QRadar Deprecated

Deprecated. Use IBM QRadar v2 or IBM QRadar v3 instead.

Analytics & SIEM · IBM QRadar

Details

ID	`QRadar`
Provider	Palo Alto Networks
Category	Analytics & SIEM
From Version	5.5.0
Docker Image	`demisto/python:2.7.18.52566`
Supported Modules	Agentix Cloud Runtime Security Cloud Posture Security XSIAM EDR Cortex Cloud

README

Deprecated. Use IBM QRadar v2 or IBM QRadar v3 instead. This integration was integrated and tested with QRadar v7.3.1 and API versions - 8.0, 8.1, and 9.0. The QRadar integration is deprecated from QRadar v7.3.2 Patch 2. If you're using a later version of QRadar, make sure you use the QRadar v2 integration.

Use the QRadar integration to query offenses and create Cortex XSOAR incidents from the offenses.

For more information about filter syntax, see the IBM support documentation.

QRadar Playbook

After you configure the QRadar integration, you can use the QRadar - Get offense correlations playbook. This playbook identifies and extracts additional information about QRadar offenses.

All correlations relevant to the offense.
Retrieve logs relevant to the correlations. Make sure that in the Should query for the correlations' log task you set the inputs.GetCorrelationLogs parameter to True). The maximum log count is 20.

Troubleshooting Performance Issues

In some cases, you might encounter performance issues when running QRadar AQL queries from Cortex XSOAR. This issue is caused by QRadar API limitations. We recommend that you test the QRadar API performance by running several cURL scripts.

1. Creating a search

Run the following command to use the QRadar API to create a new search.
Save the QUERY ID that is attached to the response for the next step.

curl -H "SEC: <API KEY>" -X POST <QRADAR INSTANCE>/api/ariel/searches?query_expression=<QUERY IN URL SAFE ENCODING>

2. Check if the search status is Complete or Executing

Use the following command to use the QRadar API to check the query status (EXECUTE, COMPLETED, or ERROR).

curl -H "SEC: <API KEY>" -X GET <QRADAR INSTANCE>/api/ariel/searches?<QUERY ID>

Configure QRadar on Cortex XSOAR

Navigate to Settings > Integrations > Servers & Services.
Search for QRadar.

Click Add instance to create and configure a new integration instance.

Name: a textual name for the integration instance.
Server URL (e.g. https://192.168.0.1)
Username
Authentication token
Query to fetch offenses
Number of offenses to pull per API call
Trust any certificate (not secure)
Use system proxy settings
Fetch incidents
Incident type
Full Incident Enrichment - when fetching incidents the integration will limit the number of requests it's sending QRadar. As a side effect, this will make the following fields contain their QRadar ids, and not values: source_address_ids, local_destination_address_ids.
Number of addresses to enrich per API call
Click Test to validate the URLs, token, and connection.

Fetch incidents:

You can apply additional (optional) filters for the fetch-incident query using the Query to fetch offenses integration parameter. For more information on how to use the filter syntax, see the QRadar filter documentation and QRadar offense documentation.

Full Incident Enrichment - Clear this checkbox to disable QRadar offense enrichment performed in fetch-incidents. This might help if you encounter a timeout while fetching new incidents.

Commands

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook. After you successfully execute a command, a DBot message appears in the War Room with the command details.

Get offenses: qradar-offenses
Get an offense by offense ID: qradar-offense-by-id
Search QRadar using AQL: qradar-searches
Get a search ID and state: qradar-get-search
Get search results: qradar-get-search-results
Update an offense: qradar-update-offense
List all assets: qradar-get-assets
Get an asset by the asset ID: qradar-get-asset-by-id
Get the reason an offense was closed: qradar-get-closing-reasons
Create a note for an offense: qradar-create-note
Get a note for an offense: qradar-get-note
Get a reference by the reference name: qradar-get-reference-by-name
Create a reference set: qradar-create-reference-set
Delete a reference set: qradar-delete-reference-set
Create a value in a reference set: qradar-create-reference-set-value
Add or update a value in a reference set: qradar-update-reference-set-value
Delete a value from a reference set: qradar-delete-reference-set-value

1. Get offenses

Gets offenses from QRadar.

Base Command

qradar-offenses

Input

Argument Name	Description	Required
filter	Query to filter offenses. For more information, see the QRadar documenatation.	Optional
fields	If used, will filter all fields except for the specified ones. Use this parameter to specify which fields you would like to get back in the response. Fields that are not named are excluded. Specify subfields in brackets and multiple fields in the same object are separated by commas. The filter uses QRadar's field names. For more information, see the QRadar documentation.	Optional
range	Range of results to return, e.g., 0-20	Optional
headers	Table headers to use the human readable output (if none provided, will show all table headers)	Optional

Context Output

Path	Type	Description
QRadar.Offense.Followup	boolean	Offense followup
QRadar.Offense.ID	number	The ID of the offense
QRadar.Offense.Description	string	The description of the offense
QRadar.Offense.SourceAddress	unknown	The source addresses that are associated with the offense
QRadar.Offense.DestinationAddress	unknown	The local destination addresses that are associated with the offense. If your offense has a remote destination, you will need to use QRadarFullSearch playbook with the following query: SELECT destinationip FROM events WHERE inOffense() GROUP BY destinationip
QRadar.Offense.RemoteDestinationCount	unknown	The remote destination that are associated with the offense. If this value is greater than 0 that means your offense has a remote destination, you will need to use QRadarFullSearch playbook with the following query: SELECT destinationip FROM events WHERE inOffense() GROUP BY destinationip
QRadar.Offense.StartTime	date	The time (ISO) when the offense was started.
QRadar.Offense.EventCount	number	The number of events that are associated with the offense
QRadar.Offense.Magnitude	number	The magnitude of the offense
QRadar.Offense.LastUpdatedTime	date	The time (ISO) when the offense was last updated
QRadar.Offense.OffenseType	string	The offense type (due to API limitations if username and password were not provided, this value will be the id of offense type)

Command Examples

  !qradar-offenses range=0-1 filter="follow_up = false" headers=ID,Magnitude

  !qradar-offenses fields="id,start_time"

Context Example

{
    "QRadar": {
        "Offense": {
            "Followup": false,
            "Description": "Multiple Login Failures for the Same User\n preceded by shachar_test\n containing Failed Login Attempt\n",
            "EventCount": 3,
            "Magnitude": 3,
            "OffenseType": "Username",
            "StartTime": "2018-10-16T13:07:36.245000Z",
            "SourceAddress": [
                "94.188.164.68"
            ],
            "ID": 78,
            "LastUpdatedTime": "2018-10-16T13:07:40.675000Z"
        }
    }
}

Human Readable Output

2. Get an offense by offense ID

Gets the offense with the matching offense ID from QRadar.

