QRadar Deprecated

Deprecated. Use IBM QRadar v2 or IBM QRadar v3 instead.

Analytics & SIEM · IBM QRadar

Configuration parameters

  • server — Server URL (e.g. https://192.168.0.1) (required)
  • credentials — Username
  • token — Authentication token
  • query — Query to fetch offenses
  • offensesPerCall — Number of offenses to pull per API call
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • isFetch — Fetch incidents
  • incidentType — Incident type
  • full_enrich — Full Incident Enrichment
  • enrich_size — Number of addresses to enrich per API call

Commands (26)

  • qr-get-assets Deprecated

    List all assets found in the model

  • qr-get-search Deprecated

    Gets a specific search id and state

  • qr-get-search-results Deprecated

    Gets search results

  • qr-offenses Deprecated

    Gets offenses from QRadar

  • qr-searches Deprecated

    Searches in QRadar

  • qr-update-offense Deprecated

    Update an offense

  • qradar-create-note

    Create a note on an offense

  • qradar-create-reference-set

    Creates a new reference set. If the provided name is already in use, this command will fail

  • qradar-create-reference-set-value

    Add or update a value in a reference set.

  • qradar-delete-reference-set

    Deletes a reference set corresponding to the name provided.

  • qradar-delete-reference-set-value

    Deletes a value in a reference set.

  • qradar-get-asset-by-id

    Retrieves the asset by id

  • qradar-get-assets

    List all assets found in the model

  • qradar-get-closing-reasons

    Get closing reasons

  • qradar-get-domain-by-id

    Retrieves Domain information By ID

  • qradar-get-domains

    Retrieve all Domains

  • qradar-get-note

    Retrieve a note for an offense

  • qradar-get-reference-by-name

    Information about the reference set that had data added or updated. This returns information set but not the contained data. This feature is supported from version 8.1 and upward.

  • qradar-get-search

    Gets a specific search id and status

  • qradar-get-search-results

    Gets search results

  • qradar-offense-by-id

    Gets offense with matching offense ID from qradar

  • qradar-offenses

    Gets offenses from QRadar

  • qradar-searches

    Searches in QRadar using AQL. It is highly recommended to use the playbook 'QRadarFullSearch' instead of this command - it will execute the search, and will return the result.

  • qradar-update-offense

    Update an offense

  • qradar-update-reference-set-value

    Adds or updates a value in a reference set.

  • qradar-upload-indicators

    Uploads indicators from Demisto to Qradar. This command requires Cortex SOAR v5.5 or later.