QRadarGetOffenseCorrelations Deprecated

Deprecated. Use the QradarGetOffenseCorrlations_v2 Playbook instead. Return the QRadar offense correlations if exist in logs.

python · IBM QRadar

Details

ID	`QRadarGetOffenseCorrelations`
Language	python
From Version	5.0.0
Docker Image	`demisto/python:2.7.18.20958`
Tags	QRadar

Source

QRadarGetOffenseCorrelations.py QRadarGetOffenseCorrelations_test.py QRadarGetOffenseCorrelations.yml

Download History Raw

commonfields:
  id: QRadarGetOffenseCorrelations
  version: -1
name: QRadarGetOffenseCorrelations
script: ''
type: python
subtype: python2
tags:
- QRadar
comment: Deprecated. Use the QradarGetOffenseCorrlations_v2 Playbook instead. Return the QRadar offense correlations if exist in logs.
system: true
deprecated: true
args:
- name: offenseID
  required: true
  default: true
  description: The offense ID to query.
  defaultValue: ${incident.labels.id}
- name: startTime
  required: true
  description: query from startTime (in timestamp format).
  defaultValue: ${incident.labels.start_time}
- name: headers
  description: Table headers
- name: range
  description: Number of results in return
- name: interval
  description: Interval to poll for results. Default is 10 seconds.
- name: timeout
  description: Timeout in seconds. Default is 10 minutes.
- name: fields
  description: Property fields to include in results
- name: is_cre_name_null
  auto: PREDEFINED
  predefined:
  - "True"
  - "False"
  description: Determines whether the CRE name is null by default.
  defaultValue: "False"
outputs:
- contextPath: QRadar.Correlation
  description: The QRadar offense correlations
- contextPath: QRadar.Correlation.QID
  description: The correlation QID identifier
- contextPath: QRadar.Correlation.CREName
  description: The correlation name
- contextPath: QRadar.Correlation.CREDescription
  description: The correlation description
- contextPath: QRadar.Correlation.SourceIP
  description: The correlation source IP
- contextPath: QRadar.Correlation.DestinationIP
  description: The correlation destination IP
- contextPath: QRadar.Correlation.Category
  description: The correlation high level category
- contextPath: QRadar.Correlation.Username
  description: The correlation username
- contextPath: QRadar.Correlation.StartTime
  description: The correlation start time
- contextPath: QRadar.Correlation.CategoryID
  description: 'The correlation category id '
- contextPath: QRadar
  description: QRadar context output
scripttarget: 0
dependson:
  must:
  - qradar-searches
tests:
- no tests
fromversion: 5.0.0
dockerimage: demisto/python:2.7.18.20958
supportedModules:
- agentix
- xsiam
- edr