QRadar - Get offense correlations Deprecated Hidden
Deprecated. Use the `QRadar - Get offense correlations v2` instead.\"\nRun on a QRadar offense to get more information\n\n* Get all correlations relevant to the offense\n* Get all logs relevant to the correlations (not done by default, set "GetCorrelationLogs\" to \"True\")\n\nInputs-\n* GetCorrelationLogs (default - False)\n* MaxLogsCount (default - 20)
Deprecated Content (Deprecated) · 7 tasks · 4 inputs · 23 outputs
Inputs
GetCorrelationLogs— If "True" will get all of the offense's correlations logsMaxLogsCount— Maximum number of log entires to query from QRadar (default: 20)ID— The QRadar offense IDStartTime— The QRadar offense start time
Outputs
QRadar.Correlation.StartTime— The correlation start timeQRadar.Correlation.CategoryID— The correlation category idQRadar.Correlation.QID— The correlation QID identifierQRadar.Correlation.CREName— The correlation nameQRadar.Correlation.CREDescription— The correlation descriptionQRadar.Correlation— The QRadar offense correlationsQRadar.Correlation.SourceIP— The correlation source IPQRadar— QRadar context outputQRadar.Correlation.DestinationIP— The correlation destination IPQRadar.Correlation.Category— The correlation high level categoryQRadar.Correlation.Username— The correlation usernameQRadar.Log— The QRadar offense correlation logsQRadar.Log.QID— The log's correlation IDQRadar.Log.SourceIP— The log's source IPQRadar.Log.DestinationPort— The log's destination portQRadar.Log.SourcePort— The log's source portQRadar.Log.DestinationIP— The log's destination IPQRadar.Log.Category— The log's categoryQRadar.Log.IdentityIP— The log's identity IPQRadar.Log.Username— The log's usernameQRadar.Log.StartTime— The log's start timeQRadar.Log.Magnitude— The log's magnitudeQRadar.Log.ProtocolName— The log's protocol name