QRadarCorrelationLog Deprecated

Deprecated. Use the "QRadar - Get Offense Logs"\ \ playbook instead. This playbook retrieves the correlation logs of multiple QIDs.

IBM QRadar · 7 tasks · 6 inputs · 1 output

Details

IDQRadarCorrelationLog
From Version5.0.0
Tasks7

README

Deprecated. Use the “QRadar - Get Offense Logs” playbook instead.

This playbook retrieves the correlation logs of multiple QIDs.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

  • QRadarFullSearch

Integrations

This playbook does not use any integrations.

Scripts

  • ChangeContext

Commands

This playbook does not use any commands.

Playbook Inputs

Name Description Default Value Required
QID The correlation QID.   Required
OffenseStartTime The offense start time.   Required
OffenseID The offense ID.   Required
additionalQueryFields Add more fields for basic query (a list with comma separators)   Optional
GetOnlyCREEvents If value “OnlyCRE” get only events made by CRE.    
Values can be “OnlyCRE”, “OnlyNotCRE”, “All”. OnlyCRE Optional  
MaxLogsCount Maximum number of log entires to query from QRadar (default: 20) 20 Optional

Playbook Outputs

Path Description Type
QRadar.Log Logs of QRadar correlations unknown

Inputs

  • QID — The correlation QID.
  • OffenseStartTime — The offense start time.
  • OffenseID — The offense ID.
  • additionalQueryFields — Add more fields for basic query (a list with comma separators)
  • GetOnlyCREEvents — If value "OnlyCRE" get only events made by CRE. Values can be "OnlyCRE", "OnlyNotCRE", "All".
  • MaxLogsCount — Maximum number of log entires to query from QRadar (default: 20)

Outputs

  • QRadar.Log — Logs of QRadar correlations

Flowchart

yes yes Start Start QRadarFullSearch - QRadarFullSearch QRadarFullSearch QRadarFullSearch Done Done Is OnlyNotCRE or ALL Is OnlyNotCRE or ALL Is OnlyCRE or ALL Is OnlyCRE or ALL QRadarFullSearch - QRadarFullSearch QRadarFullSearch QRadarFullSearch Change context - ChangeContext Change context ChangeContext

