Calendar Invite

Table of Contents

Release Notes

Note: The results payload returned by the Calendar Invite function has changed in 1.1.0. The function now returns the standard results JSON format generated by resilient-lib ResultPayload. See example Outputs in the Calendar Invite Function description below if you have previously created your own workflow that uses the function.

Version

Date

Notes

1.1.1

7/2023

Update for app host support

1.1.1

2/2021

Update copyright

1.1.0

1/2021

App Host and Proxy Support

1.0.0

9/2018

Initial Release

Overview

Calendar Invitation Function for IBM Security SOAR

screenshot: main

Key Features

fn_calendar_invite function takes the input incident id and retrieves the members and the owner of the incident and their email addresses. The function creates an email and calendar ICS file and sends an email to all incident members using an SMTP server inviting them to a meeting to discuss the incident. Included in the package is an example workflow that uses the fn_calendar_invite function and an example rule for creating the fn_calendar_invite workflow menu item. Both the example workflow and rule are each called “Example: Calendar Invite”.

Requirements

This app supports the IBM Security SOAR Platform and the IBM Cloud Pak for Security.

SOAR platform

The SOAR platform supports two app deployment mechanisms, App Host and integration server.

If deploying to a SOAR platform with an App Host, the requirements are:

  • SOAR platform >= 36.0.5634.

  • The app is in a container-based format (available from the AppExchange as a zip file).

If deploying to a SOAR platform with an integration server, the requirements are:

  • SOAR platform >= 36.0.5634.

  • The app is in the older integration format (available from the AppExchange as a zip file which contains a tar.gz file).

  • Integration server is running resilient_circuits>=30.0.0.

  • If using an API key account, make sure the account provides the following minimum permissions:

    Name

    Permissions

    Org Data

    Read

    Function

    Read

    Incidents

    Read

    Users

    Read

The following SOAR platform guides provide additional information:

  • App Host Deployment Guide: provides installation, configuration, and troubleshooting information, including proxy server settings.

  • Integration Server Guide: provides installation, configuration, and troubleshooting information, including proxy server settings.

  • System Administrator Guide: provides the procedure to install, configure and deploy apps.

The above guides are available on the IBM Knowledge Center at ibm.biz/resilient-docs. On this web page, select your SOAR platform version. On the follow-on page, you can find the App Host Deployment Guide or Integration Server Guide by expanding SOAR Apps in the Table of Contents pane. The System Administrator Guide is available by expanding System Administrator.

Cloud Pak for Security

If you are deploying to IBM Cloud Pak for Security, the requirements are:

  • IBM Cloud Pak for Security >= 1.4.

  • Cloud Pak is configured with an App Host.

  • The app is in a container-based format (available from the AppExchange as a zip file).

The following Cloud Pak guides provide additional information:

  • App Host Deployment Guide: provides installation, configuration, and troubleshooting information, including proxy server settings. From the Table of Contents, select Case Management and Orchestration & Automation > Orchestration and Automation Apps.

  • System Administrator Guide: provides information to install, configure, and deploy apps. From the IBM Cloud Pak for Security Knowledge Center table of contents, select Case Management and Orchestration & Automation > System administrator.

These guides are available on the IBM Knowledge Center at ibm.biz/cp4s-docs. From this web page, select your IBM Cloud Pak for Security version. From the version-specific Knowledge Center page, select Case Management and Orchestration & Automation.

Proxy Server

The app supports a proxy server.

Installation

Install

  • To install or uninstall an App or Integration on the SOAR platform, see the documentation at ibm.biz/resilient-docs.

  • To install or uninstall an App on IBM Cloud Pak for Security, see the documentation at ibm.biz/cp4s-docs and follow the instructions above to navigate to Orchestration and Automation.

App Configuration

The following table provides the settings you need to configure the app. These settings are made in the app.config file. See the documentation discussed in the Requirements section for the procedure.

Config

Required

Example

Description

email_username

Yes

user@example.com

Calendar invitation sender email address

email_password

Yes

xxxx

Password of sender’s email account

email_nickname

Yes

Resilient Meeting Organizer

Calendar invite sender nickname

email_host

Yes

smtp.gmail.com

Email server

email_port

Yes

587

Email server port

http_proxy

No

http://user:password@x.x.x.x:3128

http proxy

https_proxy

No

http://user:password@x.x.x.x:3128

https proxy

Function - Calendar Invite

This function sends a meeting invitation via email to the members and owners of an incident along with any additionally specified email recipients.

screenshot: fn-calendar-invite

Inputs:

Name

Type

Required

Example

Tooltip

calendar_invite_datetime

datetimepicker

Yes

-

-

calendar_invite_description

text

Yes

-

Calendar invite meeting description

calendar_invite_extra_email_addr

text

No

-

Comma separated list of extra email addresses for invitees who are not already members of the incident

calendar_invite_incident_id

number

Yes

-

-

calendar_invite_subject

text

Yes

-

Subject for calendar invite email

Outputs: 

results = {{
   "version":"1.0",
   "success":true,
   "reason":"None",
   "content":{
      "recipient":[
         "a@a.com",
         "restest@gmail.com"
      ],
      "sender":"Resilient Meeting Organizer <restest@gmail.com>",
      "subject":"My Incident",
      "description":"My Inicdent meeting"
   },
   "raw":"{\"recipient\": [\"a@a.com\", \"restest@gmail.com\"], \"sender\": \"Resilient Meeting Organizer <restest@gmail.com>\", \"subject\": \"My Incident\", \"description\": \"My Incident meeting\"}",
   "inputs":{
      "calendar_invite_incident_id":2151,
      "calendar_invite_datetime":1611291600000,
      "calendar_invite_extra_email_addr":"restest@gmail.com",
      "calendar_invite_subject":"My Incident",
      "calendar_invite_description":"My Incident meeting"
   },
   "metrics":{
      "version":"1.0",
      "package":"fn-calendar-invite",
      "package_version":"1.1.0",
      "host":"MacBook-Pro.local",
      "execution_time_ms":12759,
      "timestamp":"2021-01-08 15:27:01"
   }
}

Example Pre-Process Script: 

# Get the Calendar invite input
inputs.calendar_invite_incident_id = incident.id
inputs.calendar_invite_subject = incident.name
# This workflow uses activity fields specified at the rule for the following fields
inputs.calendar_invite_datetime = rule.properties.rule_calendar_date_time
inputs.calendar_invite_description = rule.properties.rule_calendar_description.content
inputs.calendar_invite_extra_email_addr = rule.properties.rule_calendar_extra_email_addr.content

Example Post-Process Script: 

# results.content dict contains "recipient", "sender", "subject", body"
content = results.get("content")
r_to = content.get("recipient")
r_from = content.get("sender")
r_subject = content.get("subject")
r_description = content.get("description")

note_text = u"""<p><b>Meeting Invite</b></p>
To: {}<br>
From:{}<br>
Subject: {}<br>
Description: {}""".format(r_to, r_from, r_subject, r_description)

incident.addNote(helper.createRichText(note_text))

Rules

Rule Name

Object

Workflow Triggered

Example: Calendar Invite

incident

example_calendar_invite

The Example: Calendar Invite rule

screenshot: fn-calendar-invite

The following activity popup menu appears when then the incident menu rule is activated:

screenshot: fn-calendar-invite

Troubleshooting & Support

Refer to the documentation listed in the Requirements section for troubleshooting information.

For Support

This is a IBM Community provided App. Please search the Community https://ibm.biz/resilientcommunity for assistance.