Access Investigation - QRadar Deprecated

Deprecated. No available replacement. This playbook uses the QRadar integration to investigate an access incident by gathering user and IP information. The playbook then interacts with the user that triggered the incident to confirm whether or not they initiated the access action.

IBM QRadar · 11 tasks · 0 inputs · 0 outputs

Commands used

setIncident

Flowchart

yes yes Start Start QRadar alert QRadar alert QRadar - Get offense correlations v2 - QRadar - Get offense correlations v2 QRadar - Get offense corr... QRadar - Get offense correlat... Access Investigation - Generic - Access Investigation - Generic Access Investigation - Ge... Access Investigation - Generic Investigate access incident Investigate access incident Done Done Set QRadar information into access custom fields - setIncident Set QRadar information in... setIncident Is QRadar v1 enabled? Is QRadar v1 enabled? Is QRadar v2 enabled? Is QRadar v2 enabled? Set timestamp to epoch - Set Set timestamp to epoch Set Set timestamp - Set Set timestamp Set