QRadar v3

IBM QRadar SIEM helps security teams accurately detect and prioritize threats across the enterprise, supports API versions 10.1 and above. Provides intelligent insights that enable teams to respond quickly to reduce the impact of incidents.
This integration was integrated and tested with version 14-20 of QRadar v3

This is the default integration for this content pack when configured by the Data Onboarder in Cortex XSIAM.

Configure IBM QRadar v3 in Cortex

Required Permissions

Mapping Limitation for Cortex XSOAR Versions below 6.0.0

The Pull from instance option to create a new mapper is not supported in Cortex XSOAR versions below 6.0.0.

Creating a Classifier Using the Pull from instance Parameter

QRadar fetches incidents using a long-running execution, not in real time. Therefore, Pull from instance pulls incidents from the QRadar service to create a classifier using samples, not real time data. This results in seeing the latest sample stored, and not the latest offense that was fetched.

Important Note Regarding the Query to fetch offenses Parameter

The Query to fetch offenses feature enables defining a specific query for offenses to be retrieved, e.g., ‘status = OPEN and id = 5’. The QRadar integration keeps track of IDs that have already been fetched in order to avoid duplicate fetching.
If you change the Query to fetch offenses value, it will not re-fetch offenses that have already been fetched. To re-fetch those offenses, run the qradar-reset-last-run command.
Note:
The list of QRadar IDs that were already fetched will be reset and duplicate offenses could be re-fetched, depending on the user query.

In case of setting a query with the intent to fetch specific offenses or older offenses, make sure that the First fetch timestamp parameter is set to a value that covers the desired time range for the offenses to be fetched. If using an already existing instance that has performed fetch, run the qradar-reset-last-run command before starting the fetch with the new query.

Migration from QRadar v2 to QRadar v3

Every command and playbook that runs in QRadar v2 also runs in QRadar v3. No adjustments are required.

Additions and Changes from QRadar v2 to QRadar v3

New Commands

• qradar-rule-groups-list
• qradar-searches-list
• qradar-geolocations-for-ip
• qradar-log-sources-list
• qradar-upload-indicators
• get-modified-remote-data

Command Name Changes

Mirroring

This integration supports in mirroring from QRadar offenses to Cortex XSOAR.
When a field of an offense is updated in QRadar services, the update is mirrored in Cortex XSOAR.

Mirroring Events

• Mirroring events from QRadar to Cortex XSOAR is supported via the Mirror Offense and Events option.
• Events will only be mirrored in the incoming direction.
• Mirroring events will only work when the Long running instance parameter is enabled.
• Filtering events using the events_limit and events_columns options for mirrored incidents will be the same as in the fetched incidents.
• The integration will always mirror the events that occurred first in each offense.

For more information about mirroring configurations, see here.

Use the API Token Instead of Username and Password

• In the Username / API Key field, type _api_token_key.
• In the Password field, type your API token.

Choose Your API Version

1. Visit the QRadar API versions page for a full list of available API versions according to the QRadar version.
2. Choose one of the API versions listed under the Supported REST API versions column in the line corresponding to your QRadar version.

Note:
If you’re uncertain which API version to use, it is recommended to use the latest API version listed in the Supported REST API versions column in the line corresponding to your QRadar version.

View Your QRadar Version

1. Enter QRadar service.
2. Click the Menu toolbar. A scrolling toolbar will appear.
3. Click About. A new window will appear with the details of your QRadar version.

Troubleshooting

Fetch with Events Retries

When “Fetch with events” is configured, the integration will fetch the offense events from IBM QRadar.
Nevertheless, some events may not be available when trying to fetch them during an incident creation. If Retry events fetch is enabled, the integration tries to fetch more events when the number fetched is less than the expected event_count. In the default setting, the integration will try 3 times, with a wait time of 100 seconds between retries.
In order to change the default values, configure the following Advanced Parameters in the instance configuration:

EVENTS_SEARCH_TRIES=<amount of tries for events search> (default 3),EVENTS_SEARCH_RETRY_SECONDS=<amount of seconds to wait between tries> (default 100),EVENTS_POLLING_TRIES=<number of times to poll for one search> (default 10),

It is recommended to enable mirroring, as it should fetch previously missed events when the offense is updated.
Alternatively, the retrieve events command can be used to retrieve the events immediately.
If the command takes too long to finish executing, try setting the interval_in_seconds to a lower value (down to a minimum of 10 seconds).

API Call Metrics

This feature collects metadata on QRadar API calls and their success status.

API Call metrics are not available for long-running commands such as fetch incidents.

API Metrics are shown in the built-in API Execution Metrics dashboard, and are available to use in custom widgets.

Duplicate Incidents

When running on an Engine Load-Balancing Group, concurrent fetches may run on multiple containers, leading to the creation of duplicate Incidents.

Recommended workarounds:

• Option A - Preserve high availability: Continue running the integration on the Load-Balancing Group for optimal fault tolerance and higher availability. Create an Incident Pre-processing Rule to drop duplicate incidents.
• Option B - Use a simplified setup: Alternatively, run the integration on a single custom engine or use the default “No engine” option if possible for a more streamlined configuration.

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

qradar-offenses-list

Gets offenses from QRadar.

Base Command

qradar-offenses-list

Input

Context Output

Command example

!qradar-offenses-list enrichment=IPs filter="status=OPEN" range=0-2

Context Example

{
    "QRadar": {
        "Offense": [
            {
                "AssignedTo": "admin",
                "Categories": [
                    "Information",
                    "Suspicious Activity",
                    "Process Creation Success",
                    "Suspicious Windows Events",
                    "User Login Attempt",
                    "Misc Login Succeeded",
                    "Virtual Machine Creation Attempt",
                    "Read Activity Attempted",
                    "Object Download Attempt"
                ],
                "Credibility": 4,
                "Description": "Detected A Successful Login From Different Geographies For the Same Username - AWSCloud (Exp Center)\n preceded by An AWS API Has Been Invoked From Kali - AWSCloud (Exp Center)\n preceded by Microsoft Word Launc\n preceded by Detected a Massive Creation of EC2 Instances - AWSCloud (Exp Center)\n containing Mail Server Info Message\n",
                "DestinationAddress": [
                    "1.1.1.1",
                    "1.1.1.1"
                ],
                "DestinationHostname": [
                    "other",
                    "Net-10-172-192.Net_192_168_0_0"
                ],
                "EventCount": 35651,
                "FlowCount": 0,
                "Followup": true,
                "ID": 14,
                "LastUpdatedTime": "2023-07-26T15:31:11.839000+00:00",
                "LinkToOffense": "https://ec2.eu.compute-1.amazonaws.com/console/do/sem/offensesummary?appName=Sem&pageId=OffenseSummary&summaryId=14",
                "Magnitude": 4,
                "OffenseSource": "userD",
                "OffenseType": "Username",
                "Protected": false,
                "Relevance": 0,
                "RemoteDestinationCount": 1,
                "Rules": [
                    {
                        "id": 102539,
                        "name": "EC: AWS Cloud - Detected An Email with An Attachment From a Spam Sender",
                        "type": "CRE_RULE"
                    },
                    {
                        "id": 102589,
                        "name": "EC: AWS Cloud - Microsoft Word Launched a Command Shell",
                        "type": "CRE_RULE"
                    },
                    {
                        "id": 102639,
                        "name": "EC: AWS Cloud - Detected A Successful Login From Different Geographies For the Same Username",
                        "type": "CRE_RULE"
                    },
                    {
                        "id": 102389,
                        "name": "EC: AWS Cloud - An AWS API Has Been Invoked From Kali",
                        "type": "CRE_RULE"
                    },
                    {
                        "id": 102439,
                        "name": "EC: AWS Cloud - A Database backup Has Been Downloaded From S3 Bucket",
                        "type": "CRE_RULE"
                    },
                    {
                        "id": 102489,
                        "name": "EC: AWS Cloud - Detected a Massive Creation of EC2 Instances",
                        "type": "CRE_RULE"
                    }
                ],
                "Severity": 10,
                "SourceAddress": [
                    "1.1.1.1",
                    "1.1.1.1",
                    "1.1.1.1",
                    "1.1.1.1"
                ],
                "StartTime": "2023-07-26T14:31:13.387000+00:00",
                "Status": "OPEN"
            },
            {
                "Categories": [
                    "Mail",
                    "System Failure"
                ],
                "Credibility": 2,
                "Description": "Flow Source/Interface Stopped Sending Flows\n",
                "DestinationAddress": [
                    "1.1.1.1"
                ],
                "DestinationHostname": [
                    "Net-10-172-192.Net_10_0_0_0"
                ],
                "EventCount": 2,
                "FlowCount": 6026,
                "Followup": true,
                "ID": 13,
                "LastUpdatedTime": "2023-06-12T08:49:50.145000+00:00",
                "LinkToOffense": "https://ec2.eu.compute-1.amazonaws.com/console/do/sem/offensesummary?appName=Sem&pageId=OffenseSummary&summaryId=13",
                "Magnitude": 1,
                "OffenseSource": "Flow Source Stopped Sending Flows",
                "OffenseType": "Rule",
                "Protected": true,
                "Relevance": 0,
                "RemoteDestinationCount": 0,
                "Rules": [
                    {
                        "id": 100270,
                        "name": "Flow Source Stopped Sending Flows",
                        "type": "CRE_RULE"
                    }
                ],
                "Severity": 1,
                "SourceAddress": [
                    "1.1.1.1",
                    "1.1.1.1",
                    "1.1.1.1"
                ],
                "StartTime": "2023-06-12T08:19:02.020000+00:00",
                "Status": "OPEN"
            },
            {
                "Categories": [
                    "User Activity"
                ],
                "Credibility": 3,
                "Description": "User Account Created and Used and Deleted within a short time frame (Exp Center)\n",
                "DestinationAddress": [
                    "1.1.1.1"
                ],
                "DestinationHostname": [
                    "Net-10-172-192.Net_172_16_0_0"
                ],
                "EventCount": 8,
                "FlowCount": 0,
                "Followup": true,
                "ID": 12,
                "LastUpdatedTime": "2023-06-12T08:17:33.008000+00:00",
                "LinkToOffense": "https://ec2.eu.compute-1.amazonaws.com/console/do/sem/offensesummary?appName=Sem&pageId=OffenseSummary&summaryId=12",
                "Magnitude": 2,
                "OffenseSource": "badadmin",
                "OffenseType": "Username",
                "Protected": true,
                "Relevance": 0,
                "RemoteDestinationCount": 0,
                "Rules": [
                    {
                        "id": 102989,
                        "name": "EC: User Account Created and Used and Removed",
                        "type": "CRE_RULE"
                    }
                ],
                "Severity": 5,
                "SourceAddress": [
                    "1.1.1.1"
                ],
                "StartTime": "2023-06-12T08:15:54.740000+00:00",
                "Status": "OPEN"
            }
        ]
    }
}