Base Command

qradar-offense-by-id

Input

Argument Name	Description	Required
offense_id	Offense ID	Required
filter	Query to filter offenses. For more information, see the QRadar documentation.	Optional
fields	If used, will filter all fields except for the specified ones. Use this parameter to specify which fields you would like to get back in the response. Fields that are not named are excluded. Specify subfields in brackets and multiple fields in the same object are separated by commas. The filter uses QRadar's field names. For more information, see the QRadar documentation.	Optional
headers	Table headers to use the human readable output (if none provided, will show all table headers)	Optional

Context Output

Path	Type	Description
QRadar.Offense.Credibility	number	The credibility of the offense
QRadar.Offense.Relevance	number	The relevance of the offense
QRadar.Offense.Severity	number	The severity of the offense
QRadar.Offense.SourceAddress	unknown	The source addresses that are associated with the offense.
QRadar.Offense.DestinationAddress	unknown	The local destination addresses that are associated with the offense. If your offense has a remote destination, you will need to use QRadarFullSearch playbook with the following query: SELECT destinationip FROM events WHERE inOffense() GROUP BY destinationip
QRadar.Offense.RemoteDestinationCount	unknown	The remote destination that are associated with the offense. If this value is greater than 0 that means your offense has a remote destination, you will need to use QRadarFullSearch playbook with the following query: SELECT destinationip FROM events WHERE inOffense() GROUP BY destinationip
QRadar.Offense.AssignedTo	string	The user the offense is assigned to
QRadar.Offense.StartTime	date	The time (ISO) when the offense started
QRadar.Offense.ID	int	The ID of the offense.
QRadar.Offense.DestinationHostname	unknown	Destination hostname
QRadar.Offense.Description	string	The description of the offense
QRadar.Offense.EventCount	number	The number of events that are associated with the offense.
QRadar.Offense.OffenseSource	string	The source of the offense.
QRadar.Offense.Status	string	The status of the offense ("OPEN", "HIDDEN", or "CLOSED")
QRadar.Offense.Magnitude	number	The magnitude of the offense.
QRadar.Offense.ClosingUser	string	The user that closed the offense
QRadar.Offense.ClosingReason	string	The offense closing reason.
QRadar.Offense.CloseTime	date	The time when the offense was closed.
QRadar.Offense.LastUpdatedTime	date	The time (ISO) when the offense was last updated.
QRadar.Offense.Categories	unknown	Event categories that are associated with the offense.
QRadar.Offense.FlowCount	number	The number of flows that are associated with the offense.
QRadar.Offense.FollowUp	boolean	Offense followup.
QRadar.Offense.OffenseType	string	A number that represents the offense type
QRadar.Offense.Protected	boolean	Is the offense protected

Command Example

!qradar-offense-by-id fields=id,magnitude offense_id=78

!qradar-offense-by-id offense_id=78

Context Example

{
    "QRadar": {
        "Offense": {
            "Followup": false,
            "OffenseSource": "admin",
            "Description": "Multiple Login Failures for the Same User\n preceded by shachar_test\n containing Failed Login Attempt\n",
            "EventCount": 3,
            "Credibility": 3,
            "Status": "OPEN",
            "DestinationHostname": [
                "Net-10-172-192.Net_172_16_0_0"
            ],
            "StartTime": "2018-10-16T13:07:36.245000Z",
            "Protected": false,
            "Magnitude": 3,
            "FlowCount": 0,
            "OffenseType": "Username",
            "SourceAddress": [
                "94.188.164.68"
            ],
            "Relevance": 3,
            "Severity": 7,
            "ID": 78,
            "Categories": [
                "User Login Failure",
                "SIM User Authentication"
            ],
            "LastUpdatedTime": "2018-10-16T13:07:40.675000Z"
        }
    }
}

Human Readable Output

3. Search QRadar using AQLqradar-searches

Searches in QRadar using AQL. It is highly recommended to use the playbook 'QRadarFullSearch' instead of this command - it will execute the search, and will return the result.

Base Command

qradar-searches

Input

Argument Name	Description	Required
query_expression	The query expressions in AQL. For more information, see the Ariel Query Language documentation.	Required
headers	Table headers to use the human readable output (if none provided, will show all table headers)	Optional

Context Output

Path	Type	Description
QRadar.Search.ID	number	Search ID
QRadar.Search.State	string	The state of the search

Command Example

!qradar-searches query_expression="SELECT sourceip AS 'MY Source IPs' FROM events"

Context Example

{
    "QRadar": {
        "Search": {
            "Status": "EXECUTE",
            "ID": "14b1d702-edba-43e7-b01c-36f8da1ed016"
        }
    }
}

Human Readable Output

4. Get a search ID and state

Gets a specific search ID and state.

Base Command

qradar-get-search

Input

Argument Name	Description	Required
search_id	The search ID	Required
headers	Table headers to use the human readable output (if none provided, will show all table headers)	Optional

Context Output

Path	Type	Description
QRadar.Search.ID	number	Search ID
QRadar.Search.State	string	The state of the search

Command Example

!qradar-get-search search_id=14b1d702-edba-43e7-b01c-36f8da1ed016

Context Example

{
    "QRadar": {
        "Search": {
            "Status": "COMPLETED",
            "ID": "14b1d702-edba-43e7-b01c-36f8da1ed016"
        }
    }
}

Human Readable Output

5. Get search results

Gets search results.

Base Command

qradar-get-search-results

Input

Argument Name	Description	Required
search_id	The search ID	Required
range	Range of results to return, e.g., 0-20	Optional
headers	Table headers to use the human readable output (if none provided, will show all table headers)	Optional
output_path	Replaces the default context output path for the query result (QRadar.Search.Result). For example, for `output_path=QRadar.Correlations` the result will be under the key QRadar.Correlations in the context data.	Optional

Context Output

Path	Type	Description
QRadar.Search.Result	unknown	The result of the search

Command Example

!qradar-get-search-results search_id=14b1d702-edba-43e7-b01c-36f8da1ed016 range=0-0

Context Example

{
    "QRadar": {
        "Search": {
            "Result": {
                "events": [
                    {
                        "MY Source IPs": "172.31.25.170"
                    }
                ]
            }
        }
    }
}

Human Readable Output

6. Update an offense

Updates an offense.

Base Command

qradar-update-offense

Input

Argument Name	Description	Required
offense_id	The ID of the offense to update	Required
protected	Set to true to protect the offense	Optional
follow_up	Set to true to set the follow up flag on the offense	Optional
status	The new status for the offense	Optional
closing_reason_name	The name of a closing reason. You must provide a valid closing_reason_name when you close an offense. The default closing_reasons are: (1) False-Positive, Tuned (2) Non-Issues (3) Policy Violation	Optional
assigned_to	A user to assign the offense to	Optional
headers	Table headers	Optional
fields	Use this parameter to specify which fields you would like to get back in the response. Fields that are not named are excluded. Specify subfields in brackets and multiple fields in the same object are separated by commas. For more information, see the QRadar documentation.	Optional

