IBM QRadar v3

This Integration is part of the IBM QRadar Pack.#

Supported versions

Supported Cortex XSOAR versions: 5.5.0 and later.

Use the QRadar v3 integration to help security teams quickly and accurately detect and prioritize threats across the enterprise.
This integration was integrated and tested with API versions 10.1-14.0 on QRadar platform 7.4.1 (supports API versions 10.1 and above).

Configure QRadar v3 on Cortex XSOAR#

Navigate to Settings > Integrations > Servers & Services.
Search for QRadar v3.

Click Add instance to create and configure a new integration instance.

Parameter	Description	Required
Server URL	(e.g., https://192.168.0.1\)	True
Username		True
QRadar API Version	API version of QRadar (e.g., '12.0'). Minimum API version is 10.1.	True
Incident Type		False
Fetch mode		True
Retry events fetch	Whenever enabled, the integration retries to fetch all events if the number of events fetched is less than `event_count`. Default number of tries is 3, but can be configured via the Advanced Parameter: EVENTS_SEARCH_TRIES. e.g EVENTS_SEARCH_TRIES=5.	False
Number of offenses to pull per API call (max 50)		False
Query to fetch offenses.	Define a query to determine which offenses to fetch. E.g., "severity >= 4 AND id > 5". Filtering by status in the query may result in unexpected behavior when changing an incident's status.	False
First fetch time	how long to look back while fetching incidents on the first fetch (<number> <time unit>, e.g., 12 hours, 7 days)	False
Incidents Enrichment	IPs enrichment transforms IDs of the IPs of the offense to IP values. Asset enrichment adds correlated assets to the fetched offenses.	True
Incidents Enrichment	IP enrichment transforms IDs of the IPs of the offense to IP values. Asset enrichment adds correlated assets to the fetched offenses.	True
Event fields to return from the events query (WARNING: This parameter is correlated to the incoming mapper and changing the values may adversely affect mapping).	The parameter uses the AQL SELECT syntax. For more information, see: https://www.ibm.com/support/knowledgecenter/en/SS42VS_7.4/com.ibm.qradar.doc/c_aql_intro.html	False
Mirroring Options	How mirroring from QRadar to Cortex XSOAR should be done.	False
Close Mirrored XSOAR Incident	When selected, closing the QRadar offense is mirrored in Cortex XSOAR. Can't be used with "status=OPEN" query.	False
The number of incoming incidents to mirror each time	Maximum number of incoming incidents to mirror each time.	False
Advanced Parameters	Comma-separated configuration for advanced parameter values. E.g., EVENTS_INTERVAL_SECS=20,FETCH_SLEEP=5	False
Trust any certificate (not secure)		False
Use system proxy settings		False

Click Test to validate the URLs, token, and connection.

Required Permissions#

Component	Permission
Assets	Vulnerability Management or Assets
Domains	Admin
Offenses (Manage Closing Reason)	Manage Offense Closing Reasons
Offenses (Assign Offenses to Users)	Assign Offenses to Users
Offenses (Read)	Offenses
References (Create/Update)	Admin
References (Read)	View Reference Data

Mapping Limitation for Cortex XSOAR Versions below 6.0.0#

The Pull from instance option to create a new mapper is not supported in Cortex XSOAR versions below 6.0.0.

Creating a Classifier Using the Pull from instance Parameter#

QRadar fetches incidents using a long-running execution, not in real time. Therefore, Pull from instance pulls incidents from the QRadar service to create a classifier using samples, not real time data. This results in seeing the latest sample stored, and not the latest offense that was fetched.

Important Note Regarding the Query to fetch offenses Parameter#

The Query to fetch offenses feature enables defining a specific query for offenses to be retrieved, e.g., 'status = OPEN and id = 5'. The QRadar integration keeps track of IDs that have already been fetched in order to avoid duplicate fetching.
If you change the Query to fetch offenses value, it will not re-fetch offenses that have already been fetched. To re-fetch those offenses, run the qradar-reset-last-run command.
Note:
The list of QRadar IDs that were already fetched will be reset and duplicate offenses could be re-fetched, depending on the user query.

Migration from QRadar v2 to QRadar v3#

Every command and playbook that runs in QRadar v2 also runs in QRadar v3. No adjustments are required.

Additions and Changes from QRadar v2 to QRadar v3#

New Commands#

qradar-rule-groups-list
qradar-searches-list
qradar-geolocations-for-ip
qradar-log-sources-list
qradar-upload-indicators
get-modified-remote-data

Command Name Changes#

QRadar v2 command	QRadar V3 command	Notes
qradar-offenses	qradar-offenses-list
qradar-offense-by-id	qradar-offenses-list	Specify the offense_id argument in the command.
qradar-update-offense	qradar-offense-update
qradar-get-closing-reasons	qradar-closing-reasons
qradar-get-note	qradar-offense-notes-list
qradar-create-note	qradar-offense-note-create
qradar-get-assets	qradar-assets-list
qradar-get-asset-by-id	qradar-assets-list	Specify the asset_id argument in the command.
qradar-searches	qradar-search-create
qradar-get-search	qradar-search-status-get
qradar-get-search-results	qradar-search-results-get
qradar-get-reference-by-name	qradar-reference-sets-list	Specify the ref_name argument in the command.
qradar-create-reference-set	qradar-reference-set-create
qradar-delete-reference-set	qradar-reference-set-delete
qradar-create-reference-set-value	qradar-reference-set-value-upsert
qradar-update-reference-set-value	qradar-reference-set-value-upsert
qradar-delete-reference-set-value	qradar-reference-set-value-delete
qradar-get-domains	qradar-domains-list
qradar-domains-list	qradar-get-domain-by-id	Specify the domain_id argument in the command.

Mirroring#

This integration supports in mirroring from QRadar offenses to Cortex XSOAR.
When a field of an offense is updated in QRadar services, the update is mirrored in Cortex XSOAR.

Mirroring Events#

Mirroring events from QRadar to Cortex XSOAR is supported via the Mirror Offense and Events option.
Events will only be mirrored in the incoming direction.
Mirroring events will only work when the Long running instance parameter is enabled.
Filtering events using the events_limit and events_columns options for mirrored incidents will be the same as in the fetched incidents.
The integration will always mirror the events that occurred first in each offense.

