QRadar_v2

Deprecated. Use the IBM QRadar v3 integration instead. Fetch offenses from QRadar using Cortex XSOAR. Supports API versions until 10.0. You can fetch the offenses with their related events and assets by creating a comma-separated list of event fields.

Category

Analytics & SIEM

Pack

QRadar

Configuration parameters

• incidentType — Incident type
• server — Server URL (e.g. https://192.168.0.1) (required)
• credentials — Username / API Key (see '?')
• insecure — Trust any certificate (not secure)
• proxy — Use system proxy settings
• longRunning — Long running instance
• query — Query to fetch offenses
• offenses_per_fetch — Number of offenses to pull per API call (max 50)
• ip_enrich — Incident IP Enrichment
• asset_enrich — Incident Asset Enrichment
• events_columns — Event fields to return from the events query (CAUTION this parameter is correlated to the incoming mapper, and changing the values may adversely affect mapping)
• fetch_mode — Fetch mode (required)
• events_limit — Max number of events per incident
• adv_params — Advanced Parameters

Commands (23)

• get-mapping-fields — Returns the list of fields for an incident type. This command should be used for debugging purposes.
• qradar-create-note — Create a note on an offense.
• qradar-create-reference-set — Creates a new reference set. If the provided name is already in use, this command will fail.
• qradar-create-reference-set-value — Add or update a value in a reference set.
• qradar-delete-reference-set — Deletes a reference set corresponding to the name provided.
• qradar-delete-reference-set-value — Deletes a value in a reference set.
• qradar-get-asset-by-id — Retrieves the asset by id.
• qradar-get-assets — List all assets found in the model.
• qradar-get-closing-reasons — Get closing reasons.
• qradar-get-custom-properties — Retrieves a list of event regex properties.
• qradar-get-domain-by-id — Retrieves Domain information By ID.
• qradar-get-domains — Retrieve all Domains.
• qradar-get-note — Retrieve a note for an offense.
• qradar-get-reference-by-name — Information about the reference set that had data added or updated. This returns the information set, but not the contained data. This feature is supported from version 8.1 and upward.
• qradar-get-search — Gets a specific search id and status.
• qradar-get-search-results — Gets search results.
• qradar-offense-by-id — Gets offense with matching offense ID from qradar.
• qradar-offenses — Gets offenses from QRadar.
• qradar-reset-last-run — Reset fetch incidents last run value, which resets the fetch to its initial fetch state (will try to fetch first available offense).
• qradar-searches — Searches in QRadar using AQL. It is highly recommended to use the playbook 'QRadarFullSearch' instead of this command - it will execute the search, and will return the result.
• qradar-update-offense — Update an offense.
• qradar-update-reference-set-value — Adds or updates a value in a reference set.
• qradar-upload-indicators — Uploads indicators from Demisto to Qradar.