FortiSOAR Knowledge Base
FortiSOAR: Security Orchestration and Response software provides innovative case management, automation, and orchestration. It pulls together all of an organization's tools, helps unify operations, and reduce alert fatigue, context switching, and the mean time to respond to incidents.
Andy_G
Staff
Staff
Article Id 190634
Description

Issue:

Playbooks with Post-Create and Post-Update triggers fail, after you have upgraded to CyOPs™ 4.12.3 or later, if in the subsequent steps use correlated records. 


Root Cause:

In CyOPs™ 4.12.1 and 4.12.2 the post trigger steps used to fetch related records and therefore the playbooks would work. From CyOPs™ 4.12.3 onwards the post-trigger steps will not fetch related records, since getting relationships data increases the trigger payload significantly if there are too many related records.


Solution

Fix:

You can add a Find Record step after the post-trigger step with True selected in the Include Correlated Records field.

OR 

You can add a Set Variable step after the post-trigger step with the following jinja:

{{ (vars.input.records[0]['@id'] + "?$relationships=true") | fromIRI }}
where vars.input.records[0][‘@id’] has an IRI as a value.


Applicable Version

CyOPs™ 4.12.3 onwards


Contributors