QRadar Deprecated

Deprecated. Use IBM QRadar v2 or IBM QRadar v3 instead.

Analytics & SIEM · IBM QRadar

Details

ID	`QRadar`
Provider	Palo Alto Networks
Category	Analytics & SIEM
From Version	5.5.0
Docker Image	`demisto/python:2.7.18.52566`
Supported Modules	Agentix Cloud Runtime Security Cloud Posture Security XSIAM EDR Cortex Cloud

README

Deprecated. Use IBM QRadar v2 or IBM QRadar v3 instead. This integration was integrated and tested with QRadar v7.3.1 and API versions - 8.0, 8.1, and 9.0. The QRadar integration is deprecated from QRadar v7.3.2 Patch 2. If you're using a later version of QRadar, make sure you use the QRadar v2 integration.

Use the QRadar integration to query offenses and create Cortex XSOAR incidents from the offenses.

For more information about filter syntax, see the IBM support documentation.

QRadar Playbook

After you configure the QRadar integration, you can use the QRadar - Get offense correlations playbook. This playbook identifies and extracts additional information about QRadar offenses.

All correlations relevant to the offense.
Retrieve logs relevant to the correlations. Make sure that in the Should query for the correlations' log task you set the inputs.GetCorrelationLogs parameter to True). The maximum log count is 20.

Troubleshooting Performance Issues

In some cases, you might encounter performance issues when running QRadar AQL queries from Cortex XSOAR. This issue is caused by QRadar API limitations. We recommend that you test the QRadar API performance by running several cURL scripts.

1. Creating a search

Run the following command to use the QRadar API to create a new search.
Save the QUERY ID that is attached to the response for the next step.

curl -H "SEC: <API KEY>" -X POST <QRADAR INSTANCE>/api/ariel/searches?query_expression=<QUERY IN URL SAFE ENCODING>

2. Check if the search status is Complete or Executing

Use the following command to use the QRadar API to check the query status (EXECUTE, COMPLETED, or ERROR).

curl -H "SEC: <API KEY>" -X GET <QRADAR INSTANCE>/api/ariel/searches?<QUERY ID>

Configure QRadar on Cortex XSOAR

Navigate to Settings > Integrations > Servers & Services.
Search for QRadar.

Click Add instance to create and configure a new integration instance.

Name: a textual name for the integration instance.
Server URL (e.g. https://192.168.0.1)
Username
Authentication token
Query to fetch offenses
Number of offenses to pull per API call
Trust any certificate (not secure)
Use system proxy settings
Fetch incidents
Incident type
Full Incident Enrichment - when fetching incidents the integration will limit the number of requests it's sending QRadar. As a side effect, this will make the following fields contain their QRadar ids, and not values: source_address_ids, local_destination_address_ids.
Number of addresses to enrich per API call
Click Test to validate the URLs, token, and connection.

Fetch incidents:

You can apply additional (optional) filters for the fetch-incident query using the Query to fetch offenses integration parameter. For more information on how to use the filter syntax, see the QRadar filter documentation and QRadar offense documentation.

Full Incident Enrichment - Clear this checkbox to disable QRadar offense enrichment performed in fetch-incidents. This might help if you encounter a timeout while fetching new incidents.

Commands

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook. After you successfully execute a command, a DBot message appears in the War Room with the command details.

Get offenses: qradar-offenses
Get an offense by offense ID: qradar-offense-by-id
Search QRadar using AQL: qradar-searches
Get a search ID and state: qradar-get-search
Get search results: qradar-get-search-results
Update an offense: qradar-update-offense
List all assets: qradar-get-assets
Get an asset by the asset ID: qradar-get-asset-by-id
Get the reason an offense was closed: qradar-get-closing-reasons
Create a note for an offense: qradar-create-note
Get a note for an offense: qradar-get-note
Get a reference by the reference name: qradar-get-reference-by-name
Create a reference set: qradar-create-reference-set
Delete a reference set: qradar-delete-reference-set
Create a value in a reference set: qradar-create-reference-set-value
Add or update a value in a reference set: qradar-update-reference-set-value
Delete a value from a reference set: qradar-delete-reference-set-value

1. Get offenses

Gets offenses from QRadar.

Base Command

qradar-offenses

Input

Argument Name	Description	Required
filter	Query to filter offenses. For more information, see the QRadar documenatation.	Optional
fields	If used, will filter all fields except for the specified ones. Use this parameter to specify which fields you would like to get back in the response. Fields that are not named are excluded. Specify subfields in brackets and multiple fields in the same object are separated by commas. The filter uses QRadar's field names. For more information, see the QRadar documentation.	Optional
range	Range of results to return, e.g., 0-20	Optional
headers	Table headers to use the human readable output (if none provided, will show all table headers)	Optional

Context Output

Path	Type	Description
QRadar.Offense.Followup	boolean	Offense followup
QRadar.Offense.ID	number	The ID of the offense
QRadar.Offense.Description	string	The description of the offense
QRadar.Offense.SourceAddress	unknown	The source addresses that are associated with the offense
QRadar.Offense.DestinationAddress	unknown	The local destination addresses that are associated with the offense. If your offense has a remote destination, you will need to use QRadarFullSearch playbook with the following query: SELECT destinationip FROM events WHERE inOffense() GROUP BY destinationip
QRadar.Offense.RemoteDestinationCount	unknown	The remote destination that are associated with the offense. If this value is greater than 0 that means your offense has a remote destination, you will need to use QRadarFullSearch playbook with the following query: SELECT destinationip FROM events WHERE inOffense() GROUP BY destinationip
QRadar.Offense.StartTime	date	The time (ISO) when the offense was started.
QRadar.Offense.EventCount	number	The number of events that are associated with the offense
QRadar.Offense.Magnitude	number	The magnitude of the offense
QRadar.Offense.LastUpdatedTime	date	The time (ISO) when the offense was last updated
QRadar.Offense.OffenseType	string	The offense type (due to API limitations if username and password were not provided, this value will be the id of offense type)

Command Examples

  !qradar-offenses range=0-1 filter="follow_up = false" headers=ID,Magnitude

  !qradar-offenses fields="id,start_time"

Context Example

{
    "QRadar": {
        "Offense": {
            "Followup": false,
            "Description": "Multiple Login Failures for the Same User\n preceded by shachar_test\n containing Failed Login Attempt\n",
            "EventCount": 3,
            "Magnitude": 3,
            "OffenseType": "Username",
            "StartTime": "2018-10-16T13:07:36.245000Z",
            "SourceAddress": [
                "94.188.164.68"
            ],
            "ID": 78,
            "LastUpdatedTime": "2018-10-16T13:07:40.675000Z"
        }
    }
}

Human Readable Output

2. Get an offense by offense ID

Gets the offense with the matching offense ID from QRadar.

Base Command

qradar-offense-by-id

Input

Argument Name	Description	Required
offense_id	Offense ID	Required
filter	Query to filter offenses. For more information, see the QRadar documentation.	Optional
fields	If used, will filter all fields except for the specified ones. Use this parameter to specify which fields you would like to get back in the response. Fields that are not named are excluded. Specify subfields in brackets and multiple fields in the same object are separated by commas. The filter uses QRadar's field names. For more information, see the QRadar documentation.	Optional
headers	Table headers to use the human readable output (if none provided, will show all table headers)	Optional

Context Output

Path	Type	Description
QRadar.Offense.Credibility	number	The credibility of the offense
QRadar.Offense.Relevance	number	The relevance of the offense
QRadar.Offense.Severity	number	The severity of the offense
QRadar.Offense.SourceAddress	unknown	The source addresses that are associated with the offense.
QRadar.Offense.DestinationAddress	unknown	The local destination addresses that are associated with the offense. If your offense has a remote destination, you will need to use QRadarFullSearch playbook with the following query: SELECT destinationip FROM events WHERE inOffense() GROUP BY destinationip
QRadar.Offense.RemoteDestinationCount	unknown	The remote destination that are associated with the offense. If this value is greater than 0 that means your offense has a remote destination, you will need to use QRadarFullSearch playbook with the following query: SELECT destinationip FROM events WHERE inOffense() GROUP BY destinationip
QRadar.Offense.AssignedTo	string	The user the offense is assigned to
QRadar.Offense.StartTime	date	The time (ISO) when the offense started
QRadar.Offense.ID	int	The ID of the offense.
QRadar.Offense.DestinationHostname	unknown	Destination hostname
QRadar.Offense.Description	string	The description of the offense
QRadar.Offense.EventCount	number	The number of events that are associated with the offense.
QRadar.Offense.OffenseSource	string	The source of the offense.
QRadar.Offense.Status	string	The status of the offense ("OPEN", "HIDDEN", or "CLOSED")
QRadar.Offense.Magnitude	number	The magnitude of the offense.
QRadar.Offense.ClosingUser	string	The user that closed the offense
QRadar.Offense.ClosingReason	string	The offense closing reason.
QRadar.Offense.CloseTime	date	The time when the offense was closed.
QRadar.Offense.LastUpdatedTime	date	The time (ISO) when the offense was last updated.
QRadar.Offense.Categories	unknown	Event categories that are associated with the offense.
QRadar.Offense.FlowCount	number	The number of flows that are associated with the offense.
QRadar.Offense.FollowUp	boolean	Offense followup.
QRadar.Offense.OffenseType	string	A number that represents the offense type
QRadar.Offense.Protected	boolean	Is the offense protected

Command Example

!qradar-offense-by-id fields=id,magnitude offense_id=78

!qradar-offense-by-id offense_id=78

Context Example

{
    "QRadar": {
        "Offense": {
            "Followup": false,
            "OffenseSource": "admin",
            "Description": "Multiple Login Failures for the Same User\n preceded by shachar_test\n containing Failed Login Attempt\n",
            "EventCount": 3,
            "Credibility": 3,
            "Status": "OPEN",
            "DestinationHostname": [
                "Net-10-172-192.Net_172_16_0_0"
            ],
            "StartTime": "2018-10-16T13:07:36.245000Z",
            "Protected": false,
            "Magnitude": 3,
            "FlowCount": 0,
            "OffenseType": "Username",
            "SourceAddress": [
                "94.188.164.68"
            ],
            "Relevance": 3,
            "Severity": 7,
            "ID": 78,
            "Categories": [
                "User Login Failure",
                "SIM User Authentication"
            ],
            "LastUpdatedTime": "2018-10-16T13:07:40.675000Z"
        }
    }
}

Human Readable Output

3. Search QRadar using AQLqradar-searches

Searches in QRadar using AQL. It is highly recommended to use the playbook 'QRadarFullSearch' instead of this command - it will execute the search, and will return the result.

