Writing scripts for playbooks

You can write a script from the Scripts tab on the Customization Settings window, or on the Playbook Designer canvas. The scope of a script can be local or global.

Global scripts are available in every playbook. In the playbook library, they are organized by object type. You see only the global scripts whose object type is compatible with the playbook's object type. You can also access global scripts from the Scripts tab on the Customization Settings window.

Local scripts are available only in the playbook. In the playbook library, they are organized under Local Scripts. You cannot access local scripts on the Customization Settings window.

Creating scripts in Customization Settings

To create a global script from the Customization Settings window, follow these steps.

  1. On the Scripts tab, click New Script.
  2. Type a name and description for the script.
  3. In the Object Type field, select the type of object.

    If you select Data Table, you must also select the specific data table.

  4. In the Language field, select Python 3.

    You must write scripts using Python 3. If you are familiar with writing scripts using Python 2, see Python 2 and Python 3 differences.

  5. In the script editor window, code the script as required.

    Start each line by typing the object. For example, type incident. or task. to display the available field values. To see the custom fields, type incident.properties..

  6. Click Run to iteratively test the script.
  7. Click Save & Close when you are finished writing the script.

Creating scripts in Playbook Designer

Data navigator provides an easy-to-use interface for creating and editing playbook scripts in IBM Security® QRadar® SOAR Platform. In the playbook script editor, you can select playbook objects from the Playbook schema window and add them to the script, reducing the need for direct coding in the script editor.

The data navigator is also available in the playbook script editor for function inputs and sub-playbook inputs.

  1. On the SOAR Platform home page, click Playbooks.
  2. Click a playbook to open it on the canvas.
  3. In the library toolbar, click the Scripts () icon.
  4. Click Create Script to open the script editor.
  5. Choose the Script scope. Select Global to have this script available to all playbooks and from the Scripts tab, or Local to have this script available to the playbook only.
  6. Type a name and description for the script.
  7. To use Data Navigator, click View playbook schema to open the Playbook schema panel.
    1. In the Playbook schema pane, locate the object or attribute that you want to add to the script and click the plus (+) icon to add the path to the script editor.

      You can view more information about the object before you add it to the script editor. In the Playbook schema pane, hover the cursor over the data item and click the () icon to view the Details pane.

  8. To manually code the script directly in the playbook script editor, start by typing the object.

    For example, type incident. or task. to display the available field values. To see the custom fields, type incident.properties..

    If you are creating a local script, see Playbook operations for scripts for operations unique to the playbook script.

  9. Click Run to iteratively test the script.
  10. When the script is complete, click Create.