Just built a custom action script to post high-severity offenses to a Slack war room.

QRadar's built-in notification actions are limited. Needed high-severity offenses to trigger an immediate post in our incident response Slack channel.

Built a custom action script that uses the offense ID from the context. Script fetches offense details via API and formats a clean Slack message. Requires a valid API key and Slack webhook.

```python
#!/opt/qradar/bin/python
# Custom Action Script for Slack
import sys
import json
import requests
from qpylib import qpylib

# Fetch offense details
offense_id = sys.argv[1]
api_url = '/api/siem/offenses/{0}'.format(offense_id)
offense_data = qpylib.REST('GET', api_url)
offense_json = json.loads(offense_data.read())

# Build Slack payload
slack_payload = {
"text": "High Severity Offense Created",
"blocks": [
{
"type": "section",
"text": {
"type": "mrkdwn",
"text": f"*Offense ID:* {offense_json['id']}n*Severity:* {offense_json['severity']}n*Description:* {offense_json['description']}"
}
}
]
}

# Post to Slack webhook
webhook_url = 'YOUR_SLACK_WEBHOOK_URL'
response = requests.post(webhook_url, json=slack_payload)
if response.status_code != 200:
qpylib.log('Failed to post to Slack: ' + str(response.status_code))
```

Deploy to `/opt/qradar/bin/` and configure a rule action to execute it. Now the SOC team sees critical offenses in under 10 seconds. Main pitfall: ensure your appliance has outbound HTTPS access to Slack's API endpoints.

mw