Base Command

qradar-searches

Input

Argument Name	Description	Required
query_expression	The query expressions in AQL. For more information, see the Ariel Query Language documentation.	Required
headers	Table headers to use the human readable output (if none provided, will show all table headers)	Optional

Context Output

Path	Type	Description
QRadar.Search.ID	number	Search ID
QRadar.Search.State	string	The state of the search

Command Example

!qradar-searches query_expression="SELECT sourceip AS 'MY Source IPs' FROM events"

Context Example

{
    "QRadar": {
        "Search": {
            "Status": "EXECUTE",
            "ID": "14b1d702-edba-43e7-b01c-36f8da1ed016"
        }
    }
}

Human Readable Output

4. Get a search ID and state

Gets a specific search ID and state.

Base Command

qradar-get-search

Input

Argument Name	Description	Required
search_id	The search ID	Required
headers	Table headers to use the human readable output (if none provided, will show all table headers)	Optional

Context Output

Path	Type	Description
QRadar.Search.ID	number	Search ID
QRadar.Search.State	string	The state of the search

Command Example

!qradar-get-search search_id=14b1d702-edba-43e7-b01c-36f8da1ed016

Context Example

{
    "QRadar": {
        "Search": {
            "Status": "COMPLETED",
            "ID": "14b1d702-edba-43e7-b01c-36f8da1ed016"
        }
    }
}

Human Readable Output

5. Get search results

Gets search results.

Base Command

qradar-get-search-results

Input

Argument Name	Description	Required
search_id	The search ID	Required
range	Range of results to return, e.g., 0-20	Optional
headers	Table headers to use the human readable output (if none provided, will show all table headers)	Optional
output_path	Replaces the default context output path for the query result (QRadar.Search.Result). For example, for `output_path=QRadar.Correlations` the result will be under the key QRadar.Correlations in the context data.	Optional

Context Output

Path	Type	Description
QRadar.Search.Result	unknown	The result of the search

Command Example

!qradar-get-search-results search_id=14b1d702-edba-43e7-b01c-36f8da1ed016 range=0-0

Context Example

{
    "QRadar": {
        "Search": {
            "Result": {
                "events": [
                    {
                        "MY Source IPs": "172.31.25.170"
                    }
                ]
            }
        }
    }
}

Human Readable Output

6. Update an offense

Updates an offense.

Base Command

qradar-update-offense

Input

Argument Name	Description	Required
offense_id	The ID of the offense to update	Required
protected	Set to true to protect the offense	Optional
follow_up	Set to true to set the follow up flag on the offense	Optional
status	The new status for the offense	Optional
closing_reason_name	The name of a closing reason. You must provide a valid closing_reason_name when you close an offense. The default closing_reasons are: (1) False-Positive, Tuned (2) Non-Issues (3) Policy Violation	Optional
assigned_to	A user to assign the offense to	Optional
headers	Table headers	Optional
fields	Use this parameter to specify which fields you would like to get back in the response. Fields that are not named are excluded. Specify subfields in brackets and multiple fields in the same object are separated by commas. For more information, see the QRadar documentation.	Optional

Context Output

Path	Type	Description
QRadar.Offense.Credibility	number	The credibility of the offense
QRadar.Offense.Relevance	number	The relevance of the offense
QRadar.Offense.Severity	number	The severity of the offense
QRadar.Offense.SourceAddress	unknown	The source addresses that are associated with the offense.
QRadar.Offense.DestinationAddress	unknown	The destination addresses that are associated with the offense.
QRadar.Offense.AssignedTo	string	The user the offense is assigned to.
QRadar.Offense.StartTime	date	The time (ISO) when the offense was started.
QRadar.Offense.ID	int	The ID of the offense.
QRadar.Offense.DestinationHostname	unknown	Destination hostname
QRadar.Offense.Description	string	The description of the offense.
QRadar.Offense.EventCount	number	The number of events that are associated with the offense.
QRadar.Offense.OffenseSource	string	The source of the offense.
QRadar.Offense.Status	string	The status of the offense. One of "OPEN", "HIDDEN", or "CLOSED".
QRadar.Offense.Magnitude	number	The magnitude of the offense.
QRadar.Offense.ClosingUser	string	The user that closed the offense
QRadar.Offense.ClosingReason	string	The offense closing reason.
QRadar.Offense.CloseTime	date	The time when the offense was closed.
QRadar.Offense.LastUpdatedTime	date	The time (ISO) when the offense was last updated.
QRadar.Offense.Categories	unknown	Event categories that are associated with the offense.
QRadar.Offense.FlowCount	number	The number of flows that are associated with the offense.
QRadar.Offense.FollowUp	boolean	Offense followup.
QRadar.Offense.OffenseType	string	A number that represents the offense type
QRadar.Offense.Protected	boolean	Is the offense protected

Command Example

!qradar-update-offense offense_id=78 protected=false

Context Example

{
    "QRadar": {
        "Offense": {
            "Followup": false,
            "OffenseSource": "admin",
            "Description": "Multiple Login Failures for the Same User\n preceded by shachar_test\n containing Failed Login Attempt\n",
            "EventCount": 3,
            "Credibility": 3,
            "Status": "OPEN",
            "DestinationHostname": [
                "Net-10-172-192.Net_172_16_0_0"
            ],
            "StartTime": "2018-10-16T13:07:36.245000Z",
            "Protected": false,
            "Magnitude": 3,
            "FlowCount": 0,
            "OffenseType": "Username",
            "SourceAddress": [
                "94.188.164.68"
            ],
            "Relevance": 3,
            "Severity": 7,
            "ID": 78,
            "Categories": [
                "User Login Failure",
                "SIM User Authentication"
            ],
            "LastUpdatedTime": "2018-10-16T13:07:40.675000Z"
        }
    }
}

Human Readable Output

7. List all assets

List all assets found in the model.

Base Command

qradar-get-assets

Input

Argument Name	Description	Required
filter	Query to filter assets. For more information, see the QRadar documentation.	Optional
fields	If used, will filter all fields except for the specified ones. Use this parameter to specify which fields you would like to get back in the response. Fields that are not named are excluded. Specify subfields in brackets and multiple fields in the same object are separated by commas. The filter uses QRadar's field names. For more information, see the QRadar documentation.	Optional
range	Range of results to return. e.g.: 0-20	Optional
headers	Table headers to use the human readable output (if none provided, will show all table headers)	Optional

Context Output

Path	Type	Description
QRadar.Assets.ID	number	The ID of the asset
Endpoint.IPAddress	unknown	IP address of the asset
QRadar.Assets.Name.Value	string	Name of the asset
Endpoint.OS	number	Asset OS
QRadar.Assets.AggregatedCVSSScore.Value	number	CVSSScore
QRadar.Assets.AggregatedCVSSScore.LastUser	string	Last user who updated the Aggregated CVSS Score
QRadar.Assets.Weight.Value	number	Asset weight
QRadar.Assets.Weight.LastUser	string	Last user who updated the weight
QRadar.Assets.Name.LastUser	string	Last user who updated the name

Command Example

!qradar-get-assets range=0-1

Context Example

{
    "QRadar": {
        "Asset": {
            "AggregatedCVSSScore": {
                "LastUser": "USER:admin",
                "Value": "h"
            },
            "ID": 1001,
            "Weight": {
                "LastUser": "USER:admin",
                "Value": "10"
            },
            "Name": {
                "LastUser": "USER:admin",
                "Value": "Test"
            }
        }
    },
    "Endpoint": {
        "OS": "80345",
        "IPAddress": [
            "10.0.0.1",
            "10.0.0.2"
        ]
    }
}

Human Readable Output

8. Get an asset by the asset ID

Retrieves the asset by ID.

