QRadarFullSearch Deprecated

Deprecated.Use the following command instead `qradar-search-retrieve-results`. This playbook runs a QRadar query and return its results to the context.

IBM QRadar · 10 tasks · 5 inputs · 1 output

Details

IDQRadarFullSearch
From Version5.0.0
Tasks10

README

Deprecated.Use the following command instead qradar-search-retrieve-results.
This playbook runs a QRadar query and return its results to the context.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

  • GenericPolling

Integrations

  • QRadar
  • QRadar_v3
  • QRadar_v2

Scripts

  • PrintErrorEntry

Commands

  • qradar-get-search
  • qradar-searches
  • qradar-get-search-results

Playbook Inputs

Name Description Default Value Required
timeout How much time to wait before a timeout occurs (minutes) 600 Optional
interval Polling frequency - how often the polling command should run (minutes) 1 Optional
query_expression The query expressions in AQL   Required
range Range of results to return (e.g. 0-20)   Optional
headers Table headers   Optional

Playbook Outputs

Path Description Type
QRadar.Search.Result The result of the search unknown

Playbook Image

QRadarFullSearch

Inputs

  • timeout — How much time to wait before a timeout occurs (minutes)
  • interval — Polling frequency - how often the polling command should run (minutes)
  • query_expression — The query expressions in AQL
  • range — Range of results to return (e.g. 0-20)
  • headers — Table headers

Outputs

  • QRadar.Search.Result — The result of the search

Commands used

qradar-get-search qradar-get-search-results qradar-searches

Flowchart

yes yes yes Start Start Run QRadar search - qradar-searches Run QRadar search qradar-searches Get QRadar search - qradar-get-search Get QRadar search qradar-get-search GenericPolling - GenericPolling GenericPolling GenericPolling Get QRadar search results - qradar-get-search-results Get QRadar search results qradar-get-search-results Done Done Is search completed? Is search completed? Is QRadar enabled? Is QRadar enabled? Is search canceled? Is search canceled? ERROR - PrintErrorEntry ERROR PrintErrorEntry