Human Readable Output

Offenses List

ID	Description	OffenseType	Status	Severity	DestinationHostname	LastUpdatedTime	Credibility	Rules	SourceAddress	AssignedTo	OffenseSource	Followup	EventCount	StartTime	FlowCount	DestinationAddress	LinkToOffense	RemoteDestinationCount	Relevance	Categories	Magnitude	Protected
14	Detected A Successful Login From Different Geographies For the Same Username - AWSCloud (Exp Center) preceded by An AWS API Has Been Invoked From Kali - AWSCloud (Exp Center) preceded by Microsoft Word Launc preceded by Detected a Massive Creation of EC2 Instances - AWSCloud (Exp Center) containing Mail Server Info Message	Username	OPEN	10	other, Net-10-172-192.Net_192_168_0_0	2023-07-26T15:31:11.839000+00:00	4	{‘id’: 102539, ‘type’: ‘CRE_RULE’, ‘name’: ‘EC: AWS Cloud - Detected An Email with An Attachment From a Spam Sender’}, {‘id’: 102589, ‘type’: ‘CRE_RULE’, ‘name’: ‘EC: AWS Cloud - Microsoft Word Launched a Command Shell’}, {‘id’: 102639, ‘type’: ‘CRE_RULE’, ‘name’: ‘EC: AWS Cloud - Detected A Successful Login From Different Geographies For the Same Username’}, {‘id’: 102389, ‘type’: ‘CRE_RULE’, ‘name’: ‘EC: AWS Cloud - An AWS API Has Been Invoked From Kali’}, {‘id’: 102439, ‘type’: ‘CRE_RULE’, ‘name’: ‘EC: AWS Cloud - A Database backup Has Been Downloaded From S3 Bucket’}, {‘id’: 102489, ‘type’: ‘CRE_RULE’, ‘name’: ‘EC: AWS Cloud - Detected a Massive Creation of EC2 Instances’}	1.1.1.1, 1.1.1.1, 1.1.1.1, 1.1.1.1	admin	userD	true	35651	2023-07-26T14:31:13.387000+00:00	0	1.1.1.1, 1.1.1.1	https://ec2.eu.compute-1.amazonaws.com/console/do/sem/offensesummary?appName=Sem&pageId=OffenseSummary&summaryId=14	1	0	Information, Suspicious Activity, Process Creation Success, Suspicious Windows Events, User Login Attempt, Misc Login Succeeded, Virtual Machine Creation Attempt, Read Activity Attempted, Object Download Attempt	4	false
13	Flow Source/Interface Stopped Sending Flows	Rule	OPEN	1	Net-10-172-192.Net_10_0_0_0	2023-06-12T08:49:50.145000+00:00	2	{‘id’: 100270, ‘type’: ‘CRE_RULE’, ‘name’: ‘Flow Source Stopped Sending Flows’}	1.1.1.1, 1.1.1.1, 1.1.1.1		Flow Source Stopped Sending Flows	true	2	2023-06-12T08:19:02.020000+00:00	6026	1.1.1.1	https://ec2-1.eu.compute-1.amazonaws.com/console/do/sem/offensesummary?appName=Sem&pageId=OffenseSummary&summaryId=13	0	0	Mail, System Failure	1	true
12	User Account Created and Used and Deleted within a short time frame (Exp Center)	Username	OPEN	5	Net-10-172-192.Net_172_16_0_0	2023-06-12T08:17:33.008000+00:00	3	{‘id’: 102989, ‘type’: ‘CRE_RULE’, ‘name’: ‘EC: User Account Created and Used and Removed’}	1.1.1.1		badadmin	true	8	2023-06-12T08:15:54.740000+00:00	0	1.1.1.1	https://ec2-3.eu.compute-1.amazonaws.com/console/do/sem/offensesummary?appName=Sem&pageId=OffenseSummary&summaryId=12	0	0	User Activity	2	true

qradar-offense-update

Updates an offense.

Base Command

qradar-offense-update

Input

Context Output

Command example

!qradar-offense-update offense_id=14 assigned_to=admin enrichment="IPs And Assets" follow_up=true status=OPEN protected=false

Context Example

{
    "QRadar": {
        "Offense": {
            "AssignedTo": "admin",
            "Categories": [
                "Information",
                "Suspicious Activity",
                "Process Creation Success",
                "Suspicious Windows Events",
                "User Login Attempt",
                "Misc Login Succeeded",
                "Virtual Machine Creation Attempt",
                "Read Activity Attempted",
                "Object Download Attempt"
            ],
            "Credibility": 4,
            "Description": "Detected A Successful Login From Different Geographies For the Same Username - AWSCloud (Exp Center)\n preceded by An AWS API Has Been Invoked From Kali - AWSCloud (Exp Center)\n preceded by Microsoft Word Launc\n preceded by Detected a Massive Creation of EC2 Instances - AWSCloud (Exp Center)\n containing Mail Server Info Message\n",
            "DestinationAddress": [
                "1.1.1.1",
                "1.1.1.1"
            ],
            "DestinationHostname": [
                "other",
                "Net-10-172-192.Net_192_168_0_0"
            ],
            "EventCount": 35651,
            "FlowCount": 0,
            "Followup": true,
            "ID": 14,
            "LastUpdatedTime": "2023-07-26T15:31:11.839000+00:00",
            "LinkToOffense": "https://ec2-1.eu.compute-1.amazonaws.com/console/do/sem/offensesummary?appName=Sem&pageId=OffenseSummary&summaryId=14",
            "Magnitude": 4,
            "OffenseSource": "userD",
            "OffenseType": "Username",
            "Protected": false,
            "Relevance": 0,
            "RemoteDestinationCount": 1,
            "Rules": [
                {
                    "id": 102539,
                    "name": "EC: AWS Cloud - Detected An Email with An Attachment From a Spam Sender",
                    "type": "CRE_RULE"
                },
                {
                    "id": 102589,
                    "name": "EC: AWS Cloud - Microsoft Word Launched a Command Shell",
                    "type": "CRE_RULE"
                },
                {
                    "id": 102639,
                    "name": "EC: AWS Cloud - Detected A Successful Login From Different Geographies For the Same Username",
                    "type": "CRE_RULE"
                },
                {
                    "id": 102389,
                    "name": "EC: AWS Cloud - An AWS API Has Been Invoked From Kali",
                    "type": "CRE_RULE"
                },
                {
                    "id": 102439,
                    "name": "EC: AWS Cloud - A Database backup Has Been Downloaded From S3 Bucket",
                    "type": "CRE_RULE"
                },
                {
                    "id": 102489,
                    "name": "EC: AWS Cloud - Detected a Massive Creation of EC2 Instances",
                    "type": "CRE_RULE"
                }
            ],
            "Severity": 10,
            "SourceAddress": [
                "1.1.1.1",
                "1.1.1.1",
                "1.1.1.1",
                "1.1.1.1"
            ],
            "StartTime": "2023-07-26T14:31:13.387000+00:00",
            "Status": "OPEN"
        }
    }
}

