QRadar v3

IBM QRadar SIEM helps security teams accurately detect and prioritize threats across the enterprise, supports API versions 10.1 and above. Provides intelligent insights that enable teams to respond quickly to reduce the impact of incidents.

Category

Analytics & SIEM

Pack

QRadar

Configuration parameters

• server — Server URL (required)
• credentials — Username (required)
• api_version — QRadar API Version (required)
• incident_type — Incident Type
• first_fetch — First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
• fetch_mode — Fetch mode
• retry_events_fetch — Retry events fetch
• events_limit — Maximum number of events per incident.
• offenses_per_fetch — Number of offenses to pull per API call (max 50)
• query — Query to fetch offenses.
• enrichment — Incidents Enrichment
• limit_assets — Maximum number of assets to fetch
• events_columns — Event fields to return from the events query (WARNING: This parameter is correlated to the incoming mapper and changing the values may adversely affect mapping).
• mirror_options — Mirroring Options
• close_incident — Close Mirrored XSOAR Incident
• mirror_limit — The number of incoming incidents to mirror each time
• adv_params — Advanced Parameters
• insecure — Trust any certificate (not secure)
• proxy — Use system proxy settings
• timeout — Timeout for http-requests
• fetch_interval — Fetch Incidents Interval

Commands (71)

