category: Analytics & SIEM provider: Palo Alto Networks commonfields: id: QRadar_v2 version: -1 configuration: - display: Incident type name: incidentType type: 13 required: false - display: Server URL (e.g. https://192.168.0.1) name: server required: true type: 0 - display: Username / API Key (see '?') name: credentials type: 9 required: false - display: Trust any certificate (not secure) name: insecure type: 8 required: false - display: Use system proxy settings name: proxy type: 8 required: false - display: Long running instance name: longRunning type: 8 required: false - display: Query to fetch offenses name: query type: 0 additionalinfo: "Define a query to determine which offenses to fetch. e.g. status=OPEN. See ? for more details." required: false - defaultvalue: '20' display: Number of offenses to pull per API call (max 50) name: offenses_per_fetch type: 0 required: false - defaultvalue: 'true' display: Incident IP Enrichment name: ip_enrich type: 8 additionalinfo: "IP values related to the offense are returned from the API as ID values. Enable this parameter the IDs to IP values." required: false - defaultvalue: 'true' display: Incident Asset Enrichment name: asset_enrich type: 8 additionalinfo: "Enable this to fetch assets that correlate to the fetched offenses." required: false - defaultvalue: 'QIDNAME(qid), LOGSOURCENAME(logsourceid), CATEGORYNAME(highlevelcategory), CATEGORYNAME(category), PROTOCOLNAME(protocolid), sourceip, sourceport, destinationip, destinationport, QIDDESCRIPTION(qid), username, PROTOCOLNAME(protocolid), RULENAME("creEventList"), sourcegeographiclocation, sourceMAC, sourcev6, destinationgeographiclocation, destinationv6, LOGSOURCETYPENAME(devicetype), credibility, severity, magnitude, eventcount, eventDirection, postNatDestinationIP, postNatDestinationPort, postNatSourceIP, postNatSourcePort, preNatDestinationPort, preNatSourceIP, preNatSourcePort, UTF8(payload), starttime, devicetime' display: Event fields to return from the events query (CAUTION this parameter is correlated to the incoming mapper, and changing the values may adversely affect mapping) name: events_columns additionalinfo: "The parameter uses the AQL SELECT syntax. For more info see: https://www.ibm.com/support/knowledgecenter/en/SS42VS_7.3.3/com.ibm.qradar.doc/c_aql_intro.html" type: 12 required: false - defaultvalue: Fetch With All Events display: Fetch mode name: fetch_mode options: - Fetch Without Events - Fetch With All Events - Fetch Correlation Events Only required: true type: 15 - defaultvalue: '20' display: Max number of events per incident name: events_limit type: 0 additionalinfo: This field is require when running as ‘long running instance’ - please set the max amount of events to fetch. required: false - additionalinfo: Comma-separated configuration for advanced parameters values. e.g. EVENTS_INTERVAL_SECS=20,FETCH_SLEEP=5 display: Advanced Parameters name: adv_params type: 12 required: false description: 'Deprecated. Use the IBM QRadar v3 integration instead. Fetch offenses from QRadar using Cortex XSOAR. Supports API versions until 10.0. You can fetch the offenses with their related events and assets by creating a comma-separated list of event fields.' display: IBM QRadar v2 (Deprecated) deprecated: true name: QRadar_v2 script: commands: - arguments: - description: 'Query by which to filter offenses. For reference, consult: https://www.ibm.com/support/knowledgecenter/en/SS42VS_7.3.1/com.ibm.qradar.doc/c_rest_api_filtering.html' name: filter - description: 'If used, will filter all fields except for the specified ones. Use this parameter to specify which fields you would like to get back in the response. Fields that are not explicitly named, are excluded. Specify subfields in brackets and multiple fields in the same object separated by commas. The filter uses QRadar''s field names. For reference, consult: https://www.ibm.com/support/knowledgecenter/SSKMKU/com.ibm.qradar.doc_cloud/9.1--siem-offenses-GET.html' name: fields - description: 'Range of results to return. e.g.: 0-20.' name: range - description: Table headers to use the human readable output (if none provided, will show all table headers). name: headers description: Gets offenses from QRadar. name: qradar-offenses outputs: - contextPath: QRadar.Offense.Followup description: Offense followup. type: boolean - contextPath: QRadar.Offense.ID description: The ID of the offense. type: number - contextPath: QRadar.Offense.Description description: The description of the offense. type: string - contextPath: QRadar.Offense.SourceAddress description: The source addresses that are associated with the offense. type: Unknown - contextPath: QRadar.Offense.DestinationAddress description: The local destination addresses that are associated with the offense. If your offense has a remote destination, you will need to use the QRadarFullSearch playbook with the following query - SELECT