Context Output

Path	Type	Description
QRadar.Offense.Credibility	number	The credibility of the offense
QRadar.Offense.Relevance	number	The relevance of the offense
QRadar.Offense.Severity	number	The severity of the offense
QRadar.Offense.SourceAddress	unknown	The source addresses that are associated with the offense.
QRadar.Offense.DestinationAddress	unknown	The destination addresses that are associated with the offense.
QRadar.Offense.AssignedTo	string	The user the offense is assigned to.
QRadar.Offense.StartTime	date	The time (ISO) when the offense was started.
QRadar.Offense.ID	int	The ID of the offense.
QRadar.Offense.DestinationHostname	unknown	Destination hostname
QRadar.Offense.Description	string	The description of the offense.
QRadar.Offense.EventCount	number	The number of events that are associated with the offense.
QRadar.Offense.OffenseSource	string	The source of the offense.
QRadar.Offense.Status	string	The status of the offense. One of "OPEN", "HIDDEN", or "CLOSED".
QRadar.Offense.Magnitude	number	The magnitude of the offense.
QRadar.Offense.ClosingUser	string	The user that closed the offense
QRadar.Offense.ClosingReason	string	The offense closing reason.
QRadar.Offense.CloseTime	date	The time when the offense was closed.
QRadar.Offense.LastUpdatedTime	date	The time (ISO) when the offense was last updated.
QRadar.Offense.Categories	unknown	Event categories that are associated with the offense.
QRadar.Offense.FlowCount	number	The number of flows that are associated with the offense.
QRadar.Offense.FollowUp	boolean	Offense followup.
QRadar.Offense.OffenseType	string	A number that represents the offense type
QRadar.Offense.Protected	boolean	Is the offense protected

Command Example

!qradar-update-offense offense_id=78 protected=false

Context Example

{
    "QRadar": {
        "Offense": {
            "Followup": false,
            "OffenseSource": "admin",
            "Description": "Multiple Login Failures for the Same User\n preceded by shachar_test\n containing Failed Login Attempt\n",
            "EventCount": 3,
            "Credibility": 3,
            "Status": "OPEN",
            "DestinationHostname": [
                "Net-10-172-192.Net_172_16_0_0"
            ],
            "StartTime": "2018-10-16T13:07:36.245000Z",
            "Protected": false,
            "Magnitude": 3,
            "FlowCount": 0,
            "OffenseType": "Username",
            "SourceAddress": [
                "94.188.164.68"
            ],
            "Relevance": 3,
            "Severity": 7,
            "ID": 78,
            "Categories": [
                "User Login Failure",
                "SIM User Authentication"
            ],
            "LastUpdatedTime": "2018-10-16T13:07:40.675000Z"
        }
    }
}

Human Readable Output

7. List all assets

List all assets found in the model.

Base Command

qradar-get-assets

Input

Argument Name	Description	Required
filter	Query to filter assets. For more information, see the QRadar documentation.	Optional
fields	If used, will filter all fields except for the specified ones. Use this parameter to specify which fields you would like to get back in the response. Fields that are not named are excluded. Specify subfields in brackets and multiple fields in the same object are separated by commas. The filter uses QRadar's field names. For more information, see the QRadar documentation.	Optional
range	Range of results to return. e.g.: 0-20	Optional
headers	Table headers to use the human readable output (if none provided, will show all table headers)	Optional

Context Output

Path	Type	Description
QRadar.Assets.ID	number	The ID of the asset
Endpoint.IPAddress	unknown	IP address of the asset
QRadar.Assets.Name.Value	string	Name of the asset
Endpoint.OS	number	Asset OS
QRadar.Assets.AggregatedCVSSScore.Value	number	CVSSScore
QRadar.Assets.AggregatedCVSSScore.LastUser	string	Last user who updated the Aggregated CVSS Score
QRadar.Assets.Weight.Value	number	Asset weight
QRadar.Assets.Weight.LastUser	string	Last user who updated the weight
QRadar.Assets.Name.LastUser	string	Last user who updated the name

Command Example

!qradar-get-assets range=0-1

Context Example

{
    "QRadar": {
        "Asset": {
            "AggregatedCVSSScore": {
                "LastUser": "USER:admin",
                "Value": "h"
            },
            "ID": 1001,
            "Weight": {
                "LastUser": "USER:admin",
                "Value": "10"
            },
            "Name": {
                "LastUser": "USER:admin",
                "Value": "Test"
            }
        }
    },
    "Endpoint": {
        "OS": "80345",
        "IPAddress": [
            "10.0.0.1",
            "10.0.0.2"
        ]
    }
}

Human Readable Output

8. Get an asset by the asset ID

Retrieves the asset by ID.

Base Command

qradar-get-asset-by-id

Input

Argument Name	Description	Required
asset_id	The ID of the requested asset.	Required

Context Output

Path	Type	Description
QRadar.Assets.ID	number	The ID of the asset.
Endpoint.MACAddress	unknown	Asset MAC address.
Endpoint.IPAddress	unknown	It's in ip_addresses - value
QRadar.Assets.ComplianceNotes.Value	string	Compliance notes
QRadar.Assets.CompliancePlan.Value	string	Compliance plan
QRadar.Assets.CollateralDamagePotential.Value	unknown	Collateral damage potential
QRadar.Assets.AggregatedCVSSScore.Value	number	CVSSScore
QRadar.Assets.Name.Value	string	Name of the asset
QRadar.Assets.GroupName	string	Name of the asset's group
Endpoint.Domain	unknown	DNS name
Endpoint.OS	unknown	Asset OS
QRadar.Assets.Weight.Value	number	Asset weight
QRadar.Assets.Vulnerabilities.Value	unknown	Vulnerabilities
QRadar.Assets.Location	string	Location.
QRadar.Assets.Description	string	The asset description.
QRadar.Assets.SwitchID	number	Switch ID
QRadar.Assets.SwitchPort	number	Switch port.
QRadar.Assets.Name.LastUser	string	Last user who updated the name
QRadar.Assets.AggregatedCVSSScore.LastUser	string	Last user who updated the Aggregated CVSS Score
QRadar.Assets.Weight.LastUser	string	Last user who updated the weight
QRadar.Assets.ComplianceNotes.LastUser	string	Last user who updated the compliance notes
QRadar.Assets.CompliancePlan.LastUser	string	Last user who updated the compliance plan
QRadar.Assets.CollateralDamagePotential.LastUser	string	Last user who updated the collateral damage potential
QRadar.Assets.Vulnerabilities.LastUser	string	Last user who updated the vulnerabilities

Command Example

!qradar-get-asset-by-id asset_id=1001

Context Example

{
    "QRadar": {
        "Asset": {
            "Name": {
                "LastUser": "USER:admin",
                "Value": "Test"
            },
            "Weight": {
                "LastUser": "USER:admin",
                "Value": "10"
            },
            "SwitchPort": {
                "LastUser": "USER:admin",
                "Value": "1"
            },
            "SwitchID": {
                "LastUser": "USER:admin",
                "Value": "1"
            },
            "AggregatedCVSSScore": {
                "LastUser": "USER:admin",
                "Value": "h"
            },
            "Location": {
                "LastUser": "USER:admin",
                "Value": "Israel"
            },
            "CompliancePlan": {
                "LastUser": "USER:admin",
                "Value": "Correction Plan"
            },
            "ID": 1001,
            "ComplianceNotes": {
                "LastUser": "USER:admin",
                "Value": "some notes"
            }
        }
    },
    "Endpoint": [
        {
            "OS": "80345",
            "IPAddress": [
                "10.0.0.1",
                "10.0.0.2"
            ]
        },
        {
            "MACAddress": [
                "Unknown NIC"
            ],
            "OS": "80345",
            "IPAddress": [
                "10.0.0.1",
                "10.0.0.2"
            ]
        }
    ]

Human Readable Output

9. Get the reason an offense was closed

Get closing reasons.

