents.Description
      description: Incident description.
      type: string
    - contextPath: Resilient.Incidents.Confirmed
      description: Incident confirmation.
      type: boolean
    - contextPath: Resilient.Incidents.NegativePr
      description: Whether negative PR is likely.
      type: boolean
    - contextPath: Resilient.Incidents.DateOccurred
      description: Date incident occurred.
      type: string
    - contextPath: Resilient.Incidents.Reporter
      description: Name of reporting individual.
      type: string
    - contextPath: Resilient.Incidents.NistAttackVectors
      description: Incident NIST attack vectors.
      type: Unknown
    - contextPath: Resilient.Incidents.ExposureType
      description: Incident exposure type.
      type: string
    - contextPath: Resilient.Incidents.ResolutionSummary
      description: Incident resolution summary.
      type: strin

  - arguments:
    - description: ID of the incident for which to update its members.
      name: incident-id
      required: true
    - description: A comma-separated list of members to add, e.g. 1,2,3.
      name: members
      required: true

    description: Updates the incident's members.
    name: rs-incidents-update-member

  - description: Gets a list of all users in the system.
    name: rs-get-users

  - arguments:
    - description: ID of the incident to close.
      name: incident-id
      required: true
      default: true
    description: Closes an incident.
    name: rs-close-incident

  - arguments:
    - description: Incident name.
      name: name
      required: true
    description: Creates an incident.
    name: rs-create-incident
    outputs:
    - contextPath: Resilient.Incidents.Id
      description: Incident ID.
      type: string
    - contextPath: Resilient.Incidents.Name
      description: Incident name.
      type: string

  - arguments:
    - description: Incident ID to get artifacts of.
      name: incident-id
      required: true
    description: Gets incident artifacts.
    name: rs-incident-artifacts
    outputs:
    - contextPath: Resilient.Incidents.Id
      description: Incident ID.
      type: string
    - contextPath: Resilient.Incidents.Name
      description: Incident name.
      type: string
    - contextPath: Resilient.Incidents.Artifacts.CreatedDate
      description: Artifact created date.
      type: string
    - contextPath: Resilient.Incidents.Artifacts.Creator
      description: Artifact creator.
      type: string
    - contextPath: Resilient.Incidents.Artifacts.Description
      description: Artifact description.
      type: string
    - contextPath: Resilient.Incidents.Artifacts.ID
      description: Artifact ID.
      type: number
    - contextPath: Resilient.Incidents.Artifacts.Type
      description: Artifact type.
      type: string
    - contextPath: Resilient.Incidents.Artifacts.Value
      description: Artifact value.
      type: string
    - contextPath: Resilient.Incidents.Artifacts.Attachments.ContentType
      description: Attachment content type.
      type: string
    - contextPath: Resilient.Incidents.Artifacts.Attachments.CreatedDate
      description: Attachment created date.
      type: string
    - contextPath: Resilient.Incidents.Artifacts.Attachments.Creator
      description: Attachment creator.
      type: string
    - contextPath: Resilient.Incidents.Artifacts.Attachments.ID
      description: Attachment ID.
      type: number
    - contextPath: Resilient.Incidents.Artifacts.Attachments.Name
      description: Attachment name.
      type: string
    - contextPath: Resilient.Incidents.Artifacts.Attachments.Size
      description: Attachment size.
      type: number

  - arguments:
    - description: Incident ID to get attachments from.
      name: incident-id
      required: true
    description: Gets incident attachments.
    name: rs-incident-attachments
    outputs:
    - contextPath: Resilient.Incidents.Id
      description: Incident ID.
      type: string
    - contextPath: Resilient.Incidents.Name
      description: Incident name.
      type: string
    - contextPath: Resilient.Incidents.Owner
      description: Incident owner.
      type: string
    - contextPath: Resilient.Incidents.Attachments.ContentType
      description: Attachment content type.
      type: string
    - contextPath: Resilient.Incidents.Attachments.CreatedDate
      description: Attachment created date.
      type: string
    - contextPath: Resilient.Incidents.Attachments.Creator
      description: Attachment creator.
      type: string
    - contextPath: Resilient.Incidents.Attachments.ID
      description: Attachment ID.
      type: number
    - contextPath: Resilient.Incidents.Attachments.Name
      description: Attachment name.
      type: string
    - contextPath: Resilient.Incidents.Attachments.Size
      description: Attachment size.
      type: number