For more information about mirroring configurations, see here.

Use the API Token Instead of Username and Password#

In the Username / API Key field, type _api_token_key.
In the Password field, type your API token.

Choose Your API Version#

Visit the QRadar API versions page for a full list of available API versions according to the QRadar version.
Choose one of the API versions listed under the Supported REST API versions column in the line corresponding to your QRadar version.

Note:
If you're uncertain which API version to use, it is recommended to use the latest API version listed in the Supported REST API versions column in the line corresponding to your QRadar version.

View Your QRadar Version#

Enter QRadar service.
Click the Menu toolbar. A scrolling toolbar will appear.
Click About. A new window will appear with the details of your QRadar version.

Troubleshooting#

When Fetch with events is configured, the integration will fetch the offense events from QRadar. Nevertheless, some events may not be available when trying to fetch them during an incident creation. If Retry events fetch is enabled, the integration tries to fetch more events when the number fetched is less than the expected event_count. In the default setting, the integration will try 3 times, with a wait time of 100 seconds between retries. In order to change the default values, configure the following Advanced Parameters in the instance configuration:

EVENTS_SEARCH_TRIES=<amount of tries for events search> (default 3),EVENTS_SEARCH_RETRY_SECONDS=<amount of seconds to wait between tries> (default 100),EVENTS_POLLING_TRIES=<number of times to poll for one search> (default 10),

It is recommended to enable mirroring, as it should fetch previously missed events when the offense is updated. Alternatively, the retrieve events command can be used to retrieve the events immediately. If the command takes too long to finish executing, try setting the interval_in_seconds to a lower value (down to a minimum of 10 seconds).

Commands#

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook. After you successfully execute a command, a DBot message appears in the War Room with the command details.

qradar-offenses-list#

Gets offenses from QRadar.

Base Command#

qradar-offenses-list

Input#

Argument Name	Description	Required
offense_id	The offense ID to retrieve its details. Specify offense_id to get details about a specific offense.	Optional
enrichment	IP enrichment transforms IDs of the IPs of the offense to IP values. Asset enrichment adds correlated assets to the fetched offenses. Possible values are: IPs, IPs And Assets, None. Default is None.	Optional
range	Range of results to return (e.g.: 0-20, 3-5, 3-3). Default is 0-49.	Optional
filter	Query to filter offenses, e.g., "severity >= 4 AND id > 5 AND status=OPEN". For reference, see: https://www.ibm.com/support/knowledgecenter/SS42VS_SHR/com.ibm.qradarapi.doc/c_rest_api_filtering.html.	Optional
fields	Comma-separated list of fields to retrieve in the response. Fields that are not explicitly named are excluded. E.g., "id,severity,status". Specify subfields in brackets and multiple fields in the same object separated by commas. For a full list of available fields, see: https://www.ibm.com/support/knowledgecenter/SS42VS_SHR/com.ibm.qradarapi140.doc/14.0--siem-offenses-GET.html.	Optional

Context Output#

Path	Type	Description
QRadar.Offense.Description	String	Description of the offense.
QRadar.Offense.Rules.id	Number	The ID of the rule.
QRadar.Offense.Rules.type	String	The type of the rule.
QRadar.Offense.Rules.name	String	The name of the rule.
QRadar.Offense.EventCount	Number	Number of events that are associated with the offense.
QRadar.Offense.FlowCount	Number	Number of flows that are associated with the offense.
QRadar.Offense.AssignedTo	String	The user to whom the offense is assigned.
QRadar.Offense.Followup	Boolean	Whether the offense is marked for follow-up.
QRadar.Offense.SourceAddress	Number	Source addresses (IPs if IPs enrich have been requested, else IDs of the IPs) that are associated with the offense.
QRadar.Offense.Protected	Boolean	Whether the offense is protected.
QRadar.Offense.ClosingUser	String	The user who closed the offense.
QRadar.Offense.DestinationHostname	String	Destination networks that are associated with the offense.
QRadar.Offense.CloseTime	Date	Time when the offense was closed.
QRadar.Offense.RemoteDestinationCount	Number	Number of remote destinations that are associated with the offense.
QRadar.Offense.StartTime	Date	Date of the earliest item that contributed to the offense.
QRadar.Offense.Magnitude	Number	Magnitude of the offense.
QRadar.Offense.LastUpdatedTime	String	Date of the most recent item that contributed to the offense.
QRadar.Offense.Credibility	Number	Credibility of the offense.
QRadar.Offense.ID	Number	ID of the offense.
QRadar.Offense.Categories	String	Event categories that are associated with the offense.
QRadar.Offense.Severity	Number	Severity of the offense.
QRadar.Offense.ClosingReason	String	Reason the offense was closed.
QRadar.Offense.OffenseType	String	Type of the offense.
QRadar.Offense.Relevance	Number	Relevance of the offense.
QRadar.Offense.OffenseSource	String	Source of the offense.
QRadar.Offense.DestinationAddress	Number	Destination addresses (IPs if IPs enrichment have been requested, else IDs of the IPs) that are associated with the offense.
QRadar.Offense.Status	String	Status of the offense. Possible values: "OPEN", "HIDDEN", "CLOSED".
QRadar.Offense.LinkToOffense	String	Link to the URL containing information about the offense.
QRadar.Offense.Assets	String	Assets correlated to the offense, if enrichment was requested.

