QRadar - Get offense correlations Deprecated Hidden

Deprecated. Use the `QRadar - Get offense correlations v2` instead.\"\nRun on a QRadar offense to get more information\n\n* Get all correlations relevant to the offense\n* Get all logs relevant to the correlations (not done by default, set "GetCorrelationLogs\" to \"True\")\n\nInputs-\n* GetCorrelationLogs (default - False)\n* MaxLogsCount (default - 20)

Deprecated Content (Deprecated) · 7 tasks · 4 inputs · 23 outputs

Details

ID	`QRadar - Get offense correlations`
From Version	5.0.0
Tasks	7

README

Deprecated. Use the QRadar - Get offense correlations v2 instead. Run on a QRadar offense to get more information

Get all correlations relevant to the offense\n* Get all logs relevant to the correlations (not done by default, set “GetCorrelationLogs" to "True")\n\nInputs-\n* GetCorrelationLogs (default - False)\n* MaxLogsCount (default - 20)

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

This playbook does not use any integrations.

Scripts

QRadarGetCorrelationLogs
QRadarGetOffenseCorrelations

Commands

This playbook does not use any commands.

Playbook Inputs

Name	Description	Default Value	Required
GetCorrelationLogs	If “True” will get all of the offense’s correlations logs	False	Optional
MaxLogsCount	Maximum number of log entires to query from QRadar (default: 20)	20	Optional
ID	The QRadar offense ID	incident.labels.id	Required
StartTime	The QRadar offense start time	incident.labels.start_time	Required

Playbook Outputs

Path	Description	Type
QRadar.Correlation.StartTime	The correlation start time	unknown
QRadar.Correlation.CategoryID	The correlation category id	unknown
QRadar.Correlation.QID	The correlation QID identifier	unknown
QRadar.Correlation.CREName	The correlation name	unknown
QRadar.Correlation.CREDescription	The correlation description	unknown
QRadar.Correlation	The QRadar offense correlations	unknown
QRadar.Correlation.SourceIP	The correlation source IP	unknown
QRadar	QRadar context output	unknown
QRadar.Correlation.DestinationIP	The correlation destination IP	unknown
QRadar.Correlation.Category	The correlation high level category	unknown
QRadar.Correlation.Username	The correlation username	unknown
QRadar.Log	The QRadar offense correlation logs	unknown
QRadar.Log.QID	The log’s correlation ID	unknown
QRadar.Log.SourceIP	The log’s source IP	unknown
QRadar.Log.DestinationPort	The log’s destination port	unknown
QRadar.Log.SourcePort	The log’s source port	unknown
QRadar.Log.DestinationIP	The log’s destination IP	unknown
QRadar.Log.Category	The log’s category	unknown
QRadar.Log.IdentityIP	The log’s identity IP	unknown
QRadar.Log.Username	The log’s username	unknown
QRadar.Log.StartTime	The log’s start time	unknown
QRadar.Log.Magnitude	The log’s magnitude	unknown
QRadar.Log.ProtocolName	The log’s protocol name	unknown

Playbook Image

QRadar_Get_offense_correlations

Inputs

GetCorrelationLogs — If "True" will get all of the offense's correlations logs
MaxLogsCount — Maximum number of log entires to query from QRadar (default: 20)
ID — The QRadar offense ID
StartTime — The QRadar offense start time

Outputs

QRadar.Correlation.StartTime — The correlation start time
QRadar.Correlation.CategoryID — The correlation category id
QRadar.Correlation.QID — The correlation QID identifier
QRadar.Correlation.CREName — The correlation name
QRadar.Correlation.CREDescription — The correlation description
QRadar.Correlation — The QRadar offense correlations
QRadar.Correlation.SourceIP — The correlation source IP
QRadar — QRadar context output
QRadar.Correlation.DestinationIP — The correlation destination IP
QRadar.Correlation.Category — The correlation high level category
QRadar.Correlation.Username — The correlation username
QRadar.Log — The QRadar offense correlation logs
QRadar.Log.QID — The log's correlation ID
QRadar.Log.SourceIP — The log's source IP
QRadar.Log.DestinationPort — The log's destination port
QRadar.Log.SourcePort — The log's source port
QRadar.Log.DestinationIP — The log's destination IP
QRadar.Log.Category — The log's category
QRadar.Log.IdentityIP — The log's identity IP
QRadar.Log.Username — The log's username
QRadar.Log.StartTime — The log's start time
QRadar.Log.Magnitude — The log's magnitude
QRadar.Log.ProtocolName — The log's protocol name