Base Command

qradar-get-closing-reasons

Input

Argument Name	Description	Required
include_reserved	If true, reserved closing reasons are included in the response	Optional
include_deleted	If true, deleted closing reasons are included in the response	Optional
filter	Query to filter results. For more information, see the QRadar documentation.	Optional
fields	If used, will filter all fields except for the specified ones. Use this parameter to specify which fields you would like to get back in the response. Fields that are not named are excluded. Specify subfields in brackets and multiple fields in the same object are separated by commas. The filter uses QRadar's field names. For more information, see the QRadar documentation.	Optional
range	Range of results to return. e.g.: 0-20	Optional

Context Output

Path	Type	Description
QRadar.Offense.ClosingReasons.ID	number	Closing reason ID
QRadar.Offense.ClosingReasons.Name	string	Closing reason name

Command Example

!qradar-get-closing-reasons include_reserved=false

Context Example

{
    "QRadar": {
        "Offense": {
            "ClosingReasons": [
                {
                    "IsReserved": false,
                    "ID": 2,
                    "IsDeleted": false,
                    "Name": "False-Positive, Tuned"
                },
                {
                    "IsReserved": false,
                    "ID": 1,
                    "IsDeleted": false,
                    "Name": "Non-Issue"
                },
                {
                    "IsReserved": false,
                    "ID": 3,
                    "IsDeleted": false,
                    "Name": "Policy Violation"
                },
                {
                    "IsReserved": false,
                    "ID": 54,
                    "IsDeleted": false,
                    "Name": "Duplicate"
                }
            ]
        }
    }
}

Human Readable Output

10. Create a note for an offense

Creates a note on an offense.

Base Command

qradar-create-note

Input

Argument Name	Description	Required
offense_id	The offense ID to add the note to	Required
note_text	The note text	Required
fields	If used, will filter all fields except for the specified ones. Use this parameter to specify which fields you would like to get back in the response. Fields that are not named are excluded. Specify subfields in brackets and multiple fields in the same object are separated by commas. The filter uses QRadar's field names. For more information, see the QRadar documentation.	Optional
headers	Table headers to use the human readable output (if none provided, will show all table headers)	Optional

Context Output

Path	Type	Description
QRadar.Note.ID	number	Note ID
QRadar.Note.Text	string	Note text
QRadar.Note.CreateTime	date	The creation time of the note
QRadar.Note.CreatedBy	string	The user who created the note

Command Example

!qradar-create-note offense_id=78 note_text="Demisto has the best documentation!"

Context Example

{
    "QRadar": {
        "Note": {
            "Text": "Demisto has the best documentation!",
            "CreateTime": "2018-10-29T13:26:57.579000Z",
            "CreatedBy": "API_user: admin",
            "ID": 190
        }
    }
}

Human Readable Output

11. Get a note for an offense

Retrieve a note for an offense.

Base Command

qradar-get-note

Input

Argument Name	Description	Required
offense_id	The offense ID to retrieve the note from	Required
note_id	The note ID	Optional
fields	If used, will filter all fields except for the specified ones. Use this parameter to specify which fields you would like to get back in the response. Fields that are not named are excluded. Specify subfields in brackets and multiple fields in the same object are separated by commas. The filter uses QRadar's field names. For more information, see the QRadar documentation.	Optional
headers	Table headers to use the human readable output (if none provided, will show all table headers)	Optional

Context Output

Path	Type	Description
QRadar.Note.ID	number	Note ID
QRadar.Note.Text	string	Note text
QRadar.Note.CreateTime	date	The creation time of the note
QRadar.Note.CreatedBy	string	The user who created the note

Command Example

!qradar-get-note offense_id=78 note_id=190 fields=id,create_time

Context Example

{
    "QRadar": {
        "Note": {
            "Text": "Demisto has the best documentation!",
            "CreateTime": "2018-10-29T13:26:57.579000Z",
            "CreatedBy": "API_user: admin",
            "ID": 190
        }
    }
}

Human Readable Output

12. Get a reference by the reference name

Information about the reference set that had data added or updated. This returns information set but not the contained data. This feature is supported from version 8.1 and later.

Base Command

qradar-get-reference-by-name

Input

Argument Name	Description	Required
ref_name	The name of the requested reference.	Required
headers	Table headers to use the human readable output (if not specified, will show all table headers)	Optional
date_value	If true, will try to convert the data values to an ISO-8601 string	Optional

Context Output

Path	Type	Description
QRadar.Reference.Name	string	The name of the reference set
QRadar.Reference.CreationTime	date	The creation time (ISO) of the reference
QRadar.Reference.ElementType	string	Reference element type
QRadar.Reference.NumberOfElements	number	Number of elements
QRadar.Reference.TimeToLive	string	Reference time to live
QRadar.Reference.TimeoutType	string	Reference timeout type (UNKNOWN, FIRST_SEEN, LAST_SEEN)
QRadar.Reference.Data	unknown	Reference set items

Command Example

!qradar-get-reference-by-name ref_name=Date date_value=True

Context Example

{
    "QRadar": {
        "Reference": {
            "Name": "Date",
            "CreationTime": "2018-11-27T11:34:23.110000Z",
            "TimeoutType": "UNKNOWN",
            "ElementType": "DATE",
            "Data": [
                {
                    "Source": "reference data api",
                    "Value": "2018-11-27T11:34:23.000000Z",
                    "LastSeen": "2018-11-27T11:34:59.552000Z",
                    "FirstSeen": "2018-11-27T11:34:59.552000Z"
                }
            ],
            "NumberOfElements": 1
        }
    }
}

Human Readable Output

13. Create a reference set

Creates a new reference set. If the specified name is already in use, the command will fail.

Base Command

qradar-create-reference-set

Input

Argument Name	Description	Required
ref_name	Reference name to be created	Required
element_type	The element type for the values allowed in the reference set. The allowed values are: ALN (alphanumeric), ALNIC (alphanumeric ignore case), IP (IP address), NUM (numeric), PORT (port number) or DATE. Note that date values need to be represented in milliseconds since the Unix Epoch January 1st 1970.	Required
timeout_type	The allowed values are "FIRST_SEEN", LAST_SEEN and UNKNOWN. The default value is UNKNOWN.	Optional
time_to_live	The time to live interval, for example: "1 month" or "5 minutes"	Optional

Context Output

Path	Type	Description
QRadar.Reference.CreationTime	date	Creation time of the reference set
QRadar.Reference.ElementType	string	The element type for the values allowed in the reference set. The allowed values are: ALN (alphanumeric), ALNIC (alphanumeric ignore case), IP (IP address), NUM (numeric), PORT (port number) or DATE.
QRadar.Reference.Name	string	Name of the reference set
QRadar.Reference.NumberOfElements	number	Number of elements in the created reference set.
QRadar.Reference.TimeoutType	string	Timeout type of the reference (FIRST_SEEN, LAST_SEEN and UNKNOWN)

Command Example

!qradar-create-reference-set element_type=DATE ref_name=Date

Context Example

{
    "QRadar": {
        "Reference": {
            "TimeoutType": "UNKNOWN",
            "ElementType": "DATE",
            "CreationTime": "2018-11-27T11:34:23.000000Z",
            "Name": "Date",
            "NumberOfElements": 1
        }
    }
}

Human Readable Output

14. Delete a reference

Deletes a reference set corresponding to the name provided.