Human Readable Output

offense Update

ID	Description	OffenseType	Status	Severity	DestinationHostname	LastUpdatedTime	Credibility	Rules	SourceAddress	AssignedTo	OffenseSource	Followup	EventCount	StartTime	FlowCount	DestinationAddress	LinkToOffense	RemoteDestinationCount	Relevance	Categories	Magnitude	Protected
14	Detected A Successful Login From Different Geographies For the Same Username - AWSCloud (Exp Center) preceded by An AWS API Has Been Invoked From Kali - AWSCloud (Exp Center) preceded by Microsoft Word Launc preceded by Detected a Massive Creation of EC2 Instances - AWSCloud (Exp Center) containing Mail Server Info Message	Username	OPEN	10	other, Net-10-172-192.Net_192_168_0_0	2023-07-26T15:31:11.839000+00:00	4	{‘id’: 102539, ‘type’: ‘CRE_RULE’, ‘name’: ‘EC: AWS Cloud - Detected An Email with An Attachment From a Spam Sender’}, {‘id’: 102589, ‘type’: ‘CRE_RULE’, ‘name’: ‘EC: AWS Cloud - Microsoft Word Launched a Command Shell’}, {‘id’: 102639, ‘type’: ‘CRE_RULE’, ‘name’: ‘EC: AWS Cloud - Detected A Successful Login From Different Geographies For the Same Username’}, {‘id’: 102389, ‘type’: ‘CRE_RULE’, ‘name’: ‘EC: AWS Cloud - An AWS API Has Been Invoked From Kali’}, {‘id’: 102439, ‘type’: ‘CRE_RULE’, ‘name’: ‘EC: AWS Cloud - A Database backup Has Been Downloaded From S3 Bucket’}, {‘id’: 102489, ‘type’: ‘CRE_RULE’, ‘name’: ‘EC: AWS Cloud - Detected a Massive Creation of EC2 Instances’}	1.1.1.1, 1.1.1.1, 1.1.1.1, 1.1.1.1	admin	userD	true	35651	2023-07-26T14:31:13.387000+00:00	0	1.1.1.1, 1.1.1.1	https://ec2-1.eu.compute-1.amazonaws.com/console/do/sem/offensesummary?appName=Sem&pageId=OffenseSummary&summaryId=14	1	0	Information, Suspicious Activity, Process Creation Success, Suspicious Windows Events, User Login Attempt, Misc Login Succeeded, Virtual Machine Creation Attempt, Read Activity Attempted, Object Download Attempt	4	false

qradar-closing-reasons

Retrieves a list of offense closing reasons.

Base Command

qradar-closing-reasons

Input

Context Output

Command example

!qradar-closing-reasons include_deleted=true include_reserved=true

Context Example

{
    "QRadar": {
        "Offense": {
            "ClosingReasons": [
                {
                    "ID": 2,
                    "IsDeleted": false,
                    "IsReserved": false,
                    "Name": "False-Positive, Tuned"
                },
                {
                    "ID": 1,
                    "IsDeleted": false,
                    "IsReserved": false,
                    "Name": "Non-Issue"
                },
                {
                    "ID": 3,
                    "IsDeleted": false,
                    "IsReserved": false,
                    "Name": "Policy Violation"
                },
                {
                    "ID": 4,
                    "IsDeleted": false,
                    "IsReserved": true,
                    "Name": "System Change (Upgrade, Reset, etc.)"
                }
            ]
        }
    }
}

Human Readable Output

Closing Reasons

ID	Name	IsReserved	IsDeleted
2	False-Positive, Tuned	false	false
1	Non-Issue	false	false
3	Policy Violation	false	false
4	System Change (Upgrade, Reset, etc.)	true	false

qradar-offense-notes-list

Retrieves a list of notes for an offense.

Base Command

qradar-offense-notes-list

Input

Context Output

Command example

!qradar-offense-notes-list offense_id=14 filter="username='API_user: admin'" range=0-1

Context Example

{
    "QRadar": {
        "Note": [
            {
                "CreateTime": "2023-07-27T13:58:46.428000+00:00",
                "CreatedBy": "API_user: admin",
                "ID": 53,
                "Text": "Note Regarding The Offense"
            },
            {
                "CreateTime": "2023-08-02T08:23:05.473000+00:00",
                "CreatedBy": "API_user: admin",
                "ID": 60,
                "Text": "Note Regarding The Offense"
            }
        ]
    }
}

Human Readable Output

Offense Notes List For Offense ID 14

ID	Text	CreatedBy	CreateTime
53	Note Regarding The Offense	API_user: admin	2023-07-27T13:58:46.428000+00:00
60	Note Regarding The Offense	API_user: admin	2023-08-02T08:23:05.473000+00:00

qradar-offense-note-create

Creates a note on an offense.

Base Command

qradar-offense-note-create

Input

Context Output

Command example

!qradar-offense-note-create note_text="Note Regarding The Offense" offense_id=14

Context Example

{
    "QRadar": {
        "Note": {
            "CreateTime": "2023-08-02T08:39:15.813000+00:00",
            "CreatedBy": "API_user: admin",
            "ID": 65,
            "Text": "Note Regarding The Offense"
        }
    }
}

Human Readable Output

Create Note

ID	Text	CreatedBy	CreateTime
65	Note Regarding The Offense	API_user: admin	2023-08-02T08:39:15.813000+00:00

qradar-rules-list

Retrieves a list of rules.

Base Command

qradar-rules-list

Input

Context Output

Command example

!qradar-rules-list rule_type=COMMON range=0-2

Context Example

{
    "QRadar": {
        "Rule": [
            {
                "AverageCapacity": 0,
                "BaseCapacity": 0,
                "BaseHostID": 0,
                "CapacityTimestamp": 0,
                "CreationDate": "2007-10-14T20:12:00.374000+00:00",
                "Enabled": true,
                "ID": 100068,
                "ModificationDate": "2022-11-21T18:44:32.696000+00:00",
                "Name": "Login Successful After Scan Attempt",
                "Origin": "SYSTEM",
                "Owner": "admin",
                "Type": "COMMON"
            },
            {
                "AverageCapacity": 0,
                "BaseCapacity": 0,
                "BaseHostID": 0,
                "CapacityTimestamp": 0,
                "CreationDate": "2006-03-27T10:54:12.077000+00:00",
                "Enabled": false,
                "ID": 100102,
                "ModificationDate": "2023-02-23T14:12:52.067000+00:00",
                "Name": "Potential Botnet Connection (DNS)",
                "Origin": "SYSTEM",
                "Owner": "admin",
                "Type": "COMMON"
            },
            {
                "AverageCapacity": 0,
                "BaseCapacity": 0,
                "BaseHostID": 0,
                "CapacityTimestamp": 0,
                "CreationDate": "2005-12-22T00:54:48.708000+00:00",
                "Enabled": true,
                "ID": 100109,
                "ModificationDate": "2023-02-23T14:12:49.992000+00:00",
                "Name": "Host Port Scan Detected by Remote Host",
                "Origin": "SYSTEM",
                "Owner": "admin",
                "Type": "COMMON"
            }
        ]
    }
}

Human Readable Output

Rules List

ID	Name	Type	Enabled	BaseHostID	Origin	ModificationDate	CreationDate	BaseCapacity	AverageCapacity	Owner	CapacityTimestamp
100068	Login Successful After Scan Attempt	COMMON	true	0	SYSTEM	2022-11-21T18:44:32.696000+00:00	2007-10-14T20:12:00.374000+00:00	0	0	admin	0
100102	Potential Botnet Connection (DNS)	COMMON	false	0	SYSTEM	2023-02-23T14:12:52.067000+00:00	2006-03-27T10:54:12.077000+00:00	0	0	admin	0
100109	Host Port Scan Detected by Remote Host	COMMON	true	0	SYSTEM	2023-02-23T14:12:49.992000+00:00	2005-12-22T00:54:48.708000+00:00	0	0	admin	0

qradar-rule-groups-list

Retrieves a list of the rule groups.

