QRadar Get Hunting Results
This playbook is used to sort the QRadar search results to display the IP addresses, assets, and usernames that the search provided. In addition, the results allow you to differentiate between internal and external IP addresses as well as query the QRadar assets API in order to get the assets details from the IP addresses. You can provide the QRadar fields names and the organizations' IP ranges in order to properly sort the data. The end result of the playbook will be the internal and external IP addresses detected as well as the assets and users.
- Pack
- QRadar
- Tasks
- 18
Inputs
- InternalRange — A list of internal IP ranges to check IP addresses against. The comma-separated list should be provided in CIDR notation. For example, a list of ranges would be: "172.16.0.0/12,10.0.0.0/8,192.168.0.0/16" (without quotes).
- InvestigationIPFields — The values of these QRadar fields will be used for the playbook IP addresses outputs.
- InvestigationUserFields — The values of these QRadar fields will be used for the playbook user name outputs.
- SearchResults — The search results of an AQL search.
Outputs
- QRadar.DetectedUsers — Users detected based on the username field in your search.
- QRadar.DetectedInternalIPs — Internal IP addresses detected based on fields and inputs in your search.
- QRadar.DetectedExternalIPs — External IP addresses detected based on fields and inputs in your search.
- QRadar.DetectedInternalHosts — Internal host names detected based on hosts in your assets table. Note that the data accuracy depends on how the asset mapping is configured in QRadar.
- QRadar.DetectedExternalHosts — External host names detected based on hosts in your assets table. Note that the data accuracy depends on how the asset mapping is configured in QRadar.
Commands used
- qradar-assets-list