Base Command

qradar-get-asset-by-id

Input

Argument Name	Description	Required
asset_id	The ID of the requested asset.	Required

Context Output

Path	Type	Description
QRadar.Assets.ID	number	The ID of the asset.
Endpoint.MACAddress	unknown	Asset MAC address.
Endpoint.IPAddress	unknown	It's in ip_addresses - value
QRadar.Assets.ComplianceNotes.Value	string	Compliance notes
QRadar.Assets.CompliancePlan.Value	string	Compliance plan
QRadar.Assets.CollateralDamagePotential.Value	unknown	Collateral damage potential
QRadar.Assets.AggregatedCVSSScore.Value	number	CVSSScore
QRadar.Assets.Name.Value	string	Name of the asset
QRadar.Assets.GroupName	string	Name of the asset's group
Endpoint.Domain	unknown	DNS name
Endpoint.OS	unknown	Asset OS
QRadar.Assets.Weight.Value	number	Asset weight
QRadar.Assets.Vulnerabilities.Value	unknown	Vulnerabilities
QRadar.Assets.Location	string	Location.
QRadar.Assets.Description	string	The asset description.
QRadar.Assets.SwitchID	number	Switch ID
QRadar.Assets.SwitchPort	number	Switch port.
QRadar.Assets.Name.LastUser	string	Last user who updated the name
QRadar.Assets.AggregatedCVSSScore.LastUser	string	Last user who updated the Aggregated CVSS Score
QRadar.Assets.Weight.LastUser	string	Last user who updated the weight
QRadar.Assets.ComplianceNotes.LastUser	string	Last user who updated the compliance notes
QRadar.Assets.CompliancePlan.LastUser	string	Last user who updated the compliance plan
QRadar.Assets.CollateralDamagePotential.LastUser	string	Last user who updated the collateral damage potential
QRadar.Assets.Vulnerabilities.LastUser	string	Last user who updated the vulnerabilities

Command Example

!qradar-get-asset-by-id asset_id=1001

Context Example

{
    "QRadar": {
        "Asset": {
            "Name": {
                "LastUser": "USER:admin",
                "Value": "Test"
            },
            "Weight": {
                "LastUser": "USER:admin",
                "Value": "10"
            },
            "SwitchPort": {
                "LastUser": "USER:admin",
                "Value": "1"
            },
            "SwitchID": {
                "LastUser": "USER:admin",
                "Value": "1"
            },
            "AggregatedCVSSScore": {
                "LastUser": "USER:admin",
                "Value": "h"
            },
            "Location": {
                "LastUser": "USER:admin",
                "Value": "Israel"
            },
            "CompliancePlan": {
                "LastUser": "USER:admin",
                "Value": "Correction Plan"
            },
            "ID": 1001,
            "ComplianceNotes": {
                "LastUser": "USER:admin",
                "Value": "some notes"
            }
        }
    },
    "Endpoint": [
        {
            "OS": "80345",
            "IPAddress": [
                "10.0.0.1",
                "10.0.0.2"
            ]
        },
        {
            "MACAddress": [
                "Unknown NIC"
            ],
            "OS": "80345",
            "IPAddress": [
                "10.0.0.1",
                "10.0.0.2"
            ]
        }
    ]

Human Readable Output

9. Get the reason an offense was closed

Get closing reasons.

Base Command

qradar-get-closing-reasons

Input

Argument Name	Description	Required
include_reserved	If true, reserved closing reasons are included in the response	Optional
include_deleted	If true, deleted closing reasons are included in the response	Optional
filter	Query to filter results. For more information, see the QRadar documentation.	Optional
fields	If used, will filter all fields except for the specified ones. Use this parameter to specify which fields you would like to get back in the response. Fields that are not named are excluded. Specify subfields in brackets and multiple fields in the same object are separated by commas. The filter uses QRadar's field names. For more information, see the QRadar documentation.	Optional
range	Range of results to return. e.g.: 0-20	Optional

Context Output

Path	Type	Description
QRadar.Offense.ClosingReasons.ID	number	Closing reason ID
QRadar.Offense.ClosingReasons.Name	string	Closing reason name

Command Example

!qradar-get-closing-reasons include_reserved=false

Context Example

{
    "QRadar": {
        "Offense": {
            "ClosingReasons": [
                {
                    "IsReserved": false,
                    "ID": 2,
                    "IsDeleted": false,
                    "Name": "False-Positive, Tuned"
                },
                {
                    "IsReserved": false,
                    "ID": 1,
                    "IsDeleted": false,
                    "Name": "Non-Issue"
                },
                {
                    "IsReserved": false,
                    "ID": 3,
                    "IsDeleted": false,
                    "Name": "Policy Violation"
                },
                {
                    "IsReserved": false,
                    "ID": 54,
                    "IsDeleted": false,
                    "Name": "Duplicate"
                }
            ]
        }
    }
}

Human Readable Output

10. Create a note for an offense

Creates a note on an offense.

Base Command

qradar-create-note

Input

Argument Name	Description	Required
offense_id	The offense ID to add the note to	Required
note_text	The note text	Required
fields	If used, will filter all fields except for the specified ones. Use this parameter to specify which fields you would like to get back in the response. Fields that are not named are excluded. Specify subfields in brackets and multiple fields in the same object are separated by commas. The filter uses QRadar's field names. For more information, see the QRadar documentation.	Optional
headers	Table headers to use the human readable output (if none provided, will show all table headers)	Optional

Context Output

Path	Type	Description
QRadar.Note.ID	number	Note ID
QRadar.Note.Text	string	Note text
QRadar.Note.CreateTime	date	The creation time of the note
QRadar.Note.CreatedBy	string	The user who created the note

Command Example

!qradar-create-note offense_id=78 note_text="Demisto has the best documentation!"

Context Example

{
    "QRadar": {
        "Note": {
            "Text": "Demisto has the best documentation!",
            "CreateTime": "2018-10-29T13:26:57.579000Z",
            "CreatedBy": "API_user: admin",
            "ID": 190
        }
    }
}

Human Readable Output

11. Get a note for an offense

Retrieve a note for an offense.

Base Command

qradar-get-note

Input

Argument Name	Description	Required
offense_id	The offense ID to retrieve the note from	Required
note_id	The note ID	Optional
fields	If used, will filter all fields except for the specified ones. Use this parameter to specify which fields you would like to get back in the response. Fields that are not named are excluded. Specify subfields in brackets and multiple fields in the same object are separated by commas. The filter uses QRadar's field names. For more information, see the QRadar documentation.	Optional
headers	Table headers to use the human readable output (if none provided, will show all table headers)	Optional

Context Output

Path	Type	Description
QRadar.Note.ID	number	Note ID
QRadar.Note.Text	string	Note text
QRadar.Note.CreateTime	date	The creation time of the note
QRadar.Note.CreatedBy	string	The user who created the note

Command Example

!qradar-get-note offense_id=78 note_id=190 fields=id,create_time

Context Example

{
    "QRadar": {
        "Note": {
            "Text": "Demisto has the best documentation!",
            "CreateTime": "2018-10-29T13:26:57.579000Z",
            "CreatedBy": "API_user: admin",
            "ID": 190
        }
    }
}

Human Readable Output

12. Get a reference by the reference name

Information about the reference set that had data added or updated. This returns information set but not the contained data. This feature is supported from version 8.1 and later.

Base Command

qradar-get-reference-by-name

Input

Argument Name	Description	Required
ref_name	The name of the requested reference.	Required
headers	Table headers to use the human readable output (if not specified, will show all table headers)	Optional
date_value	If true, will try to convert the data values to an ISO-8601 string	Optional

Context Output

Path	Type	Description
QRadar.Reference.Name	string	The name of the reference set
QRadar.Reference.CreationTime	date	The creation time (ISO) of the reference
QRadar.Reference.ElementType	string	Reference element type
QRadar.Reference.NumberOfElements	number	Number of elements
QRadar.Reference.TimeToLive	string	Reference time to live
QRadar.Reference.TimeoutType	string	Reference timeout type (UNKNOWN, FIRST_SEEN, LAST_SEEN)
QRadar.Reference.Data	unknown	Reference set items

Command Example

!qradar-get-reference-by-name ref_name=Date date_value=True

Context Example

{
    "QRadar": {
        "Reference": {
            "Name": "Date",
            "CreationTime": "2018-11-27T11:34:23.110000Z",
            "TimeoutType": "UNKNOWN",
            "ElementType": "DATE",
            "Data": [
                {
                    "Source": "reference data api",
                    "Value": "2018-11-27T11:34:23.000000Z",
                    "LastSeen": "2018-11-27T11:34:59.552000Z",
                    "FirstSeen": "2018-11-27T11:34:59.552000Z"
                }
            ],
            "NumberOfElements": 1
        }
    }
}

Human Readable Output

13. Create a reference set

Creates a new reference set. If the specified name is already in use, the command will fail.

Base Command

qradar-create-reference-set

Input

Argument Name	Description	Required
ref_name	Reference name to be created	Required
element_type	The element type for the values allowed in the reference set. The allowed values are: ALN (alphanumeric), ALNIC (alphanumeric ignore case), IP (IP address), NUM (numeric), PORT (port number) or DATE. Note that date values need to be represented in milliseconds since the Unix Epoch January 1st 1970.	Required
timeout_type	The allowed values are "FIRST_SEEN", LAST_SEEN and UNKNOWN. The default value is UNKNOWN.	Optional
time_to_live	The time to live interval, for example: "1 month" or "5 minutes"	Optional

Context Output

Path	Type	Description
QRadar.Reference.CreationTime	date	Creation time of the reference set
QRadar.Reference.ElementType	string	The element type for the values allowed in the reference set. The allowed values are: ALN (alphanumeric), ALNIC (alphanumeric ignore case), IP (IP address), NUM (numeric), PORT (port number) or DATE.
QRadar.Reference.Name	string	Name of the reference set
QRadar.Reference.NumberOfElements	number	Number of elements in the created reference set.
QRadar.Reference.TimeoutType	string	Timeout type of the reference (FIRST_SEEN, LAST_SEEN and UNKNOWN)

Command Example

!qradar-create-reference-set element_type=DATE ref_name=Date

Context Example

{
    "QRadar": {
        "Reference": {
            "TimeoutType": "UNKNOWN",
            "ElementType": "DATE",
            "CreationTime": "2018-11-27T11:34:23.000000Z",
            "Name": "Date",
            "NumberOfElements": 1
        }
    }
}

Human Readable Output

14. Delete a reference

Deletes a reference set corresponding to the name provided.

