IbmUpdateTask

Use this script to add a note entry in Cortex XSOAR, which will then be mirrored as a note to an IBM QRadar SOAR incident. This script should be run within an incident.

python · IBM Security QRadar SOAR

Source

import demistomock as demisto  # noqa: F401
from CommonServerPython import *  # noqa: F401


def update_task(args: Dict[str, Any]) -> CommandResults:
    demisto.debug(f"update_task {args=}")
    results = demisto.executeCommand("rs-update-task", args=args)
    demisto.debug(f"update_task {results=}")

    readable_output = (
        results[0]["HumanReadable"]
        if (isinstance(results, list) and len(results) > 0 and results[0]["HumanReadable"])
        else "Error updating task ID."
    )
    return CommandResults(readable_output=readable_output)


def main():  # pragma: no cover
    try:
        res = update_task(demisto.args())
        return_results(res)

    except Exception as ex:
        return_error(f"Failed to execute IbmUpdateTask. Error: {ex!s}")


if __name__ in ["__builtin__", "builtins", "__main__"]:
    main()

README

Use this script to update an IBM QRadar SOAR incident’s task. This script should be run within an incident.

Script Data

Name Description
Script Type python3
Cortex XSOAR Version 6.8.0

Dependencies

This script uses the following commands and scripts.

  • IBM Resilient Systems
  • rs-update-task

Inputs

Argument Name Description
task_id ID of task to update.
name Task name. Technically required, copy original task name if no changes are desired.
owner_id User ID of the new owner.
due_date Task due date in ISO format e.g. “2020-02-02T19:00:00Z. Empty date indicates that the task has no assigned due date.
phase The phase to which this task belongs.
status Changing the status field, completes or re-openes the task.

Outputs

There are no outputs for this script.