category: Analytics & SIEM provider: Palo Alto Networks deprecated: true commonfields: id: QRadar version: -1 configuration: - display: Server URL (e.g. https://192.168.0.1) name: server required: true type: 0 - display: Username name: credentials type: 9 required: false - display: Authentication token name: token type: 4 required: false - display: Query to fetch offenses name: query type: 0 required: false - defaultvalue: '50' display: Number of offenses to pull per API call name: offensesPerCall type: 0 required: false - display: Trust any certificate (not secure) name: insecure type: 8 required: false - display: Use system proxy settings name: proxy type: 8 required: false - display: Fetch incidents name: isFetch type: 8 required: false - display: Incident type name: incidentType type: 13 required: false - defaultvalue: 'true' display: Full Incident Enrichment name: full_enrich type: 8 required: false - defaultvalue: '100' display: Number of addresses to enrich per API call name: enrich_size type: 0 required: false description: Deprecated. Use IBM QRadar v2 or IBM QRadar v3 instead. display: IBM QRadar (Deprecated) name: QRadar script: commands: - arguments: - description: 'Query to filter offenses. For refernce please consult: https://www.ibm.com/support/knowledgecenter/en/SS42VS_7.3.1/com.ibm.qradar.doc/c_rest_api_filtering.html' name: filter - description: 'If used, will filter all fields except for the specified ones. Use this parameter to specify which fields you would like to get back in the response. Fields that are not named are excluded. Specify subfields in brackets and multiple fields in the same object are separated by commas. The filter uses QRadar''s field names, for reference please consult: https://www.ibm.com/support/knowledgecenter/SSKMKU/com.ibm.qradar.doc_cloud/9.1--siem-offenses-GET.html' name: fields - description: 'Range of results to return. e.g.: 0-20' name: range - description: Table headers to use the human readable output (if none provided, will show all table headers) name: headers description: Gets offenses from QRadar name: qradar-offenses outputs: - contextPath: QRadar.Offense.Followup description: Offense followup. type: boolean - contextPath: QRadar.Offense.ID description: The ID of the offense. type: number - contextPath: QRadar.Offense.Description description: The description of the offense. type: string - contextPath: QRadar.Offense.SourceAddress description: The source addresses that are associated with the offense. type: Unknown - contextPath: QRadar.Offense.DestinationAddress description: The local destination addresses that are associated with the offense. If your offense has a remote destination, you will need to use QRadarFullSearch playbook with the following query - SELECT destinationip FROM events WHERE inOffense() GROUP BY destinationip type: Unknown - contextPath: QRadar.Offense.RemoteDestinationCount description: The remote destination that are associated with the offesne. If this value is greater than 0 that means your offense has a remote destination, you will need to use QRadarFullSearch playbook with the following query - SELECT destinationip FROM events WHERE inOffense() GROUP BY destinationip type: Unknown - contextPath: QRadar.Offense.StartTime description: The time (ISO) when the offense was started. type: date - contextPath: QRadar.Offense.EventCount description: The number of events that are associated with the offense. type: number - contextPath: QRadar.Offense.Magnitude description: The magnitude of the offense. type: number - contextPath: QRadar.Offense.LastUpdatedTime description: The time (ISO) when the offense was last updated. type: date - contextPath: QRadar.Offense.OffenseType description: The offense type (due to API limitations if username and password were not provided, this value will be the id of offense type) type: string - arguments: - default: true description: Offense ID name: offense_id required: true - description: 'Query to filter offense. For refernce please consult: https://www.ibm.com/support/knowledgecenter/en/SS42VS_7.3.1/com.ibm.qradar.doc/c_rest_api_filtering.html' name: filter - description: 'If used, will filter all fields except for the specified ones. Use this parameter to specify which fields you would like to get back in the response. Fields that are not named are excluded. Specify subfields in brackets and multiple fields in the same object are separated by commas. The filter uses QRadar''s field names, for reference please consult: https://www.ibm.com/support/knowledgecenter/SSKMKU/com.ibm.qradar.doc_cloud/9.1--siem-offenses-offense_id-GET.html' name: fields - description: Table headers to use the human readable output (if none provided, will show all table headers) name: headers description: Gets offense with matching offense ID from qradar name: qradar-offense-by-id outputs: - contextPath: QRadar.Offense.Credibility description: The credibility of the offense type: number - contextPath: QRadar.Offense.Relevance description: The relevance of the offense type: number - contextPath: QRadar.Offense.Severity description: The severity of the offense type: number - contextPath: QRadar.Offense.SourceAddress description: The source addresses that are associated with the offense. type: Unknown - contextPath: QRadar.Offense.DestinationAddress description: The local destination addresses that are associated with the offense. If your offense has a remote destination, you will need to use QRadarFullSearch playbook with the following query - SELECT destinationip FROM events WHERE inOffense() GROUP BY destinationip type: Unknown - contextPath: QRadar.Offense.RemoteDestinationCount description: The remote destination that are associated with the offesne. If this value is greater than 0 that means your offense has a remote destination, you will need to use QRadarFullSearch playbook with the following query - SELECT destinationip FROM events WHERE inOffense() GROUP BY destinationip type: Unknown - contextPath: QRadar.Offense.AssignedTo description: The user the offense is assigned to. type: string - contextPath: QRadar.Offense.StartTime description: The time (ISO) when the offense was started. type: date - contextPath: QRadar.Offense.ID description: The ID of the offense. type: int - contextPath: QRadar.Offense.DestinationHostname description: Destintion hostname type: Unknown - contextPath: QRadar.Offense.Description description: The description of the offense. type: string - contextPath: QRadar.Offense.EventCount description: The number of events that are associated with the offense. type: number - contextPath: QRadar.Offense.OffenseSource description: The source of the offense. type: string - contextPath: QRadar.Offense.Status description: The status of the offense. One of "OPEN", "HIDDEN", or "CLOSED". type: string - contextPath: QRadar.Offense.Magnitude description: The magnitude of the offense. type: number - contextPath: QRadar.Offense.ClosingUser description: The user that closed the offense type: string - contextPath: QRadar.Offense.ClosingReason description: The offense closing reason. type: string - contextPath: QRadar.Offense.CloseTime description: The time when the offense was closed. type: date - contextPath: QRadar.Offense.LastUpdatedTime description: The time (ISO) when the offense was last updated. type: date - contextPath: QRadar.Offense.Categories description: Event categories that are associated with the offense. type: Unknown - contextPath: QRadar.Offense.FlowCount description: The number of flows that are associated with the offense. type: number - contextPath: QRadar.Offense.FollowUp description: Offense followup. type: boolean - contextPath: QRadar.Offense.OffenseType description: A number that represents the offense type type: string - contextPath: QRadar.Offense.Protected description: Is the offense protected type: boolean - arguments: - default: true description: The query expressions in AQL (for more information about Ariel Query Language please review "https://www.ibm.com/support/knowledgecenter/en/SS42VS_7.3.0/com.ibm.qradar.doc/c_aql_intro.html") name: query_expression required: true - description: Table headers to use the human readable output (if none provided, will show all table headers) name: headers description: Searches in QRadar using AQL. It is highly recommended to use the playbook 'QRadarFullSearch' instead of this command - it will execute the search, and will return the result. name: qradar-searches outputs: - contextPath: QRadar.Search.ID description: Search ID type: number - contextPath: QRadar.Search.Status description: The status of the search. type: string - arguments: - default: true description: The search id name: search_id required: true - description: Table headers to use the human readable output (if none provided, will show all table headers) name: headers description: Gets a specific search id and status name: qradar-get-search outputs: - contextPath: QRadar.Search.ID description: Search ID type: number - contextPath: QRadar.Search.Status description: The status of the search. type: string - arguments: - default: true description: The search id name: search_id required: true - description: 'Range of results to return. e.g.: 0-20' name: range - description: Table headers to use the human readable output (if none provided, will show all table headers) name: headers - description: Replaces the default context output path for the query result (QRadar.Search.Result). e.g. for output_path=QRadar.Correlations the result will be under the key "QRadar.Correlations" in the context data. name: output_path description: Gets search results name: qradar-get-search-results outputs: - contextPath: QRadar.Search.Result description: The result of the search type: Unknown - arguments: - default: true description: The ID of the offense to update name: offense_id required: true - auto: PREDEFINED description: Set to true to protect the offense name: protected predefined: - 'true' - 'false' - auto: PREDEFINED description: Set to true to set the follow up flag on the offense name: follow_up predefined: - 'true' - 'false' - auto: PREDEFINED description: The new status for the offense name: status predefined: - OPEN - HIDDEN - CLOSED - description: 'The id of a closing reason. You