Command Example#

!qradar-offenses-list enrichment=IPs filter="status=OPEN" range=0-2

Context Example#

{
    "QRadar": {
        "Offense": [
            {
                "Categories": [
                    "Session Closed"
                ],
                "Credibility": 2,
                "Description": "Session Closed\n",
                "DestinationAddress": [
                    "192.168.1.3"
                ],
                "DestinationHostname": [
                    "Net-10-172-192.Net_192_168_1_3"
                ],
                "EventCount": 1,
                "FlowCount": 0,
                "Followup": true,
                "ID": 16,
                "LastUpdatedTime": "2021-02-15T14:24:11.536000+00:00",
                "LinkToOffense": "https://192.168.0.1/api/console/do/sem/offensesummary?appName=Sem&pageId=OffenseSummary&summaryId=16",
                "Magnitude": 1,
                "OffenseSource": "192.168.1.3",
                "OffenseType": "Source IP",
                "Protected": false,
                "Relevance": 0,
                "RemoteDestinationCount": 0,
                "Rules": [
                    {
                        "id": 100405,
                        "name": "Fake port scan",
                        "type": "CRE_RULE"
                    }
                ],
                "Severity": 2,
                "SourceAddress": [
                    "192.168.1.3"
                ],
                "StartTime": "2021-02-15T14:24:11.536000+00:00",
                "Status": "OPEN"
            },
            {
                "Categories": [
                    "User Login Failure",
                    "General Authentication Failed"
                ],
                "Credibility": 2,
                "Description": "Multiple Login Failures for the Same User\n containing Failure Audit: The domain controller failed to validate the credentials for an account\n",
                "DestinationAddress": [
                    "192.168.1.3"
                ],
                "DestinationHostname": [
                    "Net-10-172-192.Net_192_168_1_3"
                ],
                "EventCount": 15,
                "FlowCount": 0,
                "Followup": false,
                "ID": 15,
                "LastUpdatedTime": "2021-02-15T13:21:46.948000+00:00",
                "LinkToOffense": "https://192.168.0.1/api/console/do/sem/offensesummary?appName=Sem&pageId=OffenseSummary&summaryId=15",
                "Magnitude": 1,
                "OffenseSource": "yarden",
                "OffenseType": "Username",
                "Protected": false,
                "Relevance": 0,
                "RemoteDestinationCount": 0,
                "Rules": [
                    {
                        "id": 100056,
                        "name": "Multiple Login Failures for Single Username",
                        "type": "CRE_RULE"
                    }
                ],
                "Severity": 3,
                "SourceAddress": [
                    "192.168.1.3",
                    "::1"
                ],
                "StartTime": "2021-02-15T13:21:36.537000+00:00",
                "Status": "OPEN"
            },
            {
                "Categories": [
                    "User Login Success",
                    "Session Opened",
                    "Session Closed"
                ],
                "Credibility": 2,
                "Description": "User Login Success\n and Session Opened\n and Session Closed\n",
                "DestinationAddress": [
                    "192.168.1.3"
                ],
                "DestinationHostname": [
                    "Net-10-172-192.Net_192_168_1_3"
                ],
                "EventCount": 5,
                "FlowCount": 0,
                "Followup": false,
                "ID": 14,
                "LastUpdatedTime": "2021-02-04T22:29:30.742000+00:00",
                "LinkToOffense": "https://192.168.0.1/api/console/do/sem/offensesummary?appName=Sem&pageId=OffenseSummary&summaryId=14",
                "Magnitude": 1,
                "OffenseSource": "192.168.1.3",
                "OffenseType": "Source IP",
                "Protected": false,
                "Relevance": 0,
                "RemoteDestinationCount": 0,
                "Rules": [
                    {
                        "id": 100405,
                        "name": "Fake port scan",
                        "type": "CRE_RULE"
                    }
                ],
                "Severity": 1,
                "SourceAddress": [
                    "192.168.1.3"
                ],
                "StartTime": "2021-02-04T12:19:54.402000+00:00",
                "Status": "OPEN"
            }
        ]
    }
}

Human Readable Output#

Offenses List#
ID Description OffenseType Status Severity LastUpdatedTime EventCount Categories Protected Relevance LinkToOffense OffenseSource DestinationAddress Rules Magnitude SourceAddress DestinationHostname Credibility Followup RemoteDestinationCount FlowCount StartTime
16 Session Closed
Source IP OPEN 2 2021-02-15T14:24:11.536000+00:00 1 Session Closed false 0 https://192.168.0.1/api/console/do/sem/offensesummary?appName=Sem&pageId=OffenseSummary&summaryId=16 192.168.1.3 192.168.1.3 {'id': 100405, 'type': 'CRE_RULE', 'name': 'Fake port scan'} 1 192.168.1.3 Net-10-172-192.Net_192_168_1_3 2 true 0 0 2021-02-15T14:24:11.536000+00:00
15 Multiple Login Failures for the Same User
containing Failure Audit: The domain controller failed to validate the credentials for an account
Username OPEN 3 2021-02-15T13:21:46.948000+00:00 15 User Login Failure,
General Authentication Failed false 0 https://192.168.0.1/api/console/do/sem/offensesummary?appName=Sem&pageId=OffenseSummary&summaryId=15 yarden 192.168.1.3 {'id': 100056, 'type': 'CRE_RULE', 'name': 'Multiple Login Failures for Single Username'} 1 192.168.1.3,
::1 Net-10-172-192.Net_192_168_1_3 2 false 0 0 2021-02-15T13:21:36.537000+00:00
14 User Login Success
and Session Opened
and Session Closed
Source IP OPEN 1 2021-02-04T22:29:30.742000+00:00 5 User Login Success,
Session Opened,
Session Closed false 0 https://192.168.0.1/api/console/do/sem/offensesummary?appName=Sem&pageId=OffenseSummary&summaryId=14 192.168.1.3 192.168.1.3 {'id': 100405, 'type': 'CRE_RULE', 'name': 'Fake port scan'} 1 192.168.1.3 Net-10-172-192.Net_192_168_1_3 2 false 0 0 2021-02-04T12:19:54.402000+00:00

qradar-offense-update#

Update an offense.

Base Command#

qradar-offense-update

Input#

Argument Name	Description	Required
offense_id	The ID of the offense to update.	Required
enrichment	IP enrichment transforms IDs of the IPs of the offense to IP values. Asset enrichment adds correlated assets to the fetched offenses. Possible values are: IPs, IPs And Assets, None. Default is None.	Optional
protected	Whether the offense should be protected. Possible values are: true, false.	Optional
follow_up	Whether the offense should be marked for follow-up. Possible values are: true, false.	Optional
status	The new status for the offense. When the status of an offense is set to CLOSED, a valid closing_reason_id must be provided. To hide an offense, use the HIDDEN status. To show a previously hidden offense, use the OPEN status. Possible values are: OPEN, HIDDEN, CLOSED.	Optional
closing_reason_id	The ID of a closing reason. You must provide a valid closing_reason_id when you close an offense. For a full list of closing reason IDs, use the 'qradar-closing-reasons' command.	Optional
assigned_to	User to assign the offense to.	Optional
fields	Comma-separated list of fields to retrieve in the response. Fields that are not explicitly named are excluded. E.g., "id,severity,status". Specify subfields in brackets and multiple fields in the same object separated by commas. For a full list of available fields, see: https://www.ibm.com/support/knowledgecenter/SS42VS_SHR/com.ibm.qradarapi140.doc/14.0--siem-offenses-offense_id-POST.html.	Optional