Base Command

qradar-delete-reference-set

Input

Argument Name	Description	Required
ref_name	The name of reference set to delete	Required

Context Output

There is no context output for this command.

Command Example

!qradar-delete-reference-set ref_name=Date

Human Readable Output

15. Create a value in a reference set

Creates a value in a reference set.

Base Command

qradar-create-reference-set-value

Input

Argument Name	Description	Required
ref_name	The name of the reference set to add or update a value in	Required
value	The value to add or update in the reference set. Date values must be represented in milliseconds since the Unix Epoch January 1 1970.	Required
source	An indication of where the data originated. The default value is 'reference data api'.	Optional
date_value	If true, will convert the value argument from the date format %Y-%m-%dT%H:%M:%S.%f000Z' (e.g., 2018-11-06T08:56:41.000000Z) to epoch.	Optional

Context Output

Path	Type	Description
QRadar.Reference.Name	string	The name of the reference set
QRadar.Reference.CreationTime	date	The creation time (ISO) of the reference
QRadar.Reference.ElementType	string	Reference element type
QRadar.Reference.NumberOfElements	number	Number of elements
QRadar.Reference.TimeoutType	string	Reference timeout type (UNKNOWN, FIRST_SEEN, LAST_SEEN)

Command Example

These command examples will create the same result in the reference set 'Date'.

The first example provides a value in time string format instead of an epoch value.
Reference set of element type 'DATE' has to be populated with epoch values, however, when the argument date_value is set to True, the integration translates the input to epoch value. So even though the input was provided as a time string, the actual value in the reference set will be populated with the equivalent epoch value.

!qradar-create-reference-set-value ref_name=Date value=2018-11-27T11:34:23.110000Z date_value=True

!qradar-create-reference-set-value ref_name=Date value=1543318463000

Context Example

{
    "QRadar": {
        "Reference": {
            "TimeoutType": "UNKNOWN",
            "ElementType": "DATE",
            "CreationTime": "2018-11-27T11:34:23.110000Z",
            "Name": "Date",
            "NumberOfElements": 1
        }
    }
}

Human Readable Output

16. Add or update a value in a reference set

Adds or updates a value in a reference set.

Base Command

qradar-update-reference-set-value

Input

Argument Name	Description	Required
ref_name	The name of the reference set to add or update a value in.	Required
value	The value to add or update in the reference set. Date values must be represented in milliseconds since the Unix Epoch January 1st 1970.	Required
source	An indication of where the data originated. The default value is 'reference data api'.	Optional
date_value	If true, will convert the value argument from the date format %Y-%m-%dT%H:%M:%S.%f000Z' (e.g., 2018-11-06T08:56:41.000000Z) to epoch.	Optional

Context Output

Path	Type	Description
QRadar.Reference.Name	string	The name of the reference set
QRadar.Reference.CreationTime	date	The creation time (ISO) of the reference
QRadar.Reference.ElementType	string	Reference element type
QRadar.Reference.NumberOfElements	number	Number of elements
QRadar.Reference.TimeoutType	string	Reference timeout type (UNKNOWN, FIRST_SEEN, LAST_SEEN)

Command Example

!qradar-update-reference-set-value ref_name="Documentation Reference" value="Important information" source="Documentation1"

Context Example

{
    "QRadar": {
        "Reference": {
            "TimeoutType": "UNKNOWN",
            "ElementType": "ALN",
            "CreationTime": "2018-11-21T11:42:25.492000Z",
            "Name": "Documentation Reference",
            "NumberOfElements": 1
        }
    }
}

Human Readable Output

17. Delete a value from a reference set

Deletes a value from a reference set.

Base Command

qradar-delete-reference-set-value

Input

Argument Name	Description	Required
ref_name	The name of the reference set to remove a value from	Required
value	The value to remove from the reference set	Required
date_value	If true, will convert the value argument from the date format %Y-%m-%dT%H:%M:%S.%f000Z' (e.g., 2018-11-06T08:56:41.000000Z) to epoch.	Optional

Context Output

Path	Type	Description
QRadar.Reference.Name	string	The name of the reference set
QRadar.Reference.CreationTime	date	The creation time (ISO) of the reference
QRadar.Reference.ElementType	string	Reference element type
QRadar.Reference.NumberOfElements	number	Number of elements
QRadar.Reference.TimeoutType	string	Reference timeout type (UNKNOWN, FIRST_SEEN, LAST_SEEN)

Command Example

These command examples will create the same result in the reference set 'Date'.

!qradar-delete-reference-set-value ref_name=Date value=2018-11-27T11:34:23.000000Z date_value=True

!qradar-delete-reference-set-value ref_name=Date value=1543318463000

Context Example

{
    "QRadar": {
        "Reference": {
            "TimeoutType": "UNKNOWN",
            "ElementType": "DATE",
            "CreationTime": "2018-11-27T11:34:23.110000Z",
            "Name": "Date",
            "NumberOfElements": 0
        }
    }
}

Human Readable Output

Configuration parameters

server — Server URL (e.g. https://192.168.0.1) (required)
credentials — Username
token — Authentication token
query — Query to fetch offenses
offensesPerCall — Number of offenses to pull per API call
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings
isFetch — Fetch incidents
incidentType — Incident type
full_enrich — Full Incident Enrichment
enrich_size — Number of addresses to enrich per API call

Commands (26)

qr-get-assets Deprecated
List all assets found in the model
qr-get-search Deprecated
Gets a specific search id and state
qr-get-search-results Deprecated
Gets search results
qr-offenses Deprecated
Gets offenses from QRadar
qr-searches Deprecated
Searches in QRadar
qr-update-offense Deprecated
Update an offense
qradar-create-note
Create a note on an offense
qradar-create-reference-set
Creates a new reference set. If the provided name is already in use, this command will fail
qradar-create-reference-set-value
Add or update a value in a reference set.
qradar-delete-reference-set
Deletes a reference set corresponding to the name provided.
qradar-delete-reference-set-value
Deletes a value in a reference set.
qradar-get-asset-by-id
Retrieves the asset by id
qradar-get-assets
List all assets found in the model
qradar-get-closing-reasons
Get closing reasons
qradar-get-domain-by-id
Retrieves Domain information By ID
qradar-get-domains
Retrieve all Domains
qradar-get-note
Retrieve a note for an offense
qradar-get-reference-by-name
Information about the reference set that had data added or updated. This returns information set but not the contained data. This feature is supported from version 8.1 and upward.
qradar-get-search
Gets a specific search id and status
qradar-get-search-results
Gets search results
qradar-offense-by-id
Gets offense with matching offense ID from qradar
qradar-offenses
Gets offenses from QRadar
qradar-searches
Searches in QRadar using AQL. It is highly recommended to use the playbook 'QRadarFullSearch' instead of this command - it will execute the search, and will return the result.
qradar-update-offense
Update an offense
qradar-update-reference-set-value
Adds or updates a value in a reference set.
qradar-upload-indicators
Uploads indicators from Demisto to Qradar. This command requires Cortex SOAR v5.5 or later.

