IbmAddNote

Use this script to add a note entry in Cortex XSOAR, which will then be mirrored as a note to an IBM QRadar SOAR incident. This script should be run within an incident.

python · IBM Security QRadar SOAR

Source

import demistomock as demisto  # noqa: F401
from CommonServerPython import *  # noqa: F401


def add_note(args: Dict[str, Any]) -> CommandResults:
    note_body = args.get("note", "")
    tags = argToList(args.get("tags", ""))
    remote_incident_id = demisto.incident()["dbotMirrorId"]
    demisto.debug(f"add_note {note_body=} | {remote_incident_id=}")
    response = demisto.executeCommand("rs-add-note", args={"note": note_body, "incident-id": remote_incident_id})
    demisto.debug(f"add_note {response=}")
    return CommandResults(readable_output=note_body, mark_as_note=True, tags=tags or None)


def main():  # pragma: no cover
    try:
        res = add_note(demisto.args())
        return_results(res)

    except Exception as ex:
        return_error(f"Failed to execute IbmAddNote. Error: {ex!s}")


if __name__ in ["__builtin__", "builtins", "__main__"]:
    main()

README

Use this script to add a note with a tag (the “Note tag to IBM” defined in the instance configuration) as an entry in Cortex XSOAR, which will then be mirrored as a note to a IBM QRadar SOAR incident. This script should be run within an incident.

Script Data

Name	Description
Script Type	python3
Cortex XSOAR Version	6.8.0

Inputs

Argument Name	Description
note	Note to be added to the IBM QRadar SOAR incident.
tags	The note tag. Use the note entry tag (defined in your instance configuration) to mirror the note to IBM QRadar SOAR.

Outputs

There are no outputs for this script.