QRadar - Get Offense Logs

Works for QRadar integration version 3, v1 and v2 are deprecated. Note: You can use the integration to fetch the events with the offense however it will fetch the events according to the specified limit defined in the instance settings. By using this playbook you can define an additional search to query a larger number of logs. Default playbook inputs use the QRadar incident fields such as idoffense, starttime. These fields can be replaced but need to point to relevant offense ID and starttime fields.

Pack

QRadar

Tasks

19

Inputs

• MaxLogsCount — Maximum number of log entires to query from QRadar (default: 50)
• ID — The QRadar offense ID. Uses the id offense incident field.
• StartTime — The QRadar offense start time
• GetOnlyCREEvents — If value "OnlyCRE" get only events made by CRE. Values can be "OnlyCRE", "OnlyNotCRE", "All".
• Fields — A comma-separated list of extra fields to get from each event. You can replace with different fields as well as rename the field names.
• ApiVersion — The API version for the timestamp format changes between versions

Outputs

• QRadar — The QRadar offense logs.
• QRadar.SourceIP — The unique source ips.
• QRadar.DestinationIP — The unique destination ips.
• QRadar.Username — The unique usernames.
• QRadar.HighLevelCategory — The unique high level categories.
• QRadar.LowLevelCategory — The unique high low categories.
• QRadar.QidName — The unique QID names.
• QRadar.StartTime — The start time of the first event.

Commands used

• qradar-search-retrieve-events
• setIncident