Source

QRadar.py QRadar_test.py QRadar.yml QRadar_description.md

Download History Raw

import pytest
import demistomock as demisto
import copy
from random import randrange


@pytest.fixture(autouse=True)
def init_tests(mocker):
    mocker.patch.object(demisto, 'params', return_value={'server': 'www.qradar.com', 'token': 'token', 'proxy': True})


def test_enrich_offense_res_with_source_and_destination_address_normal(mocker):
    """
    Given:
        - Offense raw response was fetched successfully with source and destination addresses IDs
    When
        - I enrich the offense with source and destination addresses
    Then
        - The offense result will have the source and destination addresses
    """
    import QRadar as qradar
    # Given:
    #     - Offense raw response was fetched successfully with source and destination addresses IDs
    mocker.patch.object(qradar, 'extract_source_and_destination_addresses_ids',
                        return_value=(SOURCE_ADDR_IDS_DICT, DEST_ADDR_IDS_DICT))
    mocker.patch.object(qradar, 'enrich_source_addresses_dict')
    mocker.patch.object(qradar, 'enrich_destination_addresses_dict')
    # When
    #     - I enrich the offense with source and destination addresses
    enriched_offense = qradar.enrich_offense_res_with_source_and_destination_address(OFFENSE_RAW_RESULT)
    # Then
    #     - The offense result will have the source and destination addresses
    assert enriched_offense[0]['source_address_ids'] == ENRICH_OFFENSES_ADDR_EXPECTED[0]['source_address_ids']
    assert enriched_offense[0]['local_destination_address_ids'] == ENRICH_OFFENSES_ADDR_EXPECTED[0][
        'local_destination_address_ids']


def test_enrich_offense_res_with_source_and_destination_address_exception(mocker):
    """
    Given:
        - Offense raw response was fetched successfully with source and destination addresses IDs
    When
        - I enrich the offense with source and destination addresses, but encounter an exception in the middle
    Then
        - The offense result will be the same as the raw offense response
    """
    import QRadar as qradar
    # Given:
    #     - Offense raw response was fetched successfully with source and destination addresses IDs
    mocker.patch.object(qradar, 'extract_source_and_destination_addresses_ids',
                        return_value=(SOURCE_ADDR_IDS_DICT, DEST_ADDR_IDS_DICT))
    # When
    #     - I enrich the offense with source and destination addresses, but encounter an exception in the middle
    mocker.patch.object(qradar, 'enrich_source_addresses_dict', side_effect=Exception('Raised exception'))
    # Then
    #     - The offense result will be the same as the raw offense response
    assert qradar.enrich_offense_res_with_source_and_destination_address(OFFENSE_RAW_RESULT) == OFFENSE_RAW_RESULT


def test_get_reference_by_name(mocker):
    """
    Given:
        - There's a reference set with non-url safe chars
    When
        - I fetch reference by name
    Then
        - The rest API endpoint will be called with URL safe chars
    """
    import QRadar as qradar
    mocker.patch.object(qradar, 'send_request')
    # Given:
    #     - There's a reference set with non-url safe chars
    # When
    #     - I fetch reference by name
    qradar.get_ref_set(NON_URL_SAFE_MSG)
    # Then
    #     - The rest API endpoint will be called with URL safe chars
    qradar.send_request.assert_called_with('GET', 'www.qradar.com/api/reference_data/sets/{}'.format(
        NON_URL_SAFE_MSG_URL_ENCODED), REQUEST_HEADERS, params={})


def test_delete_reference_set(mocker):
    """
    Given:
        - There's a reference set with non-url safe chars
    When
        - I delete a reference by name
    Then
        - The rest API endpoint will be called with URL safe chars
    """
    import QRadar as qradar
    mocker.patch.object(qradar, 'send_request')
    # Given:
    #     - There's a reference set with non-url safe chars
    # When
    #     - I delete a reference by name
    qradar.delete_reference_set(NON_URL_SAFE_MSG)
    # Then
    #     - The rest API endpoint will be called with URL safe chars
    qradar.send_request.assert_called_with('DELETE', 'www.qradar.com/api/reference_data/sets/{}'.format(
        NON_URL_SAFE_MSG_URL_ENCODED))


def test_update_reference_set_value(mocker):
    """
    Given:
        - There's a reference set with non-url safe chars
    When
        - I fetch reference value by name
    Then
        - The rest API endpoint will be called with URL safe chars
    """
    import QRadar as qradar
    mocker.patch.object(qradar, 'send_request')
    # Given:
    #     - There's a reference set with non-url safe chars
    # When
    #     - I fetch reference value by name
    qradar.update_reference_set_value(NON_URL_SAFE_MSG, 'value')
    # Then
    #     - The rest API endpoint will be called with URL safe chars
    qradar.send_request.assert_called_with('POST', 'www.qradar.com/api/reference_data/sets/{}'.format(
        NON_URL_SAFE_MSG_URL_ENCODED), params={'name': NON_URL_SAFE_MSG, 'value': 'value'})


def test_delete_reference_set_value(mocker):
    """
    Given:
        - There's a reference set with non-url safe chars
    When
        - I delete a reference value by name
    Then
        - The rest API endpoint will be called with URL safe chars
    """
    import QRadar as qradar
    mocker.patch.object(qradar, 'send_request')
    # Given:
    #     - There's a reference set with non-url safe chars
    # When
    #     - I delete a reference value by name
    qradar.delete_reference_set_value(NON_URL_SAFE_MSG, 'value')
    # Then
    #     - The rest API endpoint will be called with URL safe chars
    qradar.send_request.assert_called_with('DELETE', 'www.qradar.com/api/reference_data/sets/{}/value'.format(
        NON_URL_SAFE_MSG_URL_ENCODED), params={'name': NON_URL_SAFE_MSG, 'value': 'value'})


def test_create_incident_from_offense():
    """
    Given:
        - There's an offense
    When:
        - I fetch incidents
    Then:
        - The function will create an incident from the offense
    """
    import QRadar as qradar
    incident = qradar.create_incident_from_offense(OFFENSE_RAW_RESULT[0])
    assert incident['name'] == INCIDENT_RESULT['name']


def test_create_incident_from_offense_no_description():
    """
    Given:
        - There's an offense
    When:
        - I fetch incidents
    Then:
        - The function will create an incident from the offense
    """
    import QRadar as qradar
    expected_incident_name = '49473 '

    raw_offense = copy.deepcopy(OFFENSE_RAW_RESULT[0])
    raw_offense['description'] = ''
    incident = qradar.create_incident_from_offense(raw_offense)
    assert incident['name'] == expected_incident_name

    raw_offense['description'] = None
    incident = qradar.create_incident_from_offense(raw_offense)
    assert incident['name'] == expected_incident_name


def test_create_incident_from_offense_new_line_description():
    """
    Given:
        - There's an offense with \n in its description
    When:
        - I fetch incidents
    Then:
        - The function will create an incident from the offense without \n in the incident name
    """
    import QRadar as qradar
    raw_offense = copy.deepcopy(OFFENSE_RAW_RESULT[0])
    raw_offense['description'] = '\n{}\n'.format(raw_offense['description'])
    incident = qradar.create_incident_from_offense(raw_offense)