destinationip FROM events WHERE inOffense() GROUP BY destinationip. type: Unknown - contextPath: QRadar.Offense.RemoteDestinationCount description: The remote destinations that are associated with the offesne. If this value is greater than 0 that means your offense has a remote destination, you will need to use QRadarFullSearch playbook with the following query - SELECT destinationip FROM events WHERE inOffense() GROUP BY destinationip. type: Unknown - contextPath: QRadar.Offense.StartTime description: The time (ISO) when the offense was started. type: date - contextPath: QRadar.Offense.EventCount description: The number of events that are associated with the offense. type: number - contextPath: QRadar.Offense.Magnitude description: The magnitude of the offense. type: number - contextPath: QRadar.Offense.LastUpdatedTime description: The time (ISO) when the offense was last updated. type: date - contextPath: QRadar.Offense.OffenseType description: The offense type (due to API limitations if username and password were not provided, this value will be the id of offense type). type: string - arguments: - default: true description: Offense ID. name: offense_id required: true - description: 'Query to filter offense. For refernce please consult: https://www.ibm.com/support/knowledgecenter/en/SS42VS_7.3.1/com.ibm.qradar.doc/c_rest_api_filtering.html' name: filter - description: 'If used, will filter all fields except for the specified ones. Use this parameter to specify which fields you would like to get back in the response. Fields that are not explicitly named are excluded. Specify subfields in brackets and multiple fields in the same object separated by commas. The filter uses QRadar''s field names, for reference, consult: https://www.ibm.com/support/knowledgecenter/SSKMKU/com.ibm.qradar.doc_cloud/9.1--siem-offenses-offense_id-GET.html' name: fields - description: Table headers to use the human readable output (if none provided, will show all table headers). name: headers description: Gets offense with matching offense ID from qradar. name: qradar-offense-by-id outputs: - contextPath: QRadar.Offense.Credibility description: The credibility of the offense. type: number - contextPath: QRadar.Offense.Relevance description: The relevance of the offense. type: number - contextPath: QRadar.Offense.Severity description: The severity of the offense. type: number - contextPath: QRadar.Offense.SourceAddress description: The source addresses that are associated with the offense. type: Unknown - contextPath: QRadar.Offense.DestinationAddress description: The local destination addresses that are associated with the offense. If your offense has a remote destination, you will need to use the QRadarFullSearch playbook with the following query - SELECT destinationip FROM events WHERE inOffense() GROUP BY destinationip. type: Unknown - contextPath: QRadar.Offense.RemoteDestinationCount description: The remote destination that are associated with the offesne. If this value is greater than 0, it means that your offense has a remote destination, you will need to use the QRadarFullSearch playbook with the following query - SELECT destinationip FROM events WHERE inOffense() GROUP BY destinationip. type: Unknown - contextPath: QRadar.Offense.AssignedTo description: The user the offense is assigned to. type: string - contextPath: QRadar.Offense.StartTime description: The time (ISO) when the offense was started. type: date - contextPath: QRadar.Offense.ID description: The ID of the offense. type: int - contextPath: QRadar.Offense.DestinationHostname description: Destintion hostname. type: Unknown - contextPath: QRadar.Offense.Description description: The description of the offense. type: string - contextPath: QRadar.Offense.EventCount description: The number of events that are associated with the offense. type: number - contextPath: QRadar.Offense.OffenseSource description: The source of the offense. type: string - contextPath: QRadar.Offense.Status description: The status of the offense. One of "OPEN", "HIDDEN", or "CLOSED". type: string - contextPath: QRadar.Offense.Magnitude description: The magnitude of the offense. type: number - contextPath: QRadar.Offense.ClosingUser description: The user that closed the offense. type: string - contextPath: QRadar.Offense.ClosingReason description: The offense closing reason. type: string - contextPath: QRadar.Offense.CloseTime description: The time when the offense was closed. type: date - contextPath: QRadar.Offense.LastUpdatedTime description: The time (ISO) when the offense was last updated. type: date - contextPath: QRadar.Offense.Categories description: Event categories that are associated with the offense. type: Unknown - contextPath: QRadar.Offense.FlowCount description: The number of flows that are associated with the offense. type: number - contextPath: QRadar.Offense.FollowUp description: Offense followup. type: boolean - contextPath: QRadar.Offense.OffenseType description: A number that represents the offense type. type: string - contextPath: QRadar.Offense.Protected description: Is the offense protected. type: boolean - arguments: - default: true description: The query expressions in AQL (for more information about Ariel Query Language, review "https://www.ibm.com/support/knowledgecenter/en/SS42VS_7.3.0/com.ibm.qradar.doc/c_aql_intro.html"). name: query_expression required: true - description: Table headers to use the human readable output (if none provided, will show all table headers). name: headers description: Searches in QRadar using AQL. It is highly recommended to use the playbook 'QRadarFullSearch' instead of this command - it will execute the search, and will return the result. name: qradar-searches outputs: - contextPath: QRadar.Search.ID description: Search ID. type: number - contextPath: QRadar.Search.Status description: The status of the search. type: string - arguments: - default: true description: The search id. name: search_id required: true - description: Table headers to use the human readable output (if none provided, will show all table headers). name: headers description: Gets a specific search id and status. name: qradar-get-search outputs: - contextPath: QRadar.Search.ID description: Search ID. type: number - contextPath: QRadar.Search.Status description: The status of the search. type: string - arguments: - default: true description: The search id. name: search_id required: true - description: 'Range of results to return. e.g.: 0-20.' name: range - description: Table headers to use the human readable output (if none provided, will show all table headers). name: headers - description: Replaces the default context output path for the query result (QRadar.Search.Result). e.g. for output_path=QRadar.Correlations the result will be under the key "QRadar.Correlations" in the context data. name: output_path description: Gets search results. name: qradar-get-search-results outputs: - contextPath: QRadar.Search.Result description: The result of the search. type: Unknown - arguments: - default: true description: The ID of the offense to update. name: offense_id required: true - auto: PREDEFINED description: Set to true to protect the offense. name: protected predefined: - 'true' - 'false' - auto: PREDEFINED description: Set to true to set the follow up flag on the offense. name: follow_up predefined: - 'true' - 'false' - auto: PREDEFINED description: The new status for the offense. name: status predefined: - OPEN - HIDDEN - CLOSED - description: 'The id of a closing reason. You must provide a valid closing_reason_name when you close an offense. The default closing_reasons are: (1) False-Positive, Tuned (2) Non-Issues (3) Policy Violation.' name: closing_reason_id - description: 'The name of a closing reason. You must provide a valid closing_reason_name when you close an offense. The default closing_reasons are: (1) False-Positive, Tuned (2) Non-Issues (3) Policy Violation.' name: closing_reason_name - description: A user to assign the offense to. name: assigned_to - description: Use this parameter to specify which fields you would like to get back in the response. Fields that are not named are excluded. Specify subfields in brackets and multiple fields in the same object separated by commas. Please consult - https://www.ibm.com/support/knowledgecenter/SSKMKU/com.ibm.qradar.doc_cloud/9.1--siem-offenses-offense_id-POST.html name: fields description: Update an offense. name: qradar-update-offense outputs: - contextPath: QRadar.Offense.Credibility description: The credibility of the offense. type: number - contextPath: QRadar.Offense.Relevance description: The relevance of the offense. type: number - contextPath: QRadar.Offense.Severity description: The severity of the offense. type: number - contextPath: QRadar.Offense.SourceAddress description: The source addresses that are associated with the offense. type: Unknown - contextPath: QRadar.Offense.DestinationAddress description: The destination addresses that are associated with the offense. type: Unknown - contextPath: QRadar.Offense.AssignedTo description: The user the offense is assigned to. type: string - contextPath: QRadar.Offense.StartTime description: The time (ISO) when the offense was started. type: date - contextPath: QRadar.Offense.ID description: The ID of the offense. type: int - contextPath: QRadar.Offense.DestinationHostname description: Destintion hostname. type: Unknown - contextPath: QRadar.Offense.Description description: The description of the offense. type: string - contextPath: QRadar.Offense.EventCount description: The number of events that are associated with the offense. type: number - contextPath: QRadar.Offense.OffenseSource description: The source of the offense. type: string - contextPath: QRadar.Offense.Status description: The status of the offense. One