QRadar

Deprecated. Use IBM QRadar v2 or IBM QRadar v3 instead.

Category

Analytics & SIEM

Pack

QRadar

Configuration parameters

• server — Server URL (e.g. https://192.168.0.1) (required)
• credentials — Username
• token — Authentication token
• query — Query to fetch offenses
• offensesPerCall — Number of offenses to pull per API call
• insecure — Trust any certificate (not secure)
• proxy — Use system proxy settings
• isFetch — Fetch incidents
• incidentType — Incident type
• full_enrich — Full Incident Enrichment
• enrich_size — Number of addresses to enrich per API call

Commands (26)

• qr-get-assets — List all assets found in the model
• qr-get-search — Gets a specific search id and state
• qr-get-search-results — Gets search results
• qr-offenses — Gets offenses from QRadar
• qr-searches — Searches in QRadar
• qr-update-offense — Update an offense
• qradar-create-note — Create a note on an offense
• qradar-create-reference-set — Creates a new reference set. If the provided name is already in use, this command will fail
• qradar-create-reference-set-value — Add or update a value in a reference set.
• qradar-delete-reference-set — Deletes a reference set corresponding to the name provided.
• qradar-delete-reference-set-value — Deletes a value in a reference set.
• qradar-get-asset-by-id — Retrieves the asset by id
• qradar-get-assets — List all assets found in the model
• qradar-get-closing-reasons — Get closing reasons
• qradar-get-domain-by-id — Retrieves Domain information By ID
• qradar-get-domains — Retrieve all Domains
• qradar-get-note — Retrieve a note for an offense
• qradar-get-reference-by-name — Information about the reference set that had data added or updated. This returns information set but not the contained data. This feature is supported from version 8.1 and upward.
• qradar-get-search — Gets a specific search id and status
• qradar-get-search-results — Gets search results
• qradar-offense-by-id — Gets offense with matching offense ID from qradar
• qradar-offenses — Gets offenses from QRadar
• qradar-searches — Searches in QRadar using AQL. It is highly recommended to use the playbook 'QRadarFullSearch' instead of this command - it will execute the search, and will return the result.
• qradar-update-offense — Update an offense
• qradar-update-reference-set-value — Adds or updates a value in a reference set.
• qradar-upload-indicators — Uploads indicators from Demisto to Qradar. This command requires Cortex SOAR v5.5 or later.