QRadar - Classifier

Classifies QRadar events.

IBM QRadar Classification

Details

ID	`QRadar`
Type	classification
Version	-1
From Version	6.0.0
Default Incident Type	—
Feed	No

Key Type Map

Key	Incident Type
`SIM User Authentication`	Access
`User Login Failure`	Access

Source

classifier-QRadar.json classifier-QRadar_-_Generic_Incoming_Mapper.json

Download History Raw

{
    "id": "QRadar",
    "name": "QRadar - Classifier",
    "type": "classification",
    "description": "Classifies QRadar events.",
    "version": -1,
    "defaultIncidentType": "",
    "transformer": {
        "simple": "categories.[0]",
        "complex": null
    },
    "keyTypeMap": {
        "SIM User Authentication": "Access",
        "User Login Failure": "Access"
    },
    "fromVersion": "6.0.0",
    "supportedModules": [
        "agentix",
        "xsiam"
    ]
}