of "OPEN", "HIDDEN", or "CLOSED". type: string - contextPath: QRadar.Offense.Magnitude description: The magnitude of the offense. type: number - contextPath: QRadar.Offense.ClosingUser description: The user that closed the offense. type: string - contextPath: QRadar.Offense.ClosingReason description: The offense closing reason. type: string - contextPath: QRadar.Offense.CloseTime description: The time when the offense was closed. type: date - contextPath: QRadar.Offense.LastUpdatedTime description: The time (ISO) when the offense was last updated. type: date - contextPath: QRadar.Offense.Categories description: Event categories that are associated with the offense. type: Unknown - contextPath: QRadar.Offense.FlowCount description: The number of flows that are associated with the offense. type: number - contextPath: QRadar.Offense.FollowUp description: Offense followup. type: boolean - contextPath: QRadar.Offense.OffenseType description: A number that represents the offense type. type: string - contextPath: QRadar.Offense.Protected description: Is the offense protected. type: boolean - arguments: - description: 'Query to filter assets. For refernce please consult: https://www.ibm.com/support/knowledgecenter/en/SS42VS_7.3.1/com.ibm.qradar.doc/c_rest_api_filtering.html' name: filter - description: 'If used, will filter all fields except for the specified ones. Use this parameter to specify which fields you would like to get back in the response. Fields that are not named are excluded. Specify subfields in brackets and multiple fields in the same object separated by commas. The filter uses QRadar''s field names, for reference, consult: https://www.ibm.com/support/knowledgecenter/SSKMKU/com.ibm.qradar.doc_cloud/9.1--asset_model-assets-GET.html' name: fields - description: 'Range of results to return. e.g.: 0-20.' name: range - description: Table headers to use the human readable output (if none provided, will show all table headers). name: headers description: List all assets found in the model. name: qradar-get-assets outputs: - contextPath: QRadar.Assets.ID description: The ID of the asset. type: number - contextPath: Endpoint.IPAddress description: IP address of the asset. type: Unknown - contextPath: QRadar.Assets.Name.Value description: Name of the asset. type: string - contextPath: Endpoint.OS description: Asset OS. type: number - contextPath: QRadar.Assets.AggregatedCVSSScore.Value description: CVSSScore. type: number - contextPath: QRadar.Assets.AggregatedCVSSScore.LastUser description: Last user who updated the Aggregated CVSS Score. type: string - contextPath: QRadar.Assets.Weight.Value description: Asset weight. type: number - contextPath: QRadar.Assets.Weight.LastUser description: Last user who updated the weight. type: string - contextPath: QRadar.Assets.Name.LastUser description: Last user who updated the name. type: string - arguments: - default: true description: The ID of the requested asset. name: asset_id required: true description: Retrieves the asset by id. name: qradar-get-asset-by-id outputs: - contextPath: QRadar.Assets.ID description: The ID of the asset. type: number - contextPath: Endpoint.MACAddress description: Asset MAC address. type: Unknown - contextPath: Endpoint.IPAddress description: IP address of the endpoint. type: Unknown - contextPath: QRadar.Assets.ComplianceNotes.Value description: Compliance notes. type: string - contextPath: QRadar.Assets.CompliancePlan.Value description: Compliance plan. type: string - contextPath: QRadar.Assets.CollateralDamagePotential.Value description: Collateral damage potential. type: Unknown - contextPath: QRadar.Assets.AggregatedCVSSScore.Value description: CVSSScore. type: number - contextPath: QRadar.Assets.Name.Value description: Name of the asset. type: string - contextPath: QRadar.Assets.GroupName description: Name of the asset's group. type: string - contextPath: Endpoint.Domain description: DNS name. type: Unknown - contextPath: Endpoint.OS description: Asset OS. type: Unknown - contextPath: QRadar.Assets.Weight.Value description: Asset weight. type: number - contextPath: QRadar.Assets.Vulnerabilities.Value description: Vulnerabilities. type: Unknown - contextPath: QRadar.Assets.Location description: Location. type: string - contextPath: QRadar.Assets.Description description: The asset description. type: string - contextPath: QRadar.Assets.SwitchID description: Switch ID. type: number - contextPath: QRadar.Assets.SwitchPort description: Switch port. type: number - contextPath: QRadar.Assets.Name.LastUser description: Last user who updated the name. type: string - contextPath: QRadar.Assets.AggregatedCVSSScore.LastUser description: Last user who updated the Aggregated CVSS Score. type: string - contextPath: QRadar.Assets.Weight.LastUser description: Last user who updated the weight. type: string - contextPath: QRadar.Assets.ComplianceNotes.LastUser description: Last user who updated the compliance notes. type: string - contextPath: QRadar.Assets.CompliancePlan.LastUser description: Last user who updated the compliance plan. type: string - contextPath: QRadar.Assets.CollateralDamagePotential.LastUser description: Last user who updated the collateral damage potential. type: string - contextPath: QRadar.Assets.Vulnerabilities.LastUser description: Last user who updated the vulnerabilities. type: string - arguments: - auto: PREDEFINED defaultValue: 'true' description: If true, reserved closing reasons are included in the response. name: include_reserved predefined: - 'true' - 'false' - auto: PREDEFINED defaultValue: 'true' description: If true, deleted closing reasons are included in the response. name: include_deleted predefined: - 'true' - 'false' - description: 'Query to filter results. For refernce, consult: https://www.ibm.com/support/knowledgecenter/en/SS42VS_7.3.1/com.ibm.qradar.doc/c_rest_api_filtering.html' name: filter - description: 'If used, will filter all fields except for the specified ones. Use this parameter to specify which fields you would like to get back in the response. Fields that are not explicitly named are excluded. Specify subfields in brackets and multiple fields in the same object separated by commas. The filter uses QRadar''s field names. For reference, consult: https://www.ibm.com/support/knowledgecenter/SSKMKU/com.ibm.qradar.doc_cloud/9.1--siem-offense_closing_reasons-GET.html' name: fields - description: 'Range of results to return. e.g.: 0-20.' name: range description: Get closing reasons. name: qradar-get-closing-reasons outputs: - contextPath: QRadar.Offense.ClosingReasons.ID description: Closing reason ID. type: number - contextPath: QRadar.Offense.ClosingReasons.Name description: Closing reason name. type: string - arguments: - default: true description: The offense ID to add the note to. name: offense_id required: true - description: The note text. name: note_text required: true - description: 'If used, will filter all fields except for the specified ones. Use this parameter to specify which fields you would like to get back in the response. Fields that are not explicitly named are excluded. Specify subfields in brackets and multiple fields in the same object separated by commas. The filter uses QRadar''s field names. For reference, consult: https://www.ibm.com/support/knowledgecenter/SSKMKU/com.ibm.qradar.doc_cloud/9.1--siem-offenses-offense_id-notes-POST.html' name: fields - description: Table headers to use the human readable output (if none provided, will show all table headers). name: headers description: Create a note on an offense. name: qradar-create-note outputs: - contextPath: QRadar.Note.ID description: Note ID. type: number - contextPath: QRadar.Note.Text description: Note text. type: string - contextPath: QRadar.Note.CreateTime description: The creation time of the note. type: date - contextPath: QRadar.Note.CreatedBy description: The user who created the note. type: string - arguments: - default: true description: The offense ID to retrieve the note from. name: offense_id required: true - description: The note ID. name: note_id - description: 'If used, will filter all fields except for the specified ones. Use this parameter to specify which fields you would like to get back in the response. Fields that are not explicitly named are excluded. Specify subfields in brackets and multiple fields in the same object separated by commas. The filter uses QRadar''s field names. For reference, consult: https://www.ibm.com/support/knowledgecenter/SSKMKU/com.ibm.qradar.doc_cloud/9.1--siem-offenses-offense_id-notes-note_id-GET.html' name: fields - description: Table headers to use the human readable output (if none provided, will show all table headers). name: headers description: Retrieve a note for an offense. name: qradar-get-note outputs: - contextPath: QRadar.Note.ID description: Note ID. type: number - contextPath: QRadar.Note.Text description: Note text. type: string - contextPath: QRadar.Note.CreateTime description: The creation time of the note. type: date - contextPath: QRadar.Note.CreatedBy description: The user who created the note. type: string - arguments: - default: true description: The name of the requestered reference. name: ref_name required: true - description: Table headers to use the human readable output (if none provided, will show all table headers). name: headers - auto: PREDEFINED defaultValue: 'False' description: If set to true will try to convert the data values to ISO-8601 string. name: date_value predefined: - 'True' - 'False' description: Information about the reference set that had data added or updated. This returns the information set, but not the contained data. This feature is supported from version 8.1 and upward. name: qradar-get-reference-by-name outputs: - contextPath: QRadar.Reference.Name description: The name of the