Context Output#

Path	Type	Description
QRadar.Offense.Description	String	Description of the offense.
QRadar.Offense.Rules.id	Number	The ID of the rule.
QRadar.Offense.Rules.type	String	The type of the rule.
QRadar.Offense.Rules.name	String	The name of the rule.
QRadar.Offense.EventCount	Number	Number of events that are associated with the offense.
QRadar.Offense.FlowCount	Number	Number of flows that are associated with the offense.
QRadar.Offense.AssignedTo	String	The user to whom the offense is assigned.
QRadar.Offense.Followup	Boolean	Whether the offense is marked for follow-up.
QRadar.Offense.SourceAddress	Number	Source addresses (IPs if IPs enrich have been requested, else IDs of the IPs) that are associated with the offense.
QRadar.Offense.Protected	Boolean	Whether the offense is protected.
QRadar.Offense.ClosingUser	String	The user who closed the offense.
QRadar.Offense.DestinationHostname	String	Destination networks that are associated with the offense.
QRadar.Offense.CloseTime	Date	Time when the offense was closed.
QRadar.Offense.RemoteDestinationCount	Number	Number of remote destinations that are associated with the offense.
QRadar.Offense.StartTime	Date	Date of the earliest item that contributed to the offense.
QRadar.Offense.Magnitude	Number	Magnitude of the offense.
QRadar.Offense.LastUpdatedTime	String	Date of the most recent item that contributed to the offense.
QRadar.Offense.Credibility	Number	Credibility of the offense.
QRadar.Offense.ID	Number	ID of the offense.
QRadar.Offense.Categories	String	Event categories that are associated with the offense.
QRadar.Offense.Severity	Number	Severity of the offense.
QRadar.Offense.ClosingReason	String	Reason the offense was closed.
QRadar.Offense.OffenseType	String	Type of the offense.
QRadar.Offense.Relevance	Number	Relevance of the offense.
QRadar.Offense.OffenseSource	String	Source of the offense.
QRadar.Offense.DestinationAddress	Number	Destination addresses (IPs if IPs enrichment have been requested, else IDs of the IPs) that are associated with the offense.
QRadar.Offense.Status	String	Status of the offense. Possible values: "OPEN", "HIDDEN", "CLOSED".
QRadar.Offense.LinkToOffense	String	Link to the URL containing information about the offense.
QRadar.Offense.Assets	String	Assets correlated to the offense, if enrichment was requested.

Command Example#

!qradar-offense-update offense_id=6 assigned_to=demisto enrichment="IPs And Assets" follow_up=true status=OPEN protected=false

Context Example#

{
    "QRadar": {
        "Offense": {
            "AssignedTo": "demisto",
            "Categories": [
                "Host Port Scan",
                "Access Permitted"
            ],
            "Credibility": 3,
            "Description": "Fake port scan\n",
            "DestinationAddress": [
                "192.168.1.3"
            ],
            "DestinationHostname": [
                "Net-10-172-192.Net_192_168_1_3"
            ],
            "EventCount": 6553,
            "FlowCount": 0,
            "Followup": true,
            "ID": 6,
            "LastUpdatedTime": "2021-03-02T13:38:32.438000+00:00",
            "LinkToOffense": "https://192.168.0.1/api/console/do/sem/offensesummary?appName=Sem&pageId=OffenseSummary&summaryId=6",
            "Magnitude": 6,
            "OffenseSource": "192.168.1.3",
            "OffenseType": "Source IP",
            "Protected": false,
            "Relevance": 5,
            "RemoteDestinationCount": 0,
            "Rules": [
                {
                    "id": 100405,
                    "name": "Fake port scan",
                    "type": "CRE_RULE"
                }
            ],
            "Severity": 9,
            "SourceAddress": [
                "192.168.1.3"
            ],
            "StartTime": "2020-11-10T22:24:23.603000+00:00",
            "Status": "OPEN"
        }
    }
}

Human Readable Output#

offense Update#
ID Description OffenseType Status Severity SourceAddress Relevance LastUpdatedTime OffenseSource Magnitude Followup Rules DestinationAddress DestinationHostname Categories RemoteDestinationCount Credibility FlowCount EventCount AssignedTo Protected StartTime LinkToOffense
6 Fake port scan
Source IP OPEN 9 192.168.1.3 5 2021-03-02T13:38:32.438000+00:00 192.168.1.3 6 true {'id': 100405, 'type': 'CRE_RULE', 'name': 'Fake port scan'} 192.168.1.3 Net-10-172-192.Net_192_168_1_3 Host Port Scan,
Access Permitted 0 3 0 6553 demisto false 2020-11-10T22:24:23.603000+00:00 https://192.168.0.1/api/console/do/sem/offensesummary?appName=Sem&pageId=OffenseSummary&summaryId=6

qradar-closing-reasons#

Retrieves a list of offense closing reasons.

Base Command#

qradar-closing-reasons

Input#

Argument Name	Description	Required
closing_reason_id	The closing reason ID for which to retrieve its details. Specify closing_reason_id to get details about a specific closing reason.	Optional
include_reserved	If true, reserved closing reasons are included in the response. Possible values are: true, false. Default is false.	Optional
include_deleted	If true, deleted closing reasons are included in the response. Possible values are: true, false. Default is false.	Optional
range	Range of results to return (e.g.: 0-20, 3-5, 3-3). Default is 0-49.	Optional
filter	Query to filter closing reasons, e.g. "id > 5". For reference see: https://www.ibm.com/support/knowledgecenter/SS42VS_SHR/com.ibm.qradarapi.doc/c_rest_api_filtering.html.	Optional
fields	Comma-separated list of fields to retrieve in the response. Fields that are not explicitly named are excluded. E.g., "id,text". Specify subfields in brackets and multiple fields in the same object separated by commas. For a full list of available fields, see: https://www.ibm.com/support/knowledgecenter/SS42VS_SHR/com.ibm.qradarapi140.doc/14.0--siem-offense_closing_reasons-GET.html.	Optional

Context Output#

Path	Type	Description
QRadar.Offense.ClosingReasons.IsDeleted	Boolean	Whether the closing reason is deleted. Deleted closing reasons cannot be used to close an offense.
QRadar.Offense.ClosingReasons.IsReserved	Boolean	Whether the closing reason is reserved. Reserved closing reasons cannot be used to close an offense.
QRadar.Offense.ClosingReasons.Name	String	Name of the closing reason.
QRadar.Offense.ClosingReasons.ID	Number	ID of the closing reason.

