Remedy¶

Table of Contents¶

Release Notes
Overview
- Key Features
Requirements
Installation
- Install
- App Configuration
Function - Remedy: Close Incident
Function - Remedy: Create Incident
- Custom Layouts
Data Table - Remedy Linked Incidents Reference Table
Rules
Troubleshooting & Support

Release Notes¶

Version	Date	Notes
1.0.2	07/2024	Converted to Python3
1.0.1	04/2022	Bug fix for use of ‘verify’ app.config parameter
1.0.0	04/2021	Initial Release

Overview¶

Remedy for IBM SOAR

screenshot: main

Remedy for IBM SOAR This integration provides the capability to create new incidents in Remedy from SOAR tasks via the HPD:IncidentInterface_Create form over the REST API. Once the task is complete, this integration also provides the capability to close existing Remedy Incidents.

Key Features¶

Send IBM SOAR Case tasks to Remedy as Incidents
Close Remedy Incidents from IBM SOAR

Requirements¶

This app supports the IBM Security QRadar SOAR Platform and the IBM Security QRadar SOAR for IBM Cloud Pak for Security.

SOAR platform¶

The SOAR platform supports two app deployment mechanisms, Edge Gateway (also known as App Host) and integration server.

If deploying to a SOAR platform with an App Host, the requirements are:

SOAR platform >= 51.0.0.0.9340.
The app is in a container-based format (available from the AppExchange as a zip file).

If deploying to a SOAR platform with an integration server, the requirements are:

SOAR platform >= 51.0.0.0.9340.
The app is in the older integration format (available from the AppExchange as a zip file which contains a tar.gz file).
Integration server is running resilient-circuits>=30.0.0.
If using an API key account, make sure the account provides the following minimum permissions:

Name

Permissions

Org Data

Read

Function

Read

Incidents

Read

Incident Notes

Write

Private Tasks

Read
Resilient-circuits will also require the following permission to run the customize import process.

Name

Permissions

Org Data

Write

Name	Permissions
Org Data	Read
Function	Read
Incidents	Read
Incident Notes	Write
Private Tasks	Read

Name	Permissions
Org Data	Write

The following SOAR platform guides provide additional information:

Edge Gateway Deployment Guide or App Host Deployment Guide: provides installation, configuration, and troubleshooting information, including proxy server settings.
Integration Server Guide: provides installation, configuration, and troubleshooting information, including proxy server settings.
System Administrator Guide: provides the procedure to install, configure and deploy apps.

The above guides are available on the IBM Documentation website at ibm.biz/soar-docs. On this web page, select your SOAR platform version. On the follow-on page, you can find the Edge Gateway Deployment Guide, App Host Deployment Guide, or Integration Server Guide by expanding Apps in the Table of Contents pane. The System Administrator Guide is available by expanding System Administrator.

Cloud Pak for Security¶

If you are deploying to IBM Cloud Pak for Security, the requirements are:

IBM Cloud Pak for Security >= 1.10.15.
Cloud Pak is configured with an Edge Gateway.
The app is in a container-based format (available from the AppExchange as a zip file).

The following Cloud Pak guides provide additional information:

Edge Gateway Deployment Guide or App Host Deployment Guide: provides installation, configuration, and troubleshooting information, including proxy server settings. From the Table of Contents, select Case Management and Orchestration & Automation > Orchestration and Automation Apps.
System Administrator Guide: provides information to install, configure, and deploy apps. From the IBM Cloud Pak for Security IBM Documentation table of contents, select Case Management and Orchestration & Automation > System administrator.

These guides are available on the IBM Documentation website at ibm.biz/cp4s-docs. From this web page, select your IBM Cloud Pak for Security version. From the version-specific IBM Documentation page, select Case Management and Orchestration & Automation.

Proxy Server¶

The app does support a proxy server.

