QRadar - Get Offense Logs
Works for QRadar integration version 3, v1 and v2 are deprecated. Note: You can use the integration to fetch the events with the offense however it will fetch the events according to the specified limit defined in the instance settings. By using this playbook you can define an additional search to query a larger number of logs. Default playbook inputs use the QRadar incident fields such as idoffense, starttime. These fields can be replaced but need to point to relevant offense ID and starttime fields.
IBM QRadar · 19 tasks · 6 inputs · 8 outputs
Inputs
MaxLogsCount— Maximum number of log entires to query from QRadar (default: 50)ID— The QRadar offense ID. Uses the id offense incident field.StartTime— The QRadar offense start timeGetOnlyCREEvents— If value "OnlyCRE" get only events made by CRE. Values can be "OnlyCRE", "OnlyNotCRE", "All".Fields— A comma-separated list of extra fields to get from each event. You can replace with different fields as well as rename the field names.ApiVersion— The API version for the timestamp format changes between versions
Outputs
QRadar— The QRadar offense logs.QRadar.SourceIP— The unique source ips.QRadar.DestinationIP— The unique destination ips.QRadar.Username— The unique usernames.QRadar.HighLevelCategory— The unique high level categories.QRadar.LowLevelCategory— The unique high low categories.QRadar.QidName— The unique QID names.QRadar.StartTime— The start time of the first event.
Commands used
qradar-search-retrieve-events
setIncident