must provide a valid closing_reason_name when you close an offense. The default closing_reasons are: (1) False-Positive, Tuned (2) Non-Issues (3) Policy Violation' name: closing_reason_id - description: 'The name of a closing reason. You must provide a valid closing_reason_name when you close an offense. The default closing_reasons are: (1) False-Positive, Tuned (2) Non-Issues (3) Policy Violation' name: closing_reason_name - description: A user to assign the offense to name: assigned_to - description: Table headers name: headers - description: Use this parameter to specify which fields you would like to get back in the response. Fields that are not named are excluded. Specify subfields in brackets and multiple fields in the same object are separated by commas. Please consult - https://www.ibm.com/support/knowledgecenter/SSKMKU/com.ibm.qradar.doc_cloud/9.1--siem-offenses-offense_id-POST.html name: fields description: Update an offense name: qradar-update-offense outputs: - contextPath: QRadar.Offense.Credibility description: The credibility of the offense type: number - contextPath: QRadar.Offense.Relevance description: The relevance of the offense type: number - contextPath: QRadar.Offense.Severity description: The severity of the offense type: number - contextPath: QRadar.Offense.SourceAddress description: The source addresses that are associated with the offense. type: Unknown - contextPath: QRadar.Offense.DestinationAddress description: The destination addresses that are associated with the offense. type: Unknown - contextPath: QRadar.Offense.AssignedTo description: The user the offense is assigned to. type: string - contextPath: QRadar.Offense.StartTime description: The time (ISO) when the offense was started. type: date - contextPath: QRadar.Offense.ID description: The ID of the offense. type: int - contextPath: QRadar.Offense.DestinationHostname description: Destintion hostname type: Unknown - contextPath: QRadar.Offense.Description description: The description of the offense. type: string - contextPath: QRadar.Offense.EventCount description: The number of events that are associated with the offense. type: number - contextPath: QRadar.Offense.OffenseSource description: The source of the offense. type: string - contextPath: QRadar.Offense.Status description: The status of the offense. One of "OPEN", "HIDDEN", or "CLOSED". type: string - contextPath: QRadar.Offense.Magnitude description: The magnitude of the offense. type: number - contextPath: QRadar.Offense.ClosingUser description: The user that closed the offense type: string - contextPath: QRadar.Offense.ClosingReason description: The offense closing reason. type: string - contextPath: QRadar.Offense.CloseTime description: The time when the offense was closed. type: date - contextPath: QRadar.Offense.LastUpdatedTime description: The time (ISO) when the offense was last updated. type: date - contextPath: QRadar.Offense.Categories description: Event categories that are associated with the offense. type: Unknown - contextPath: QRadar.Offense.FlowCount description: The number of flows that are associated with the offense. type: number - contextPath: QRadar.Offense.FollowUp description: Offense followup. type: boolean - contextPath: QRadar.Offense.OffenseType description: A number that represents the offense type type: string - contextPath: QRadar.Offense.Protected description: Is the offense protected type: boolean - arguments: - description: 'Query to filter assets. For refernce please consult: https://www.ibm.com/support/knowledgecenter/en/SS42VS_7.3.1/com.ibm.qradar.doc/c_rest_api_filtering.html' name: filter - description: 'If used, will filter all fields except for the specified ones. Use this parameter to specify which fields you would like to get back in the response. Fields that are not named are excluded. Specify subfields in brackets and multiple fields in the same object are separated by commas. The filter uses QRadar''s field names, for reference please consult: https://www.ibm.com/support/knowledgecenter/SSKMKU/com.ibm.qradar.doc_cloud/9.1--asset_model-assets-GET.html' name: fields - description: 'Range of results to return. e.g.: 0-20' name: range - description: Table headers to use the human readable output (if none provided, will show all table headers) name: headers description: List all assets found in the model name: qradar-get-assets outputs: - contextPath: QRadar.Assets.ID description: The ID of the asset type: number - contextPath: Endpoint.IPAddress description: IP address of the asset type: Unknown - contextPath: QRadar.Assets.Name.Value description: Name of the asset type: string - contextPath: Endpoint.OS description: Asset OS type: number - contextPath: QRadar.Assets.AggregatedCVSSScore.Value description: CVSSScore type: number - contextPath: QRadar.Assets.AggregatedCVSSScore.LastUser description: Last user who updated the Aggregated CVSS Score type: string - contextPath: QRadar.Assets.Weight.Value description: Asset weight type: number - contextPath: QRadar.Assets.Weight.LastUser description: Last user who updated the weight type: string - contextPath: QRadar.Assets.Name.LastUser description: Last user who updated the name type: string - arguments: - default: true description: The ID of the requested asset. name: asset_id required: true description: Retrieves the asset by id name: qradar-get-asset-by-id outputs: - contextPath: QRadar.Assets.ID description: The ID of the asset. type: number - contextPath: Endpoint.MACAddress description: Asset MAC address. type: Unknown - contextPath: Endpoint.IPAddress description: It's in ip_addresses - value type: Unknown - contextPath: QRadar.Assets.ComplianceNotes.Value description: Compliance notes type: string - contextPath: QRadar.Assets.CompliancePlan.Value description: Compliance plan type: string - contextPath: QRadar.Assets.CollateralDamagePotential.Value description: Collateral damage potential type: Unknown - contextPath: QRadar.Assets.AggregatedCVSSScore.Value description: CVSSScore type: number - contextPath: QRadar.Assets.Name.Value description: Name of the asset type: string - contextPath: QRadar.Assets.GroupName description: Name of the asset's group type: string - contextPath: Endpoint.Domain description: DNS name type: Unknown - contextPath: Endpoint.OS description: Asset OS type: Unknown - contextPath: QRadar.Assets.Weight.Value description: Asset weight type: number - contextPath: QRadar.Assets.Vulnerabilities.Value description: Vulnerabilities type: Unknown - contextPath: QRadar.Assets.Location description: Location. type: string - contextPath: QRadar.Assets.Description description: The asset description. type: string - contextPath: QRadar.Assets.SwitchID description: Switch ID type: number - contextPath: QRadar.Assets.SwitchPort description: Switch port. type: number - contextPath: QRadar.Assets.Name.LastUser description: Last user who updated the name type: string - contextPath: QRadar.Assets.AggregatedCVSSScore.LastUser description: Last user who updated the Aggregated CVSS Score type: string - contextPath: QRadar.Assets.Weight.LastUser description: Last user who updated the weight type: string - contextPath: QRadar.Assets.ComplianceNotes.LastUser description: Last user who updated the compliance notes type: string - contextPath: QRadar.Assets.CompliancePlan.LastUser description: Last user who updated the compliance plan type: string - contextPath: QRadar.Assets.CollateralDamagePotential.LastUser description: Last user who updated the collateral damage potential type: string - contextPath: QRadar.Assets.Vulnerabilities.LastUser description: Last user who updated the vulnerabilities type: string - arguments: - default: true description: The query expressions in AQL (for more information about Ariel Query Language please review https://www.ibm.com/support/knowledgecenter/en/SS42VS_7.3.0/com.ibm.qradar.doc/c_aql_intro.html) name: query_expression required: true - description: Table headers name: headers deprecated: true description: Searches in QRadar name: qr-searches outputs: - contextPath: QRadar.Search.ID description: Search ID type: number - contextPath: QRadar.Search.State description: The state of the search. type: string - arguments: - default: true description: The search id name: search_id required: true - description: Table headers name: headers deprecated: true description: Gets a specific search id and state name: qr-get-search outputs: - contextPath: QRadar.Search.ID description: Search ID type: number - contextPath: QRadar.Search.State description: The state of the search. type: string - arguments: - default: true description: The search id name: search_id required: true - description: Number of results in return name: range - description: Table headers name: headers deprecated: true description: Gets search results name: qr-get-search-results outputs: - contextPath: QRadar.Search.Result description: The result of the search type: Unknown - arguments: - description: The ID of a closing reason. You must provide a valid closing_reason_id when you close an offense name: closing_reason_id - default: true description: The ID of the offense to update name: offense_id required: true - auto: PREDEFINED description: Set to true to protect the offense name: protected predefined: - 'true' - 'false' - auto: PREDEFINED description: Set to true to set the follow up flag on the offense name: follow_up predefined: - 'true' - 'false' - auto: PREDEFINED description: The new status for the offense name: status predefined: - OPEN - HIDDEN - CLOSED - description: 'The name of a closing reason. You must provide a valid closing_reason_name when you close an offense. The default closing_reasons are: (1) False-Positive, Tuned (2) Non-Issues (3) Policy Violation' name: closing_reason_name - description: A user to assign the offense to name: assigned_to - description: Table headers name: headers - description: Use this parameter to specify which fields you would like to get back in the response. Fields that are not named are excluded. Specify subfields in brackets and multiple fields in the same object are separated by commas name: fields deprecated: true description: Update an offense name: qr-update-offense outputs: - contextPath: QRadar.Offense.Followup description: Offense followup. type: Unknown - contextPath: QRadar.Offense.ID description: The ID of the offense. type: number - contextPath: QRadar.Offense.Description description: The description of the offense. type: Unknown - contextPath: QRadar.Offense.SourceAddress description: The source addresses that are associated with the offense. type: Unknown - contextPath: QRadar.Offense.DestinationAddress description: The destination addresses that are associated with the offense. type: Unknown - contextPath: QRadar.Offense.StartTime description: The time (ISO) when the offense was started. type: Unknown - contextPath: QRadar.Offense.EventCount description: The number of events that are associated with the offense. type: Unknown - contextPath: QRadar.Offense.FlowCount description: The number of flows that are associated with the offense. type: Unknown - contextPath: QRadar.Offense.OffenseSource description: The source of the offense. type: Unknown - contextPath: QRadar.Offense.Magnitude description: The magnitude of the offense. type: Unknown - contextPath: QRadar.Offense.LastUpdatedTime description: The time (ISO) when the offense was last updated. type: Unknown - contextPath: QRadar.Offense.OffenseType description: A number that represents the offense type type: Unknown - contextPath: QRadar.Offense.Protected description: Is the offense protected type: Unknown - arguments: - description: Number of results in return name: range - description: Fields to filter in name: fields - description: Query to filter offenses name: filter - description: Table headers name: headers deprecated: true description: List all assets found in the model name: qr-get-assets outputs: - contextPath: QRadar.Assets.ID description: The ID of the asset type: number - contextPath: Endpoint.IPAddress description: IP address of the asset type: Unknown - contextPath: QRadar.Assets.Name.Value description: Name of the asset type: Unknown - contextPath: Endpoint.OS description: Asset OS type: Unknown - contextPath: QRadar.Assets.AggregatedCVSSScore.Value description: CVSSScore type: Unknown - contextPath: QRadar.Assets.Weight.Value description: Asset weight type: Unknown - contextPath: QRadar.Assets.Name.LastUser description: Last user who updated the name type: Unknown - contextPath: QRadar.Assets.AggregatedCVSSScore.LastUser description: Last user who updated the Aggregated CVSS Score type: Unknown - contextPath: QRadar.Assets.Weight.LastUser description: Last user who updated the weight type: Unknown - arguments: - description: Query to filter offenses name: filter - description: 'Fields to filter in ' name: fields - description: Number of results in return name: range - description: Table headers name: headers deprecated: true description: Gets offenses from QRadar name: qr-offenses outputs: - contextPath: QRadar.Offense.Followup description: Offense followup. type: Unknown - contextPath: QRadar.Offense.ID description: The ID of the offense. type: number - contextPath: QRadar.Offense.Description description: The description of the offense. type: Unknown - contextPath: QRadar.Offense.SourceAddress description: The source addresses that are associated with the offense. type: Unknown - contextPath: QRadar.Offense.DestinationAddress description: The destination addresses that are associated with the offense. type: Unknown - contextPath: QRadar.Offense.StartTime description: The time (ISO) when the offense was started. type: Unknown - contextPath: QRadar.Offense.EventCount description: The number of events that are associated with the offense. type: Unknown - contextPath: QRadar.Offense.FlowCount description: The number of flows that are associated with the offense. type: Unknown - contextPath: QRadar.Offense.OffenseSource description: The source of the offense. type: Unknown - contextPath: QRadar.Offense.Magnitude description: The magnitude of the offense. type: Unknown - contextPath: QRadar.Offense.LastUpdatedTime description: The time (ISO) when the offense was last updated. type: Unknown - contextPath: QRadar.Offense.OffenseType description: A number that represents the offense type type: Unknown - arguments: - auto: PREDEFINED defaultValue: 'true' description: If true, reserved closing reasons are included in the response name: include_reserved predefined: - 'true' - 'false' - auto: PREDEFINED defaultValue: 'true' description: If true, deleted closing reasons are included in the response name: include_deleted predefined: - 'true' - 'false' - description: 'Query to filter results. For refernce please consult: https://www.ibm.com/support/knowledgecenter/en/SS42VS_7.3.1/com.ibm.qradar.doc/c_rest_api_filtering.html' name: filter - description: 'If used, will filter all fields except for the specified ones. Use this parameter to specify which fields you would like to get back in the response. Fields that are not named are excluded. Specify subfields in brackets and multiple fields in the same object are separated by commas. The filter uses QRadar''s field names, for reference please consult: https://www.ibm.com/support/knowledgecenter/SSKMKU/com.ibm.qradar.doc_cloud/9.1--siem-offense_closing_reasons-GET.html' name: fields - description: 'Range of results to return. e.g.: 0-20' name: range description: Get closing reasons name: qradar-get-closing-reasons outputs: - contextPath: QRadar.Offense.ClosingReasons.ID description: Closing reason ID type: number - contextPath: QRadar.Offense.ClosingReasons.Name description: Closing reason name type: string - arguments: - default: true description: The offense ID to add the note to name: offense_id required: true - description: The note text name: note_text required: true - description: 'If used, will filter all fields except for the specified ones. Use this parameter to specify which fields you would like to get back in the response. Fields that are not named are excluded. Specify subfields in brackets and multiple fields in the same object are separated by commas. The filter uses QRadar''s field names, for reference please consult: https://www.ibm.com/support/knowledgecenter/SSKMKU/com.ibm.qradar.doc_cloud/9.1--siem-offenses-offense_id-notes-POST.html' name: fields - description: Table headers to use the human readable output (if none provided, will show all table headers) name: headers description: Create a note on an offense name: qradar-create-note outputs: - contextPath: QRadar.Note.ID description: Note ID type: number - contextPath: QRadar.Note.Text description: Note text type: string - contextPath: QRadar.Note.CreateTime description: The creation time of the note type: date - contextPath: QRadar.Note.CreatedBy description: The user who created the note type: string - arguments: - default: true description: The offense ID to retrieve the note from name: offense_id required: true - description: The note ID name: note_id - description: 'If used, will filter all fields except for the specified ones. Use this parameter to specify which fields you would like to get back in the response. Fields that are not named are excluded. Specify subfields in brackets and multiple fields in the same object are separated by commas. The filter uses QRadar''s field names, for reference please consult: https://www.ibm.com/support/knowledgecenter/SSKMKU/com.ibm.qradar.doc_cloud/9.1--siem-offenses-offense_id-notes-note_id-GET.html' name: fields - description: Table headers to use the human readable output (if none provided, will show all table headers) name: headers description: Retrieve a note for an offense name: qradar-get-note outputs: - contextPath: QRadar.Note.ID description: Note ID type: number - contextPath: QRadar.Note.Text description: Note text type: string - contextPath: QRadar.Note.CreateTime description: The creation time of the note type: date - contextPath: QRadar.Note.CreatedBy description: The user who created the note type: string - arguments: - default: true description: The name of the requestered reference. name: ref_name required: true - description: Table headers to use the human readable output (if none provided, will show all table headers) name: headers - auto: PREDEFINED defaultValue: 'False' description: If set to true will try to convert the data values to ISO-8601 string. name: date_value predefined: - 'True' - 'False' description: Information about the reference set that had data added or updated. This returns information set but not the contained data. This feature is supported from version 8.1 and upward. name: qradar-get-reference-by-name outputs: - contextPath: QRadar.Reference.Name description: The name of the reference set. type: string - contextPath: QRadar.Reference.CreationTime description: The creation time (ISO) of the reference. type: date - contextPath: QRadar.Reference.ElementType description: Reference element type. type: string - contextPath: QRadar.Reference.NumberOfElements description: Number of elements. type: number - contextPath: QRadar.Reference.TimeToLive description: Reference time to live. type: string - contextPath: QRadar.Reference.TimeoutType description: 'Reference timeout type. One of: UNKNOWN, FIRST_SEEN, LAST_SEEN' type: string - contextPath: QRadar.Reference.Data description: Reference set items type: Unknown - arguments: - description: Reference name to be created name: ref_name required: true - auto: PREDEFINED description: 'The element type for the values allowed in the reference set. The allowed values are: ALN (alphanumeric), ALNIC (alphanumeric ignore case), IP (IP address), NUM (numeric), PORT (port number) or DATE. Note that date values need to be represented in milliseconds since the Unix Epoch January 1st 1970.' name: element_type predefined: - ALN - ALNIC - IP - NUM - PORT - DATE required: true - auto: PREDEFINED description: The allowed values are "FIRST_SEEN", LAST_SEEN and UNKNOWN. The default value is UNKNOWN. name: timeout_type predefined: - FIRST_SEEN - LAST_SEEN - UNKNOWN - description: 'The time to live interval, for example: "1 month" or "5 minutes"' name: time_to_live description: Creates a new reference set. If the provided name is already in use, this command will fail name: qradar-create-reference-set outputs: - contextPath: QRadar.Reference.CreationTime description: Creation time of the reference set. type: date - contextPath: QRadar.Reference.ElementType description: 'The element type for the values allowed in the reference set. The allowed values are: ALN (alphanumeric), ALNIC (alphanumeric ignore case), IP (IP address), NUM (numeric), PORT (port number) or DATE.' type: string - contextPath: QRadar.Reference.Name description: Name of the reference set. type: string - contextPath: QRadar.Reference.NumberOfElements description: Number of elements in the created reference set. type: number - contextPath: QRadar.Reference.TimeoutType description: Timeout type of the reference. The allowed values are FIRST_SEEN, LAST_SEEN and UNKNOWN. type: string - arguments: - default: true description: The name of reference set to delete. name: ref_name required: true description: Deletes a reference set corresponding to the name provided. name: qradar-delete-reference-set - arguments: - description: The name of the reference set to add or update a value in. name: ref_name required: true - description: 'The value/s to add or update in the reference set. Note: Date values must be represented in epoch in reference sets (milliseconds since the Unix Epoch January 1st 1970). If ''date_value'' is set to ''True'', then the argument will be converted from date in format: ''%Y-%m-%dT%H:%M:%S.%f000Z'' (e.g. ''2018-11-06T08:56:41.000000Z'') to epoch.' isArray: true name: value required: true - description: An indication of where the data originated. The default value is 'reference data api'. name: source - auto: PREDEFINED defaultValue: 'False' description: 'If set to True will convert ''value'' argument from date in format: ''%Y-%m-%dT%H:%M:%S.%f000Z'' (e.g. ''2018-11-06T08:56:41.000000Z'') to epoch.' name: date_value predefined: - 'True' - 'False' description: Add or update a value in a reference set. name: qradar-create-reference-set-value outputs: - contextPath: QRadar.Reference.Name description: The name of the reference set. type: string - contextPath: QRadar.Reference.CreationTime description: The creation time (ISO) of the reference. type: date - contextPath: QRadar.Reference.ElementType description: Reference element type. type: string - contextPath: QRadar.Reference.NumberOfElements description: Number of elements. type: number - contextPath: QRadar.Reference.TimeoutType description: 'Reference timeout type. One of: UNKNOWN, FIRST_SEEN, LAST_SEEN' type: string - arguments: - description: The name of the reference set to add or update a value in. name: ref_name required: true - description: ' A comma-separated list of values to add or update in the reference set. Date values must be represented in milliseconds since the Unix Epoch January 1st 1970.' isArray: true name: value required: true - description: An indication of where the data originated. The default value is 'reference data api'. name: source - auto: PREDEFINED defaultValue: 'False' description: 'If set to True will convert ''value'' argument from date in format: ''%Y-%m-%dT%H:%M:%S.%f000Z'' (e.g. ''2018-11-06T08:56:41.000000Z'') to epoch.' name: date_value predefined: - 'True' - 'False' description: Adds or updates a value in a reference set. name: qradar-update-reference-set-value outputs: - contextPath: QRadar.Reference.Name description: The name of the reference set. type: string - contextPath: QRadar.Reference.CreationTime description: The creation time (ISO) of the reference. type: date - contextPath: QRadar.Reference.ElementType description: Reference element type. type: string - contextPath: QRadar.Reference.NumberOfElements description: Number of elements. type: number - contextPath: QRadar.Reference.TimeoutType description: 'Reference timeout type. One of: UNKNOWN, FIRST_SEEN, LAST_SEEN' type: string - arguments: - description: The name of the reference set to remove a value from. name: ref_name required: true - description: The value to remove from the reference set. name: value required: true - auto: PREDEFINED defaultValue: 'False' description: 'If set to True will convert ''value'' argument from date in format: ''%Y-%m-%dT%H:%M:%S.%f000Z'' (e.g. ''2018-11-06T08:56:41.000000Z'') to epoch.' name: date_value predefined: - 'True' - 'False' description: Deletes a value in a reference set. name: qradar-delete-reference-set-value outputs: - contextPath: QRadar.Reference.Name description: The name of the reference set. type: string - contextPath: QRadar.Reference.CreationTime description: The creation time (ISO) of the reference. type: date - contextPath: QRadar.Reference.ElementType description: Reference element type. type: string - contextPath: QRadar.Reference.NumberOfElements description: Number of elements. type: number - contextPath: QRadar.Reference.TimeoutType description: 'Reference timeout type. One of: UNKNOWN, FIRST_SEEN, LAST_SEEN' type: string - arguments: - description: 'If used, will filter all fields except for the specified ones. Use this parameter to specify which fields you would like to get back in the response. Fields that are not named are excluded. Specify subfields in brackets and multiple fields in the same object are separated by commas. The filter uses QRadar''s field names, for reference