Base Command

qradar-rule-groups-list

Input

Context Output

Command example

!qradar-rule-groups-list range=0-2

Context Example

{
    "QRadar": {
        "RuleGroup": [
            {
                "ChildItems": [
                    "100045",
                    "100046",
                    "100047",
                    "100048",
                    "100049",
                    "100050",
                    "100051",
                    "100052",
                    "100053",
                    "100054",
                    "100055",
                    "100056",
                    "1607",
                    "1608",
                    "1609",
                    "1610",
                    "1611",
                    "1612",
                    "1613",
                    "1614",
                    "1615",
                    "1616",
                    "1617",
                    "1618"
                ],
                "Description": "Rules focused on detection of suspicious asset reconciliation behavior.",
                "ID": 125,
                "Level": 2,
                "ModifiedTime": "2014-01-06T15:23:26.060000+00:00",
                "Name": "Asset Reconciliation Exclusion",
                "Owner": "admin",
                "ParentID": 3,
                "Type": "RULE_GROUP"
            },
            {
                "ChildItems": [
                    "100057",
                    "100059"
                ],
                "Description": "Rules that indicate post-intrusion access activity",
                "ID": 100020,
                "Level": 2,
                "ModifiedTime": "2015-07-08T20:14:12.250000+00:00",
                "Name": "Horizontal Movement",
                "Owner": "admin",
                "ParentID": 3,
                "Type": "RULE_GROUP"
            },
            {
                "ChildItems": [
                    "100001",
                    "100003",
                    "100044",
                    "100323",
                    "1219",
                    "1265",
                    "1335",
                    "1410",
                    "1411",
                    "1412",
                    "1431",
                    "1443",
                    "1460",
                    "1461",
                    "1471",
                    "1481",
                    "1509",
                    "1552",
                    "1566"
                ],
                "Description": "Rules based on log source and event anomalies such as high event rates or excessive connections.",
                "ID": 101,
                "Level": 1,
                "ModifiedTime": "2010-08-21T11:48:27.850000+00:00",
                "Name": "Anomaly",
                "Owner": "admin",
                "ParentID": 3,
                "Type": "RULE_GROUP"
            }
        ]
    }
}

Human Readable Output

Rules Group List

ID	Name	Description	Owner	ModifiedTime	ParentID	Type	ChildItems	Level
125	Asset Reconciliation Exclusion	Rules focused on detection of suspicious asset reconciliation behavior.	admin	2014-01-06T15:23:26.060000+00:00	3	RULE_GROUP	100045, 100046, 100047, 100048, 100049, 100050, 100051, 100052, 100053, 100054, 100055, 100056, 1607, 1608, 1609, 1610, 1611, 1612, 1613, 1614, 1615, 1616, 1617, 1618	2
100020	Horizontal Movement	Rules that indicate post-intrusion access activity	admin	2015-07-08T20:14:12.250000+00:00	3	RULE_GROUP	100057, 100059	2
101	Anomaly	Rules based on log source and event anomalies such as high event rates or excessive connections.	admin	2010-08-21T11:48:27.850000+00:00	3	RULE_GROUP	100001, 100003, 100044, 100323, 1219, 1265, 1335, 1410, 1411, 1412, 1431, 1443, 1460, 1461, 1471, 1481, 1509, 1552, 1566	1

qradar-assets-list

Retrieves assets list.

Base Command

qradar-assets-list

Input

Context Output

Command example

!qradar-assets-list filter="id<1100" range=0-2

Context Example

{
    "Endpoint": [
        {
            "IPAddress": [
                "1.1.1.1"
            ]
        }
    ],
    "QRadar": {
        "Asset": {
            "DomainID": 0,
            "ID": 1003,
            "Interfaces": [
                {
                    "created": "2023-07-26T14:32:01.789000+00:00",
                    "id": 1003,
                    "ip_addresses": [
                        {
                            "created": "2023-07-26T14:32:01.789000+00:00",
                            "id": 1003,
                            "network_id": 2,
                            "type": "IPV4",
                            "value": "1.1.1.1"
                        }
                    ]
                }
            ],
            "Properties": [
                {
                    "id": 1020,
                    "last_reported": "2023-07-26T14:32:01.802000+00:00",
                    "last_reported_by": "USER:admin",
                    "name": "Unified Name",
                    "type_id": 1002,
                    "value": "1.1.1.1"
                }
            ],
            "RiskScoreSum": 0,
            "VulnerabilityCount": 0
        }
    }
}

Human Readable Output

Assets List

DomainID	ID	Interfaces	Properties	RiskScoreSum	VulnerabilityCount
0	1003	{‘created’: ‘2023-07-26T14:32:01.789000+00:00’, ‘ip_addresses’: [{‘created’: ‘2023-07-26T14:32:01.789000+00:00’, ‘network_id’: 2, ‘id’: 1003, ‘type’: ‘IPV4’, ‘value’: ‘1.1.1.1’}], ‘id’: 1003}	{‘last_reported’: ‘2023-07-26T14:32:01.802000+00:00’, ‘name’: ‘Unified Name’, ‘type_id’: 1002, ‘id’: 1020, ‘last_reported_by’: ‘USER:admin’, ‘value’: ‘1.1.1.1’}	0.0	0

Endpoints

IPAddress
1.1.1.1

qradar-saved-searches-list

Retrieves a list of Ariel saved searches.

Base Command

qradar-saved-searches-list

Input

Context Output

Command example

!qradar-saved-searches-list range=0-1

Context Example

{
    "QRadar": {
        "SavedSearch": [
            {
                "AQL": "select QIDNAME(qid) as 'Event Name',logsourcename(logSourceId) as 'Log Source',\"eventCount\" as 'Event Count',\"startTime\" as 'Time',categoryname(category) as 'Low Level Category',\"sourceIP\" as 'Source IP',\"sourcePort\" as 'Source Port',\"destinationIP\" as 'Destination IP',\"destinationPort\" as 'Destination Port',\"userName\" as 'Username',\"magnitude\" as 'Magnitude' from events where \"Experience Center\" ilike '%AWSCloud%' order by \"startTime\" desc LIMIT 1000 start '2023-08-02 08:34' stop '2023-08-02 08:39'",
                "CreationDate": "2019-04-02T17:39:08.493000+00:00",
                "Database": "EVENTS",
                "Description": "",
                "ID": 2817,
                "IsShared": false,
                "ModifiedDate": "2023-02-23T14:12:52.611000+00:00",
                "Name": "EC: AWS Cloud Attack Events",
                "Owner": "admin",
                "QuickSearch": false,
                "UID": "0144c7d8-a3fe-47c1-b16b-12721a34077e"
            },
            {
                "AQL": "select * from flows where destinationport = '445' and (FORMAT::PAYLOAD_TO_HEX(sourcepayload) like '%70 00 73 00 65 00 78 00 65 00 63 00 73 00 76 00 63 00%' OR FORMAT::PAYLOAD_TO_HEX(sourcepayload) like '%50 00 53 00 45 00 58 00 45 00 53 00 56 00 43 00 2e 00 45 00 58 00 45%' OR FORMAT::PAYLOAD_TO_HEX(sourcepayload) like '%73 00 76 00 63 00 63 00 74 00 6c 00%' OR FORMAT::PAYLOAD_TO_HEX(sourcepayload) like '%5c 00 61 00 64 00 6d 00 69 00 6e 00 24 00%' OR FORMAT::PAYLOAD_TO_HEX(sourcepayload) like '%ff 53 4d 42 72 00 00 00 00 18 07 c0%') last 24 HOURS",
                "CreationDate": "2017-07-02T18:11:44.984000+00:00",
                "Database": "FLOWS",
                "Description": "",
                "ID": 2835,
                "IsShared": true,
                "ModifiedDate": "2023-03-05T13:34:00.352000+00:00",
                "Name": "Potential Ransomware (Suspicious activity, Possible Petya, NotPetya)",
                "Owner": "admin",
                "QuickSearch": false,
                "UID": "0791701a-80e3-4a1c-b11f-7bc943b96bf6"
            }
        ]
    }
}

