QRadar - Get Offense Logs

Works for QRadar integration version 3, v1 and v2 are deprecated. Note: You can use the integration to fetch the events with the offense however it will fetch the events according to the specified limit defined in the instance settings. By using this playbook you can define an additional search to query a larger number of logs. Default playbook inputs use the QRadar incident fields such as idoffense, starttime. These fields can be replaced but need to point to relevant offense ID and starttime fields.

IBM QRadar · 19 tasks · 6 inputs · 8 outputs

Inputs

  • MaxLogsCount — Maximum number of log entires to query from QRadar (default: 50)
  • ID — The QRadar offense ID. Uses the id offense incident field.
  • StartTime — The QRadar offense start time
  • GetOnlyCREEvents — If value "OnlyCRE" get only events made by CRE. Values can be "OnlyCRE", "OnlyNotCRE", "All".
  • Fields — A comma-separated list of extra fields to get from each event. You can replace with different fields as well as rename the field names.
  • ApiVersion — The API version for the timestamp format changes between versions

Outputs

  • QRadar — The QRadar offense logs.
  • QRadar.SourceIP — The unique source ips.
  • QRadar.DestinationIP — The unique destination ips.
  • QRadar.Username — The unique usernames.
  • QRadar.HighLevelCategory — The unique high level categories.
  • QRadar.LowLevelCategory — The unique high low categories.
  • QRadar.QidName — The unique QID names.
  • QRadar.StartTime — The start time of the first event.

Commands used

qradar-search-retrieve-events setIncident

Flowchart

true no yes yes Start Start Is CRE inserted correctly? Is CRE inserted correctly? Done Done Change Context - ChangeContext Change Context ChangeContext Is QRadar v3 enabled? - IsIntegrationAvailable Is QRadar v3 enabled? IsIntegrationAvailable Set CRE settings - Set Set CRE settings Set Set source IP addresses - SetAndHandleEmpty Set source IP addresses SetAndHandleEmpty Set destination IP addresses - SetAndHandleEmpty Set destination IP addresses SetAndHandleEmpty Set usernames - SetAndHandleEmpty Set usernames SetAndHandleEmpty Set high level category - SetAndHandleEmpty Set high level category SetAndHandleEmpty Set low level category - SetAndHandleEmpty Set low level category SetAndHandleEmpty Set outputs Set outputs Set QID name - SetAndHandleEmpty Set QID name SetAndHandleEmpty Set Start time - SetAndHandleEmpty Set Start time SetAndHandleEmpty Set incident fields - setIncident Set incident fields setIncident Is QRadar API version less than 19.0? Is QRadar API version les... Set timestamp to epoch (milliseconds) - Set Set timestamp to epoch (m... Set Set timestamp to epoch (seconds) - Set Set timestamp to epoch (s... Set Run Qradar Search - qradar-search-retrieve-events Run Qradar Search qradar-search-retrieve-events