Qradar Generic
IBM QRadar Incident
Details
| ID | Qradar Generic |
|---|---|
| Group | incident |
| Version | -1 |
| From Version | 6.0.0 |
Layout Structure
Legacy Summary 0 sections
No sections defined.
Incident Info 11 sections
Case Details
| Field ID | Position |
|---|---|
| type | Col 0-2, Height: 22 |
| severity | Col 0-2, Height: 22 |
| owner | Col 0-2, Height: 22 |
| sourcebrand | Col 0-2, Height: 22 |
| sourceinstance | Col 0-2, Height: 22 |
| playbookid | Col 0-2, Height: 22 |
Notes
Work Plan
Linked Incidents
Child Incidents
Evidence
Team Members
Indicators
Timeline Information
| Field ID | Position |
|---|---|
| occurred | Col 0-1, Height: 22 |
| dbotmodified | Col 0-1, Height: 22 |
| dbotduedate | Col 0-2, Height: 22 |
| dbotcreated | Col 1-2, Height: 22 |
| dbotclosed | Col 1-2, Height: 22 |
Closing Information
| Field ID | Position |
|---|---|
| dbotclosed | Col 0-2, Height: 22 |
| closereason | Col 0-2, Height: 22 |
| closenotes | Col 0-2, Height: 22 |
Investigation Data
| Field ID | Position |
|---|---|
| details | Col 0-2, Height: 22 |
QRadar Offense 12 sections
Asset Summary
| Field ID | Position |
|---|---|
| idasset | Col 0-2, Height: 22 |
| dnsname | Col 0-2, Height: 22 |
| ipaddressasset | Col 0-2, Height: 22 |
| descriptionasset | Col 0-2, Height: 22 |
Offense Summary
| Field ID | Position |
|---|---|
| idoffense | Col 0-2, Height: 22 |
| statusoffense | Col 0-2, Height: 22 |
| typeoffense | Col 0-2, Height: 22 |
| descriptionoffense | Col 0-2, Height: 22 |
| domainoffense | Col 0-2, Height: 22 |
| lowlevelcategoriesoffense | Col 0-2, Height: 22 |
| listofrulesoffense | Col 0-2, Height: 22 |
| followup | Col 0-2, Height: 22 |
| assigneduser | Col 0-2, Height: 22 |
| externalstarttime | Col 0-2, Height: 22 |
| externallastupdatedtime | Col 0-2, Height: 22 |
| numberofflows | Col 0-2, Height: 22 |
| linktooffense | Col 0-2, Height: 22 |
Fetched Events
Event Details
| Field ID | Position |
|---|---|
| highlevelcategories | Col 0-2, Height: 53 |
| eventnames | Col 0-2, Height: 53 |
| eventdescriptions | Col 0-2, Height: 53 |
| usernames | Col 0-2, Height: 22 |
Offense Closing Details
| Field ID | Position |
|---|---|
| closingreason | Col 0-2, Height: 22 |
| closetime | Col 0-2, Height: 22 |
| closinguser | Col 0-2, Height: 22 |
Offense Metrics
| Field ID | Position |
|---|---|
| severityoffense | Col 0-2, Height: 22 |
| relevanceoffense | Col 0-2, Height: 22 |
| credibilityoffense | Col 0-2, Height: 22 |
Event Network Data
| Field ID | Position |
|---|---|
| sourceips | Col 0-2, Height: 22 |
| sourcegeolocation | Col 0-2, Height: 22 |
| srcports | Col 0-2, Height: 22 |
| destinationips | Col 0-2, Height: 22 |
| sourceipv6 | Col 0-2, Height: 22 |
| trafficdirection | Col 0-2, Height: 22 |
| dstports | Col 0-2, Height: 22 |
| sourcemacaddress | Col 0-2, Height: 22 |
| destinationgeolocation | Col 0-2, Height: 22 |
| destinationmacaddress | Col 0-2, Height: 22 |
| destinationipv6 | Col 0-2, Height: 22 |
Event NAT Data
| Field ID | Position |
|---|---|
| prenatsourceip | Col 0-2, Height: 22 |
| prenatsourceport | Col 0-2, Height: 22 |
| prenatdestinationport | Col 0-2, Height: 22 |
| postnatsourceip | Col 0-2, Height: 22 |
| postnatdestinationip | Col 0-2, Height: 22 |
| postnatsourceport | Col 0-2, Height: 22 |
| postnatdestinationport | Col 0-2, Height: 22 |
Offense Magnitude
Events Mirroring Status
Event Log Sources
| Field ID | Position |
|---|---|
| logsourcetype | Col 0-2, Height: 53 |
| logsourcename | Col 0-2, Height: 53 |
Offense Network Data
| Field ID | Position |
|---|---|
| sourceipoffense | Col 0-2, Height: 22 |
| sourcenetworkoffense | Col 0-2, Height: 22 |
| destinationipoffense | Col 0-2, Height: 22 |
| destinationnetworkoffense | Col 0-2, Height: 22 |
QRadar Events 1 section
Events
QRadar Assets 1 section
Assets
War Room 0 sections
No sections defined.
Work Plan 0 sections
No sections defined.
Evidence Board 0 sections
No sections defined.
Canvas 0 sections
No sections defined.
Related Incidents 0 sections
No sections defined.