IbmUpdateNote

Use this script to add a note entry in Cortex XSOAR, which will then be mirrored as a note to an IBM QRadar SOAR incident. This script should be run within an incident.

python · IBM Security QRadar SOAR

Source

import demistomock as demisto  # noqa: F401
from CommonServerPython import *  # noqa: F401


def update_note(args: Dict[str, Any]) -> CommandResults:
    note_id = args.get("note_id", "")
    note_body = args.get("note_body", "")
    tags = argToList(args.get("tags", ""))
    remote_incident_id = demisto.incident()["dbotMirrorId"]
    demisto.debug(f"update_note {note_body=} | {remote_incident_id=}")
    response = demisto.executeCommand(
        "rs-update-incident-note", args={"note_id": note_id, "note": note_body, "incident_id": remote_incident_id}
    )
    demisto.debug(f"update_note {response=}")
    return CommandResults(readable_output=note_body, mark_as_note=True, tags=tags or None)


def main():  # pragma: no cover
    try:
        res = update_note(demisto.args())
        return_results(res)

    except Exception as ex:
        return_error(f"Failed to execute IbmUpdateNote. Error: {ex!s}")


if __name__ in ["__builtin__", "builtins", "__main__"]:
    main()

README

Use this script to update a note in an IBM QRadar SOAR incident. This script should be run within an incident.

Script Data

Name	Description
Script Type	python3
Cortex XSOAR Version	6.8.0

Dependencies

This script uses the following commands and scripts.

rs-update-incident-note
IBM Resilient Systems

Inputs

Argument Name	Description
note_id	ID of the note to be updated.
note_body	Note body.
tags	The note tag. Use the note entry tag (defined in your instance configuration) to mirror the note to IBM QRadar SOAR.

Outputs

There are no outputs for this script.