IBM Resilient Systems

Case management that enables visibility across your tools for continual IR improvement.

Case Management · IBM Security QRadar SOAR

Configuration parameters

  • server — Server URL (e.g. 192.168.0.1) (required)
  • org — Organization name (required)
  • api_key_id — API key ID
  • api_key_secret — API key secret
  • credentials_api_key — API key ID
  • credentials — Credentials (Deprecated - use API Key authentication instead)
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • incidentType — Incident type
  • isFetch — Fetch incidents
  • fetch_closed — Fetch closed incidents
  • fetch_notes — Fetch notes
  • fetch_tasks — Fetch tasks
  • fetch_time — First fetch timestamp (YYYY-MM-DDTHH:MM:SSZ). For example: 2020-02-02T19:00:00Z
  • max_fetch — Maximum incidents to fetch.
  • mirror_direction — Incident Mirroring Direction
  • close_xsoar_incident — Close Mirrored XSOAR Incidents
  • close_ibm_incident — Close Mirrored IBM Resilient Incidents
  • tag_from_ibm — Tag from IBM Qradar SOAR
  • tag_to_ibm — Tag to IBM QRadar SOAR

Commands (31)

  • get-mapping-fields

    Returns the list of fields to map in outgoing mirroring. This command is only used for debugging purposes.

  • get-modified-remote-data

    Returns the list of incidents IDs that were modified since the last update time. Note that this method is for debugging purposes. The get-modified-remote-data command is used as part of the mirroring feature, which is available from version 6.1.

  • get-remote-data

    Get remote data from a remote incident. This method does not update the current incident, and should be used for debugging purposes only.

  • rs-add-artifact

    Add an artifact to an incident.

  • rs-add-custom-task

    Adds a custom task to the specified incident.

  • rs-add-note

    Add a note to an incident.

  • rs-close-incident

    Closes an incident.

  • rs-create-incident

    Creates an incident.

  • rs-delete-incidents

    Delete multiple incidents.

  • rs-delete-task-members

    Delete a task's member. This effectively changes the task from a "private" task to a non-private task (to one where any incident member can operate on it).

  • rs-delete-tasks

    Deletes a specified list of tasks. Note that only custom tasks can be deleted.

  • rs-get-attachment

    Gets incident attachment's name and contents as a file by its ID.

  • rs-get-incident

    Gets an individual incident by ID.

  • rs-get-task-members

    Get the members of a task. Private tasks will have the returned "members" property set. Non-private tasks will have a null "members" property.

  • rs-get-users

    Gets a list of all users in the system.

  • rs-incident-artifacts

    Gets incident artifacts.

  • rs-incident-attachments

    Gets incident attachments.

  • rs-incidents-get-members

    Gets members of the incident.

  • rs-incidents-get-tasks

    Gets tasks of incidents.

  • rs-incidents-update-member

    Updates the incident's members.

  • rs-list-incident-notes

    Gets all of the top-level comments for an incident.

  • rs-list-scripts

    Retrieves the specified script's information or a list of all organization's scripts.

  • rs-list-task-instructions

    Get the task's instructions.

  • rs-list-tasks

    Gets an array of open tasks to which the current user is assigned.

  • rs-related-incidents

    Gets related incidents.

  • rs-search-incidents

    Query for incidents.

  • rs-update-incident

    Updates incidents.

  • rs-update-incident-note

    Updates an incident's note.

  • rs-update-task

    Update an incident's task fields.

  • rs-upload-incident-attachment

    Upload an attachment for an incident.

  • update-remote-system

    Updates the remote incident with local incident changes. This method is only used for debugging purposes and will not update the current incident.