please consult: https://www.ibm.com/support/knowledgecenter/SSKMKU/com.ibm.qradar.doc_cloud/9.1--siem-offenses-offense_id-notes-note_id-GET.html' name: fields - description: Number of results in return name: range - description: Query to filter offenses name: filter description: Retrieve all Domains name: qradar-get-domains outputs: - contextPath: QRadar.Domains.AssetScannerIDs description: Array of Asset Scanner IDs. type: Number - contextPath: QRadar.Domains.CustomProperties description: Custom properties of the domain. type: String - contextPath: QRadar.Domains.Deleted description: Indicates if the domain is deleted. type: Boolean - contextPath: QRadar.Domains.Description description: Description of the domain. type: String - contextPath: QRadar.Domains.EventCollectorIDs description: Array of Event Collector IDs. type: Number - contextPath: QRadar.Domains.FlowCollectorIDs description: Array of Flow Collector IDs. type: Number - contextPath: QRadar.Domains.FlowSourceIDs description: Array of Flow Source IDs. type: Number - contextPath: QRadar.Domains.ID description: ID of the domain. type: Number - contextPath: QRadar.Domains.LogSourceGroupIDs description: Array of Log Source Group IDs. type: Number - contextPath: QRadar.Domains.LogSourceIDs description: Array of Log Source IDs. type: Number - contextPath: QRadar.Domains.Name description: Name of the Domain. type: String - contextPath: QRadar.Domains.QVMScannerIDs description: Array of QVM Scanner IDs. type: Number - contextPath: QRadar.Domains.TenantID description: ID of the Domain tenant. type: Number - arguments: - description: ID of the domain name: id required: true - description: 'If used, will filter all fields except for the specified ones. Use this parameter to specify which fields you would like to get back in the response. Fields that are not named are excluded. Specify subfields in brackets and multiple fields in the same object are separated by commas. The filter uses QRadar''s field names, for reference please consult: https://www.ibm.com/support/knowledgecenter/SSKMKU/com.ibm.qradar.doc_cloud/9.1--siem-offenses-offense_id-notes-note_id-GET.html' name: fields description: Retrieves Domain information By ID name: qradar-get-domain-by-id outputs: - contextPath: QRadar.Domains.AssetScannerIDs description: Array of Asset Scanner IDs. type: Number - contextPath: QRadar.Domains.CustomProperties description: Custom properties of the domain. type: String - contextPath: QRadar.Domains.Deleted description: Indicates if the domain is deleted. type: Boolean - contextPath: QRadar.Domains.Description description: Description of the domain. type: String - contextPath: QRadar.Domains.EventCollectorIDs description: Array of Event Collector IDs. type: Number - contextPath: QRadar.Domains.FlowCollectorIDs description: Array of Flow Collector IDs. type: Number - contextPath: QRadar.Domains.FlowSourceIDs description: Array of Flow Source IDs. type: Number - contextPath: QRadar.Domains.ID description: ID of the domain. type: Number - contextPath: QRadar.Domains.LogSourceGroupIDs description: Array of Log Source Group IDs. type: Number - contextPath: QRadar.Domains.LogSourceIDs description: Array of Log Source IDs. type: Number - contextPath: QRadar.Domains.Name description: Name of the Domain. type: String - contextPath: QRadar.Domains.QVMScannerIDs description: Array of QVM Scanner IDs. type: Number - contextPath: QRadar.Domains.TenantID description: ID of the Domain tenant. type: Number - arguments: - description: The name of the reference set to add or update a value in. To create a new reference set, you need to set the element type. name: ref_name required: true - auto: PREDEFINED description: 'The element type for the values premitted in the reference set. Only required when creating a new reference set. The valid values are: ALN (alphanumeric), ALNIC (alphanumeric ignore case), IP (IP address), NUM (numeric), PORT (port number) or DATE. Note that date values need to be represented in milliseconds since the Unix Epoch January 1st 1970.' name: element_type predefined: - ALN - ALNIC - IP - NUM - PORT - DATE - auto: PREDEFINED description: The timeout_type can be "FIRST_SEEN", "LAST_SEEN", or "UNKNOWN". The default value is UNKNOWN. Only required for creating a new refernce set. name: timeout_type predefined: - FIRST_SEEN - LAST_SEEN - UNKNOWN - description: 'The time to live interval, for example: "1 month" or "5 minutes". Only required when creating a new reference set.' name: time_to_live - description: The query for getting indicators. name: query required: true - defaultValue: '1000' description: The maximum number of indicators to return. The default value is 1000. name: limit - defaultValue: '0' description: The page from which to get the indicators name: page description: Uploads indicators from Demisto to Qradar. This command requires Cortex SOAR v5.5 or later. name: qradar-upload-indicators isfetch: true runonce: false script: '-' subtype: python2 type: python dockerimage: demisto/python:2.7.18.52566 tests: - No test fromversion: 5.5.0 defaultclassifier: QRadar defaultmapperin: QRadar-mapper