Python Environment¶

Python 3.9, 3.11, and 3.12 are officially supported. When deployed as an app, the app runs on Python 3.11. Additional package dependencies may exist for each of these packages:

resilient-circuits>=30.0.0
resilient-lib>=39.0.0

Installation¶

Install¶

To install or uninstall an App or Integration on the SOAR platform, see the documentation at ibm.biz/soar-docs.
To install or uninstall an App on IBM Cloud Pak for Security, see the documentation at ibm.biz/cp4s-docs and follow the instructions above to navigate to Orchestration and Automation.

App Configuration¶

The following table provides the settings you need to configure the app. These settings are made in the app.config file. See the documentation discussed in the Requirements section for the procedure.

Config	Required	Example	Description
remedy_host	Yes	`<example.domain>`	Hostname or IP for the Remedy instance.
remedy_user	Yes	`<example_user>`	Username to use to authenticate with Remedy.
remedy_password	Yes	`xxx`	Password to use to authenticate with Remedy.
max_datatable_rows	No	`30`	Max number of datatable rows to return from the SOAR API when closing an Incident.
remedy_port	No	`8443`	Port number over which the Remedy REST API is exposed.
verify	No	`true	false
https_proxy	No	`example.domain`	https proxy for request traffic.

Function - Remedy: Close Incident¶

Close an incident ticket in Remedy

Inputs:

Name	Type	Required	Example	Tooltip
`incident_id`	`number`	Yes	`-`	-
`remedy_payload`	`text`	No	`-`	-
`task_id`	`number`	No	`-`	-

Outputs:

NOTE: This example might be in JSON format, but results is a Python Dictionary on the SOAR platform.

results = {
    # TODO: Generate an example of the Function Output within this code block.
    # To get the output of a Function:
    #   1. Run resilient-circuits in DEBUG mode: $ resilient-circuits run --loglevel=DEBUG
    #   2. Invoke the Function in SOAR
    #   3. Gather the results using: $ resilient-sdk codegen -p fn_remedy --gather-results
    #   4. Run docgen again: $ resilient-sdk docgen -p fn_remedy
    # Or simply paste example outputs manually here. Be sure to remove any personal information
}

Example Function Input Script:

# Python 2 compatibility for CP4S 1.6
def mk_str(value, quotes=u'"'):
    if value is None:
        return "null"
    else:
        esc_value = value.replace(u'"', u'\\"')
        if quotes:
            return u'{0}{1}{0}'.format(quotes, esc_value)
        else:
            return esc_value


inputs.task_id = task.id
inputs.incident_id = incident.id

# Use this section to add key, value pairs to send to Remedy
# These values will be added/updated on the target Remedy incident,
# so they must conform with the "HPD:IncidentInterface_Create" schema
payload = """{"Status_Reason": "foo"}"""

inputs.remedy_payload = payload if payload else ''

Example Function Post Process Script:

noteText = "<h5>Remedy Close Incident:</h5>"

if results["success"]:
    if results["content"]["closed"]:
      noteText += "<p>The following incidents were matched in Remedy and successfully closed:</p>"
      for item in results["content"]["closed"]:
        noteText += "<p>    Incident Number {0}, Request ID: {1}</p>".format(item["values"]["Incident Number"], item["values"]["Request ID"])
    if results["content"]["skipped"]:
      noteText += "<p>The following incidents were not able to be closed. Common reasons include that the incident has been previously closed, " \
      "the incident has been deleted, or the payload sent to Remedy was incomplete according to the requirements of your specific system:</p>"
      for item in results["content"]["skipped"]:
        noteText += "<p>    Incident Number {0}, Request ID: {1}</p>".format(item["values"]["Incident Number"], item["values"]["Request ID"])
elif not results["content"]["closed"] and not results["content"]["skipped"]:
  # no sync to remedy, just exit
  noteText = None
else:
  noteText += "<p>Function failed to complete. Reason: {}</p>".format(results.reason)

if noteText:
  richText = helper.createRichText(noteText)
  incident.addNote(richText)

Function - Remedy: Create Incident¶

Create a new incident in Remedy from a Resilient task.

screenshot: fn-remedy-create-incident

Inputs:

Name	Type	Required	Example	Tooltip
`incident_id`	`number`	Yes	`-`	-
`remedy_incident_name`	`text`	No	`-`	-
`remedy_payload`	`text`	No	`-`	-
`task_id`	`number`	No	`-`	-