Human Readable Output

Saved Searches List

ID	Name	IsShared	AQL	UID	QuickSearch	ModifiedDate	CreationDate	Database	Owner
2817	EC: AWS Cloud Attack Events	false	select QIDNAME(qid) as ‘Event Name’,logsourcename(logSourceId) as ‘Log Source’,”eventCount” as ‘Event Count’,”startTime” as ‘Time’,categoryname(category) as ‘Low Level Category’,”sourceIP” as ‘Source IP’,”sourcePort” as ‘Source Port’,”destinationIP” as ‘Destination IP’,”destinationPort” as ‘Destination Port’,”userName” as ‘Username’,”magnitude” as ‘Magnitude’ from events where “Experience Center” ilike ‘%AWSCloud%’ order by “startTime” desc LIMIT 1000 start ‘2023-08-02 08:34’ stop ‘2023-08-02 08:39’	0144c7d8-a3fe-47c1-b16b-12721a34077e	false	2023-02-23T14:12:52.611000+00:00	2019-04-02T17:39:08.493000+00:00	EVENTS	admin
2835	Potential Ransomware (Suspicious activity, Possible Petya, NotPetya)	true	select * from flows where destinationport = ‘445’ and (FORMAT::PAYLOAD_TO_HEX(sourcepayload) like ‘%70 00 73 00 65 00 78 00 65 00 63 00 73 00 76 00 63 00%’ OR FORMAT::PAYLOAD_TO_HEX(sourcepayload) like ‘%50 00 53 00 45 00 58 00 45 00 53 00 56 00 43 00 2e 00 45 00 58 00 45%’ OR FORMAT::PAYLOAD_TO_HEX(sourcepayload) like ‘%73 00 76 00 63 00 63 00 74 00 6c 00%’ OR FORMAT::PAYLOAD_TO_HEX(sourcepayload) like ‘%5c 00 61 00 64 00 6d 00 69 00 6e 00 24 00%’ OR FORMAT::PAYLOAD_TO_HEX(sourcepayload) like ‘%ff 53 4d 42 72 00 00 00 00 18 07 c0%’) last 24 HOURS	0791701a-80e3-4a1c-b11f-7bc943b96bf6	false	2023-03-05T13:34:00.352000+00:00	2017-07-02T18:11:44.984000+00:00	FLOWS	admin

qradar-searches-list

Retrieves the list of Ariel searches IDs. Search status and results can be polled by sending the search ID to the ‘qradar-search-status-get’ and ‘qradar-search-results-get’ commands.

