QRadar - Get offense correlations v2 Deprecated
Deprecated. Use the "QRadar - Get Offense Logs" playbook instead. Run on a QRadar offense to get more information: * Get all correlations relevant to the offense * Get all logs relevant to the correlations (not done by default - set "GetCorrelationLogs" to "True") Inputs: * GetCorrelationLogs (default: False) * MaxLogsCount (default: 20)
IBM QRadar · 17 tasks · 7 inputs · 22 outputs
Inputs
GetCorrelationLogs— When set to "True", retrieves all of the offense's correlations logsMaxLogsCount— Maximum number of log entires to query from QRadar (default: 20)ID— The QRadar offense IDStartTime— The QRadar offense start timeGetOnlyCREEvents— If value "OnlyCRE" get only events made by CRE. Values can be "OnlyCRE", "OnlyNotCRE", "All".MaxCorrelationCount— Maximum number of correlations to query from QRadar (default: 100)Fields— A comma-separated list of extra fields to get from each event.
Outputs
QRadar.Correlation.StartTime— The correlation start timeQRadar.Correlation.CategoryID— The correlation category idQRadar.Correlation.QID— The correlation QID identifierQRadar.Correlation.CREName— The correlation nameQRadar.Correlation.CREDescription— The correlation descriptionQRadar.Correlation— The QRadar offense correlationsQRadar.Correlation.SourceIP— The correlation source IPQRadar.Correlation.DestinationIP— The correlation destination IPQRadar.Correlation.Category— The correlation high level categoryQRadar.Correlation.Username— The correlation usernameQRadar.Log— The QRadar offense correlation logsQRadar.Log.QID— The log's correlation IDQRadar.Log.SourceIP— The log's source IPQRadar.Log.DestinationPort— The log's destination portQRadar.Log.SourcePort— The log's source portQRadar.Log.DestinationIP— The log's destination IPQRadar.Log.Category— The log's categoryQRadar.Log.IdentityIP— The log's identity IPQRadar.Log.Username— The log's usernameQRadar.Log.StartTime— The log's start timeQRadar.Log.Magnitude— The log's magnitudeQRadar.Log.ProtocolName— The log's protocol name