Command Example#

!qradar-closing-reasons include_deleted=true include_reserved=true

Context Example#

{
    "QRadar": {
        "ClosingReason": [
            {
                "ID": 2,
                "IsDeleted": false,
                "IsReserved": false,
                "Name": "False-Positive, Tuned"
            },
            {
                "ID": 1,
                "IsDeleted": false,
                "IsReserved": false,
                "Name": "Non-Issue"
            },
            {
                "ID": 3,
                "IsDeleted": false,
                "IsReserved": false,
                "Name": "Policy Violation"
            },
            {
                "ID": 4,
                "IsDeleted": false,
                "IsReserved": true,
                "Name": "System Change (Upgrade, Reset, etc.)"
            }
        ]
    }
}

Human Readable Output#

Closing Reasons#
ID Name IsDeleted IsReserved
2 False-Positive, Tuned false false
1 Non-Issue false false
3 Policy Violation false false
4 System Change (Upgrade, Reset, etc.) false true

ID	Name	IsDeleted	IsReserved
2	False-Positive, Tuned	false	false
1	Non-Issue	false	false
3	Policy Violation	false	false
4	System Change (Upgrade, Reset, etc.)	false	true

qradar-offense-notes-list#

Retrieves a list of notes for an offense.

Base Command#

qradar-offense-notes-list

Input#

Argument Name	Description	Required
offense_id	The offense ID to retrieve the notes for.	Required
note_id	The note ID for which to retrieve its details. Specify note_id to get details about a specific note.	Optional
range	Range of results to return (e.g.: 0-20, 3-5, 3-3). Default is 0-49.	Optional
filter	Query to filter offense notes, e.g., "username=admin". For reference, see: https://www.ibm.com/support/knowledgecenter/SS42VS_SHR/com.ibm.qradarapi.doc/c_rest_api_filtering.html.	Optional
fields	Comma-separated list of fields to retrieve in the response. Fields that are not explicitly named are excluded. E.g., "username,note_text". Specify subfields in brackets and multiple fields in the same object separated by commas. For a full list of available fields, see: https://www.ibm.com/support/knowledgecenter/SS42VS_SHR/com.ibm.qradarapi140.doc/14.0--siem-offenses-offense_id-notes-GET.html.	Optional

Context Output#

Path	Type	Description
QRadar.Note.Text	String	The text of the note.
QRadar.Note.CreateTime	Date	Creation date of the note.
QRadar.Note.ID	Number	ID of the note.
QRadar.Note.CreatedBy	String	The user who created the note.

Command Example#

!qradar-offense-notes-list offense_id=6 filter="username='API_user: demisto'" range=0-1

Context Example#

{
    "QRadar": {
        "Note": [
            {
                "CreateTime": "2021-03-03T08:32:46.467000+00:00",
                "CreatedBy": "API_user: demisto",
                "ID": 12,
                "Text": "Note Regarding The Offense"
            },
            {
                "CreateTime": "2021-03-01T16:49:33.691000+00:00",
                "CreatedBy": "API_user: demisto",
                "ID": 10,
                "Text": "Note Regarding The Offense"
            }
        ]
    }
}

Human Readable Output#

Offense Notes List For Offense ID 6#
ID Text CreatedBy CreateTime
12 Note Regarding The Offense API_user: demisto 2021-03-03T08:32:46.467000+00:00
10 Note Regarding The Offense API_user: demisto 2021-03-01T16:49:33.691000+00:00

ID	Text	CreatedBy	CreateTime
12	Note Regarding The Offense	API_user: demisto	2021-03-03T08:32:46.467000+00:00
10	Note Regarding The Offense	API_user: demisto	2021-03-01T16:49:33.691000+00:00

qradar-offense-note-create#

Creates a note on an offense.

Base Command#

qradar-offense-note-create

Input#

Argument Name	Description	Required
offense_id	The offense ID to add the note to.	Required
note_text	The text of the note.	Required
fields	Comma-separated list of fields to retrieve in the response. Fields that are not explicitly named are excluded. E.g., "username,note_text". Specify subfields in brackets and multiple fields in the same object separated by commas. For a full list of available fields, see: https://www.ibm.com/support/knowledgecenter/SS42VS_SHR/com.ibm.qradarapi140.doc/14.0--siem-offenses-offense_id-notes-POST.html.	Optional

Context Output#

Path	Type	Description
QRadar.Note.Text	String	The text of the note.
QRadar.Note.CreateTime	Date	Creation date of the note.
QRadar.Note.ID	Number	ID of the note.
QRadar.Note.CreatedBy	String	The user who created the note.

Command Example#

!qradar-offense-note-create note_text="Note Regarding The Offense" offense_id=6

Context Example#

{
    "QRadar": {
        "Note": {
            "CreateTime": "2021-03-03T08:35:52.908000+00:00",
            "CreatedBy": "API_user: demisto",
            "ID": 13,
            "Text": "Note Regarding The Offense"
        }
    }
}

Human Readable Output#

Create Note#
ID Text CreatedBy CreateTime
13 Note Regarding The Offense API_user: demisto 2021-03-03T08:35:52.908000+00:00

ID	Text	CreatedBy	CreateTime
13	Note Regarding The Offense	API_user: demisto	2021-03-03T08:35:52.908000+00:00

qradar-rules-list#

Retrieves a list of rules.

