QRadarCorrelationLog Deprecated

Deprecated. Use the "QRadar - Get Offense Logs"\ \ playbook instead. This playbook retrieves the correlation logs of multiple QIDs.

IBM QRadar · 7 tasks · 6 inputs · 1 output

Inputs

  • QID — The correlation QID.
  • OffenseStartTime — The offense start time.
  • OffenseID — The offense ID.
  • additionalQueryFields — Add more fields for basic query (a list with comma separators)
  • GetOnlyCREEvents — If value "OnlyCRE" get only events made by CRE. Values can be "OnlyCRE", "OnlyNotCRE", "All".
  • MaxLogsCount — Maximum number of log entires to query from QRadar (default: 20)

Outputs

  • QRadar.Log — Logs of QRadar correlations

Flowchart

yes yes Start Start QRadarFullSearch - QRadarFullSearch QRadarFullSearch QRadarFullSearch Done Done Is OnlyNotCRE or ALL Is OnlyNotCRE or ALL Is OnlyCRE or ALL Is OnlyCRE or ALL QRadarFullSearch - QRadarFullSearch QRadarFullSearch QRadarFullSearch Change context - ChangeContext Change context ChangeContext