Base Command

qradar-searches-list

Input

Context Output

Command example

#### Context Example

```json
{
    "QRadar": {
        "SearchID": [
            {
                "SearchID": "111e7107-48da-4645-8c2c-a8285d113eac"
            },
            {
                "SearchID": "4ad8f58f-d63b-4555-9d5e-62529e6ac089"
            },
            {
                "SearchID": "909075e0-b450-400c-b641-dd04e46b65bf"
            },
            {
                "SearchID": "f6387ac3-342a-41e7-bcd4-14fe5525dc5c"
            },
            {
                "SearchID": "e15caa93-a01f-49f4-b6be-5c666b0e08c7"
            },
            {
                "SearchID": "36ad7331-149d-4419-947d-ff0d3dd23cf1"
            },
            {
                "SearchID": "a893fc4f-f405-4cb2-a6c3-698dfad6045d"
            },
            {
                "SearchID": "47f40fcd-b7fd-48d7-abbc-05fb447acee2"
            },
            {
                "SearchID": "8967788b-f746-4e5b-9174-c145196eddb1"
            },
            {
                "SearchID": "1d743e24-a524-417f-9747-c967e0328b48"
            },
            {
                "SearchID": "be14bcb5-363e-4547-9b7f-923578a16ae6"
            },
            {
                "SearchID": "a4f4d846-9057-41ae-b558-0dd47134a72a"
            },
            {
                "SearchID": "2c98e5f6-4988-4fe3-bbac-43acbbfaaea2"
            },
            {
                "SearchID": "7e4bd0cf-b04e-446f-ba94-16e1811740e9"
            },
            {
                "SearchID": "76e9ed8a-4f59-42ad-8135-9b1781568935"
            },
            {
                "SearchID": "04e953e2-153a-488b-9a53-8701d16431c4"
            },
            {
                "SearchID": "cd44255c-0496-4663-a6ac-9662ad4a13ef"
            },
            {
                "SearchID": "92e5d6ec-1c60-4c7b-ad97-7610c1e7ed90"
            },
            {
                "SearchID": "8ded0056-8853-443f-9f99-3fff30c08cd6"
            },
            {
                "SearchID": "5ced0d93-4237-461a-ba12-6513d5674fb0"
            },
            {
                "SearchID": "1de985b2-2d45-4d0e-ac86-d25c5b7d8803"
            },
            {
                "SearchID": "b19000dd-1eda-4b85-a45e-334478f0755f"
            },
            {
                "SearchID": "ae52c4d7-689f-4274-8f74-6de74bd3652c"
            },
            {
                "SearchID": "70fe39d6-4e8e-4c48-8207-12d5930544f4"
            },
            {
                "SearchID": "011e1de5-c985-462a-8252-e291acaed012"
            },
            {
                "SearchID": "174d5a7c-b004-4b9c-96fb-868c043daa3c"
            },
            {
                "SearchID": "12b576a1-410e-4c46-bd95-61b2bebb4ceb"
            },
            {
                "SearchID": "8f1b645a-6f81-43fc-86f3-23c2213359b6"
            },
            {
                "SearchID": "12463d5a-4d2c-4c5b-9640-88e4cdee245c"
            },
            {
                "SearchID": "e1d2697f-4c40-46d0-b8b3-90a51e732814"
            },
            {
                "SearchID": "e9dea979-039c-409a-8a60-fe1fe44fa3c2"
            },
            {
                "SearchID": "66ca4a44-a3ac-482b-9d7a-300d621eb8a9"
            },
            {
                "SearchID": "a42ef950-fd27-42c9-af3d-8d466bf73d5d"
            },
            {
                "SearchID": "73ee61f0-c480-4145-a00b-d8c3a55de791"
            },
            {
                "SearchID": "e73b8002-b47d-4fb3-9dae-34a99dd21943"
            },
            {
                "SearchID": "5b812a3b-624d-4cf7-a2ed-f2d1f469b0a4"
            },
            {
                "SearchID": "4f6e37db-8c4f-4e2f-9b27-b8ae68d0c38b"
            },
            {
                "SearchID": "df9cf783-d706-46ed-8be7-680a0830d3eb"
            },
            {
                "SearchID": "d2aa7f7c-dbf4-405f-9652-b6bb776164f0"
            },
            {
                "SearchID": "de72022b-8070-4151-a826-16eb913db2cd"
            },
            {
                "SearchID": "32501bb7-22b8-4d79-aa7b-0b565c4bd806"
            },
            {
                "SearchID": "f89f3515-6d27-4616-a1bb-7dc008aa1562"
            },
            {
                "SearchID": "1ba37caf-c969-43fa-b037-6c164535b512"
            },
            {
                "SearchID": "78b709c4-8037-43dc-8bf0-dfd94629674f"
            },
            {
                "SearchID": "88096e2b-4feb-4071-807e-96e3dfc080ff"
            },
            {
                "SearchID": "1a7576fc-2cc1-41c6-85b6-3728d4d44f3d"
            },
            {
                "SearchID": "b4414e3b-b5ec-4cc8-9db2-35a7a2057e46"
            },
            {
                "SearchID": "c6a82de6-cfef-444e-9b0f-b124b5599b7b"
            },
            {
                "SearchID": "185971cc-ebbb-453d-b826-bffc59836be1"
            },
            {
                "SearchID": "2a45ec38-d060-4aae-9a9c-730f49966fdc"
            }
        ]
    }
}

Human Readable Output

Search ID List

SearchID
111e7107-48da-4645-8c2c-a8285d113eac
4ad8f58f-d63b-4555-9d5e-62529e6ac089
909075e0-b450-400c-b641-dd04e46b65bf
f6387ac3-342a-41e7-bcd4-14fe5525dc5c
e15caa93-a01f-49f4-b6be-5c666b0e08c7
36ad7331-149d-4419-947d-ff0d3dd23cf1
a893fc4f-f405-4cb2-a6c3-698dfad6045d
47f40fcd-b7fd-48d7-abbc-05fb447acee2
8967788b-f746-4e5b-9174-c145196eddb1
1d743e24-a524-417f-9747-c967e0328b48
be14bcb5-363e-4547-9b7f-923578a16ae6
a4f4d846-9057-41ae-b558-0dd47134a72a
2c98e5f6-4988-4fe3-bbac-43acbbfaaea2
7e4bd0cf-b04e-446f-ba94-16e1811740e9
76e9ed8a-4f59-42ad-8135-9b1781568935
04e953e2-153a-488b-9a53-8701d16431c4
cd44255c-0496-4663-a6ac-9662ad4a13ef
92e5d6ec-1c60-4c7b-ad97-7610c1e7ed90
8ded0056-8853-443f-9f99-3fff30c08cd6
5ced0d93-4237-461a-ba12-6513d5674fb0
1de985b2-2d45-4d0e-ac86-d25c5b7d8803
b19000dd-1eda-4b85-a45e-334478f0755f
ae52c4d7-689f-4274-8f74-6de74bd3652c
70fe39d6-4e8e-4c48-8207-12d5930544f4
011e1de5-c985-462a-8252-e291acaed012
174d5a7c-b004-4b9c-96fb-868c043daa3c
12b576a1-410e-4c46-bd95-61b2bebb4ceb
8f1b645a-6f81-43fc-86f3-23c2213359b6
12463d5a-4d2c-4c5b-9640-88e4cdee245c
e1d2697f-4c40-46d0-b8b3-90a51e732814
e9dea979-039c-409a-8a60-fe1fe44fa3c2
66ca4a44-a3ac-482b-9d7a-300d621eb8a9
a42ef950-fd27-42c9-af3d-8d466bf73d5d
73ee61f0-c480-4145-a00b-d8c3a55de791
e73b8002-b47d-4fb3-9dae-34a99dd21943
5b812a3b-624d-4cf7-a2ed-f2d1f469b0a4
4f6e37db-8c4f-4e2f-9b27-b8ae68d0c38b
df9cf783-d706-46ed-8be7-680a0830d3eb
d2aa7f7c-dbf4-405f-9652-b6bb776164f0
de72022b-8070-4151-a826-16eb913db2cd
32501bb7-22b8-4d79-aa7b-0b565c4bd806
f89f3515-6d27-4616-a1bb-7dc008aa1562
1ba37caf-c969-43fa-b037-6c164535b512
78b709c4-8037-43dc-8bf0-dfd94629674f
88096e2b-4feb-4071-807e-96e3dfc080ff
1a7576fc-2cc1-41c6-85b6-3728d4d44f3d
b4414e3b-b5ec-4cc8-9db2-35a7a2057e46
c6a82de6-cfef-444e-9b0f-b124b5599b7b
185971cc-ebbb-453d-b826-bffc59836be1
2a45ec38-d060-4aae-9a9c-730f49966fdc

qradar-search-create

Creates a new asynchronous Ariel search. Returns the search ID. Search status and results can be polled by sending the search ID to the ‘qradar-search-status-get’ and ‘qradar-search-results-get’ commands. Accepts SELECT query expressions only.

Base Command

qradar-search-create

Input

Context Output

Command example

!qradar-search-create query_expression="""SELECT "destinationPort" AS 'Destination Port', UniqueCount("sourceIP") AS 'Source IP (Unique Count)', UniqueCount("destinationIP") AS 'Destination IP (Unique Count)', UniqueCount(qid) AS 'Event Name (Unique Count)', UniqueCount(logSourceId) AS 'Log Source (Unique Count)', UniqueCount(category) AS 'Low Level Category (Unique Count)', UniqueCount("protocolId") AS 'Protocol (Unique Count)', UniqueCount("userName") AS 'Username (Unique Count)', MAX("magnitude") AS 'Magnitude (Maximum)', SUM("eventCount") AS 'Event Count (Sum)', COUNT(*) AS 'Count' from events where ( ("creEventList"='100120') or ("creEventList"='100122') or ("creEventList"='100135') AND "eventDirection"='R2L' ) GROUP BY "destinationPort" order by "Event Count (Sum)" desc last 6 hours"""

Context Example

{
    "QRadar": {
        "Search": {
            "ID": "68d4e4e6-f512-4171-b130-d671334cb47d",
            "Status": "WAIT"
        }
    }
}

Human Readable Output

Create Search

ID	Status
68d4e4e6-f512-4171-b130-d671334cb47d	WAIT

qradar-search-status-get

Retrieves status information for a search, based on the search ID.

Base Command

qradar-search-status-get

Input

Context Output

qradar-search-results-get

Retrieves search results.

Base Command

qradar-search-results-get

Input

Context Output

qradar-search-delete

Deleted search from Qradar, based on the search ID.

Base Command

qradar-search-delete

Input

qradar-reference-sets-list

qradar-search-cancel

Cancelled search in QRadar based on search_id.

Base Command

qradar-search-cancel

Input

qradar-reference-sets-list

Retrieves a list of reference sets.

Base Command

qradar-reference-sets-list

Input

Context Output

Command example

!qradar-reference-sets-list filter="timeout_type=FIRST_SEEN" range=0-2

Context Example

{
    "QRadar": {
        "Reference": [
            {
                "CreationTime": "2015-08-27T17:15:40.583000+00:00",
                "ElementType": "IP",
                "Name": "Critical Assets",
                "NumberOfElements": 0,
                "TimeoutType": "FIRST_SEEN"
            },
            {
                "CreationTime": "2017-10-25T16:31:15.992000+00:00",
                "ElementType": "ALNIC",
                "Name": "BadRabbit_FileHash",
                "NumberOfElements": 6,
                "TimeoutType": "FIRST_SEEN"
            },
            {
                "CreationTime": "2022-10-03T10:38:51.140000+00:00",
                "ElementType": "IP",
                "Name": "Windows RCE IPs",
                "NumberOfElements": 19,
                "TimeoutType": "FIRST_SEEN"
            }
        ]
    }
}

Human Readable Output

Reference Sets List

Name	ElementType	TimeoutType	CreationTime	NumberOfElements
Critical Assets	IP	FIRST_SEEN	2015-08-27T17:15:40.583000+00:00	0
BadRabbit_FileHash	ALNIC	FIRST_SEEN	2017-10-25T16:31:15.992000+00:00	6
Windows RCE IPs	IP	FIRST_SEEN	2022-10-03T10:38:51.140000+00:00	19

qradar-reference-set-create

Creates a new reference set.

Base Command

qradar-reference-set-create

Input

Context Output

Command example

!qradar-reference-set-create element_type=IP ref_name="Malicious IPs" time_to_live="1 year" timeout_type=FIRST_SEEN

Context Example

{
    "QRadar": {
        "Reference": {
            "CreationTime": "2023-08-02T08:39:30.887000+00:00",
            "ElementType": "IP",
            "Name": "Malicious IPs",
            "NumberOfElements": 0,
            "TimeToLive": "1 years 0 mons 0 days 0 hours 0 mins 0.0 secs",
            "TimeoutType": "FIRST_SEEN"
        }
    }
}

Human Readable Output

Reference Set Create

Name	ElementType	TimeToLive	TimeoutType	CreationTime	NumberOfElements
Malicious IPs	IP	1 years 0 mons 0 days 0 hours 0 mins 0.0 secs	FIRST_SEEN	2023-08-02T08:39:30.887000+00:00	0

qradar-reference-set-delete

Removes a reference set or purges its contents.

Base Command

qradar-reference-set-delete

Input

Context Output

There is no context output for this command.

Command example

!qradar-reference-set-delete ref_name="Malicious IPs"

Human Readable Output

Request to delete reference Malicious IPs was submitted. Current deletion status: QUEUED

qradar-reference-set-value-upsert

Adds or updates an element in a reference set.

Base Command

qradar-reference-set-value-upsert

Input

Context Output

Command example

!qradar-reference-set-value-upsert ref_name="Malicious IPs" value="1.1.1.1,1.1.1.1,1.1.1.1"

Context Example

{
    "QRadar": {
        "Reference": {
            "CreationTime": "2023-08-02T08:39:30.887000+00:00",
            "Data": [
                {
                    "first_seen": 1690965572017,
                    "last_seen": 1690965572017,
                    "source": "reference data api",
                    "value": "1.1.1.1"
                },
                {
                    "first_seen": 1690965572017,
                    "last_seen": 1690965572017,
                    "source": "reference data api",
                    "value": "1.1.1.1"
                },
                {
                    "first_seen": 1690965572017,
                    "last_seen": 1690965572017,
                    "source": "reference data api",
                    "value": "1.1.1.1"
                }
            ],
            "ElementType": "IP",
            "Name": "Malicious IPs",
            "NumberOfElements": 3,
            "TimeToLive": "1 years 0 mons 0 days 0 hours 0 mins 0.0 secs",
            "TimeoutType": "FIRST_SEEN"
        }
    }
}

Human Readable Output

Reference Update Create

CreationTime	Data	ElementType	Name	NumberOfElements	TimeToLive	TimeoutType
2023-08-02T08:39:30.887000+00:00	{‘last_seen’: 1690965572017, ‘first_seen’: 1690965572017, ‘source’: ‘reference data api’, ‘value’: ‘1.1.1.1’}, {‘last_seen’: 1690965572017, ‘first_seen’: 1690965572017, ‘source’: ‘reference data api’, ‘value’: ‘1.1.1.1’}, {‘last_seen’: 1690965572017, ‘first_seen’: 1690965572017, ‘source’: ‘reference data api’, ‘value’: ‘1.1.1.1’}	IP	Malicious IPs	3	1 years 0 mons 0 days 0 hours 0 mins 0.0 secs	FIRST_SEEN

qradar-reference-set-value-delete

Removes a value from a reference set.

Base Command

qradar-reference-set-value-delete

Input

Context Output

There is no context output for this command.

Command example

!qradar-reference-set-value-delete ref_name="Malicious IPs" value="1.1.1.1"

Human Readable Output

value: 1.1.1.1 of reference: Malicious IPs was deleted successfully

qradar-domains-list

Gets the list of domains. You must have System Administrator or Security Administrator permissions to call this endpoint if you are trying to retrieve the details of all domains. You can retrieve details of domains that are assigned to your Security Profile without having the System Administrator or Security Administrator permissions. If you do not have the System Administrator or Security Administrator permissions, then for each domain assigned to your security profile you can only view the values for the ID and name fields. All other values return null.

Base Command

qradar-domains-list

Input

Context Output

Command example

#### Context Example