    # assert incident['name'] was altered correctly
    assert incident['name'] == '49473  Activacion '

    # assert offense['description'] wasn't altered
    description_asserted = False
    for label in incident['labels']:
        if label.get('type') == 'description':
            assert label.get('value') == '\nActivacion\n'
            description_asserted = True
    assert description_asserted


def test_get_entry_for_object():
    """
    Given:
        There's a title, obj, contents, and headers
    When:
        I call get_entry_for_object
    Then:
        get_entry_for_object will return a an entry with the given headers
    """
    import QRadar as qradar
    title = "Title"
    obj = {'id': 1, 'name': 'test', 'field_to_drop': 'sensitive data'}
    contents = {'test': 'test'}
    headers = u'name'
    # single header
    entry = qradar.get_entry_for_object(title, obj, contents, headers)
    assert entry['HumanReadable'] == '### Title\n|name|\n|---|\n| test |\n'
    entry = qradar.get_entry_for_object(title, obj, contents, str(headers))
    assert entry['HumanReadable'] == '### Title\n|name|\n|---|\n| test |\n'
    assert entry['EntryContext'] == obj
    assert entry['Contents'] == contents

    # multiple headers
    headers = ['name', 'id']
    entry = qradar.get_entry_for_object(title, obj, contents, headers)
    assert 'sensitive data' not in entry['HumanReadable']
    assert 'id' in entry['HumanReadable']
    assert 'name' in entry['HumanReadable']
    assert entry['EntryContext'] == obj
    assert entry['Contents'] == contents


def test_upload_indicators_command_indicators_found(mocker):
    """
    Given:
        - There are indicators in Demisto
    When:
        - Need to upload indicators to QRadar reference set
    Then:
        - The function will upload indicators to QRadar reference set
    """

    import QRadar as qradar
    mocker.patch.object(demisto, 'args', return_value={'ref_name': 'test_ref_set', 'limit': '20', 'page': '0'})
    mocker.patch.object(qradar, 'check_ref_set_exist', return_value=REF_SET_DATA)
    mocker.patch.object(qradar, 'get_indicators_list', return_value=INDICATORS_LIST)
    mocker.patch.object(qradar, 'get_ref_set', return_value=RAW_RESPONSE)
    mocker.patch.object(qradar, 'upload_indicators_list_request', return_value=RAW_RESPONSE)
    mocker.patch.object(qradar, 'enrich_reference_set_result', return_value=REF_SET_DATA)
    res = qradar.upload_indicators_command()
    assert res[2]['name'] == 'test_ref_set'
    assert res[2]['number_of_elements'] == 42
    assert res[2]['element_type'] == 'ALN'


def test_upload_indicators_command_no_indicators_found(mocker):
    """
    Given:
        - There are no indicators in Demisto
    When:
        - Need to upload indicators to QRadar reference set
    Then:
        - The function will not upload indicators to QRadar reference set
    """

    import QRadar as qradar
    mocker.patch.object(demisto, 'args', return_value={'ref_name': 'test_ref_set', 'limit': '20', 'page': '0'})
    mocker.patch.object(qradar, 'check_ref_set_exist', return_value=REF_SET_DATA_NO_INDICATORS)
    mocker.patch.object(qradar, 'get_indicators_list', return_value=([], []))
    res, _, _ = qradar.upload_indicators_command()
    assert res == "No indicators found, Reference set test_ref_set didn't change"


def test_fetch_incidents(mocker):
    """
    Given:
        - There are 3 fetchable offenses in the system with random gaps between them
        - Last run is empty
        - The first fetch is unsuccessful
    When:
        - fetch-incidents is called

    Then:
        - The integration will try to fetch until it fetches the first available offense
        - The integration will set the last run to be GTE to the last fetched offense
    """
    import QRadar as qradar
    # init
    offenses_num = 3
    gap_between_offenses = randrange(5)
    get_offenses_results = []
    first_offense_id = None
    # set offenses_per_call for fetch
    qradar.OFFENSES_PER_CALL = 1

    # prepare offenses with gaps between them
    for i in range(offenses_num - 1):
        for j in range(gap_between_offenses):
            get_offenses_results.append([])
        offense = copy.deepcopy(OFFENSE_RAW_RESULT[0])
        offense['id'] = len(get_offenses_results)
        if first_offense_id is None:
            first_offense_id = offense['id']
        get_offenses_results.append([offense])

    # empty result should be fetched first - triggers look for limit
    get_offenses_results.insert(0, [])
    # last offense should be fetched 2nd - sets limit
    get_offenses_results.insert(1, get_offenses_results[-1])

    mocker.patch.object(demisto, 'params', return_value={'full_enrich': False})
    mocker.patch.object(qradar, 'get_offenses', side_effect=get_offenses_results)
    set_last_run_mock = mocker.patch.object(demisto, 'setLastRun')

    qradar.fetch_incidents()
    assert first_offense_id <= set_last_run_mock.call_args[0][0]['id']


""" CONSTANTS """
REQUEST_HEADERS = {'Content-Type': 'application/json', 'SEC': 'token'}
NON_URL_SAFE_MSG = 'non-safe/;/?:@=&"<>#%{}|\\^~[] `'
NON_URL_SAFE_MSG_URL_ENCODED = 'non-safe%2F%3B%2F%3F%3A%40%3D%26%22%3C%3E%23%25%7B%7D%7C%5C%5E%7E%5B%5D%20%60'

""" API RAW RESULTS """

OFFENSE_RAW_RESULT = [{
    "assigned_to": "mocker",
    "categories": [
        "Unknown Potential Exploit Attack",
        "Potential Web Exploit"
    ],
    "category_count": 2,
    "close_time": None,
    "closing_reason_id": None,
    "closing_user": None,
    "credibility": 2,
    "description": "Activacion",
    "destination_networks": [
        "mock_net"
    ],
    "device_count": 2,
    "domain_id": 27,
    "event_count": 2,
    "flow_count": 0,
    "follow_up": False,
    "id": 49473,
    "inactive": False,
    "last_updated_time": 1563433313767,
    "local_destination_address_ids": [
        1234412
    ],
    "local_destination_count": 1,
    "log_sources": [
        {
            "id": 115,
            "name": "Custom Rule Engine",
            "type_id": 18,
            "type_name": "EventCRE"
        },
        {
            "id": 2439,
            "name": "FortiGate 02",
            "type_id": 73,
            "type_name": "FortiGate"
        }
    ],
    "magnitude": 4,
    "offense_source": "192.168.0.1",
    "offense_type": 0,
    "policy_category_count": 0,
    "protected": False,
    "relevance": 4,
    "remote_destination_count": 0,
    "rules": [
        {
            "id": 166,
            "type": "CRE_RULE"
        }
    ],
    "security_category_count": 2,
    "severity": 6,
    "source_address_ids": [
        294626
    ],
    "source_count": 1,
    "source_network": "other",
    "start_time": 1563433305606,
    "status": "OPEN",
    "username_count": 0
}]

""" FUNCTION MOCK RESULTS """

