TIM - QRadar Add IP Indicators

This playbook queries indicators based on a pre-defined query or results from a parent playbook, and adds the resulting indicators to a QRadar Reference Set. The Reference Set name must be defined in the playbook inputs.

Pack

QRadar

Tasks

13

Inputs

• QRadarBlackListIPReferenceSetName — The name of the QRadar block list IP reference set to insert the data to.
• QRadarWhiteListIPReferenceSetName — The name of the QRadar allow list IP reference set to insert the data in to.
• QRadarWatchListIPReferenceSetName — The name of the QRadar watch list IP reference set to insert the data in to.

Commands used

• appendIndicatorField
• qradar-update-reference-set-value