  - name: rs-get-attachment
    description: Gets incident attachment's name and contents as a file by its ID.
    arguments:
    - description: Incident ID to get attachments from.
      name: incident_id
      required: true
    - description: Attachment ID to get.
      name: attachment_id
      required: true

  - name: rs-related-incidents
    description: Gets related incidents.
    arguments:
    - description: Incident ID to get related incidents of.
      name: incident-id
      required: true
    outputs:
    - contextPath: Resilient.Incidents.Id
      description: Incident ID.
      type: string
    - contextPath: Resilient.Incidents.Related.CreatedDate
      description: Created date of the related incident.
      type: string
    - contextPath: Resilient.Incidents.Related.Name
      description: Name of the related incident.
      type: string
    - contextPath: Resilient.Incidents.Related.ID
      description: ID of the related incident.
      type: number
    - contextPath: Resilient.Incidents.Related.Status
      description: Status (Active/Closed) of the related incident.
      type: string
    - contextPath: Resilient.Incidents.Related.Artifacts.CreatedDate
      description: Created date of the artifact.
      type: string
    - contextPath: Resilient.Incidents.Related.Artifacts.ID
      description: ID of the artifact.
      type: number
    - contextPath: Resilient.Incidents.Related.Artifacts.Creator
      description: Creator of the artifact.
      type: string

  - name: rs-incidents-get-tasks
    description: Gets tasks of incidents.
    arguments:
    - description: Incident ID to get tasks of.
      name: incident-id
      required: true
    outputs:
    - contextPath: Resilient.Incidents.Id
      description: Incident ID.
      type: string
    - contextPath: Resilient.Incidents.Name
      description: Incident name.
      type: string
    - contextPath: Resilient.Incidents.Tasks.Category
      description: Task category.
      type: string
    - contextPath: Resilient.Incidents.Tasks.Creator
      description: Task creator.
      type: string
    - contextPath: Resilient.Incidents.Tasks.DueDate
      description: Task due date.
      type: string
    - contextPath: Resilient.Incidents.Tasks.Form
      description: Task form.
      type: string
    - contextPath: Resilient.Incidents.Tasks.ID
      description: Task ID.
      type: string
    - contextPath: Resilient.Incidents.Tasks.Name
      description: Task name.
      type: string
    - contextPath: Resilient.Incidents.Tasks.Required
      description: Whether the task is required.
      type: boolean
    - contextPath: Resilient.Incidents.Tasks.Status
      description: Task status (Open/Closed).
      type: string

