QRadarClassifier Deprecated

Deprecated. No available replacement. This script Classifies QRadar incidents.\nThe 'QRADAR_CATEGORIES' dictionary translate QRadar 'High level Categories' to its 'Demisto Types' counterpart.\n\nFor custom categories, use the 'customCategories' argument.\nThe offense high level category will be put to context.

javascript · IBM QRadar

Source

var QRADAR_CATEGORIES = {
    'Recon' : 'Reconnaissance',
    'DOS' : 'DoS',
    'Authentication' : 'Authentication',
    'Access' : 'Access',
    'Exploit' : 'Exploit',
    'Malware' : 'Malware',
    'Suspicious Activity' : 'Network',
    'System' : 'Unclassified',
    'Policy' : 'Unclassified',
    'Unknown' : 'Unclassified',
    'Time Series' : 'Unclassified',
    'CRE' : 'Unclassified',
    'Potential Exploit' : 'Exploit',
    'Flow' : 'Network',
    'User Defined' : 'Unclassified',
    'SIM Audit' : 'Unclassified',
    'VIS Host Discovery' : 'Network',
    'Application' : 'Unclassified',
    'Audit' : 'Unclassified',
    'Risk' : 'Vulnerability',
    'Risk Manager Audit' : 'Unclassified',
    'Control System' : 'Unclassified',
    'Asset Profiler' : 'Network'
};

if (args.customCategories){
    var customObj = JSON.parse(args.customCategories);
    for (var attrname in customObj) { QRADAR_CATEGORIES[attrname] = customObj[attrname];}
}

var CONTEXT_OUTPUT = 'Classifier/Description';
if("contextOutput" in args){
    CONTEXT_OUTPUT = args.contextOutput;
}

var QUERY = "SELECT CATEGORYNAME(highlevelcategory) FROM events WHERE INOFFENSE({0}) START {1}";

var incident = incidents[0];

var offense_id = "";
var start_time = "";
var offense_type = "";
var incident_type = "";
var labels = dq(incident,"labels");

labels.forEach(function(label){
    if (label.type == 'id'){
        offense_id = label.value;
    }
    if (label.type == 'start_time'){
        start_time = label.value;
    }
});

resp =  executeCommand('QRadarFullSearch', {query_expression :QUERY.format(offense_id,start_time)});
if (isError(resp[0])){
    return resp;
}
else {
    data = dq(resp[0],'Contents.events');
    offense_type = (data instanceof Array && data.length > 0) ? dq(data[0],'categoryname_highlevelcategory') : '';
}
if (offense_type){
    incident_type = QRADAR_CATEGORIES[offense_type] ? offense_type in QRADAR_CATEGORIES : '';
    setContext(CONTEXT_OUTPUT,offense_type);
}

if (incident_type){
    resp =  executeCommand('IncidentSet', {'type': incident_type, 'updatePlaybookForType' : 'yes'});
    if (isError(resp[0])){
        return resp;
    }
}
else {
    return { ContentsFormat: formats.text, Type: entryTypes.error, Contents: "Couldn't extract incident type for QRadar offense ID '{0}'".format(offense_id) };
}