reference set. type: string - contextPath: QRadar.Reference.CreationTime description: The creation time (ISO) of the reference. type: date - contextPath: QRadar.Reference.ElementType description: Reference element type. type: string - contextPath: QRadar.Reference.NumberOfElements description: Number of elements. type: number - contextPath: QRadar.Reference.TimeToLive description: Reference time to live. type: string - contextPath: QRadar.Reference.TimeoutType description: 'Reference timeout type. Valid values are: UNKNOWN, FIRST_SEEN, LAST_SEEN.' type: string - contextPath: QRadar.Reference.Data description: Reference set items. type: Unknown - arguments: - description: Reference name to be created. name: ref_name required: true - auto: PREDEFINED description: 'The element type for the values allowed in the reference set. The allowed values are: ALN (alphanumeric), ALNIC (alphanumeric ignore case), IP (IP address), NUM (numeric), PORT (port number) or DATE. Note that date values need to be represented in milliseconds since the Unix Epoch January 1st 1970.' name: element_type predefined: - ALN - ALNIC - IP - NUM - PORT - DATE required: true - auto: PREDEFINED description: The allowed values are "FIRST_SEEN", LAST_SEEN and UNKNOWN. The default value is UNKNOWN. name: timeout_type predefined: - FIRST_SEEN - LAST_SEEN - UNKNOWN - description: 'The time to live interval, for example: "1 month" or "5 minutes".' name: time_to_live description: Creates a new reference set. If the provided name is already in use, this command will fail. name: qradar-create-reference-set outputs: - contextPath: QRadar.Reference.CreationTime description: Creation time of the reference set. type: date - contextPath: QRadar.Reference.ElementType description: 'The element type for the values allowed in the reference set. The allowed values are: ALN (alphanumeric), ALNIC (alphanumeric ignore case), IP (IP address), NUM (numeric), PORT (port number) or DATE.' type: string - contextPath: QRadar.Reference.Name description: Name of the reference set. type: string - contextPath: QRadar.Reference.NumberOfElements description: Number of elements in the created reference set. type: number - contextPath: QRadar.Reference.TimeoutType description: Timeout type of the reference. The allowed values are FIRST_SEEN, LAST_SEEN and UNKNOWN. type: string - arguments: - default: true description: The name of reference set to delete. name: ref_name required: true description: Deletes a reference set corresponding to the name provided. name: qradar-delete-reference-set - arguments: - description: The name of the reference set to add or update a value in. name: ref_name required: true - description: 'The value/s to add or update in the reference set. Note: Date values must be represented in epoch in reference sets (milliseconds since the Unix Epoch January 1st 1970). If ''date_value'' is set to ''True'', then the argument will be converted from date in format: ''%Y-%m-%dT%H:%M:%S.%f000Z'' (e.g. ''2018-11-06T08:56:41.000000Z'') to epoch.' isArray: true name: value required: true - description: An indication of where the data originated. The default value is 'reference data api'. name: source - auto: PREDEFINED defaultValue: 'False' description: 'If set to True, will convert ''value'' argument from date in format: ''%Y-%m-%dT%H:%M:%S.%f000Z'' (e.g. ''2018-11-06T08:56:41.000000Z'') to epoch.' name: date_value predefined: - 'True' - 'False' description: Add or update a value in a reference set. name: qradar-create-reference-set-value outputs: - contextPath: QRadar.Reference.Name description: The name of the reference set. type: string - contextPath: QRadar.Reference.CreationTime description: The creation time (ISO) of the reference. type: date - contextPath: QRadar.Reference.ElementType description: Reference element type. type: string - contextPath: QRadar.Reference.NumberOfElements description: Number of elements. type: number - contextPath: QRadar.Reference.TimeoutType description: 'Reference timeout type. One of: UNKNOWN, FIRST_SEEN, LAST_SEEN.' type: string - arguments: - description: The name of the reference set to add or update a value in. name: ref_name required: true - description: ' A comma-separated list of values to add or update in the reference set. Date values must be represented in milliseconds since the Unix Epoch January 1st 1970.' isArray: true name: value required: true - description: An indication of where the data originated. The default value is 'reference data api'. name: source - auto: PREDEFINED defaultValue: 'False' description: 'If set to True, will convert ''value'' argument from date in format: ''%Y-%m-%dT%H:%M:%S.