Flowchart

Source

playbook-QRadar_-_Get_offense_correlations_.yml

Download History Raw

id: 'QRadar - Get offense correlations '
version: -1
name: QRadar - Get offense correlations
fromversion: 5.0.0
description: Deprecated. Use the `QRadar - Get offense correlations v2` instead.\"\nRun on a QRadar offense to get more information\n\n* Get all correlations relevant to the offense\n* Get all logs relevant to the correlations (not done by default, set "GetCorrelationLogs\" to \"True\")\n\nInputs-\n* GetCorrelationLogs (default - False)\n* MaxLogsCount (default - 20)
hidden: true
starttaskid: '0'
tasks:
  '0':
    id: '0'
    taskid: 608f0ec1-4001-4e68-8ead-e160f7802b35
    type: start
    task:
      id: 608f0ec1-4001-4e68-8ead-e160f7802b35
      version: -1
      name: ''
      description: ''
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '1'
    separatecontext: false
    view: "{\n  \"position\": {\n    \"x\": 50,\n    \"y\": 51\n  }\n}"
  '1':
    id: '1'
    taskid: e403a36f-c0fd-4ef0-8ec7-8a6683a5b0a5
    type: condition
    task:
      id: e403a36f-c0fd-4ef0-8ec7-8a6683a5b0a5
      version: -1
      name: Is this a QRadar offense?
      description: ''
      type: condition
      iscommand: false
      brand: ''
    nexttasks:
      '#default#':
      - '2'
      'yes':
      - '5'
    separatecontext: false
    conditions:
    - label: 'yes'
      condition:
      - - operator: general.isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: string.isEqual
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: QRadar
                    ignorecase: true
                accessor: brand
            iscontext: true
    view: "{\n  \"position\": {\n    \"x\": 50,\n    \"y\": 195\n  }\n}"
  '2':
    id: '2'
    taskid: edc69a27-88bc-4edb-8fca-8a111d2b6785
    type: title
    task:
      id: edc69a27-88bc-4edb-8fca-8a111d2b6785
      version: -1
      name: Done
      description: ''
      type: title
      iscommand: false
      brand: ''
    separatecontext: false
    view: "{\n  \"position\": {\n    \"x\": 50,\n    \"y\": 1040\n  }\n}"
  '3':
    id: '3'
    taskid: bbe06f8f-78a7-4de5-81ff-ff16aa98f5b6
    type: regular
    task:
      id: bbe06f8f-78a7-4de5-81ff-ff16aa98f5b6
      version: -1
      name: Get Offense correlations
      description: Query QRadar for the offense correlations using the QRadar API
      scriptName: QRadarGetOffenseCorrelations
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '6'
    scriptarguments:
      fields: {}
      headers: {}
      interval: {}
      offenseID:
        complex:
          root: inputs.ID
      range: {}
      startTime:
        complex:
          root: inputs.StartTime
      timeout: {}
    separatecontext: false
    view: "{\n  \"position\": {\n    \"x\": 162.5,\n    \"y\": 515\n  }\n}"
  '4':
    id: '4'
    taskid: 324f9756-1ddb-4d58-8d45-26f892ba6759
    type: regular
    task:
      id: 324f9756-1ddb-4d58-8d45-26f892ba6759
      version: -1
      name: Get correlations' logs
      description: ''
      scriptName: QRadarGetCorrelationLogs
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '2'
    scriptarguments:
      additionalQueryFields: {}
      fields: {}
      headers: {}
      interval: {}
      offenseID:
        complex:
          root: inputs.ID
      qid:
        complex:
          root: QRadar
          accessor: Correlation.QID
      range:
        simple: 0-${inputs.MaxLogsCount}
      startTime:
        complex:
          root: inputs.StartTime
      timeout: {}
    separatecontext: false
    view: "{\n  \"position\": {\n    \"x\": 275,\n    \"y\": 865\n  }\n}"
  '5':
    id: '5'
    taskid: d05103bc-af8a-4d0b-80e2-a1637c45aa9c
    type: title
    task:
