Scope of scripts for playbooks

You must use Python 3 to write new scripts in IBM Security® QRadar® SOAR. Scripts that were written in Python 2 still run, but you must use Python 3 to make changes to the script.

For a list of sample Python 3 scripts, see the IBM® Resilient® Github folder for scripts.

Accessing incident data, you can use scripts to add objects, such as tasks, notes, and a row in a data table. A script modifies or acts on the object that triggered the rule or its parent object. For the email message object, it also can modify its associated incident (if there is one).