Base Command#

qradar-rules-list

Input#

Argument Name	Description	Required
rule_id	The rule ID for which to retrieve its details. Specify rule_id to get details about a specific rule.	Optional
rule_type	Retrieves rules corresponding to the specified rule type. Possible values are: EVENT, FLOW, COMMON, USER.	Optional
range	Range of results to return (e.g.: 0-20, 3-5, 3-3). Default is 0-49.	Optional
filter	Query by which to filter rules, e.g., "type=EVENT". For reference, see: https://www.ibm.com/support/knowledgecenter/SS42VS_SHR/com.ibm.qradarapi.doc/c_rest_api_filtering.html.	Optional
fields	Comma-separated list of fields to retrieve in the response. Fields that are not explicitly named are excluded. E.g., "owner,identifier,origin". Specify subfields in brackets and multiple fields in the same object separated by commas. For a full list of available fields, see: https://www.ibm.com/support/knowledgecenter/SS42VS_SHR/com.ibm.qradarapi150.doc/15.0--analytics-rules-GET.html.	Optional

Context Output#

Path	Type	Description
QRadar.Rule.Owner	String	Owner of the rule.
QRadar.Rule.BaseHostID	Number	ID of the host from which the rule's base capacity was determined.
QRadar.Rule.CapacityTimestamp	Number	Date when the rule's capacity values were last updated.
QRadar.Rule.Origin	String	Origin of the rule. Possible values: "SYSTEM", "OVERRIDE", "USER".
QRadar.Rule.CreationDate	Date	Date when rule was created.
QRadar.Rule.Type	String	Type of the rule. Possible values: "EVENT", "FLOW", "COMMON", "USER".
QRadar.Rule.Enabled	Boolean	Whether rule is enabled.
QRadar.Rule.ModificationDate	Date	Date when the rule was last modified.
QRadar.Rule.Name	String	Name of the rule.
QRadar.Rule.AverageCapacity	Number	Moving average capacity in EPS of the rule across all hosts.
QRadar.Rule.ID	Number	ID of the rule.
QRadar.Rule.BaseCapacity	Number	Base capacity of the rule in events per second.

Command Example#

!qradar-rules-list rule_type=COMMON

Context Example#

{
    "QRadar": {
        "Rule": [
            {
                "AverageCapacity": 0,
                "BaseCapacity": 0,
                "BaseHostID": 0,
                "CapacityTimestamp": 0,
                "CreationDate": "2007-10-14T20:12:00.374000+00:00",
                "Enabled": true,
                "ID": 100057,
                "ModificationDate": "2020-10-18T19:40:21.886000+00:00",
                "Name": "Login Successful After Scan Attempt",
                "Origin": "SYSTEM",
                "Owner": "admin",
                "Type": "COMMON"
            },
            {
                "AverageCapacity": 0,
                "BaseCapacity": 0,
                "BaseHostID": 0,
                "CapacityTimestamp": 0,
                "CreationDate": "2006-03-27T10:54:12.077000+00:00",
                "Enabled": false,
                "ID": 100091,
                "ModificationDate": "2020-10-18T19:40:19.334000+00:00",
                "Name": "Botnet: Potential Botnet Connection (DNS)",
                "Origin": "SYSTEM",
                "Owner": "admin",
                "Type": "COMMON"
            },
            {
                "AverageCapacity": 0,
                "BaseCapacity": 0,
                "BaseHostID": 0,
                "CapacityTimestamp": 0,
                "CreationDate": "2005-12-22T00:54:48.708000+00:00",
                "Enabled": true,
                "ID": 100098,
                "ModificationDate": "2020-10-18T19:40:21.421000+00:00",
                "Name": "Host Port Scan Detected by Remote Host",
                "Origin": "SYSTEM",
                "Owner": "admin",
                "Type": "COMMON"
            }
        ]
    }
}

Human Readable Output#

Rules List#
ID Name Type CapacityTimestamp Owner Enabled BaseCapacity Origin AverageCapacity ModificationDate CreationDate BaseHostID
100057 Login Successful After Scan Attempt COMMON 0 admin true 0 SYSTEM 0 2020-10-18T19:40:21.886000+00:00 2007-10-14T20:12:00.374000+00:00 0
100091 Botnet: Potential Botnet Connection (DNS) COMMON 0 admin false 0 SYSTEM 0 2020-10-18T19:40:19.334000+00:00 2006-03-27T10:54:12.077000+00:00 0
100098 Host Port Scan Detected by Remote Host COMMON 0 admin true 0 SYSTEM 0 2020-10-18T19:40:21.421000+00:00 2005-12-22T00:54:48.708000+00:00 0

ID	Name	Type	Owner	Enabled	Origin	ModificationDate	CreationDate
100057	Login Successful After Scan Attempt	COMMON	admin	true	SYSTEM	2020-10-18T19:40:21.886000+00:00	2007-10-14T20:12:00.374000+00:00
100091	Botnet: Potential Botnet Connection (DNS)	COMMON	admin	false	SYSTEM	2020-10-18T19:40:19.334000+00:00	2006-03-27T10:54:12.077000+00:00
100098	Host Port Scan Detected by Remote Host	COMMON	admin	true	SYSTEM	2020-10-18T19:40:21.421000+00:00	2005-12-22T00:54:48.708000+00:00

qradar-rule-groups-list#

Retrieves a list of the rule groups.

Base Command#

qradar-rule-groups-list

Input#

Argument Name	Description	Required
rule_group_id	The rule group ID for which to retrieve its details. Specify rule_group_id to get details about a specific rule group.	Optional
range	Range of results to return (e.g.: 0-20, 3-5, 3-3). Default is 0-49.	Optional
filter	Query by which to filter rules, e.g., "id >= 125". For reference, see: https://www.ibm.com/support/knowledgecenter/SS42VS_SHR/com.ibm.qradarapi.doc/c_rest_api_filtering.html.	Optional
fields	Comma-separated list of fields to retrieve in the response. Fields that are not explicitly named are excluded. E.g., "owner,parent_id". Specify subfields in brackets and multiple fields in the same object separated by commas. For a full list of available fields, see: https://www.ibm.com/support/knowledgecenter/SS42VS_SHR/com.ibm.qradarapi140.doc/14.0--analytics-rule_groups-GET.html.	Optional

Context Output#

Path	Type	Description
QRadar.RuleGroup.Owner	String	Owner of the group.
QRadar.RuleGroup.ModifiedTime	Date	Date since the group was last modified.
QRadar.RuleGroup.Level	Number	Depth of the group in the group hierarchy.
QRadar.RuleGroup.Name	String	Name of the group.
QRadar.RuleGroup.Description	String	Description of the group.
QRadar.RuleGroup.ID	Number	ID of the group.
QRadar.RuleGroup.ChildItems	String	Child items of the group.
QRadar.RuleGroup.ChildGroups	Number	Child group IDs.
QRadar.RuleGroup.Type	String	The type of the group.
QRadar.RuleGroup.ParentID	Number	ID of the parent group.