      id: d05103bc-af8a-4d0b-80e2-a1637c45aa9c
      version: -1
      name: Get offense information
      description: ''
      type: title
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '3'
    separatecontext: false
    view: "{\n  \"position\": {\n    \"x\": 162.5,\n    \"y\": 370\n  }\n}"
  '6':
    id: '6'
    taskid: 8dfe1ea9-0c27-4ff9-8892-ae66f014ec4b
    type: condition
    task:
      id: 8dfe1ea9-0c27-4ff9-8892-ae66f014ec4b
      version: -1
      name: Should query for the correlations' logs?
      description: ''
      type: condition
      iscommand: false
      brand: ''
    nexttasks:
      '#default#':
      - '2'
      'yes':
      - '4'
    separatecontext: false
    conditions:
    - label: 'yes'
      condition:
      - - operator: string.isEqual
          left:
            value:
              complex:
                root: inputs.GetCorrelationLogs
            iscontext: true
          right:
            value:
              simple: 'True'
          ignorecase: true
    view: "{\n  \"position\": {\n    \"x\": 162.5,\n    \"y\": 690\n  }\n}"
view: "{\n  \"linkLabelsPosition\": {},\n  \"paper\": {\n    \"dimensions\": {\n      \"height\": 1054,\n      \"width\": 605,\n      \"x\": 50,\n      \"y\": 51\n    }\n  }\n}"
inputs:
- key: GetCorrelationLogs
  value:
    simple: 'False'
  required: false
  description: If "True" will get all of the offense's correlations logs
- key: MaxLogsCount
  value:
    simple: '20'
  required: false
  description: 'Maximum number of log entires to query from QRadar (default: 20)'
- key: ID
  value:
    complex:
      root: incident
      accessor: labels.id
  required: true
  description: 'The QRadar offense ID '
- key: StartTime
  value:
    complex:
      root: incident
      accessor: labels.start_time
  required: true
  description: The QRadar offense start time
outputs:
- contextPath: QRadar.Correlation.StartTime
  description: The correlation start time
- contextPath: QRadar.Correlation.CategoryID
  description: 'The correlation category id '
- contextPath: QRadar.Correlation.QID
  description: The correlation QID identifier
- contextPath: QRadar.Correlation.CREName
  description: The correlation name
- contextPath: QRadar.Correlation.CREDescription
  description: The correlation description
- contextPath: QRadar.Correlation
  description: The QRadar offense correlations
- contextPath: QRadar.Correlation.SourceIP
  description: The correlation source IP
- contextPath: QRadar
  description: QRadar context output
- contextPath: QRadar.Correlation.DestinationIP
  description: The correlation destination IP
- contextPath: QRadar.Correlation.Category
  description: The correlation high level category
- contextPath: QRadar.Correlation.Username
  description: The correlation username
- contextPath: QRadar.Log
  description: The QRadar offense correlation logs
- contextPath: QRadar.Log.QID
  description: The log's correlation ID
- contextPath: QRadar.Log.SourceIP
  description: The log's source IP
- contextPath: QRadar.Log.DestinationPort
  description: The log's destination port
- contextPath: QRadar.Log.SourcePort
  description: The log's source port
- contextPath: QRadar.Log.DestinationIP
  description: The log's destination IP
- contextPath: QRadar.Log.Category
  description: The log's category
- contextPath: QRadar.Log.IdentityIP
  description: The log's identity IP
- contextPath: QRadar.Log.Username
  description: The log's username
- contextPath: QRadar.Log.StartTime
  description: The log's start time
- contextPath: QRadar.Log.Magnitude
  description: The log's magnitude
- contextPath: QRadar.Log.ProtocolName
  description: The log's protocol name
tests:
- no tests
deprecated: true