Outputs:

NOTE: This example might be in JSON format, but results is a Python Dictionary on the SOAR platform.

results = {
    # TODO: Generate an example of the Function Output within this code block.
    # To get the output of a Function:
    #   1. Run resilient-circuits in DEBUG mode: $ resilient-circuits run --loglevel=DEBUG
    #   2. Invoke the Function in SOAR
    #   3. Gather the results using: $ resilient-sdk codegen -p fn_remedy --gather-results
    #   4. Run docgen again: $ resilient-sdk docgen -p fn_remedy
    # Or simply paste example outputs manually here. Be sure to remove any personal information
}

Example Function Input Script:

# Python 2 compatibility for CP4S 1.6
def mk_str(value, quotes=u'"'):
    if value is None:
        return "null"
    else:
        esc_value = value.replace(u'"', u'\\"')
        if quotes:
            return u'{0}{1}{0}'.format(quotes, esc_value)
        else:
            return esc_value


payload = u"""{{ "ApplyTemplate": {},
  "First_Name": {},
  "Last_Name": {},
  "Impact": {},
  "Urgency": {},
  "Service_Type": {},
  "Status": {},
  "Reported Source": {},
  "Description": {},
  "Assigned Support Organization": {},
  "additional_data": {}
}}""".format(mk_str(rule.properties.remedy_template),
  mk_str(rule.properties.remedy_first_name),
  mk_str(rule.properties.remedy_last_name),
  mk_str(rule.properties.remedy_impact),
  mk_str(rule.properties.remedy_urgency),
  mk_str(rule.properties.remedy_service_type),
  mk_str(rule.properties.remedy_status),
  mk_str(rule.properties.remedy_reported_source),
  mk_str(rule.properties.remedy_note),
  mk_str(rule.properties.remedy_support_group),
  rule.properties.remedy_additional_data.content if rule.properties.remedy_additional_data.content else "null"
)

# set inputs
inputs.task_id = task.id 
inputs.incident_id = incident.id
inputs.remedy_incident_name = task.name
inputs.remedy_payload = payload

Example Function Post Process Script:

noteText = "<h5> Remedy Create Incident</h5>"

task_id = task.id
task_name = task.name

if results["success"]:
  noteText += "<p>Successfully sent task {0} \"{1}\" to Remedy as Incident Number {2} (UI name) and Request ID {3} (API name).</p>"\
  "".format(task_id, task_name, \
  results["content"]["values"]["Incident Number"], results["content"]["values"]["Request ID"])
else:
  noteText += "<p>Unable to send task {0} \"{1}\" to Remedy</p>".format(task_id, task_name)
  noteText += "<p>Ensure the activity fields and payload you provide meet the minimum requirements in your system for incident creation and routing."

richText = helper.createRichText(noteText)
incident.addNote(richText)

Custom Layouts¶

Import the Data Tables and Custom Fields like the screenshot below:

Data Table - Remedy Linked Incidents Reference Table¶

screenshot: dt-remedy-linked-incidents-reference-table

API Name:¶

remedy_linked_incidents_reference_table

Columns:¶

Column Name	API Access Name	Type	Tooltip
Extra	`extra`	`textarea`	-
Remedy ID	`remedy_id`	`text`	Request ID of the Remedy form entry
Status	`status`	`textarea`	Last status applied to the Remedy Incident
Task ID	`taskincident_id`	`text`	ID of the Task and its description
Timestamp	`timestamp`	`datetimepicker`	-

Rules¶

Rule Name	Object	Workflow Triggered	Condition
Remedy Close Incident from Task	task	`close_a_remedy_incident_from_task`	`task.status changed_to Closed`
Remedy Create Incident from Task	task	`create_a_remedy_incident_from_task`	`task.status equals Open`

Troubleshooting & Support¶

Refer to the documentation listed in the Requirements section for troubleshooting information.

For Support¶

This is an IBM supported app. Please search ibm.com/mysupport for assistance.