  - name: rs-add-note
    description: Add a note to an incident.
    arguments:
    - description: The ID of the incident.
      name: incident-id
      required: true
    - description: The text of the note.
      name: note
      required: true
    outputs:
    - contextPath: Resilient.IncidentNote.type
      description: The type of the note (incident or task).
      type: String
    - contextPath: Resilient.IncidentNote.id
      description: The note's ID.
      type: Number
    - contextPath: Resilient.IncidentNote.parent_id
      description: The ID of the parent note (null for top-level note)..
      type: Number
    - contextPath: Resilient.IncidentNote.user_id
      description: The ID of the user who created the note.
      type: Number
    - contextPath: Resilient.IncidentNote.user_fname
      description: The user's first name.
      type: String
    - contextPath: Resilient.IncidentNote.user_lname
      description: The user's last name.
      type: String
    - contextPath: Resilient.IncidentNote.text
      description: The note text.
      type: String
    - contextPath: Resilient.IncidentNote.create_date
      description: The date the note was created.
      type: Date
    - contextPath: Resilient.IncidentNote.modify_date
      description: The date the note was modified.
      type: Date
    - contextPath: Resilient.IncidentNote.is_deleted
      description: The flag indicating if the note is deleted. Generally, note objects are removed from the database when the user deletes them. However, if the user deletes a parent note, the parent is just marked as deleted (and its text is cleared).
      type: Boolean
    - contextPath: Resilient.IncidentNote.modify_user.id
      description: The ID of the user who last modified the note.
      type: Number
    - contextPath: Resilient.IncidentNote.modify_user.first_name
      description: The first name of the user who last modified the note.
      type: String
    - contextPath: Resilient.IncidentNote.modify_user.last_name
      description: The last name of the user who last modified the note.
      type: String
    - contextPath: Resilient.IncidentNote.inc_id
      description: The ID of the incident to which this note belongs.
      type: Number
    - contextPath: Resilient.IncidentNote.inc_name
      description: The name of the incident to which this note belongs.
      type: String
    - contextPath: Resilient.IncidentNote.task_id
      description: The ID of the task to which this note belongs. Will be null on incident notes.
      type: Number
    - contextPath: Resilient.IncidentNote.task_name
      description: The name of the task to which this note belongs. Will be null on incident notes.
      type: String
    - contextPath: Resilient.IncidentNote.task_custom
      description: For a task note, whether that task is a custom task. Null for incident notes.
      type: Booolean
    - contextPath: Resilient.IncidentNote.task_members
      description: For a task note, the list of that task's members, if any. Null for incident notes.
      type: Unknown
    - contextPath: Resilient.IncidentNote.task_at_id
      description: For a task note, whether that task is an automatic task. Null for incident notes and task notes that are not automatically generated.
      type: Unknown
    - contextPath: Resilient.IncidentNote.inc_owner
      description: The owner of the incident to which this note belongs.
      type: Number
    - contextPath: Resilient.IncidentNote.user_name
      description: The name of the owner of the incident to which this note belongs.
      type: String
    - contextPath: Resilient.IncidentNote.modify_principal.id
      description: The ID of the principal.
      type: Number
    - contextPath: Resilient.IncidentNote.modify_principal.type
      description: The type of the principal. Currently only user or group.
      type: String
    - contextPath: Resilient.IncidentNote.modify_principal.name
      description: The name of the principal.
      type: String
    - contextPath: Resilient.IncidentNote.modify_principal.display_name
      description: The display name of the principal.
      type: String
    - contextPath: Resilient.IncidentNote.comment_perms.update
      description: Whether the current user has permission to update this note.
      type: Boolean
    - contextPath: Resilient.IncidentNote.comment_perms.delete
      description: Whether the current user has permission to delete this note.
      type: Boolean