• get-mapping-fields — Returns the list of fields for an incident type. This command should be used for debugging purposes.
• get-modified-remote-data — Returns the list of incidents IDs that were modified since the last update time. Note that this method is for debugging purposes. The get-modified-remote-data command is used as part of the mirroring feature, which is available from version 6.1.
• get-remote-data — Gets remote data from a remote incident. This method does not update the current incident, and should be used for debugging purposes.
• qradar-assets-list — Retrieves assets list.
• qradar-closing-reasons — Retrieves a list of offense closing reasons.
• qradar-create-note — Create a note on an offense. Deprecated, Use qradar-offense-note-create instead.
• qradar-create-reference-set — Creates a new reference set. If the provided name is already in use, this command will fail. Deprecated, Use qradar-reference-set-create instead.
• qradar-create-reference-set-value — Add or update a value in a reference set. Deprecated, Use qradar-reference-set-value-upsert instead.
• qradar-delete-reference-set — Deletes a reference set corresponding to the name provided. Deprecated, Use qradar-reference-set-delete instead.
• qradar-delete-reference-set-value — Deletes a value in a reference set. Deprecated, Use qradar-reference-set-value-delete instead.
• qradar-disconnected-log-collectors-list — Retrieves a list of disconnected log collectors.
• qradar-domains-list — Gets the list of domains. You must have System Administrator or Security Administrator permissions to call this endpoint if you are trying to retrieve the details of all domains. You can retrieve details of domains that are assigned to your Security Profile without having the System Administrator or Security Administrator permissions. If you do not have the System Administrator or Security Administrator permissions, then for each domain assigned to your security profile you can only view the values for the ID and name fields. All other values return null.
• qradar-event-collectors-list — Retrieves a list of event collectors.
• qradar-geolocations-for-ip — Retrieves the MaxMind GeoIP data for the specified IP address.
• qradar-get-asset-by-id — Retrieves the asset by id. Deprecated, Use qradar-assets-list instead.
• qradar-get-assets — List all assets found in the model. Deprecated, Use qradar-assets-list instead.
• qradar-get-closing-reasons — Get closing reasons. Deprecated, Use qradar-closing-reasons instead.
• qradar-get-custom-properties — Retrieves a list of event regex properties.
• qradar-get-domain-by-id — Retrieves Domain information By ID. Deprecated, Use qradar-domains-list instead.
• qradar-get-domains — Retrieve all Domains. Deprecated, Use qradar-domains-list instead.
• qradar-get-note — Retrieve a note for an offense. Deprecated, Use qradar-offense-notes-list instead.
• qradar-get-reference-by-name — Information about the reference set that had data added or updated. This returns the information set, but not the contained data. This feature is supported from version 8.1 and upward. Deprecated, Use qradar-reference-sets-list instead.
• qradar-get-search — Gets a specific search ID and status. Deprecated, Use qradar-search-status-get instead.
• qradar-get-search-results — Gets search results. Deprecated, Use qradar-search-results-get instead.
• qradar-indicators-upload — Uploads indicators to QRadar.
• qradar-ips-local-destination-get — Get Source IPs.
• qradar-ips-source-get — Get Source IPs.
• qradar-log-source-create — Creates a new log source.
• qradar-log-source-delete — Deletes a log source by ID or name. One of the arguments must be provided.
• qradar-log-source-extensions-list — Retrieves a list of log source extensions.
• qradar-log-source-groups-list — Retrieves a list of log source languages.
• qradar-log-source-languages-list — Retrieves a list of log source languages.
• qradar-log-source-protocol-types-list — Retrieves the list of protocol types.
• qradar-log-source-types-list — Retrieves a list of log sources types.
• qradar-log-source-update — Updates an exising log source.
• qradar-log-sources-list — Retrieves a list of log sources.
• qradar-offense-by-id — Gets offense with matching offense ID from qradar.Deprecated, Use qradar-offense-list instead.
• qradar-offense-note-create — Creates a note on an offense.
• qradar-offense-notes-list — Retrieves a list of notes for an offense.
• qradar-offense-update — Updates an offense.
• qradar-offenses — Gets offenses from QRadar. Deprecated, Use qradar-offenses-list instead.
• qradar-offenses-list — Gets offenses from QRadar.
• qradar-print-context — Returns a redacted snapshot of integration context metrics (queued, in-progress, finished, meta sizes, concurrent active, samples count). This command is intended for debugging purposes and may return sensitive data.
• qradar-reference-map-value-upsert — Adds or updates an element in a reference map.
• qradar-reference-maps-list — Retrieves a list of reference maps.
• qradar-reference-set-create — Creates a new reference set.
• qradar-reference-set-delete — Removes a reference set or purges its contents.
• qradar-reference-set-value-delete — Removes a value from a reference set.
• qradar-reference-set-value-upsert — Adds or updates an element in a reference set.
• qradar-reference-sets-list — Retrieves a list of reference sets.
• qradar-remote-network-cidr-create — Create remote network CIDRs.
• qradar-remote-network-cidr-delete — Deletes an existing staged remote network.
• qradar-remote-network-cidr-list — Retrieves the list of staged remote networks.
• qradar-remote-network-cidr-update — Updates an existing staged remote network.
• qradar-remote-network-deploy-execution — Executes a deployment. Potentially harmful: This API command executes any waiting system deployments in QRadar within the same deployment type and hosts defined.
• qradar-reset-last-run — Resets the fetch incidents last run value, which resets the fetch to its initial fetch state. (Will try to fetch the first available offense).
• qradar-rule-groups-list — Retrieves a list of the rule groups.
• qradar-rules-list — Retrieves a list of rules.
• qradar-saved-searches-list — Retrieves a list of Ariel saved searches.
• qradar-search-cancel — Cancels the search in QRadar.
• qradar-search-create — Creates a new asynchronous Ariel search. Returns the search ID. Search status and results can be polled by sending the search ID to the 'qradar-search-status-get' and 'qradar-search-results-get' commands. Accepts SELECT query expressions only.
• qradar-search-delete — Deletes the search from Qradar.
• qradar-search-results-get — Retrieves search results.
• qradar-search-retrieve-events — Polling command to search for events of a specific offense.
• qradar-search-status-get — Retrieves status information for a search, based on the search ID.
• qradar-searches — Searches in QRadar using AQL. It is highly recommended to use the playbook 'QRadarFullSearch' instead of this command - it will execute the search, and will return the result. Deprecated, Use qradar-search-create instead.
• qradar-searches-list — Retrieves the list of Ariel searches IDs. Search status and results can be polled by sending the search ID to the 'qradar-search-status-get' and 'qradar-search-results-get' commands.
• qradar-update-offense — Update an offense. Deprecated, Use qradar-offense-update instead.
• qradar-update-reference-set-value — Adds or updates a value in a reference set. Deprecated, Use qradar-reference-set-value-upsert instead.
• qradar-upload-indicators — Uploads indicators from Demisto to QRadar.
• qradar-wincollect-destinations-list — Retrieves a list of WinCollect destinations. In order to get wincollect_internal_destination_ids - filter internal=true needs to be used In order to get wincollect_external_destination_ids - filter internal=false needs to be used.