Base Command

qradar-delete-reference-set

Input

Argument Name	Description	Required
ref_name	The name of reference set to delete	Required

Context Output

There is no context output for this command.

Command Example

!qradar-delete-reference-set ref_name=Date

Human Readable Output

15. Create a value in a reference set

Creates a value in a reference set.

Base Command

qradar-create-reference-set-value

Input

Argument Name	Description	Required
ref_name	The name of the reference set to add or update a value in	Required
value	The value to add or update in the reference set. Date values must be represented in milliseconds since the Unix Epoch January 1 1970.	Required
source	An indication of where the data originated. The default value is 'reference data api'.	Optional
date_value	If true, will convert the value argument from the date format %Y-%m-%dT%H:%M:%S.%f000Z' (e.g., 2018-11-06T08:56:41.000000Z) to epoch.	Optional

Context Output

Path	Type	Description
QRadar.Reference.Name	string	The name of the reference set
QRadar.Reference.CreationTime	date	The creation time (ISO) of the reference
QRadar.Reference.ElementType	string	Reference element type
QRadar.Reference.NumberOfElements	number	Number of elements
QRadar.Reference.TimeoutType	string	Reference timeout type (UNKNOWN, FIRST_SEEN, LAST_SEEN)

Command Example

These command examples will create the same result in the reference set 'Date'.

The first example provides a value in time string format instead of an epoch value.
Reference set of element type 'DATE' has to be populated with epoch values, however, when the argument date_value is set to True, the integration translates the input to epoch value. So even though the input was provided as a time string, the actual value in the reference set will be populated with the equivalent epoch value.

!qradar-create-reference-set-value ref_name=Date value=2018-11-27T11:34:23.110000Z date_value=True

!qradar-create-reference-set-value ref_name=Date value=1543318463000

Context Example

{
    "QRadar": {
        "Reference": {
            "TimeoutType": "UNKNOWN",
            "ElementType": "DATE",
            "CreationTime": "2018-11-27T11:34:23.110000Z",
            "Name": "Date",
            "NumberOfElements": 1
        }
    }
}

Human Readable Output

16. Add or update a value in a reference set

Adds or updates a value in a reference set.

Base Command

qradar-update-reference-set-value

Input

Argument Name	Description	Required
ref_name	The name of the reference set to add or update a value in.	Required
value	The value to add or update in the reference set. Date values must be represented in milliseconds since the Unix Epoch January 1st 1970.	Required
source	An indication of where the data originated. The default value is 'reference data api'.	Optional
date_value	If true, will convert the value argument from the date format %Y-%m-%dT%H:%M:%S.%f000Z' (e.g., 2018-11-06T08:56:41.000000Z) to epoch.	Optional

Context Output

Path	Type	Description
QRadar.Reference.Name	string	The name of the reference set
QRadar.Reference.CreationTime	date	The creation time (ISO) of the reference
QRadar.Reference.ElementType	string	Reference element type
QRadar.Reference.NumberOfElements	number	Number of elements
QRadar.Reference.TimeoutType	string	Reference timeout type (UNKNOWN, FIRST_SEEN, LAST_SEEN)

Command Example

!qradar-update-reference-set-value ref_name="Documentation Reference" value="Important information" source="Documentation1"

Context Example

{
    "QRadar": {
        "Reference": {
            "TimeoutType": "UNKNOWN",
            "ElementType": "ALN",
            "CreationTime": "2018-11-21T11:42:25.492000Z",
            "Name": "Documentation Reference",
            "NumberOfElements": 1
        }
    }
}

Human Readable Output

17. Delete a value from a reference set

Deletes a value from a reference set.

Base Command

qradar-delete-reference-set-value

Input

Argument Name	Description	Required
ref_name	The name of the reference set to remove a value from	Required
value	The value to remove from the reference set	Required
date_value	If true, will convert the value argument from the date format %Y-%m-%dT%H:%M:%S.%f000Z' (e.g., 2018-11-06T08:56:41.000000Z) to epoch.	Optional

Context Output

Path	Type	Description
QRadar.Reference.Name	string	The name of the reference set
QRadar.Reference.CreationTime	date	The creation time (ISO) of the reference
QRadar.Reference.ElementType	string	Reference element type
QRadar.Reference.NumberOfElements	number	Number of elements
QRadar.Reference.TimeoutType	string	Reference timeout type (UNKNOWN, FIRST_SEEN, LAST_SEEN)

Command Example

These command examples will create the same result in the reference set 'Date'.

!qradar-delete-reference-set-value ref_name=Date value=2018-11-27T11:34:23.000000Z date_value=True

!qradar-delete-reference-set-value ref_name=Date value=1543318463000

Context Example

{
    "QRadar": {
        "Reference": {
            "TimeoutType": "UNKNOWN",
            "ElementType": "DATE",
            "CreationTime": "2018-11-27T11:34:23.110000Z",
            "Name": "Date",
            "NumberOfElements": 0
        }
    }
}

Human Readable Output

Configuration parameters

server — Server URL (e.g. https://192.168.0.1) (required)
credentials — Username
token — Authentication token
query — Query to fetch offenses
offensesPerCall — Number of offenses to pull per API call
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings
isFetch — Fetch incidents
incidentType — Incident type
full_enrich — Full Incident Enrichment
enrich_size — Number of addresses to enrich per API call

Commands (26)

qr-get-assets Deprecated
List all assets found in the model
qr-get-search Deprecated
Gets a specific search id and state
qr-get-search-results Deprecated
Gets search results
qr-offenses Deprecated
Gets offenses from QRadar
qr-searches Deprecated
Searches in QRadar
qr-update-offense Deprecated
Update an offense
qradar-create-note
Create a note on an offense
qradar-create-reference-set
Creates a new reference set. If the provided name is already in use, this command will fail
qradar-create-reference-set-value
Add or update a value in a reference set.
qradar-delete-reference-set
Deletes a reference set corresponding to the name provided.
qradar-delete-reference-set-value
Deletes a value in a reference set.
qradar-get-asset-by-id
Retrieves the asset by id
qradar-get-assets
List all assets found in the model
qradar-get-closing-reasons
Get closing reasons
qradar-get-domain-by-id
Retrieves Domain information By ID
qradar-get-domains
Retrieve all Domains
qradar-get-note
Retrieve a note for an offense
qradar-get-reference-by-name
Information about the reference set that had data added or updated. This returns information set but not the contained data. This feature is supported from version 8.1 and upward.
qradar-get-search
Gets a specific search id and status
qradar-get-search-results
Gets search results
qradar-offense-by-id
Gets offense with matching offense ID from qradar
qradar-offenses
Gets offenses from QRadar
qradar-searches
Searches in QRadar using AQL. It is highly recommended to use the playbook 'QRadarFullSearch' instead of this command - it will execute the search, and will return the result.
qradar-update-offense
Update an offense
qradar-update-reference-set-value
Adds or updates a value in a reference set.
qradar-upload-indicators
Uploads indicators from Demisto to Qradar. This command requires Cortex SOAR v5.5 or later.

