Skip to content

Files

Latest commit

 

History

History

fn_calendar_invite

Calendar Invite

Table of Contents


Release Notes

Note: The results payload returned by the Calendar Invite function has changed in 1.1.0. The function now returns the standard results JSON format generated by resilient-lib ResultPayload. See example Outputs in the Calendar Invite Function description below if you have previously created your own workflow that uses the function.

Version Date Notes
1.1.1 7/2023 Update for app host support
1.1.1 2/2021 Update copyright
1.1.0 1/2021 App Host and Proxy Support
1.0.0 9/2018 Initial Release

Overview

Calendar Invitation Function for IBM Security SOAR

screenshot: main

Key Features

fn_calendar_invite function takes the input incident id and retrieves the members and the owner of the incident and their email addresses. The function creates an email and calendar ICS file and sends an email to all incident members using an SMTP server inviting them to a meeting to discuss the incident. Included in the package is an example workflow that uses the fn_calendar_invite function and an example rule for creating the fn_calendar_invite workflow menu item. Both the example workflow and rule are each called “Example: Calendar Invite”.


Requirements

This app supports the IBM Security SOAR Platform and the IBM Cloud Pak for Security.

SOAR platform

The SOAR platform supports two app deployment mechanisms, App Host and integration server.

If deploying to a SOAR platform with an App Host, the requirements are:

  • SOAR platform >= 36.0.5634.
  • The app is in a container-based format (available from the AppExchange as a zip file).

If deploying to a SOAR platform with an integration server, the requirements are:

  • SOAR platform >= 36.0.5634.
  • The app is in the older integration format (available from the AppExchange as a zip file which contains a tar.gz file).
  • Integration server is running resilient_circuits>=30.0.0.
  • If using an API key account, make sure the account provides the following minimum permissions:
    Name Permissions
    Org Data Read
    Function Read
    Incidents Read
    Users Read

The following SOAR platform guides provide additional information:

  • App Host Deployment Guide: provides installation, configuration, and troubleshooting information, including proxy server settings.
  • Integration Server Guide: provides installation, configuration, and troubleshooting information, including proxy server settings.
  • System Administrator Guide: provides the procedure to install, configure and deploy apps.

The above guides are available on the IBM Knowledge Center at ibm.biz/resilient-docs. On this web page, select your SOAR platform version. On the follow-on page, you can find the App Host Deployment Guide or Integration Server Guide by expanding SOAR Apps in the Table of Contents pane. The System Administrator Guide is available by expanding System Administrator.

Cloud Pak for Security

If you are deploying to IBM Cloud Pak for Security, the requirements are:

  • IBM Cloud Pak for Security >= 1.4.
  • Cloud Pak is configured with an App Host.
  • The app is in a container-based format (available from the AppExchange as a zip file).

The following Cloud Pak guides provide additional information:

  • App Host Deployment Guide: provides installation, configuration, and troubleshooting information, including proxy server settings. From the Table of Contents, select Case Management and Orchestration & Automation > Orchestration and Automation Apps.
  • System Administrator Guide: provides information to install, configure, and deploy apps. From the IBM Cloud Pak for Security Knowledge Center table of contents, select Case Management and Orchestration & Automation > System administrator.

These guides are available on the IBM Knowledge Center at ibm.biz/cp4s-docs. From this web page, select your IBM Cloud Pak for Security version. From the version-specific Knowledge Center page, select Case Management and Orchestration & Automation.

Proxy Server

The app supports a proxy server.


Installation

Install

  • To install or uninstall an App or Integration on the SOAR platform, see the documentation at ibm.biz/resilient-docs.
  • To install or uninstall an App on IBM Cloud Pak for Security, see the documentation at ibm.biz/cp4s-docs and follow the instructions above to navigate to Orchestration and Automation.

App Configuration

The following table provides the settings you need to configure the app. These settings are made in the app.config file. See the documentation discussed in the Requirements section for the procedure.

Config Required Example Description
email_username Yes user@example.com Calendar invitation sender email address
email_password Yes xxxx Password of sender's email account
email_nickname Yes Resilient Meeting Organizer Calendar invite sender nickname
email_host Yes smtp.gmail.com Email server
email_port Yes 587 Email server port
http_proxy No http://user:password@x.x.x.x:3128 http proxy
https_proxy No http://user:password@x.x.x.x:3128 https proxy

Function - Calendar Invite

This function sends a meeting invitation via email to the members and owners of an incident along with any additionally specified email recipients.

screenshot: fn-calendar-invite

Inputs:

Name Type Required Example Tooltip
calendar_invite_datetime datetimepicker Yes - -
calendar_invite_description text Yes - Calendar invite meeting description
calendar_invite_extra_email_addr text No - Comma separated list of extra email addresses for invitees who are not already members of the incident
calendar_invite_incident_id number Yes - -
calendar_invite_subject text Yes - Subject for calendar invite email

Outputs:

results = {{
   "version":"1.0",
   "success":true,
   "reason":"None",
   "content":{
      "recipient":[
         "a@a.com",
         "restest@gmail.com"
      ],
      "sender":"Resilient Meeting Organizer <restest@gmail.com>",
      "subject":"My Incident",
      "description":"My Inicdent meeting"
   },
   "raw":"{\"recipient\": [\"a@a.com\", \"restest@gmail.com\"], \"sender\": \"Resilient Meeting Organizer <restest@gmail.com>\", \"subject\": \"My Incident\", \"description\": \"My Incident meeting\"}",
   "inputs":{
      "calendar_invite_incident_id":2151,
      "calendar_invite_datetime":1611291600000,
      "calendar_invite_extra_email_addr":"restest@gmail.com",
      "calendar_invite_subject":"My Incident",
      "calendar_invite_description":"My Incident meeting"
   },
   "metrics":{
      "version":"1.0",
      "package":"fn-calendar-invite",
      "package_version":"1.1.0",
      "host":"MacBook-Pro.local",
      "execution_time_ms":12759,
      "timestamp":"2021-01-08 15:27:01"
   }
}

Example Pre-Process Script:

# Get the Calendar invite input
inputs.calendar_invite_incident_id = incident.id
inputs.calendar_invite_subject = incident.name
# This workflow uses activity fields specified at the rule for the following fields
inputs.calendar_invite_datetime = rule.properties.rule_calendar_date_time
inputs.calendar_invite_description = rule.properties.rule_calendar_description.content
inputs.calendar_invite_extra_email_addr = rule.properties.rule_calendar_extra_email_addr.content

Example Post-Process Script:

# results.content dict contains "recipient", "sender", "subject", body"
content = results.get("content")
r_to = content.get("recipient")
r_from = content.get("sender")
r_subject = content.get("subject")
r_description = content.get("description")

note_text = u"""<p><b>Meeting Invite</b></p>
To: {}<br>
From:{}<br>
Subject: {}<br>
Description: {}""".format(r_to, r_from, r_subject, r_description)

incident.addNote(helper.createRichText(note_text))


Rules

Rule Name Object Workflow Triggered
Example: Calendar Invite incident example_calendar_invite

The Example: Calendar Invite rule

screenshot: fn-calendar-invite

The following activity popup menu appears when then the incident menu rule is activated:

screenshot: fn-calendar-invite


Troubleshooting & Support

Refer to the documentation listed in the Requirements section for troubleshooting information.

For Support

This is a IBM Community provided App. Please search the Community https://ibm.biz/resilientcommunity for assistance.