Source

playbook-QRadarCorrelationLog.yml
Download History Raw 
id: QRadarCorrelationLog
version: -1
name: QRadarCorrelationLog
deprecated: true
description: Deprecated. Use the "QRadar - Get Offense Logs"\ \ playbook instead. This playbook retrieves the correlation logs of multiple QIDs.
starttaskid: '0'
tasks:
  '0':
    id: '0'
    taskid: 8eac4af4-139b-450e-86ee-fe015bd40bf3
    type: start
    task:
      id: 8eac4af4-139b-450e-86ee-fe015bd40bf3
      version: -1
      name: ''
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '3'
      - '4'
    separatecontext: false
    view: "{\n  \"position\": {\n    \"x\": 265,\n    \"y\": 50\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  '1':
    id: '1'
    taskid: ba750359-b6e4-49cb-89c2-e9fc67fa5a00
    type: playbook
    task:
      id: ba750359-b6e4-49cb-89c2-e9fc67fa5a00
      version: -1
      name: QRadarFullSearch
      description: This playbook runs a QRadar query and return its results to the context.
      playbookName: QRadarFullSearch
      type: playbook
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '8'
    scriptarguments:
      headers: {}
      interval:
        simple: '1'
      query_expression:
        simple: "\t\tselect qid QID,\n\t\tsourceip as \"SourceIP\",\n\t\tdestinationip as \"DestinationIP\",\n\t\teventcount as \"EventCount\",\n\t\tsourceport as \"SourcePort\",\n\t\tusername as \"Username\",\n\t\tstarttime as \"StartTime\",\n\t\tdestinationport as \"DestinationPort\",\n\t\tmagnitude as \"Magnitude\",\n\t\tidentityip as \"IdentityIP\",\n\t\tCATEGORYNAME(category) as \"Category\",\n\t\tPROTOCOLNAME(protocolid) as \"ProtocolName\",\n\t\tLOGSOURCENAME(logsourceid)${inputs.additionalQueryFields}\n\t\tfrom events where (RULENAME(${inputs.QID}) ILIKE '%') AND \"CRE Name\" IS NULL AND INOFFENSE(${inputs.OffenseID})\nLIMIT ${inputs.MaxLogsCount}\n START '${inputs.OffenseStartTime}'"
      range: {}
      timeout:
        simple: '600'
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ''
      wait: 1
      max: 100
    view: "{\n  \"position\": {\n    \"x\": 480,\n    \"y\": 370\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  '2':
    id: '2'
    taskid: acf1d671-7a06-47d7-8f34-0d9a9def2b20
    type: title
    task:
      id: acf1d671-7a06-47d7-8f34-0d9a9def2b20
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ''
      description: ''
    separatecontext: false
    view: "{\n  \"position\": {\n    \"x\": 265,\n    \"y\": 720\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  '3':
    id: '3'
    taskid: 557f3ad8-f7fd-4c5d-8e28-dadd7c59acc9
    type: condition
    task:
      id: 557f3ad8-f7fd-4c5d-8e28-dadd7c59acc9
      version: -1
      name: Is OnlyNotCRE or ALL
      type: condition
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      'yes':
      - '1'
    separatecontext: false
    conditions:
    - label: 'yes'
      condition:
      - - operator: inList
          left:
            value:
              simple: inputs.GetOnlyCREEvents
            iscontext: true
          right:
            value:
              simple: OnlyNotCRE,All
    view: "{\n  \"position\": {\n    \"x\": 480,\n    \"y\": 195\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  '4':
    id: '4'
    taskid: ee41e8ef-5236-4fbd-84c3-c8dda0fd9593
    type: condition
    task:
      id: ee41e8ef-5236-4fbd-84c3-c8dda0fd9593
      version: -1
      name: Is OnlyCRE or ALL
      type: condition
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      'yes':
      - '5'
    separatecontext: false
    conditions:
    - label: 'yes'
      condition:
      - - operator: inList
          left:
            value:
              simple: inputs.GetOnlyCREEvents
            iscontext: true
          right:
            value:
              simple: OnlyCRE,All
    view: "{\n  \"position\": {\n    \"x\": 50,\n    \"y\": 195\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  '5':
    id: '5'
    taskid: ff2dabeb-8f58-42f5-8f6f-b3deffdb18c9
    type: playbook
    task:
      id: ff2dabeb-8f58-42f5-8f6f-b3deffdb18c9
      version: -1
      name: QRadarFullSearch
      description: This playbook runs a QRadar query and return its results to the context.
      playbookName: QRadarFullSearch
      type: playbook
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '8'
    scriptarguments:
      headers: {}
      interval:
        simple: '1'
      query_expression:
        simple: "\t\tselect qid QID,\n\t\tsourceip as \"SourceIP\",\n\t\tdestinationip as \"DestinationIP\",\n\t\teventcount as \"EventCount\",\n\t\tsourceport as \"SourcePort\",\n\t\tusername as \"Username\",\n\t\tstarttime as \"StartTime\",\n\t\tdestinationport as \"DestinationPort\",\n\t\tmagnitude as \"Magnitude\",\n\t\tidentityip as \"IdentityIP\",\n\t\tCATEGORYNAME(category) as \"Category\",\n\t\tPROTOCOLNAME(protocolid) as \"ProtocolName\",\n\t\tLOGSOURCENAME(logsourceid)${inputs.additionalQueryFields}\n\t\tfrom events where (RULENAME(${inputs.QID}) ILIKE '%') AND \"CRE Name\" <> NULL AND INOFFENSE(${inputs.OffenseID}) \nLIMIT ${inputs.MaxLogsCount}\n START '${inputs.OffenseStartTime}'"
      range: {}
      timeout:
        simple: '600'
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ''
      wait: 1
      max: 100
    view: "{\n  \"position\": {\n    \"x\": 50,\n    \"y\": 370\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  '8':
    id: '8'
    taskid: 8f647022-1139-47e9-87dd-95e9f904ea13
    type: regular
    task:
      id: 8f647022-1139-47e9-87dd-95e9f904ea13
      version: -1
      name: Change context
      description: 'Enables changing context in two ways. The first is to capitalize the first letter of each key in following level of the context key entered. The second is to change context keys to new values. '
      scriptName: ChangeContext
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '2'
    scriptarguments:
      capitalize:
        simple: 'False'
      inplace:
        simple: 'False'
      input:
        simple: ${QRadar.Search.Result.events}
      output_key:
        simple: QRadar.Log
      replace_dict:
        simple: '{"sourceip": "SourceIP", "qid":"QID", "destinationip": "DestinationIP", "category": "CategoryID", "starttime": "StartTime"}'
    separatecontext: false
    view: "{\n  \"position\": {\n    \"x\": 265,\n    \"y\": 545\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
view: "{\n  \"linkLabelsPosition\": {},\n  \"paper\": {\n    \"dimensions\": {\n      \"height\": 735,\n      \"width\": 810,\n      \"x\": 50,\n      \"y\": 50\n    }\n  }\n}"
inputs:
- key: QID
  value: {}
  required: true
  description: The correlation QID.
  playbookInputQuery:
- key: OffenseStartTime
  value: {}
  required: true
  description: The offense start time.
  playbookInputQuery:
- key: OffenseID
  value: {}
  required: true
  description: The offense ID.
  playbookInputQuery:
- key: additionalQueryFields
  value: {}
  required: false
  description: Add more fields for basic query (a list with comma separators)
  playbookInputQuery:
- key: GetOnlyCREEvents
  value:
    simple: OnlyCRE
  required: false
  description: "If value \"OnlyCRE\" get only events made by CRE.\nValues can be \"OnlyCRE\", \"OnlyNotCRE\", \"All\"."
  playbookInputQuery:
- key: MaxLogsCount
  value:
    simple: '20'
  required: false
  description: 'Maximum number of log entires to query from QRadar (default: 20)'
  playbookInputQuery:
outputs:
- contextPath: QRadar.Log
  description: Logs of QRadar correlations
  type: unknown
fromversion: 5.0.0
tests:
- No test
supportedModules:
- agentix
- xsiam