Source

QRadar.py QRadar_test.py QRadar.yml QRadar_description.md

Download History Raw

category: Analytics & SIEM
provider: Palo Alto Networks
deprecated: true
commonfields:
  id: QRadar
  version: -1
configuration:
- display: Server URL (e.g. https://192.168.0.1)
  name: server
  required: true
  type: 0
- display: Username
  name: credentials
  type: 9
  required: false
- display: Authentication token
  name: token
  type: 4
  required: false
- display: Query to fetch offenses
  name: query
  type: 0
  required: false
- defaultvalue: '50'
  display: Number of offenses to pull per API call
  name: offensesPerCall
  type: 0
  required: false
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
- display: Fetch incidents
  name: isFetch
  type: 8
  required: false
- display: Incident type
  name: incidentType
  type: 13
  required: false
- defaultvalue: 'true'
  display: Full Incident Enrichment
  name: full_enrich
  type: 8
  required: false
- defaultvalue: '100'
  display: Number of addresses to enrich per API call
  name: enrich_size
  type: 0
  required: false
description: Deprecated. Use IBM QRadar v2 or IBM QRadar v3 instead.
display: IBM QRadar (Deprecated)
name: QRadar
script:
  commands:
  - arguments:
    - description: 'Query to filter offenses. For refernce please consult: https://www.ibm.com/support/knowledgecenter/en/SS42VS_7.3.1/com.ibm.qradar.doc/c_rest_api_filtering.html'
      name: filter
    - description: 'If used, will filter all fields except for the specified ones. Use this parameter to specify which fields you would like to get back in the response. Fields that are not named are excluded. Specify subfields in brackets and multiple fields in the same object are separated by commas. The filter uses QRadar''s field names, for reference please consult: https://www.ibm.com/support/knowledgecenter/SSKMKU/com.ibm.qradar.doc_cloud/9.1--siem-offenses-GET.html'
      name: fields
    - description: 'Range of results to return. e.g.: 0-20'
      name: range
    - description: Table headers to use the human readable output (if none provided, will show all table headers)
      name: headers
    description: Gets offenses from QRadar
    name: qradar-offenses
    outputs:
    - contextPath: QRadar.Offense.Followup
      description: Offense followup.
      type: boolean
    - contextPath: QRadar.Offense.ID
      description: The ID of the offense.
      type: number
    - contextPath: QRadar.Offense.Description
      description: The description of the offense.
      type: string
    - contextPath: QRadar.Offense.SourceAddress
      description: The source addresses that are associated with the offense.
      type: Unknown
    - contextPath: QRadar.Offense.DestinationAddress
      description: The local destination addresses that are associated with the offense. If your offense has a remote destination, you will need to use QRadarFullSearch playbook with the following query - SELECT destinationip FROM events WHERE inOffense(<offenseID>) GROUP BY destinationip
      type: Unknown
    - contextPath: QRadar.Offense.RemoteDestinationCount
      description: The remote destination that are associated with the offesne. If this value is greater than 0 that means your offense has a remote destination, you will need to use QRadarFullSearch playbook with the following query - SELECT destinationip FROM events WHERE inOffense(<offenseID>) GROUP BY destinationip
      type: Unknown
    - contextPath: QRadar.Offense.StartTime
      description: The time (ISO) when the offense was started.
      type: date
    - contextPath: QRadar.Offense.EventCount
      description: The number of events that are associated with the offense.
      type: number
    - contextPath: QRadar.Offense.Magnitude
      description: The magnitude of the offense.
      type: number
    - contextPath: QRadar.Offense.LastUpdatedTime
      description: The time (ISO) when the offense was last updated.
      type: date
    - contextPath: QRadar.Offense.OffenseType
      description: The offense type (due to API limitations if username and password were not provided, this value will be the id of offense type)
      type: string
  - arguments:
    - default: true
      description: Offense ID
      name: offense_id
      required: true
    - description: 'Query to filter offense. For refernce please consult: https://www.ibm.com/support/knowledgecenter/en/SS42VS_7.3.1/com.ibm.qradar.doc/c_rest_api_filtering.html'
      name: filter
    - description: 'If used, will filter all fields except for the specified ones. Use this parameter to specify which fields you would like to get back in the response. Fields that are not named are excluded. Specify subfields in brackets and multiple fields in the same object are separated by commas. The filter uses QRadar''s field names, for reference please consult: https://www.ibm.com/support/knowledgecenter/SSKMKU/com.ibm.qradar.doc_cloud/9.1--siem-offenses-offense_id-GET.html'
      name: fields
    - description: Table headers to use the human readable output (if none provided, will show all table headers)
      name: headers
    description: Gets offense with matching offense ID from qradar
    name: qradar-offense-by-id
    outputs:
    - contextPath: QRadar.Offense.Credibility
      description: The credibility of the offense
      type: number
    - contextPath: QRadar.Offense.Relevance
      description: The relevance of the offense
      type: number
    - contextPath: QRadar.Offense.Severity
      description: The severity of the offense
      type: number
    - contextPath: QRadar.Offense.SourceAddress
      description: The source addresses that are associated with the offense.
      type: Unknown
    - contextPath: QRadar.Offense.DestinationAddress
      description: The local destination addresses that are associated with the offense. If your offense has a remote destination, you will need to use QRadarFullSearch playbook with the following query - SELECT destinationip FROM events WHERE inOffense(<offenseID>) GROUP BY destinationip
      type: Unknown
    - contextPath: QRadar.Offense.RemoteDestinationCount
      description: The remote destination that are associated with the offesne. If this value is greater than 0 that means your offense has a remote destination, you will need to use QRadarFullSearch playbook with the following query - SELECT destinationip FROM events WHERE inOffense(<offenseID>) GROUP BY destinationip
      type: Unknown
    - contextPath: QRadar.Offense.AssignedTo
      description: The user the offense is assigned to.
      type: string
    - contextPath: QRadar.Offense.StartTime
      description: The time (ISO) when the offense was started.
      type: date
    - contextPath: QRadar.Offense.ID
      description: The ID of the offense.
      type: int
    - contextPath: QRadar.Offense.DestinationHostname
      description: Destintion hostname
      type: Unknown
    - contextPath: QRadar.Offense.Description
      description: The description of the offense.
      type: string
    - contextPath: QRadar.Offense.EventCount
      description: The number of events that are associated with the offense.
      type: number
    - contextPath: QRadar.Offense.OffenseSource
      description: The source of the offense.
      type: string
    - contextPath: QRadar.Offense.Status
      description: The status of the offense. One of "OPEN", "HIDDEN", or "CLOSED".
      type: string
    - contextPath: QRadar.Offense.Magnitude
      description: The magnitude of the offense.
      type: number
    - contextPath: QRadar.Offense.ClosingUser
      description: The user that closed the offense
      type: string
    - contextPath: QRadar.Offense.ClosingReason
      description: The offense closing reason.
      type: string
    - contextPath: QRadar.Offense.CloseTime
      description: The time when the offense was closed.
      type: date
    - contextPath: QRadar.Offense.LastUpdatedTime
      description: The time (ISO) when the offense was last updated.
      type: date
    - contextPath: QRadar.Offense.Categories
      description: Event categories that are associated with the offense.
      type: Unknown
    - contextPath: QRadar.Offense.FlowCount
      description: The number of flows that are associated with the offense.
      type: number
    - contextPath: QRadar.Offense.FollowUp
      description: Offense followup.
      type: boolean
    - contextPath: QRadar.Offense.OffenseType
      description: A number that represents the offense type
      type: string
    - contextPath: QRadar.Offense.Protected
      description: Is the offense protected
      type: boolean
  - arguments:
    - default: true
      description: The query expressions in AQL (for more information about Ariel Query Language please review "https://www.ibm.com/support/knowledgecenter/en/SS42VS_7.3.0/com.ibm.qradar.doc/c_aql_intro.html")
      name: query_expression
      required: true
    - description: Table headers to use the human readable output (if none provided, will show all table headers)
      name: headers
    description: Searches in QRadar using AQL. It is highly recommended to use the playbook 'QRadarFullSearch' instead of this command - it will execute the search, and will return the result.
    name: qradar-searches
    outputs:
    - contextPath: QRadar.Search.ID
      description: Search ID
      type: number
    - contextPath: QRadar.Search.Status
      description: The status of the search.
      type: string
  - arguments:
    - default: true
      description: The search id
      name: search_id
      required: true
    - description: Table headers to use the human readable output (if none provided, will show all table headers)
      name: headers
    description: Gets a specific search id and status
    name: qradar-get-search
    outputs:
    - contextPath: QRadar.Search.ID
      description: Search ID
      type: number
    - contextPath: QRadar.Search.Status
      description: The status of the search.
      type: string
  - arguments:
    - default: true
      description: The search id
      name: search_id
      required: true
    - description: 'Range of results to return. e.g.: 0-20'
      name: range
    - description: Table headers to use the human readable output (if none provided, will show all table headers)
      name: headers
    - description: Replaces the default context output path for the query result (QRadar.Search.Result). e.g. for output_path=QRadar.Correlations the result will be under the key "QRadar.Correlations" in the context data.
      name: output_path
    description: Gets search results
    name: qradar-get-search-results
    outputs:
    - contextPath: QRadar.Search.Result
      description: The result of the search
      type: Unknown
  - arguments:
    - default: true
      description: The ID of the offense to update
      name: offense_id
      required: true
    - auto: PREDEFINED
      description: Set to true to protect the offense
      name: protected
      predefined:
      - 'true'
      - 'false'
    - auto: PREDEFINED
      description: Set to true to set the follow up flag on the offense
      name: follow_up
      predefined:
      - 'true'
      - 'false'
    - auto: PREDEFINED
      description: The new status for the offense
      name: status
      predefined:
      - OPEN
      - HIDDEN
      - CLOSED
    - description: 'The id of a closing reason. You must provide a valid closing_reason_name when you close an offense. The default  closing_reasons are: (1) False-Positive, Tuned (2) Non-Issues (3) Policy Violation'
      name: closing_reason_id