SOURCE_ADDR_IDS_DICT = {
    294626: '192.168.0.1'
}
DEST_ADDR_IDS_DICT = {
    1234412: '192.168.0.2'
}

ENRICH_OFFENSES_ADDR_EXPECTED = [
    {'offense_source': '192.168.0.1', 'status': 'OPEN', 'remote_destination_count': 0, 'source_count': 1,
     'description': 'Activacion', 'rules': [{'type': 'CRE_RULE', 'id': 166}], 'destination_networks': ['mock_net'],
     'source_address_ids': ['192.168.0.1'], 'policy_category_count': 0, 'last_updated_time': 1563433313767,
     'offense_type': 0, 'category_count': 2, 'inactive': False, 'security_category_count': 2, 'flow_count': 0,
     'protected': False, 'domain_id': 27, 'categories': ['Unknown Potential Exploit Attack', 'Potential Web Exploit'],
     'follow_up': False, 'close_time': None, 'start_time': 1563433305606, 'severity': 6, 'event_count': 2,
     'credibility': 2, 'local_destination_count': 1, 'closing_reason_id': None, 'device_count': 2, 'id': 49473,
     'username_count': 0, 'magnitude': 4, 'closing_user': None, 'source_network': 'other', 'assigned_to': 'mocker',
     'relevance': 4, 'local_destination_address_ids': ['192.168.0.2'],
     'log_sources': [{'type_name': 'EventCRE', 'type_id': 18, 'id': 115, 'name': 'Custom Rule Engine'},
                     {'type_name': 'FortiGate', 'type_id': 73, 'id': 2439, 'name': 'FortiGate 02'}]}]

INCIDENT_RESULT = {
    "labels": [
        {
            "type": "offense_source",
            "value": "192.168.0.1"
        },
        {
            "type": "status",
            "value": "OPEN"
        },
        {
            "type": "remote_destination_count",
            "value": "0"
        },
        {
            "type": "source_count",
            "value": "1"
        },
        {
            "type": "description",
            "value": "Activacion"
        },
        {
            "type": "rules",
            "value": "[{'type': 'CRE_RULE', 'id': 166}]"
        },
        {
            "type": "destination_networks",
            "value": "['mock_net']"
        },
        {
            "type": "source_address_ids",
            "value": "[294626]"
        },
        {
            "type": "policy_category_count",
            "value": "0"
        },
        {
            "type": "last_updated_time",
            "value": "1563433313767"
        },
        {
            "type": "offense_type",
            "value": "0"
        },
        {
            "type": "category_count",
            "value": "2"
        },
        {
            "type": "inactive",
            "value": "False"
        },
        {
            "type": "security_category_count",
            "value": "2"
        },
        {
            "type": "flow_count",
            "value": "0"
        },
        {
            "type": "protected",
            "value": "False"
        },
        {
            "type": "domain_id",
            "value": "27"
        },
        {
            "type": "categories",
            "value": "['Unknown Potential Exploit Attack', 'Potential Web Exploit']"
        },
        {
            "type": "follow_up",
            "value": "False"
        },
        {
            "type": "close_time",
            "value": "None"
        },
        {
            "type": "start_time",
            "value": "1563433305606"
        },
        {
            "type": "severity",
            "value": "6"
        },
        {
            "type": "event_count",
            "value": "2"
        },
        {
            "type": "credibility",
            "value": "2"
        },
        {
            "type": "local_destination_count",
            "value": "1"
        },
        {
            "type": "closing_reason_id",
            "value": "None"
        },
        {
            "type": "device_count",
            "value": "2"
        },
        {
            "type": "id",
            "value": "49473"
        },
        {
            "type": "username_count",
            "value": "0"
        },
        {
            "type": "magnitude",
            "value": "4"
        },
        {
            "type": "closing_user",
            "value": "None"
        },
        {
            "type": "source_network",
            "value": "other"
        },
        {
            "type": "assigned_to",
            "value": "mocker"
        },
        {
            "type": "relevance",
            "value": "4"
        },
        {
            "type": "local_destination_address_ids",
            "value": "[1234412]"
        },
        {
            "type": "log_sources",
            "value": "[{'type_name': 'EventCRE', 'type_id': 18, 'id': 115, 'name': 'Custom Rule Engine'}, {'type_name':"
                     " 'FortiGate', 'type_id': 73, 'id': 2439, 'name': 'FortiGate 02'}]"
        }
    ],
    "name": "49473 Activacion",
    "occurred": "2019-07-18T07:01:45.606000Z",
    "rawJSON": "{\"offense_source\": \"192.168.0.1\", \"status\": \"OPEN\", \"remote_destination_count\": 0, \"source_"
               "count\": 1, \"description\": \"Activacion\", \"rules\": [{\"type\": \"CRE_RULE\", \"id\": 166}], \"de"
               "stination_networks\": [\"mock_net\"], \"source_address_ids\": [294626], \"policy_category_count\": 0, "
               "\"last_updated_time\": 1563433313767, \"offense_type\": 0, \"category_count\": 2, \"inactive\": false, "
               "\"security_category_count\": 2, \"flow_count\": 0, \"protected\": false, \"domain_id\": 27, \"cate"
               "gories\": [\"Unknown Potential Exploit Attack\", \"Potential Web Exploit\"], \"follow_up\": false, \"c"
               "lose_time\": null, \"start_time\": 1563433305606, \"severity\": 6, \"event_count\": 2, \"credibility\":"
               " 2, \"local_destination_count\": 1, \"closing_reason_id\": null, \"device_count\": 2, \"id\": 4947"
               "3, \"username_count\": 0, \"magnitude\": 4, \"closing_user\": null, \"source_network\": \"other\", \"as"
               "signed_to\": \"mocker\", \"relevance\": 4, \"local_destination_address_ids\": [1234412], \"log_sour"
               "ces\": [{\"type_name\": \"EventCRE\", \"type_id\": 18, \"id\": 115, \"name\": \"Custom Rule Engine\"}, "
               "{\"type_name\": \"FortiGate\", \"type_id\": 73, \"id\": 2439, \"name\": \"FortiGate 02\"}]}"
}

INDICATORS_LIST = [{'indicator_type': 'File', 'value': 'file_test'},
                   {'indicator_type': 'Domain', 'value': 'domain.com'}]

RAW_RESPONSE = {
    'timeout_type': 'UNKNOWN',
    'element_type': 'ALN',
    'creation_time': '00000',
    'number_of_elements': 42,
    'name': 'test_ref_set'
}
REF_SET_DATA = {
    'TimeoutType': 'UNKNOWN',
    'ElementType': 'ALN',
    'CreationTime': '00000',
    'NumberOfElements': 42,
    'Name': 'test_ref_set'
}


REF_SET_DATA_NO_INDICATORS = {
    'Name': 'test_ref_set',
    'NumberOfElements': 0,
    'ElementType': 'ALN',
    'TimeoutType': 'UNKNOWN',
}


RAW_RESPONSE_NO_INDICATORS = {
    'TimeoutType': 'UNKNOWN',
    'ElementType': 'ALN',
    'CreationTime': '00000',
    'NumberOfElements': 0,
    'Name': 'test_ref_set'
}