QRadar_v2 Deprecated

Deprecated. Use the IBM QRadar v3 integration instead. Fetch offenses from QRadar using Cortex XSOAR. Supports API versions until 10.0. You can fetch the offenses with their related events and assets by creating a comma-separated list of event fields.

Analytics & SIEM · IBM QRadar

Configuration parameters

  • incidentType — Incident type
  • server — Server URL (e.g. https://192.168.0.1) (required)
  • credentials — Username / API Key (see '?')
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • longRunning — Long running instance
  • query — Query to fetch offenses
  • offenses_per_fetch — Number of offenses to pull per API call (max 50)
  • ip_enrich — Incident IP Enrichment
  • asset_enrich — Incident Asset Enrichment
  • events_columns — Event fields to return from the events query (CAUTION this parameter is correlated to the incoming mapper, and changing the values may adversely affect mapping)
  • fetch_mode — Fetch mode (required)
  • events_limit — Max number of events per incident
  • adv_params — Advanced Parameters

Commands (23)

  • get-mapping-fields

    Returns the list of fields for an incident type. This command should be used for debugging purposes.

  • qradar-create-note

    Create a note on an offense.

  • qradar-create-reference-set

    Creates a new reference set. If the provided name is already in use, this command will fail.

  • qradar-create-reference-set-value

    Add or update a value in a reference set.

  • qradar-delete-reference-set

    Deletes a reference set corresponding to the name provided.

  • qradar-delete-reference-set-value

    Deletes a value in a reference set.

  • qradar-get-asset-by-id

    Retrieves the asset by id.

  • qradar-get-assets

    List all assets found in the model.

  • qradar-get-closing-reasons

    Get closing reasons.

  • qradar-get-custom-properties

    Retrieves a list of event regex properties.

  • qradar-get-domain-by-id

    Retrieves Domain information By ID.

  • qradar-get-domains

    Retrieve all Domains.

  • qradar-get-note

    Retrieve a note for an offense.

  • qradar-get-reference-by-name

    Information about the reference set that had data added or updated. This returns the information set, but not the contained data. This feature is supported from version 8.1 and upward.

  • qradar-get-search

    Gets a specific search id and status.

  • qradar-get-search-results

    Gets search results.

  • qradar-offense-by-id

    Gets offense with matching offense ID from qradar.

  • qradar-offenses

    Gets offenses from QRadar.

  • qradar-reset-last-run

    Reset fetch incidents last run value, which resets the fetch to its initial fetch state (will try to fetch first available offense).

  • qradar-searches

    Searches in QRadar using AQL. It is highly recommended to use the playbook 'QRadarFullSearch' instead of this command - it will execute the search, and will return the result.

  • qradar-update-offense

    Update an offense.

  • qradar-update-reference-set-value

    Adds or updates a value in a reference set.

  • qradar-upload-indicators

    Uploads indicators from Demisto to Qradar.