    - description: 'The name of a closing reason. You must provide a valid closing_reason_name when you close an offense. The default  closing_reasons are: (1) False-Positive, Tuned (2) Non-Issues (3) Policy Violation'
      name: closing_reason_name
    - description: A user to assign the offense to
      name: assigned_to
    - description: Table headers
      name: headers
    - description: Use this parameter to specify which fields you would like to get back in the response. Fields that are not named are excluded. Specify subfields in brackets and multiple fields in the same object are separated by commas. Please consult - https://www.ibm.com/support/knowledgecenter/SSKMKU/com.ibm.qradar.doc_cloud/9.1--siem-offenses-offense_id-POST.html
      name: fields
    description: Update an offense
    name: qradar-update-offense
    outputs:
    - contextPath: QRadar.Offense.Credibility
      description: The credibility of the offense
      type: number
    - contextPath: QRadar.Offense.Relevance
      description: The relevance of the offense
      type: number
    - contextPath: QRadar.Offense.Severity
      description: The severity of the offense
      type: number
    - contextPath: QRadar.Offense.SourceAddress
      description: The source addresses that are associated with the offense.
      type: Unknown
    - contextPath: QRadar.Offense.DestinationAddress
      description: The destination addresses that are associated with the offense.
      type: Unknown
    - contextPath: QRadar.Offense.AssignedTo
      description: The user the offense is assigned to.
      type: string
    - contextPath: QRadar.Offense.StartTime
      description: The time (ISO) when the offense was started.
      type: date
    - contextPath: QRadar.Offense.ID
      description: The ID of the offense.
      type: int
    - contextPath: QRadar.Offense.DestinationHostname
      description: Destintion hostname
      type: Unknown
    - contextPath: QRadar.Offense.Description
      description: The description of the offense.
      type: string
    - contextPath: QRadar.Offense.EventCount
      description: The number of events that are associated with the offense.
      type: number
    - contextPath: QRadar.Offense.OffenseSource
      description: The source of the offense.
      type: string
    - contextPath: QRadar.Offense.Status
      description: The status of the offense. One of "OPEN", "HIDDEN", or "CLOSED".
      type: string
    - contextPath: QRadar.Offense.Magnitude
      description: The magnitude of the offense.
      type: number
    - contextPath: QRadar.Offense.ClosingUser
      description: The user that closed the offense
      type: string
    - contextPath: QRadar.Offense.ClosingReason
      description: The offense closing reason.
      type: string
    - contextPath: QRadar.Offense.CloseTime
      description: The time when the offense was closed.
      type: date
    - contextPath: QRadar.Offense.LastUpdatedTime
      description: The time (ISO) when the offense was last updated.
      type: date
    - contextPath: QRadar.Offense.Categories
      description: Event categories that are associated with the offense.
      type: Unknown
    - contextPath: QRadar.Offense.FlowCount
      description: The number of flows that are associated with the offense.
      type: number
    - contextPath: QRadar.Offense.FollowUp
      description: Offense followup.
      type: boolean
    - contextPath: QRadar.Offense.OffenseType
      description: A number that represents the offense type
      type: string
    - contextPath: QRadar.Offense.Protected
      description: Is the offense protected
      type: boolean
  - arguments:
    - description: 'Query to filter assets. For refernce please consult: https://www.ibm.com/support/knowledgecenter/en/SS42VS_7.3.1/com.ibm.qradar.doc/c_rest_api_filtering.html'
      name: filter
    - description: 'If used, will filter all fields except for the specified ones. Use this parameter to specify which fields you would like to get back in the response. Fields that are not named are excluded. Specify subfields in brackets and multiple fields in the same object are separated by commas. The filter uses QRadar''s field names, for reference please consult: https://www.ibm.com/support/knowledgecenter/SSKMKU/com.ibm.qradar.doc_cloud/9.1--asset_model-assets-GET.html'
      name: fields
    - description: 'Range of results to return. e.g.: 0-20'
      name: range
    - description: Table headers to use the human readable output (if none provided, will show all table headers)
      name: headers
    description: List all assets found in the model
    name: qradar-get-assets
    outputs:
    - contextPath: QRadar.Assets.ID
      description: The ID of the asset
      type: number
    - contextPath: Endpoint.IPAddress
      description: IP address of the asset
      type: Unknown
    - contextPath: QRadar.Assets.Name.Value
      description: Name of the asset
      type: string
    - contextPath: Endpoint.OS
      description: Asset OS
      type: number
    - contextPath: QRadar.Assets.AggregatedCVSSScore.Value
      description: CVSSScore
      type: number
    - contextPath: QRadar.Assets.AggregatedCVSSScore.LastUser
      description: Last user who updated the Aggregated CVSS Score
      type: string
    - contextPath: QRadar.Assets.Weight.Value
      description: Asset weight
      type: number
    - contextPath: QRadar.Assets.Weight.LastUser
      description: Last user who updated the weight
      type: string
    - contextPath: QRadar.Assets.Name.LastUser
      description: Last user who updated the name
      type: string
  - arguments:
    - default: true
      description: The ID of the requested asset.
      name: asset_id
      required: true
    description: Retrieves the asset by id
    name: qradar-get-asset-by-id
    outputs:
    - contextPath: QRadar.Assets.ID
      description: The ID of the asset.
      type: number
    - contextPath: Endpoint.MACAddress
      description: Asset MAC address.
      type: Unknown
    - contextPath: Endpoint.IPAddress
      description: It's in ip_addresses - value
      type: Unknown
    - contextPath: QRadar.Assets.ComplianceNotes.Value
      description: Compliance notes
      type: string
    - contextPath: QRadar.Assets.CompliancePlan.Value
      description: Compliance plan
      type: string
    - contextPath: QRadar.Assets.CollateralDamagePotential.Value
      description: Collateral damage potential
      type: Unknown
    - contextPath: QRadar.Assets.AggregatedCVSSScore.Value
      description: CVSSScore
      type: number
    - contextPath: QRadar.Assets.Name.Value
      description: Name of the asset
      type: string
    - contextPath: QRadar.Assets.GroupName
      description: Name of the asset's group
      type: string
    - contextPath: Endpoint.Domain
      description: DNS name
      type: Unknown
    - contextPath: Endpoint.OS
      description: Asset OS
      type: Unknown
    - contextPath: QRadar.Assets.Weight.Value
      description: Asset weight
      type: number
    - contextPath: QRadar.Assets.Vulnerabilities.Value
      description: Vulnerabilities
      type: Unknown
    - contextPath: QRadar.Assets.Location
      description: Location.
      type: string
    - contextPath: QRadar.Assets.Description
      description: The asset description.
      type: string
    - contextPath: QRadar.Assets.SwitchID
      description: Switch ID
      type: number
    - contextPath: QRadar.Assets.SwitchPort
      description: Switch port.
      type: number
    - contextPath: QRadar.Assets.Name.LastUser
      description: Last user who updated the name
      type: string
    - contextPath: QRadar.Assets.AggregatedCVSSScore.LastUser
      description: Last user who updated the Aggregated CVSS Score
      type: string
    - contextPath: QRadar.Assets.Weight.LastUser
      description: Last user who updated the weight
      type: string
    - contextPath: QRadar.Assets.ComplianceNotes.LastUser
      description: Last user who updated the compliance notes
      type: string
    - contextPath: QRadar.Assets.CompliancePlan.LastUser
      description: Last user who updated the compliance plan
      type: string
    - contextPath: QRadar.Assets.CollateralDamagePotential.LastUser
      description: Last user who updated the collateral damage potential
      type: string
    - contextPath: QRadar.Assets.Vulnerabilities.LastUser
      description: Last user who updated the vulnerabilities
      type: string
  - arguments:
    - default: true
      description: The query expressions in AQL (for more information about Ariel Query Language please review https://www.ibm.com/support/knowledgecenter/en/SS42VS_7.3.0/com.ibm.qradar.doc/c_aql_intro.html)
      name: query_expression
      required: true
    - description: Table headers
      name: headers
    deprecated: true
    description: Searches in QRadar
    name: qr-searches
    outputs:
    - contextPath: QRadar.Search.ID
      description: Search ID
      type: number
    - contextPath: QRadar.Search.State
      description: The state of the search.
      type: string
  - arguments:
    - default: true
      description: The search id
      name: search_id
      required: true
    - description: Table headers
      name: headers
    deprecated: true
    description: Gets a specific search id and state
    name: qr-get-search
    outputs:
    - contextPath: QRadar.Search.ID
      description: Search ID
      type: number
    - contextPath: QRadar.Search.State
      description: The state of the search.
      type: string
  - arguments:
    - default: true
      description: The search id
      name: search_id
      required: true
    - description: Number of results in return
      name: range
    - description: Table headers
      name: headers
    deprecated: true
    description: Gets search results
    name: qr-get-search-results
    outputs:
    - contextPath: QRadar.Search.Result
      description: The result of the search
      type: Unknown
  - arguments:
    - description: The ID of a closing reason. You must provide a valid closing_reason_id when you close an offense
      name: closing_reason_id
    - default: true
      description: The ID of the offense to update
      name: offense_id
      required: true
    - auto: PREDEFINED
      description: Set to true to protect the offense
      name: protected
      predefined:
      - 'true'
      - 'false'
    - auto: PREDEFINED
      description: Set to true to set the follow up flag on the offense
      name: follow_up
      predefined:
      - 'true'
      - 'false'
    - auto: PREDEFINED
      description: The new status for the offense
      name: status
      predefined:
      - OPEN
      - HIDDEN
      - CLOSED
    - description: 'The name of a closing reason. You must provide a valid closing_reason_name when you close an offense. The default  closing_reasons are: (1) False-Positive, Tuned (2) Non-Issues (3) Policy Violation'
      name: closing_reason_name
    - description: A user to assign the offense to
      name: assigned_to
    - description: Table headers
      name: headers
    - description: Use this parameter to specify which fields you would like to get back in the response. Fields that are not named are excluded. Specify subfields in brackets and multiple fields in the same object are separated by commas
      name: fields
    deprecated: true
    description: Update an offense
    name: qr-update-offense
    outputs:
    - contextPath: QRadar.Offense.Followup
      description: Offense followup.
      type: Unknown