%f000Z'' (e.g. ''2018-11-06T08:56:41.000000Z'') to epoch.' name: date_value predefined: - 'True' - 'False' description: Adds or updates a value in a reference set. name: qradar-update-reference-set-value outputs: - contextPath: QRadar.Reference.Name description: The name of the reference set. type: string - contextPath: QRadar.Reference.CreationTime description: The creation time (ISO) of the reference. type: date - contextPath: QRadar.Reference.ElementType description: Reference element type. type: string - contextPath: QRadar.Reference.NumberOfElements description: Number of elements. type: number - contextPath: QRadar.Reference.TimeoutType description: 'Reference timeout type. One of: UNKNOWN, FIRST_SEEN, LAST_SEEN.' type: string - arguments: - description: The name of the reference set to remove a value from. name: ref_name required: true - description: The value to remove from the reference set. name: value required: true - auto: PREDEFINED defaultValue: 'False' description: 'If set to True will convert ''value'' argument from date in format: ''%Y-%m-%dT%H:%M:%S.%f000Z'' (e.g. ''2018-11-06T08:56:41.000000Z'') to epoch.' name: date_value predefined: - 'True' - 'False' description: Deletes a value in a reference set. name: qradar-delete-reference-set-value outputs: - contextPath: QRadar.Reference.Name description: The name of the reference set. type: string - contextPath: QRadar.Reference.CreationTime description: The creation time (ISO) of the reference. type: date - contextPath: QRadar.Reference.ElementType description: Reference element type. type: string - contextPath: QRadar.Reference.NumberOfElements description: Number of elements. type: number - contextPath: QRadar.Reference.TimeoutType description: 'Reference timeout type. One of: UNKNOWN, FIRST_SEEN, LAST_SEEN.' type: string - arguments: - description: 'If used, will filter all fields except for the specified ones. Use this parameter to specify which fields you would like to get back in the response. Fields that are not explicitly named are excluded. Specify subfields in brackets and multiple fields in the same object are separated by commas. The filter uses QRadar''s field names, for reference please consult: https://www.ibm.com/support/knowledgecenter/SSKMKU/com.ibm.qradar.doc_cloud/9.1--siem-offenses-offense_id-notes-note_id-GET.html' name: fields - description: Number of results in return. name: range - description: Query to filter offenses. name: filter description: Retrieve all Domains. name: qradar-get-domains outputs: - contextPath: QRadar.Domains.AssetScannerIDs description: Array of Asset Scanner IDs. type: Number - contextPath: QRadar.Domains.CustomProperties description: Custom properties of the domain. type: String - contextPath: QRadar.Domains.Deleted description: Indicates if the domain is deleted. type: Boolean - contextPath: QRadar.Domains.Description description: Description of the domain. type: String - contextPath: QRadar.Domains.EventCollectorIDs description: Array of Event Collector IDs. type: Number - contextPath: QRadar.Domains.FlowCollectorIDs description: Array of Flow Collector IDs. type: Number - contextPath: QRadar.Domains.FlowSourceIDs description: Array of Flow Source IDs. type: Number - contextPath: QRadar.Domains.ID description: ID of the domain. type: Number - contextPath: QRadar.Domains.LogSourceGroupIDs description: Array of Log Source Group IDs. type: Number - contextPath: QRadar.Domains.LogSourceIDs description: Array of Log Source IDs. type: Number - contextPath: QRadar.Domains.Name description: Name of the Domain. type: String - contextPath: QRadar.Domains.QVMScannerIDs description: Array of QVM Scanner IDs. type: Number - contextPath: QRadar.Domains.TenantID description: ID of the Domain tenant. type: Number - arguments: - description: ID of the domain. name: id required: true - description: 'If used, will filter all fields except for the specified ones. Use this parameter to specify which fields you would like to get back in the response. Fields that are not explicitly named are excluded. Specify subfields in brackets and multiple fields in the same object are separated by commas. The filter uses QRadar''s field names, for reference please consult: https://www.ibm.com/support/knowledgecenter/SSKMKU/com.ibm.qradar.doc_cloud/9.1--siem-offenses-offense_id-notes-note_id-GET.html' name: fields description: Retrieves Domain information By ID. name: qradar-get-domain-by-id outputs: - contextPath: QRadar.Domains.AssetScannerIDs description: Array of Asset Scanner IDs. type: Number - contextPath: QRadar.Domains.CustomProperties description: Custom properties of the domain. type: String - contextPath: QRadar.Domains.Deleted description: Indicates if the domain is deleted. type: Boolean - contextPath: QRadar.Domains.Description description: Description of the domain. type: String - contextPath: QRadar.Domains.EventCollectorIDs description: Array of Event Collector IDs. type: Number - contextPath: QRadar.Domains.FlowCollectorIDs description: Array of Flow Collector IDs. type: Number - contextPath: QRadar.Domains.FlowSourceIDs description: Array of Flow Source IDs. type: Number - contextPath: