QRadar - Get offense correlations v2
Deprecated. Use the "QRadar - Get Offense Logs" playbook instead. Run on a QRadar offense to get more information: * Get all correlations relevant to the offense * Get all logs relevant to the correlations (not done by default - set "GetCorrelationLogs" to "True") Inputs: * GetCorrelationLogs (default: False) * MaxLogsCount (default: 20)
- Pack
- QRadar
- Tasks
- 17
Inputs
- GetCorrelationLogs — When set to "True", retrieves all of the offense's correlations logs
- MaxLogsCount — Maximum number of log entires to query from QRadar (default: 20)
- ID — The QRadar offense ID
- StartTime — The QRadar offense start time
- GetOnlyCREEvents — If value "OnlyCRE" get only events made by CRE. Values can be "OnlyCRE", "OnlyNotCRE", "All".
- MaxCorrelationCount — Maximum number of correlations to query from QRadar (default: 100)
- Fields — A comma-separated list of extra fields to get from each event.
Outputs
- QRadar.Correlation.StartTime — The correlation start time
- QRadar.Correlation.CategoryID — The correlation category id
- QRadar.Correlation.QID — The correlation QID identifier
- QRadar.Correlation.CREName — The correlation name
- QRadar.Correlation.CREDescription — The correlation description
- QRadar.Correlation — The QRadar offense correlations
- QRadar.Correlation.SourceIP — The correlation source IP
- QRadar.Correlation.DestinationIP — The correlation destination IP
- QRadar.Correlation.Category — The correlation high level category
- QRadar.Correlation.Username — The correlation username
- QRadar.Log — The QRadar offense correlation logs
- QRadar.Log.QID — The log's correlation ID
- QRadar.Log.SourceIP — The log's source IP
- QRadar.Log.DestinationPort — The log's destination port
- QRadar.Log.SourcePort — The log's source port
- QRadar.Log.DestinationIP — The log's destination IP
- QRadar.Log.Category — The log's category
- QRadar.Log.IdentityIP — The log's identity IP
- QRadar.Log.Username — The log's username
- QRadar.Log.StartTime — The log's start time
- QRadar.Log.Magnitude — The log's magnitude
- QRadar.Log.ProtocolName — The log's protocol name