    - contextPath: QRadar.Offense.ID
      description: The ID of the offense.
      type: number
    - contextPath: QRadar.Offense.Description
      description: The description of the offense.
      type: Unknown
    - contextPath: QRadar.Offense.SourceAddress
      description: The source addresses that are associated with the offense.
      type: Unknown
    - contextPath: QRadar.Offense.DestinationAddress
      description: The destination addresses that are associated with the offense.
      type: Unknown
    - contextPath: QRadar.Offense.StartTime
      description: The time (ISO) when the offense was started.
      type: Unknown
    - contextPath: QRadar.Offense.EventCount
      description: The number of events that are associated with the offense.
      type: Unknown
    - contextPath: QRadar.Offense.FlowCount
      description: The number of flows that are associated with the offense.
      type: Unknown
    - contextPath: QRadar.Offense.OffenseSource
      description: The source of the offense.
      type: Unknown
    - contextPath: QRadar.Offense.Magnitude
      description: The magnitude of the offense.
      type: Unknown
    - contextPath: QRadar.Offense.LastUpdatedTime
      description: The time (ISO) when the offense was last updated.
      type: Unknown
    - contextPath: QRadar.Offense.OffenseType
      description: A number that represents the offense type
      type: Unknown
    - contextPath: QRadar.Offense.Protected
      description: Is the offense protected
      type: Unknown
  - arguments:
    - description: Number of results in return
      name: range
    - description: Fields to filter in
      name: fields
    - description: Query to filter offenses
      name: filter
    - description: Table headers
      name: headers
    deprecated: true
    description: List all assets found in the model
    name: qr-get-assets
    outputs:
    - contextPath: QRadar.Assets.ID
      description: The ID of the asset
      type: number
    - contextPath: Endpoint.IPAddress
      description: IP address of the asset
      type: Unknown
    - contextPath: QRadar.Assets.Name.Value
      description: Name of the asset
      type: Unknown
    - contextPath: Endpoint.OS
      description: Asset OS
      type: Unknown
    - contextPath: QRadar.Assets.AggregatedCVSSScore.Value
      description: CVSSScore
      type: Unknown
    - contextPath: QRadar.Assets.Weight.Value
      description: Asset weight
      type: Unknown
    - contextPath: QRadar.Assets.Name.LastUser
      description: Last user who updated the name
      type: Unknown
    - contextPath: QRadar.Assets.AggregatedCVSSScore.LastUser
      description: Last user who updated the Aggregated CVSS Score
      type: Unknown
    - contextPath: QRadar.Assets.Weight.LastUser
      description: Last user who updated the weight
      type: Unknown
  - arguments:
    - description: Query to filter offenses
      name: filter
    - description: 'Fields to filter in '
      name: fields
    - description: Number of results in return
      name: range
    - description: Table headers
      name: headers
    deprecated: true
    description: Gets offenses from QRadar
    name: qr-offenses
    outputs:
    - contextPath: QRadar.Offense.Followup
      description: Offense followup.
      type: Unknown
    - contextPath: QRadar.Offense.ID
      description: The ID of the offense.
      type: number
    - contextPath: QRadar.Offense.Description
      description: The description of the offense.
      type: Unknown
    - contextPath: QRadar.Offense.SourceAddress
      description: The source addresses that are associated with the offense.
      type: Unknown
    - contextPath: QRadar.Offense.DestinationAddress
      description: The destination addresses that are associated with the offense.
      type: Unknown
    - contextPath: QRadar.Offense.StartTime
      description: The time (ISO) when the offense was started.
      type: Unknown
    - contextPath: QRadar.Offense.EventCount
      description: The number of events that are associated with the offense.
      type: Unknown
    - contextPath: QRadar.Offense.FlowCount
      description: The number of flows that are associated with the offense.
      type: Unknown
    - contextPath: QRadar.Offense.OffenseSource
      description: The source of the offense.
      type: Unknown
    - contextPath: QRadar.Offense.Magnitude
      description: The magnitude of the offense.
      type: Unknown
    - contextPath: QRadar.Offense.LastUpdatedTime
      description: The time (ISO) when the offense was last updated.
      type: Unknown
    - contextPath: QRadar.Offense.OffenseType
      description: A number that represents the offense type
      type: Unknown
  - arguments:
    - auto: PREDEFINED
      defaultValue: 'true'
      description: If true, reserved closing reasons are included in the response
      name: include_reserved
      predefined:
      - 'true'
      - 'false'
    - auto: PREDEFINED
      defaultValue: 'true'
      description: If true, deleted closing reasons are included in the response
      name: include_deleted
      predefined:
      - 'true'
      - 'false'
    - description: 'Query to filter results. For refernce please consult: https://www.ibm.com/support/knowledgecenter/en/SS42VS_7.3.1/com.ibm.qradar.doc/c_rest_api_filtering.html'
      name: filter
    - description: 'If used, will filter all fields except for the specified ones. Use this parameter to specify which fields you would like to get back in the response. Fields that are not named are excluded. Specify subfields in brackets and multiple fields in the same object are separated by commas. The filter uses QRadar''s field names, for reference please consult: https://www.ibm.com/support/knowledgecenter/SSKMKU/com.ibm.qradar.doc_cloud/9.1--siem-offense_closing_reasons-GET.html'
      name: fields
    - description: 'Range of results to return. e.g.: 0-20'
      name: range
    description: Get closing reasons
    name: qradar-get-closing-reasons
    outputs:
    - contextPath: QRadar.Offense.ClosingReasons.ID
      description: Closing reason ID
      type: number
    - contextPath: QRadar.Offense.ClosingReasons.Name
      description: Closing reason name
      type: string
  - arguments:
    - default: true
      description: The offense ID to add the note to
      name: offense_id
      required: true
    - description: The note text
      name: note_text
      required: true
    - description: 'If used, will filter all fields except for the specified ones. Use this parameter to specify which fields you would like to get back in the response. Fields that are not named are excluded. Specify subfields in brackets and multiple fields in the same object are separated by commas. The filter uses QRadar''s field names, for reference please consult: https://www.ibm.com/support/knowledgecenter/SSKMKU/com.ibm.qradar.doc_cloud/9.1--siem-offenses-offense_id-notes-POST.html'
      name: fields
    - description: Table headers to use the human readable output (if none provided, will show all table headers)
      name: headers
    description: Create a note on an offense
    name: qradar-create-note
    outputs:
    - contextPath: QRadar.Note.ID
      description: Note ID
      type: number
    - contextPath: QRadar.Note.Text
      description: Note text
      type: string
    - contextPath: QRadar.Note.CreateTime
      description: The creation time of the note
      type: date
    - contextPath: QRadar.Note.CreatedBy
      description: The user who created the note
      type: string
  - arguments:
    - default: true
      description: The offense ID to retrieve the note from
      name: offense_id
      required: true
    - description: The note ID
      name: note_id
    - description: 'If used, will filter all fields except for the specified ones. Use this parameter to specify which fields you would like to get back in the response. Fields that are not named are excluded. Specify subfields in brackets and multiple fields in the same object are separated by commas. The filter uses QRadar''s field names, for reference please consult: https://www.ibm.com/support/knowledgecenter/SSKMKU/com.ibm.qradar.doc_cloud/9.1--siem-offenses-offense_id-notes-note_id-GET.html'
      name: fields
    - description: Table headers to use the human readable output (if none provided, will show all table headers)
      name: headers
    description: Retrieve a note for an offense
    name: qradar-get-note
    outputs:
    - contextPath: QRadar.Note.ID
      description: Note ID
      type: number
    - contextPath: QRadar.Note.Text
      description: Note text
      type: string
    - contextPath: QRadar.Note.CreateTime
      description: The creation time of the note
      type: date
    - contextPath: QRadar.Note.CreatedBy
      description: The user who created the note
      type: string
  - arguments:
    - default: true
      description: The name of the requestered reference.
      name: ref_name
      required: true
    - description: Table headers to use the human readable output (if none provided, will show all table headers)
      name: headers
    - auto: PREDEFINED
      defaultValue: 'False'
      description: If set to true will try to convert the data values to ISO-8601 string.
      name: date_value
      predefined:
      - 'True'
      - 'False'
    description: Information about the reference set that had data added or updated. This returns information set but not the contained data. This feature is supported from version 8.1 and upward.
    name: qradar-get-reference-by-name
    outputs:
    - contextPath: QRadar.Reference.Name
      description: The name of the reference set.
      type: string
    - contextPath: QRadar.Reference.CreationTime
      description: The creation time (ISO) of the reference.
      type: date
    - contextPath: QRadar.Reference.ElementType
      description: Reference element type.
      type: string
    - contextPath: QRadar.Reference.NumberOfElements
      description: Number of elements.
      type: number
    - contextPath: QRadar.Reference.TimeToLive
      description: Reference time to live.
      type: string
    - contextPath: QRadar.Reference.TimeoutType
      description: 'Reference timeout type. One of: UNKNOWN, FIRST_SEEN, LAST_SEEN'
      type: string
    - contextPath: QRadar.Reference.Data
      description: Reference set items
      type: Unknown
  - arguments:
    - description: Reference name to be created
      name: ref_name
      required: true
    - auto: PREDEFINED
      description: 'The element type for the values allowed in the reference set. The allowed values are: ALN (alphanumeric), ALNIC (alphanumeric ignore case), IP (IP address), NUM (numeric), PORT (port number) or DATE. Note that date values need to be represented in milliseconds since the Unix Epoch January 1st 1970.'
      name: element_type
      predefined:
      - ALN
      - ALNIC
      - IP
      - NUM
      - PORT
      - DATE
      required: true
    - auto: PREDEFINED
      description: The allowed values are "FIRST_SEEN", LAST_SEEN and UNKNOWN. The default value is UNKNOWN.
      name: timeout_type
      predefined:
      - FIRST_SEEN
      - LAST_SEEN
      - UNKNOWN
    - description: 'The time to live interval, for example: "1 month" or "5 minutes"'
      name: time_to_live
    description: Creates a new reference set. If the provided name is already in use, this command will fail
    name: qradar-create-reference-set
    outputs:
    - contextPath: QRadar.Reference.CreationTime
      description: Creation time of the reference set.