Command Example#

!qradar-rule-groups-list

Context Example#

{
    "QRadar": {
        "RuleGroup": [
            {
                "ChildItems": [
                    "1607",
                    "1608",
                    "1609",
                    "1610",
                    "1611",
                    "1612",
                    "1613",
                    "1614",
                    "1615",
                    "1616",
                    "1617",
                    "1618",
                    "100039",
                    "100041",
                    "100037",
                    "100040",
                    "100038",
                    "100035",
                    "100036",
                    "100044",
                    "100034",
                    "100042",
                    "100045",
                    "100043"
                ],
                "Description": "Rules focused on detection of suspicious asset reconciliation behavior.",
                "ID": 125,
                "Level": 2,
                "ModifiedTime": "2014-01-06T15:23:26.060000+00:00",
                "Name": "Asset Reconciliation Exclusion",
                "Owner": "admin",
                "ParentID": 3,
                "Type": "RULE_GROUP"
            },
            {
                "ChildItems": [
                    "1209",
                    "1210",
                    "100237",
                    "100238"
                ],
                "Description": "Sample rules for building email and other responses based on a rule.",
                "ID": 100,
                "Level": 1,
                "ModifiedTime": "2020-10-18T19:10:24.297000+00:00",
                "Name": "Response",
                "Owner": "admin",
                "ParentID": 3,
                "Type": "RULE_GROUP"
            },
            {
                "ChildItems": [
                    "1219",
                    "1265",
                    "1335",
                    "1410",
                    "1411",
                    "1412",
                    "1431",
                    "1443",
                    "1460",
                    "1461",
                    "1471",
                    "1481",
                    "1509",
                    "1552",
                    "1566",
                    "100287",
                    "100001",
                    "100033",
                    "100003"
                ],
                "Description": "Rules based on log source and event anomalies such as high event rates or excessive connections.",
                "ID": 101,
                "Level": 1,
                "ModifiedTime": "2020-10-18T19:10:24.297000+00:00",
                "Name": "Anomaly",
                "Owner": "admin",
                "ParentID": 3,
                "Type": "RULE_GROUP"
            }
        ]
    }
}

Human Readable Output#

Rules Group List#
ID Name Description Owner ChildGroups Level ParentID Type ChildItems ModifiedTime
125 Asset Reconciliation Exclusion Rules focused on detection of suspicious asset reconciliation behavior. admin 2 3 RULE_GROUP 1607,
1608,
1609,
1610,
1611,
1612,
1613,
1614,
1615,
1616,
1617,
1618,
100039,
100041,
100037,
100040,
100038,
100035,
100036,
100044,
100034,
100042,
100045,
100043 2014-01-06T15:23:26.060000+00:00
100 Response Sample rules for building email and other responses based on a rule. admin 1 3 RULE_GROUP 1209,
1210,
100237,
100238 2020-10-18T19:10:24.297000+00:00
101 Anomaly Rules based on log source and event anomalies such as high event rates or excessive connections. admin 1 3 RULE_GROUP 1219,
1265,
1335,
1410,
1411,
1412,
1431,
1443,
1460,
1461,
1471,
1481,
1509,
1552,
1566,
100287,
100001,
100033,
100003 2020-10-18T19:10:24.297000+00:00

ID	Name	Description	Owner	Level	ParentID	Type	ChildItems	ModifiedTime
125	Asset Reconciliation Exclusion	Rules focused on detection of suspicious asset reconciliation behavior.	admin	2	3	RULE_GROUP	1607, 1608, 1609, 1610, 1611, 1612, 1613, 1614, 1615, 1616, 1617, 1618, 100039, 100041, 100037, 100040, 100038, 100035, 100036, 100044, 100034, 100042, 100045, 100043	2014-01-06T15:23:26.060000+00:00
100	Response	Sample rules for building email and other responses based on a rule.	admin	1	3	RULE_GROUP	1209, 1210, 100237, 100238	2020-10-18T19:10:24.297000+00:00
101	Anomaly	Rules based on log source and event anomalies such as high event rates or excessive connections.	admin	1	3	RULE_GROUP	1219, 1265, 1335, 1410, 1411, 1412, 1431, 1443, 1460, 1461, 1471, 1481, 1509, 1552, 1566, 100287, 100001, 100033, 100003	2020-10-18T19:10:24.297000+00:00

qradar-assets-list#

Retrieves assets list.

Base Command#

qradar-assets-list

Input#

Argument Name	Description	Required
asset_id	The asset ID for which to retrieve its details. Specify asset_id to get details about a specific asset.	Optional
range	Range of results to return (e.g.: 0-20, 3-5, 3-3). Default is 0-49.	Optional
filter	Query by which to filter assets, e.g., "domain_id=0". For reference, see: https://www.ibm.com/support/knowledgecenter/SS42VS_SHR/com.ibm.qradarapi.doc/c_rest_api_filtering.html.	Optional
fields	Comma-separated list of fields to retrieve in the response. Fields that are not explicitly named are excluded. E.g., "id,interfaces,users,properties". Specify subfields in brackets and multiple fields in the same object separated by commas. For a full list of available fields, see: https://www.ibm.com/support/knowledgecenter/SS42VS_SHR/com.ibm.qradarapi140.doc/14.0--asset_model-assets-GET.html.	Optional

