QRadar - Get offense correlations
Deprecated. Use the `QRadar - Get offense correlations v2` instead.\"\nRun on a QRadar offense to get more information\n\n* Get all correlations relevant to the offense\n* Get all logs relevant to the correlations (not done by default, set "GetCorrelationLogs\" to \"True\")\n\nInputs-\n* GetCorrelationLogs (default - False)\n* MaxLogsCount (default - 20)
- Pack
- DeprecatedContent
- Tasks
- 7
Inputs
- GetCorrelationLogs — If "True" will get all of the offense's correlations logs
- MaxLogsCount — Maximum number of log entires to query from QRadar (default: 20)
- ID — The QRadar offense ID
- StartTime — The QRadar offense start time
Outputs
- QRadar.Correlation.StartTime — The correlation start time
- QRadar.Correlation.CategoryID — The correlation category id
- QRadar.Correlation.QID — The correlation QID identifier
- QRadar.Correlation.CREName — The correlation name
- QRadar.Correlation.CREDescription — The correlation description
- QRadar.Correlation — The QRadar offense correlations
- QRadar.Correlation.SourceIP — The correlation source IP
- QRadar — QRadar context output
- QRadar.Correlation.DestinationIP — The correlation destination IP
- QRadar.Correlation.Category — The correlation high level category
- QRadar.Correlation.Username — The correlation username
- QRadar.Log — The QRadar offense correlation logs
- QRadar.Log.QID — The log's correlation ID
- QRadar.Log.SourceIP — The log's source IP
- QRadar.Log.DestinationPort — The log's destination port
- QRadar.Log.SourcePort — The log's source port
- QRadar.Log.DestinationIP — The log's destination IP
- QRadar.Log.Category — The log's category
- QRadar.Log.IdentityIP — The log's identity IP
- QRadar.Log.Username — The log's username
- QRadar.Log.StartTime — The log's start time
- QRadar.Log.Magnitude — The log's magnitude
- QRadar.Log.ProtocolName — The log's protocol name