  - name: rs-add-artifact
    description: Add an artifact to an incident.
    arguments:
    - description: The ID of the incident.
      name: incident-id
      required: true
    - auto: PREDEFINED
      description: The type of the artifact.
      name: artifact-type
      predefined:
      - DNS Name
      - Email Attachment
      - Email Attachment Name
      - Email Body
      - Email Recipient
      - Email Sender
      - Email Sender Name
      - Email Subject
      - File Name
      - File Path
      - HTTP Request Header
      - HTTP Response Header
      - IP Address
      - Log File
      - MAC Address
      - Malware Family/Variant
      - Malware MD5 Hash
      - Malware Sample
      - Malware Sample Fuzzy Hash
      - Malware SHA-1 Hash
      - Malware SHA-256 Hash
      - Mutex
      - Network CIDR Range
      - Observed Data
      - Other File
      - Password
      - Port
      - Process Name
      - Registry Key
      - RFC 822 Email Message File
      - Service
      - String
      - System Name
      - Threat CVE ID
      - URI Path
      - URL
      - URL Referer
      - User Account
      - User Agent
      - X509 Certificate File
      required: true
    - description: The value of the artifact.
      name: artifact-value
      required: true
    - description: The description of the artifact.
      name: artifact-description
    outputs:
    - contextPath: Resilient.IncidentArtifact.id
      description: The ID of the artifact.
      type: Number
    - contextPath: Resilient.IncidentArtifact.type
      description: The type of the artifact.
      type: Number
    - contextPath: Resilient.IncidentArtifact.value
      description: The value of the artifact. For example, the IP address for an IP address artifact.
      type: String
    - contextPath: Resilient.IncidentArtifact.description
      description: The description of the artifact.
      type: String
    - contextPath: Resilient.IncidentArtifact.attachment
      description: The files attached to the artifact.
      type: Unknown
    - contextPath: Resilient.IncidentArtifact.parent_id
      description: The parent artifact ID.
      type: Number
    - contextPath: Resilient.IncidentArtifact.creator.id
      description: The ID of the artifact creator.
      type: Number
    - contextPath: Resilient.IncidentArtifact.creator.fname
      description: The first name of the artifact creator.
      type: String
    - contextPath: Resilient.IncidentArtifact.creator.lname
      description: The last name of the artifact creator.
      type: String
    - contextPath: Resilient.IncidentArtifact.creator.display_name
      description: The display name of the artifact creator.
      type: String
    - contextPath: Resilient.IncidentArtifact.creator.status
      description: The status of the artifact creator.
      type: String
    - contextPath: Resilient.IncidentArtifact.creator.email
      description: The email of the artifact creator.
      type: String
    - contextPath: Resilient.IncidentArtifact.creator.phone
      description: The phone number of the artifact creator.
      type: String
    - contextPath: Resilient.IncidentArtifact.creator.cell
      description: The cellphone number of the artifact creator.
      type: String
    - contextPath: Resilient.IncidentArtifact.creator.title
      description: The user's job title (e.g., Incident Response Manager).
      type: String
    - contextPath: Resilient.IncidentArtifact.creator.locked
      description: The status of the creator's account. (True if locked. false otherwise).
      type: Boolean
    - contextPath: Resilient.IncidentArtifact.creator.password_changed
      description: Whether the user's password has changed. (True if changed, false otherwise).
      type: Boolean
    - contextPath: Resilient.IncidentArtifact.creator.is_external
      description: Whether the user's account is authenticated externally.
      type: Boolean
    - contextPath: Resilient.IncidentArtifact.creator.ui_theme
      description: The UI theme the user has selected. The Resilient UI recognizes the following values (darkmode, lightmode, verydarkmode).
      type: String
    - contextPath: Resilient.IncidentArtifact.inc_id
      description: The incident ID.
      type: Number
    - contextPath: Resilient.IncidentArtifact.inc_name
      description: The incident name.
      type: String
    - contextPath: Resilient.IncidentArtifact.inc_owner
      description: The incident owner.
      type: Number
    - contextPath: Resilient.IncidentArtifact.created
      description: The date when the artifact is created.
      type: Date
    - contextPath: Resilient.IncidentArtifact.last_modified_time
      description: The last date on which the artifact changed.
      type: Date
    - contextPath: Resilient.IncidentArtifact.last_modified_by.id
      description: The ID of the user who last changed the artifact.
      type: Number
    - contextPath: Resilient.IncidentArtifact.last_modified_by.type
      description: The type of user who last changed the artifact.
      type: String
    - contextPath: Resilient.IncidentArtifact.last_modified_by.name
      description: The name of the user who last changed the artifact.
      type: String
    - contextPath: Resilient.IncidentArtifact.last_modified_by.display_name
      description: The display name of the user who last changed the artifact.
      type: String
    - contextPath: Resilient.IncidentArtifact.perms.read
      description: Whether the current user has permission to read this artifact.
      type: Boolean
    - contextPath: Resilient.IncidentArtifact.perms.write
      description: Whether the current user has permission to write to this artifact.
      type: Boolean
    - contextPath: Resilient.IncidentArtifact.perms.delete
      description: Whether the current user has permission to delete this artifact.
      type: Boolean
    - contextPath: Resilient.IncidentArtifact.properties
      description: The additional artifact properties.
      type: Unknown
    - contextPath: Resilient.IncidentArtifact.hash
      description: The hash of the incident.
      type: String
    - contextPath: Resilient.IncidentArtifact.relating
      description: Whether this artifact should be used for relating to other incidents. Null means use the default specified by the type. True means to always relate. False means to never relate.
      type: Boolean
    - contextPath: Resilient.IncidentArtifact.creator_principal.id
      description: The ID of the principal.
      type: Number
    - contextPath: Resilient.IncidentArtifact.creator_principal.type
      description: The type of the principal. Currently only user or group.
      type: String
    - contextPath: Resilient.IncidentArtifact.creator_principal.name
      description: The API name of the principal.
      type: String
    - contextPath: Resilient.IncidentArtifact.creator_principal.display_name
      description: The display name of the principal.
      type: String
    - contextPath: Resilient.IncidentArtifact.ip.source
      description: Whether the IP address is a source.
      type: Boolean
    - contextPath: Resilient.IncidentArtifact.ip.destination
      description: Whether the IP address is a destination.
      type: Boolean

  - name: rs-list-scripts
    description: Retrieves the specified script's information or a list of all organization's scripts.
    arguments:
    - name: script_id
      description: Internal ID/name of the script.
      required: false
    outputs:
    - contextPath: Resilient.Scripts
      description: Retrieved script or list of scripts with metadata.
      type: Dictionary

  - name: rs-upload-incident-attachment
    description: Upload an attachment for an incident.
    arguments:
    - name: incident_id
      description: Incident ID to update.
      required: true
    - name: entry_id
      description: EntryID of the file to upload.
      required: true