Source

playbook-QRadarFullSearch.yml
Download History Raw 
id: QRadarFullSearch
version: -1
name: QRadarFullSearch
description: |-
  Deprecated.Use the following command instead `qradar-search-retrieve-results`.
  This playbook runs a QRadar query and return its results to the context.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: ea863b7b-8773-444d-8ee8-0d0ce9fba6b1
    type: start
    task:
      id: ea863b7b-8773-444d-8ee8-0d0ce9fba6b1
      version: -1
      name: ""
      description: Start of playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "7"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 152.5,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "1":
    id: "1"
    taskid: c4bad30a-41e8-42dc-893d-b83ef87e28e6
    type: regular
    task:
      id: c4bad30a-41e8-42dc-893d-b83ef87e28e6
      version: -1
      name: Run QRadar search
      description: Creates a search in QRadar using the search query
      script: '|||qradar-searches'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      headers:
        simple: ${inputs.headers}
      query_expression:
        simple: ${inputs.query_expression}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "2":
    id: "2"
    taskid: ba498a12-5e29-4d65-8973-4056466f58ed
    type: regular
    task:
      id: ba498a12-5e29-4d65-8973-4056466f58ed
      version: -1
      name: Get QRadar search
      description: Gets search object to initialize polling playbook
      script: '|||qradar-get-search'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "6"
    scriptarguments:
      headers:
        simple: ${inputs.headers}
      search_id:
        simple: ${QRadar.Search.ID}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 545
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "3":
    id: "3"
    taskid: c5c40bd8-435b-46d1-8e3e-ffb9e72954c2
    type: playbook
    task:
      id: c5c40bd8-435b-46d1-8e3e-ffb9e72954c2
      version: -1
      name: GenericPolling
      description: Generic polling of qradar-get-search
      playbookName: GenericPolling
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "8"
    scriptarguments:
      Ids:
        simple: ${QRadar.Search.ID}
      Interval:
        simple: ${inputs.interval}
      PollingCommandArgName:
        simple: search_id
      PollingCommandName:
        simple: qradar-get-search
      Timeout:
        simple: ${inputs.timeout}
      dt:
        simple: QRadar.Search(val.Status!=='COMPLETED' && val.Status!=='CANCELED').ID
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 0
    view: |-
      {
        "position": {
          "x": -200,
          "y": 910
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "4":
    id: "4"
    taskid: a8af7d6b-87e5-4f16-847a-038e2b15ac2c
    type: regular
    task:
      id: a8af7d6b-87e5-4f16-847a-038e2b15ac2c
      version: -1
      name: Get QRadar search results
      description: executes qradar-get-search-results to get the search results
      tags:
      - SIEMResults
      script: '|||qradar-get-search-results'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "5"
    scriptarguments:
      headers:
        simple: ${inputs.headers}
      range:
        simple: ${inputs.range}
      search_id:
        simple: ${QRadar.Search.ID}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 300,
          "y": 1300
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    evidencedata:
      customfields: {}
      description:
        simple: Qradar Full Search Results.
  "5":
    id: "5"
    taskid: 7160734d-90ad-4d48-8fa6-d8c7aa68bc61
    type: title
    task:
      id: 7160734d-90ad-4d48-8fa6-d8c7aa68bc61
      version: -1
      name: Done
      description: Playbook is done
      type: title
      iscommand: false
      brand: ""
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 152.5,
          "y": 1570
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "6":
    id: "6"
    taskid: 3f799ca0-9bbb-4d1e-8010-f864a2d0325a
    type: condition
    task:
      id: 3f799ca0-9bbb-4d1e-8010-f864a2d0325a
      version: -1
      name: Is search completed?
      description: Checks whether the search is completed
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "3"
      "yes":
      - "4"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              simple: QRadar.Search.Status
            iscontext: true
          right:
            value:
              simple: COMPLETED
    view: |-
      {
        "position": {
          "x": 265,
          "y": 720
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "7":
    id: "7"
    taskid: 58fd7e65-aa1d-4619-86e2-01b38d4974c9
    type: condition
    task:
      id: 58fd7e65-aa1d-4619-86e2-01b38d4974c9
      version: -1
      name: Is QRadar enabled?
      description: Returns 'yes' if integration brand is available. Otherwise returns 'no'
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "5"
      "yes":
      - "1"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: inList
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: QRadar,QRadar_v2,QRadar v3
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
            iscontext: true
    view: |-
      {
        "position": {
          "x": 152.5,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "8":
    id: "8"
    taskid: 3719dd6d-f2ad-4744-8845-8b1c210522be
    type: condition
    task:
      id: 3719dd6d-f2ad-4744-8845-8b1c210522be
      version: -1
      name: Is search canceled?
      description: Checks whether the search was canceled
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "4"
      "yes":
      - "9"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              simple: QRadar.Search.Status
            iscontext: true
          right:
            value:
              simple: CANCELED
    view: |-
      {
        "position": {
          "x": -200,
          "y": 1110
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "9":
    id: "9"
    taskid: d25ec92e-f69c-46e8-8c75-80c93f0af5b9
    type: regular
    task:
      id: d25ec92e-f69c-46e8-8c75-80c93f0af5b9
      version: -1
      name: ERROR
      description: Prints an error entry with a given message
      scriptName: PrintErrorEntry
      type: regular
      iscommand: false
      brand: ""
    scriptarguments:
      message:
        simple: 'Error in QRadar: qradar-get-search command returned with status ''CANCELED''. '
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -500,
          "y": 1300
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "7_5_#default#": 0.55,
      "8_4_#default#": 0.9
    },
    "paper": {
      "dimensions": {
        "height": 1585,
        "width": 1180,
        "x": -500,
        "y": 50
      }
    }
  }
inputs:
- key: timeout
  value:
    simple: "600"
  required: false
  description: How much time to wait before a timeout occurs (minutes)
  playbookInputQuery:
- key: interval
  value:
    simple: "1"
  required: false
  description: Polling frequency - how often the polling command should run (minutes)
  playbookInputQuery:
- key: query_expression
  value: {}
  required: true
  description: The query expressions in AQL
  playbookInputQuery:
- key: range
  value: {}
  required: false
  description: Range of results to return (e.g. 0-20)
  playbookInputQuery:
- key: headers
  value: {}
  required: false
  description: Table headers
  playbookInputQuery:
outputs:
- contextPath: QRadar.Search.Result
  description: The result of the search
tests:
- No tests (auto formatted)
fromversion: 5.0.0
deprecated: true
contentitemexportablefields:
  contentitemfields: {}
system: true
supportedModules:
- agentix
- xsiam