```json
{
    "QRadar": {
        "Domains": {
            "Deleted": false,
            "Description": "",
            "ID": 0,
            "Name": "",
            "TenantID": 0
        }
    }
}

Human Readable Output

Domains List

Deleted	ID	TenantID
false	0	0

qradar-indicators-upload

Uploads indicators to QRadar.

Base Command

qradar-indicators-upload

Input

Context Output

qradar-geolocations-for-ip

Retrieves the MaxMind GeoIP data for the specified IP address.

Base Command

qradar-geolocations-for-ip

Input

Context Output

Command example

!qradar-geolocations-for-ip ip="1.1.1.1,1.1.1.1" range=0-1

Context Example

{
    "QRadar": {
        "GeoForIP": [
            {
                "CityName": "Mukilteo",
                "ContinentName": "NorthAmerica",
                "Coordinates": [
                    47.913,
                    -122.3042
                ],
                "IPAddress": "1.1.1.1",
                "LocationAccuracyRadius": 1000,
                "LocationLatitude": 47.913,
                "LocationLongitude": -122.3042,
                "LocationMetroCode": 819,
                "LocationTimezone": "America/Los_Angeles",
                "PhysicalCountryIsoCode": "US",
                "PhysicalCountryName": "United States",
                "PostalCode": "98275",
                "RegisteredCountryIsoCode": "US",
                "RegisteredCountryName": "United States"
            },
            {
                "CityName": "Mukilteo",
                "ContinentName": "NorthAmerica",
                "Coordinates": [
                    47.913,
                    -122.3042
                ],
                "IPAddress": "1.1.1.1",
                "LocationAccuracyRadius": 1000,
                "LocationLatitude": 47.913,
                "LocationLongitude": -122.3042,
                "LocationMetroCode": 819,
                "LocationTimezone": "America/Los_Angeles",
                "PhysicalCountryIsoCode": "US",
                "PhysicalCountryName": "United States",
                "PostalCode": "98275",
                "RegisteredCountryIsoCode": "US",
                "RegisteredCountryName": "United States"
            }
        ]
    }
}

Human Readable Output

Geolocation For IP

CityName	ContinentName	Coordinates	IPAddress	LocationAccuracyRadius	LocationLatitude	LocationLongitude	LocationMetroCode	LocationTimezone	PhysicalCountryIsoCode	PhysicalCountryName	PostalCode	RegisteredCountryIsoCode	RegisteredCountryName
Mukilteo	NorthAmerica	47.913, -122.3042	1.1.1.1	1000	47.913	-122.3042	819	America/Los_Angeles	US	United States	98275	US	United States
Mukilteo	NorthAmerica	47.913, -122.3042	1.1.1.1	1000	47.913	-122.3042	819	America/Los_Angeles	US	United States	98275	US	United States

qradar-log-sources-list

Retrieves a list of log sources.

Base Command

qradar-log-sources-list

Input

Context Output

Command example

!qradar-log-sources-list qrd_encryption_algorithm=AES128 range=0-2

Context Example

{
    "QRadar": {
        "LogSource": [
            {
                "AutoDiscovered": false,
                "CreationDate": "2022-11-21T18:45:24.624000+00:00",
                "Credibility": 10,
                "Description": "Search Results",
                "Enabled": true,
                "Gateway": false,
                "GroupIDs": [
                    0
                ],
                "ID": 68,
                "Internal": true,
                "LastEventTime": "1970-01-01T00:00:00+00:00",
                "ModifiedDate": "2022-11-21T18:45:24.624000+00:00",
                "Name": "Search Results-2 :: ip-172-31-17-10",
                "ProtocolParameters": [
                    {
                        "id": 0,
                        "name": "identifier",
                        "value": "1.1.1.1"
                    },
                    {
                        "id": 1,
                        "name": "incomingPayloadEncoding",
                        "value": "UTF-8"
                    }
                ],
                "ProtocolTypeID": 0,
                "Status": {
                    "last_updated": 0,
                    "status": "NA"
                },
                "TypeID": 355
            },
            {
                "AutoDiscovered": false,
                "CreationDate": "2022-11-21T18:45:24.621000+00:00",
                "Credibility": 10,
                "Description": "System Notification",
                "Enabled": true,
                "Gateway": false,
                "GroupIDs": [
                    0
                ],
                "ID": 65,
                "Internal": true,
                "LastEventTime": "2023-08-02T08:39:00.106000+00:00",
                "ModifiedDate": "2022-11-21T18:45:24.621000+00:00",
                "Name": "System Notification-2 :: ip-172-31-17-10",
                "ProtocolParameters": [
                    {
                        "id": 0,
                        "name": "identifier",
                        "value": "1.1.1.1"
                    },
                    {
                        "id": 1,
                        "name": "incomingPayloadEncoding",
                        "value": "UTF-8"
                    }
                ],
                "ProtocolTypeID": 0,
                "Status": {
                    "last_updated": 0,
                    "status": "SUCCESS"
                },
                "TypeID": 147
            },
            {
                "AutoDiscovered": true,
                "CreationDate": "2018-10-24T15:25:21.928000+00:00",
                "Credibility": 5,
                "Description": "WindowsAuthServer device",
                "Enabled": true,
                "Gateway": false,
                "GroupIDs": [
                    0
                ],
                "ID": 1262,
                "Internal": false,
                "LastEventTime": "2023-06-12T08:17:22.292000+00:00",
                "ModifiedDate": "2023-02-23T14:12:45.774000+00:00",
                "Name": "Experience Center: WindowsAuthServer @ 1.1.1.1",
                "ProtocolParameters": [
                    {
                        "id": 0,
                        "name": "identifier",
                        "value": "1.1.1.1"
                    },
                    {
                        "id": 1,
                        "name": "incomingPayloadEncoding",
                        "value": "UTF-8"
                    }
                ],
                "ProtocolTypeID": 0,
                "Status": {
                    "last_updated": 0,
                    "messages": [
                        {
                            "severity": "ERROR",
                            "text": "Events have not been received from this Log Source in over 720 minutes."
                        }
                    ],
                    "status": "ERROR"
                },
                "TypeID": 12
            }
        ]
    }
}