  - name: rs-delete-incidents
    description: Delete multiple incidents.
    arguments:
    - name: incident_ids
      description: A comma-separated list of incident IDs to be deleted.
      required: true
      isArray: true

  - name: rs-list-incident-notes
    description: Gets all of the top-level comments for an incident.
    arguments:
    - name: incident_id
      description: Incident ID to update.
      required: true
    outputs:
    - contextPath: Resilient.IncidentNote
      description: Top-level comments for incident.
      type: Dictionary

  - name: rs-update-incident-note
    description: Updates an incident's note.
    arguments:
    - name: incident_id
      description: Incident ID to update its note.
      required: true
    - name: note_id
      description: Note ID to update.
      required: true
    - name: note
      description: Text of the note.
      required: true

  - name: rs-add-custom-task
    description: Adds a custom task to the specified incident.
    arguments:
    - name: incident_id
      description: ID of incident to add a task to.
      required: true

    - description: Task name.
      name: name
      required: true
      type: shortText

    - description: Task description.
      name: description
      required: true
      type: longText

    - description: Textual instructions for the task. This will override the default instructions for the task.
      name: instructions
      type: longText
      required: true

    - name: due_date
      description: Task due date in ISO format e.g., "2020-02-02T19:00:00Z. Empty date indicates that the task has no assigned due date.
      required: true

    - name: owner_id
      description: The owner of the task (ID or name as appears in IBM QRadar SOAR). Leave empty if the task has no owner.

    - name: phase
      auto: PREDEFINED
      defaultValue: task
      description: Task to be added to the IBM QRadar incident.
      required: true
      predefined:
      - Initial
      - Engage
      - Detect/Analyze
      - Respond
      - Post-Incident
      - Custom
      - Complete

  - name: rs-list-tasks
    description: Gets an array of open tasks to which the current user is assigned.
    outputs:
    - contextPath: Resilient.Tasks
      description: List of open tasks.
      type: Dictionary

  - name: rs-update-task
    description: Update an incident's task fields.
    arguments:
    - name: task_id
      description: ID of task to update.
      required: true
    - name: name
      description: Task name. Technically required, copy original task name if no changes are desired.
      required: true
    - name: owner_id
      description: User ID of the new owner.
    - name: due_date
      description: Task due date in ISO format e.g., "2020-02-02T19:00:00Z. Empty date indicates that the task has no assigned due date.
    - name: phase
      description: The phase to which this task belongs.
      auto: PREDEFINED
      predefined:
      - Initial
      - Engage
      - Detect/Analyze
      - Respond
      - Post-Incident
      - Custom
      - Complete
    - name: status
      description: Changing the status field, completes or re-openes the task.
      auto: PREDEFINED
      predefined:
      - Open
      - Completed

  - name: rs-get-task-members
    description: Get the members of a task. Private tasks will have the returned "members" property set. Non-private tasks will have a null "members" property.
    arguments:
    - name: task_id
      description: A comma-separated list of task IDs to be deleted.
      required: true
    outputs:
    - contextPath: Resilient.Task
      description: Task members.
      type: Dictionary

  - name: rs-delete-tasks
    description: Deletes a specified list of tasks. Note that only custom tasks can be deleted.
    arguments:
    - name: task_ids
      description: A comma-separated list of task IDs to be deleted.
      required: true

  - name: rs-delete-task-members
    description: Delete a task's member. This effectively changes the task from a "private" task to a non-private task (to one where any incident member can operate on it).
    arguments:
    - name: task_id
      description: ID of the task to delete its members.
      required: true

  - name: rs-list-task-instructions
    description: Get the task's instructions.
    arguments:
    - name: task_id
      description: ID of the task to list its instructions.
      required: true
    outputs:
    - contextPath: Resilient.Task
      description: Task instructions.
      type: Dictionary

  dockerimage: demisto/resilient:2.0.0.10133006
  isfetch: true
  runonce: false
  script: '-'
  subtype: python3
  type: python
  ismappable: true
  isremotesyncin: true
  isremotesyncout: true
fromversion: 5.0.0
tests:
- IBM Resilient Systems Test
defaultclassifier: IBM QRadar SOAR - Classifier
defaultmapperin: IBM QRadar SOAR Incoming Mapper
defaultmapperout: IBM QRadar SOAR Outgoing Mapper