QRadar.Domains.ID description: ID of the domain. type: Number - contextPath: QRadar.Domains.LogSourceGroupIDs description: Array of Log Source Group IDs. type: Number - contextPath: QRadar.Domains.LogSourceIDs description: Array of Log Source IDs. type: Number - contextPath: QRadar.Domains.Name description: Name of the Domain. type: String - contextPath: QRadar.Domains.QVMScannerIDs description: Array of QVM Scanner IDs. type: Number - contextPath: QRadar.Domains.TenantID description: ID of the Domain tenant. type: Number - arguments: - description: The name of the reference set to add or update a value in. To create a new reference set, you need to set the element type. name: ref_name required: true - auto: PREDEFINED description: 'The element type for the values premitted in the reference set. Only required when creating a new reference set. The valid values are: ALN (alphanumeric), ALNIC (alphanumeric ignore case), IP (IP address), NUM (numeric), PORT (port number) or DATE. Note that date values need to be represented in milliseconds since the Unix Epoch January 1st 1970.' name: element_type predefined: - ALN - ALNIC - IP - NUM - PORT - DATE - auto: PREDEFINED description: The timeout_type can be "FIRST_SEEN", "LAST_SEEN", or "UNKNOWN". The default value is UNKNOWN. Only required for creating a new refernce set. name: timeout_type predefined: - FIRST_SEEN - LAST_SEEN - UNKNOWN - description: 'The time to live interval, for example: "1 month" or "5 minutes". Only required when creating a new reference set.' name: time_to_live - description: The query for getting indicators. name: query required: true - defaultValue: '1000' description: The maximum number of indicators to return. The default value is 1000. name: limit - defaultValue: '0' description: The page from which to get the indicators. name: page description: Uploads indicators from Demisto to Qradar. name: qradar-upload-indicators - description: Reset fetch incidents last run value, which resets the fetch to its initial fetch state (will try to fetch first available offense). name: qradar-reset-last-run - description: Returns the list of fields for an incident type. This command should be used for debugging purposes. name: get-mapping-fields - arguments: - defaultValue: '25' description: The maximum number of regex event properties to fetch. name: limit - description: A comma-separated list of names of an exact properties to search for. isArray: true name: field_name - description: A comma-separated list of fields that specifies the fields that are returned by the command output. When not given, will return all. Options are identifier, name, id, locale, datetime_format, description, username, property_type, auto_discovered, use_for_rule_engine. name: fields - description: A comma-separated list names of a properties to search for. Values are case insensitive. name: like_name - description: This parameter is used to restrict the elements in a list base on the contents of various fields. name: filter description: Retrieves a list of event regex properties. name: qradar-get-custom-properties outputs: - contextPath: QRadar.Properties.auto_discovered description: The flag to indicate if the event regex property is generated by custom properties discovery engine. type: Number - contextPath: QRadar.Properties.creation_date description: The date when the event regex property wase created. type: Date - contextPath: QRadar.Properties.datetime_format description: The date/time pattern that the event regex property matches. type: String - contextPath: QRadar.Properties.description description: The description of the event regex property. type: String - contextPath: QRadar.Properties.id description: The sequence ID of the event regex property. type: Number - contextPath: QRadar.Properties.identifier description: The ID of the event regex property. type: String - contextPath: QRadar.Properties.locale description: The language tag of the locale that the property matches. type: String - contextPath: QRadar.Properties.modification_date description: The date when the event regex property was last modified. type: Date - contextPath: QRadar.Properties.name description: The name of the event regex property. type: String - contextPath: QRadar.Properties.property_type description: The property type (STRING, NUMERIC, IP, PORT, TIME) of the event regex property. type: String - contextPath: QRadar.Properties.use_for_rule_engine description: The flag to indicate if the event regex property is parsed when the event is received. type: Number - contextPath: QRadar.Properties.username description: The owner of the event regex property. type: String dockerimage: demisto/python3:3.12.12.5490952 longRunning: true runonce: false script: '-' subtype: python3 type: python isFetchSamples: true ismappable: true defaultmapperin: QRadar-mapper defaultclassifier: QRadar fromversion: 6.0.0 tests: - test_Qradar_v2