Human Readable Output

Log Sources List

ID	Name	Description	Internal	ProtocolParameters	Credibility	GroupIDs	CreationDate	Status	Enabled	ProtocolTypeID	AutoDiscovered	Gateway	TypeID	ModifiedDate	LastEventTime
68	Search Results-2 :: ip-172-31-17-10	Search Results	true	{‘name’: ‘identifier’, ‘id’: 0, ‘value’: ‘1.1.1.1’}, {‘name’: ‘incomingPayloadEncoding’, ‘id’: 1, ‘value’: ‘UTF-8’}	10	0	2022-11-21T18:45:24.624000+00:00	last_updated: 0 status: NA	true	0	false	false	355	2022-11-21T18:45:24.624000+00:00	1970-01-01T00:00:00+00:00
65	System Notification-2 :: ip-172-31-17-10	System Notification	true	{‘name’: ‘identifier’, ‘id’: 0, ‘value’: ‘1.1.1.1’}, {‘name’: ‘incomingPayloadEncoding’, ‘id’: 1, ‘value’: ‘UTF-8’}	10	0	2022-11-21T18:45:24.621000+00:00	last_updated: 0 status: SUCCESS	true	0	false	false	147	2022-11-21T18:45:24.621000+00:00	2023-08-02T08:39:00.106000+00:00
1262	Experience Center: WindowsAuthServer @ 1.1.1.1	WindowsAuthServer device	false	{‘name’: ‘identifier’, ‘id’: 0, ‘value’: ‘1.1.1.1’}, {‘name’: ‘incomingPayloadEncoding’, ‘id’: 1, ‘value’: ‘UTF-8’}	5	0	2018-10-24T15:25:21.928000+00:00	last_updated: 0 messages: {‘severity’: ‘ERROR’, ‘text’: ‘Events have not been received from this Log Source in over 720 minutes.’} status: ERROR	true	0	true	false	12	2023-02-23T14:12:45.774000+00:00	2023-06-12T08:17:22.292000+00:00

qradar-get-custom-properties

Retrieves a list of event regex properties.

Base Command

qradar-get-custom-properties

Input

Context Output

Command example

!qradar-get-custom-properties filter="id between 90 and 100" range=1-1231

Context Example

{
    "QRadar": {
        "Properties": [
            {
                "auto_discovered": false,
                "creation_date": "2012-07-04T17:05:02+00:00",
                "datetime_format": "",
                "description": "Default custom extraction of Event Summary from DSM payload.",
                "id": 97,
                "identifier": "DEFAULT_EVENT_SUMMARY",
                "locale": "en-US",
                "modification_date": "2022-11-21T18:44:07.572000+00:00",
                "name": "Event Summary",
                "property_type": "string",
                "use_for_rule_engine": true,
                "username": "admin"
            },
            {
                "auto_discovered": false,
                "creation_date": "2009-09-04T16:58:12.961000+00:00",
                "datetime_format": "",
                "description": "Default custom extraction of Avt-App-VolumePackets from DSM payload.",
                "id": 99,
                "identifier": "4d616180-00d0-4ba0-b423-bfb54e1b8677",
                "locale": "en-US",
                "modification_date": "2022-11-21T18:44:08.049000+00:00",
                "name": "Packets",
                "property_type": "numeric",
                "use_for_rule_engine": false,
                "username": "admin"
            },
            {
                "auto_discovered": false,
                "creation_date": "2010-07-27T13:32:44.494000+00:00",
                "datetime_format": "NULL::character varying",
                "description": "",
                "id": 96,
                "identifier": "8eb82a2c-bba7-478f-9248-69fba8baf8c7",
                "locale": "NULL::character varying",
                "modification_date": "2022-11-21T18:59:14.020000+00:00",
                "name": "Parent",
                "property_type": "string",
                "use_for_rule_engine": true,
                "username": "admin"
            }
        ]
    }
}

Human Readable Output

Custom Properties

auto_discovered	creation_date	datetime_format	description	id	identifier	locale	modification_date	name	property_type	use_for_rule_engine	username
false	2012-07-04T17:05:02+00:00		Default custom extraction of Event Summary from DSM payload.	97	DEFAULT_EVENT_SUMMARY	en-US	2022-11-21T18:44:07.572000+00:00	Event Summary	string	true	admin
false	2009-09-04T16:58:12.961000+00:00		Default custom extraction of Avt-App-VolumePackets from DSM payload.	99	4d616180-00d0-4ba0-b423-bfb54e1b8677	en-US	2022-11-21T18:44:08.049000+00:00	Packets	numeric	false	admin
false	2010-07-27T13:32:44.494000+00:00	NULL::character varying		96	8eb82a2c-bba7-478f-9248-69fba8baf8c7	NULL::character varying	2022-11-21T18:59:14.020000+00:00	Parent	string	true	admin

qradar-reset-last-run

Resets the fetch incidents last run value, which resets the fetch to its initial fetch state. (Will try to fetch the first available offense).

Base Command

qradar-reset-last-run

Input

There are no input arguments for this command.

Context Output

There is no context output for this command.

qradar-print-context

Returns a redacted snapshot of integration context metrics (queued, in-progress, finished, meta sizes, concurrent active, samples count). This command is intended for debugging purposes and may return sensitive data.

Base Command

qradar-print-context

Input

There are no input arguments for this command.

Context Output

get-mapping-fields

Returns the list of fields for an incident type. This command should be used for debugging purposes.

Base Command

get-mapping-fields

Input

There are no input arguments for this command.

Context Output

There is no context output for this command.

get-remote-data

Gets remote data from a remote incident. This method does not update the current incident, and should be used for debugging purposes.

Base Command

get-remote-data

Input

Context Output

There is no context output for this command.

get-modified-remote-data

Returns the list of incidents IDs that were modified since the last update time. Note that this method is for debugging purposes. The get-modified-remote-data command is used as part of the mirroring feature, which is available from version 6.1.

Base Command

get-modified-remote-data

Input

Context Output

There is no context output for this command.

qradar-offenses

Gets offenses from QRadar.

Base Command

qradar-offenses

Input

Context Output

qradar-offense-by-id

Gets offense with matching offense ID from qradar.

Base Command

qradar-offense-by-id

Input

Context Output

qradar-searches

Searches in QRadar using AQL. It is highly recommended to use the playbook ‘QRadarFullSearch’ instead of this command - it will execute the search, and will return the result.

Base Command

qradar-searches

Input

Context Output

qradar-get-search

Gets a specific search id and status.

Base Command

qradar-get-search

Input

Context Output

qradar-get-search-results

Gets search results.

Base Command

qradar-get-search-results

Input

Context Output

qradar-get-assets

List all assets found in the model.

Base Command

qradar-get-assets

Input

Context Output

qradar-get-asset-by-id

Retrieves the asset by id.

Base Command

qradar-get-asset-by-id

Input

Context Output

qradar-get-closing-reasons

Get closing reasons.

Base Command

qradar-get-closing-reasons

Input

Context Output

qradar-get-note

Retrieve a note for an offense.

Base Command

qradar-get-note

Input

Context Output

qradar-create-note

Create a note on an offense.

Base Command

qradar-create-note

Input

Context Output