      type: date
    - contextPath: QRadar.Reference.ElementType
      description: 'The element type for the values allowed in the reference set. The allowed values are: ALN (alphanumeric), ALNIC (alphanumeric ignore case), IP (IP address), NUM (numeric), PORT (port number) or DATE.'
      type: string
    - contextPath: QRadar.Reference.Name
      description: Name of the reference set.
      type: string
    - contextPath: QRadar.Reference.NumberOfElements
      description: Number of elements in the created reference set.
      type: number
    - contextPath: QRadar.Reference.TimeoutType
      description: Timeout type of the reference. The allowed values are FIRST_SEEN, LAST_SEEN and UNKNOWN.
      type: string
  - arguments:
    - default: true
      description: The name of reference set to delete.
      name: ref_name
      required: true
    description: Deletes a reference set corresponding to the name provided.
    name: qradar-delete-reference-set
  - arguments:
    - description: The name of the reference set to add or update a value in.
      name: ref_name
      required: true
    - description: 'The value/s to add or update in the reference set. Note: Date values must be represented in epoch in reference sets (milliseconds since the Unix Epoch January 1st 1970). If ''date_value'' is set to ''True'', then the argument will be converted from date in format: ''%Y-%m-%dT%H:%M:%S.%f000Z'' (e.g. ''2018-11-06T08:56:41.000000Z'') to epoch.'
      isArray: true
      name: value
      required: true
    - description: An indication of where the data originated. The default value is 'reference data api'.
      name: source
    - auto: PREDEFINED
      defaultValue: 'False'
      description: 'If set to True will convert ''value'' argument from date in format: ''%Y-%m-%dT%H:%M:%S.%f000Z'' (e.g. ''2018-11-06T08:56:41.000000Z'') to epoch.'
      name: date_value
      predefined:
      - 'True'
      - 'False'
    description: Add or update a value in a reference set.
    name: qradar-create-reference-set-value
    outputs:
    - contextPath: QRadar.Reference.Name
      description: The name of the reference set.
      type: string
    - contextPath: QRadar.Reference.CreationTime
      description: The creation time (ISO) of the reference.
      type: date
    - contextPath: QRadar.Reference.ElementType
      description: Reference element type.
      type: string
    - contextPath: QRadar.Reference.NumberOfElements
      description: Number of elements.
      type: number
    - contextPath: QRadar.Reference.TimeoutType
      description: 'Reference timeout type. One of: UNKNOWN, FIRST_SEEN, LAST_SEEN'
      type: string
  - arguments:
    - description: The name of the reference set to add or update a value in.
      name: ref_name
      required: true
    - description: ' A comma-separated list of values to add or update in the reference set. Date values must be represented in milliseconds since the Unix Epoch January 1st 1970.'
      isArray: true
      name: value
      required: true
    - description: An indication of where the data originated. The default value is 'reference data api'.
      name: source
    - auto: PREDEFINED
      defaultValue: 'False'
      description: 'If set to True will convert ''value'' argument from date in format: ''%Y-%m-%dT%H:%M:%S.%f000Z'' (e.g. ''2018-11-06T08:56:41.000000Z'') to epoch.'
      name: date_value
      predefined:
      - 'True'
      - 'False'
    description: Adds or updates a value in a reference set.
    name: qradar-update-reference-set-value
    outputs:
    - contextPath: QRadar.Reference.Name
      description: The name of the reference set.
      type: string
    - contextPath: QRadar.Reference.CreationTime
      description: The creation time (ISO) of the reference.
      type: date
    - contextPath: QRadar.Reference.ElementType
      description: Reference element type.
      type: string
    - contextPath: QRadar.Reference.NumberOfElements
      description: Number of elements.
      type: number
    - contextPath: QRadar.Reference.TimeoutType
      description: 'Reference timeout type. One of: UNKNOWN, FIRST_SEEN, LAST_SEEN'
      type: string
  - arguments:
    - description: The name of the reference set to remove a value from.
      name: ref_name
      required: true
    - description: The value to remove from the reference set.
      name: value
      required: true
    - auto: PREDEFINED
      defaultValue: 'False'
      description: 'If set to True will convert ''value'' argument from date in format: ''%Y-%m-%dT%H:%M:%S.%f000Z'' (e.g. ''2018-11-06T08:56:41.000000Z'') to epoch.'
      name: date_value
      predefined:
      - 'True'
      - 'False'
    description: Deletes a value in a reference set.
    name: qradar-delete-reference-set-value
    outputs:
    - contextPath: QRadar.Reference.Name
      description: The name of the reference set.
      type: string
    - contextPath: QRadar.Reference.CreationTime
      description: The creation time (ISO) of the reference.
      type: date
    - contextPath: QRadar.Reference.ElementType
      description: Reference element type.
      type: string
    - contextPath: QRadar.Reference.NumberOfElements
      description: Number of elements.
      type: number
    - contextPath: QRadar.Reference.TimeoutType
      description: 'Reference timeout type. One of: UNKNOWN, FIRST_SEEN, LAST_SEEN'
      type: string
  - arguments:
    - description: 'If used, will filter all fields except for the specified ones. Use this parameter to specify which fields you would like to get back in the response. Fields that are not named are excluded. Specify subfields in brackets and multiple fields in the same object are separated by commas. The filter uses QRadar''s field names, for reference please consult: https://www.ibm.com/support/knowledgecenter/SSKMKU/com.ibm.qradar.doc_cloud/9.1--siem-offenses-offense_id-notes-note_id-GET.html'
      name: fields
    - description: Number of results in return
      name: range
    - description: Query to filter offenses
      name: filter
    description: Retrieve all Domains
    name: qradar-get-domains
    outputs:
    - contextPath: QRadar.Domains.AssetScannerIDs
      description: Array of Asset Scanner IDs.
      type: Number
    - contextPath: QRadar.Domains.CustomProperties
      description: Custom properties of the domain.
      type: String
    - contextPath: QRadar.Domains.Deleted
      description: Indicates if the domain is deleted.
      type: Boolean
    - contextPath: QRadar.Domains.Description
      description: Description of the domain.
      type: String
    - contextPath: QRadar.Domains.EventCollectorIDs
      description: Array of Event Collector IDs.
      type: Number
    - contextPath: QRadar.Domains.FlowCollectorIDs
      description: Array of Flow Collector IDs.
      type: Number
    - contextPath: QRadar.Domains.FlowSourceIDs
      description: Array of Flow Source IDs.
      type: Number
    - contextPath: QRadar.Domains.ID
      description: ID of the domain.
      type: Number
    - contextPath: QRadar.Domains.LogSourceGroupIDs
      description: Array of Log Source Group IDs.
      type: Number
    - contextPath: QRadar.Domains.LogSourceIDs
      description: Array of Log Source IDs.
      type: Number
    - contextPath: QRadar.Domains.Name
      description: Name of the Domain.
      type: String
    - contextPath: QRadar.Domains.QVMScannerIDs
      description: Array of QVM Scanner IDs.
      type: Number
    - contextPath: QRadar.Domains.TenantID
      description: ID of the Domain tenant.
      type: Number
  - arguments:
    - description: ID of the domain
      name: id
      required: true
    - description: 'If used, will filter all fields except for the specified ones. Use this parameter to specify which fields you would like to get back in the response. Fields that are not named are excluded. Specify subfields in brackets and multiple fields in the same object are separated by commas. The filter uses QRadar''s field names, for reference please consult: https://www.ibm.com/support/knowledgecenter/SSKMKU/com.ibm.qradar.doc_cloud/9.1--siem-offenses-offense_id-notes-note_id-GET.html'
      name: fields
    description: Retrieves Domain information By ID
    name: qradar-get-domain-by-id
    outputs:
    - contextPath: QRadar.Domains.AssetScannerIDs
      description: Array of Asset Scanner IDs.
      type: Number
    - contextPath: QRadar.Domains.CustomProperties
      description: Custom properties of the domain.
      type: String
    - contextPath: QRadar.Domains.Deleted
      description: Indicates if the domain is deleted.
      type: Boolean
    - contextPath: QRadar.Domains.Description
      description: Description of the domain.
      type: String
    - contextPath: QRadar.Domains.EventCollectorIDs
      description: Array of Event Collector IDs.
      type: Number
    - contextPath: QRadar.Domains.FlowCollectorIDs
      description: Array of Flow Collector IDs.
      type: Number
    - contextPath: QRadar.Domains.FlowSourceIDs
      description: Array of Flow Source IDs.
      type: Number
    - contextPath: QRadar.Domains.ID
      description: ID of the domain.
      type: Number
    - contextPath: QRadar.Domains.LogSourceGroupIDs
      description: Array of Log Source Group IDs.
      type: Number
    - contextPath: QRadar.Domains.LogSourceIDs
      description: Array of Log Source IDs.
      type: Number
    - contextPath: QRadar.Domains.Name
      description: Name of the Domain.
      type: String
    - contextPath: QRadar.Domains.QVMScannerIDs
      description: Array of QVM Scanner IDs.
      type: Number
    - contextPath: QRadar.Domains.TenantID
      description: ID of the Domain tenant.
      type: Number
  - arguments:
    - description: The name of the reference set to add or update a value in. To create a new reference set, you need to set the element type.
      name: ref_name
      required: true
    - auto: PREDEFINED
      description: 'The element type for the values premitted in the reference set. Only required when creating a new reference set. The valid values are: ALN (alphanumeric), ALNIC (alphanumeric ignore case), IP (IP address), NUM (numeric), PORT (port number) or DATE. Note that date values need to be represented in milliseconds since the Unix Epoch January 1st 1970.'
      name: element_type
      predefined:
      - ALN
      - ALNIC
      - IP
      - NUM
      - PORT
      - DATE
    - auto: PREDEFINED
      description: The timeout_type can be "FIRST_SEEN", "LAST_SEEN", or "UNKNOWN". The default value is UNKNOWN. Only required for creating a new refernce set.
      name: timeout_type
      predefined:
      - FIRST_SEEN
      - LAST_SEEN
      - UNKNOWN
    - description: 'The time to live interval, for example: "1 month" or "5 minutes". Only required when creating a new reference set.'
      name: time_to_live
    - description: The query for getting indicators.
      name: query
      required: true
    - defaultValue: '1000'
      description: The maximum number of indicators to return. The default value is 1000.
      name: limit
    - defaultValue: '0'
      description: The page from which to get the indicators
      name: page
    description: Uploads indicators from Demisto to Qradar. This command requires Cortex SOAR v5.5 or later.
    name: qradar-upload-indicators
  isfetch: true
  runonce: false
  script: '-'
  subtype: python2
  type: python
  dockerimage: demisto/python:2.7.18.52566
tests:
- No test
fromversion: 5.5.0
defaultclassifier: QRadar
defaultmapperin: QRadar-mapper