Context Output#

Path	Type	Description
Endpoint.Domain	String	DNS name.
Endpoint.OS	String	Asset operating system.
Endpoint.MACAddress	String	Asset MAC address.
Endpoint.IPAddress	Unknown	IP addresses of the endpoint.
QRadar.Asset.Interfaces.id	Number	ID of the interface.
QRadar.Asset.Interfaces.mac_address	String	MAC address of the interface. Null if unknown.
QRadar.Asset.Interfaces.ip_addresses.id	Number	ID of the interface.
QRadar.Asset.Interfaces.ip_addresses.network_id	Number	Network ID of the network the IP belongs to.
QRadar.Asset.Interfaces.ip_addresses.value	String	The IP address.
QRadar.Asset.Interfaces.ip_addresses.type	String	Type of IP address. Possible values: "IPV4", "IPV6".
QRadar.Asset.Interfaces.ip_addresses.created	Date	Date when the IP address was created.
QRadar.Asset.Interfaces.ip_addresses.first_seen_scanner	Date	Date when the IP address was first seen during a vulnerability scan.
QRadar.Asset.Interfaces.ip_addresses.first_seen_profiler	Date	Date when the IP address was first seen in event or flow traffic.
QRadar.Asset.Interfaces.ip_addresses.last_seen_scanner	Date	Date when the IP address was most recently seen during a vulnerability scan.
QRadar.Asset.Interfaces.ip_addresses.last_seen_profiler	Date	Date when the IP address was most recently seen in event or flow traffic.
QRadar.Asset.Products.id	Number	The ID of this software product instance in QRadar's asset model.
QRadar.Asset.Products.product_variant_id	Number	The ID of this software product variant in QRadar's catalog of products.
QRadar.Asset.Products.first_seen_scanner	Date	Date when the product was first seen during a vulnerability scan.
QRadar.Asset.Products.first_seen_profiler	Date	Date when the product was first seen in event or flow traffic.
QRadar.Asset.Products.last_seen_scanner	Date	Date when the product was most recently seen seen during a vulnerability scan.
QRadar.Asset.Products.last_seen_profiler	Date	Date when the product was most recently seen in event or flow traffic.
QRadar.Asset.VulnerabilityCount	Number	The total number of vulnerabilities associated with this asset.
QRadar.Asset.RiskScoreSum	Number	The sum of the CVSS scores of the vulnerabilities on this asset.
QRadar.Asset.Hostnames.last_seen_profiler	Date	Date when the host was most recently seen in event or flow traffic.
QRadar.Asset.Hostnames.created	Date	Date when the host was created.
QRadar.Asset.Hostnames.last_seen_scanner	Date	Date when the host was most recently seen during a vulnerability scan.
QRadar.Asset.Hostnames.name	String	Name of the host.
QRadar.Asset.Hostnames.first_seen_scanner	Date	Date when the host was first seen during a vulnerability scan.
QRadar.Asset.Hostnames.id	Number	ID of the host.
QRadar.Asset.Hostnames.type	String	Type of the host. Possible values: "DNS", "NETBIOS", "NETBIOSGROUP".
QRadar.Asset.Hostnames.first_seen_profiler	Date	Date when the host was first seen in event or flow traffic.
QRadar.Asset.ID	Number	ID of the asset.
QRadar.Asset.Users.last_seen_profiler	Date	Date when the user was most recently seen in event or flow traffic.
QRadar.Asset.Users.last_seen_scanner	Date	Date when the user was most recently seen during a vulnerability scan.
QRadar.Asset.Users.first_seen_scanner	Date	Date when the user was first seen during a vulnerability scan.
QRadar.Asset.Users.id	Number	ID of the user.
QRadar.Asset.Users.first_seen_profiler	Date	Date when the user was first seen in event or flow traffic.
QRadar.Asset.Users.username	String	Name of the user.
QRadar.Asset.DomainID	Number	ID of the domain this asset belongs to.
QRadar.Asset.Properties.last_reported	Date	Date when the property was last updated.
QRadar.Asset.Properties.name	String	Name of the property.
QRadar.Asset.Properties.type_id	Number	Type ID of the property.
QRadar.Asset.Properties.id	Number	ID of the property.
QRadar.Asset.Properties.last_reported_by	String	The source of the most recent update to this property.
QRadar.Asset.Properties.value	String	Property value.

Command Example#

!qradar-assets-list filter="id<1100" range=0-2

Context Example#

{
    "QRadar": {
        "Asset": [
            {
                "DomainID": 0,
                "Hostnames": [
                    {
                        "created": "2021-02-02T19:05:12.138000+00:00",
                        "first_seen_profiler": "2021-02-02T19:05:12.138000+00:00",
                        "id": 1007,
                        "last_seen_profiler": "2021-02-15T13:20:23.530000+00:00",
                        "name": "HOST1233X11",
                        "type": "NETBIOS"
                    }
                ],
                "ID": 1007,
                "Properties": [
                    {
                        "id": 1006,
                        "last_reported": "2021-02-02T19:05:12.643000+00:00",
                        "last_reported_by": "IDENTITY:112",
                        "name": "Unified Name",
                        "type_id": 1002,
                        "value": "HOST1233X11"
                    }
                ],
                "RiskScoreSum": 0,
                "Users": [
                    {
                        "first_seen_profiler": "2021-02-02T19:05:12.138000+00:00",
                        "id": 1007,
                        "last_seen_profiler": "2021-02-15T13:20:23.530000+00:00",
                        "username": "Administrator"
                    }
                ],
                "VulnerabilityCount": 0
            },
            {
                "DomainID": 0,
                "Hostnames": [
                    {
                        "created": "2021-02-02T19:05:12.139000+00:00",
                        "first_seen_profiler": "2021-02-02T19:05:12.139000+00:00",
                        "id": 1008,
                        "last_seen_profiler": "2021-02-15T13:20:23.532000+00:00",
                        "name": "-",
                        "type": "NETBIOS"
                    }
                ],
                "ID": 1008,
                "Properties": [
                    {
                        "id": 1007,
                        "last_reported": "2021-02-02T19:05:12.645000+00:00",
                        "last_reported_by": "IDENTITY:112",
                        "name": "Unified Name",
                        "type_id": 1002,
                        "value": "-"
                    }
                ],
                "RiskScoreSum": 0,
                "Users": [
                    {
                        "first_seen_profiler": "2021-02-02T19:05:12.139000+00:00",
                        "id": 1008,
                        "last_seen_profiler": "2021-02-15T13:20:23.532000+00:00",
                        "username": "DWM-3"
                    }
                ],
                "VulnerabilityCount": 0
            },
            {
                "DomainID": 0,
                "Hostnames": [
                    {
                        "created": "2021-02-02T19:05:12.140000+00:00",
                        "first_seen_profiler": "2021-02-02T19:05:12.140000+00:00",
                        "id": 1009,
                        "last_seen_profiler": "2021-02-15T13:20:23.532000+00:00",
                        "name": "EC2AMAZ-ETKN6IA",
                        "type": "NETBIOS"
                    }
                ],
                "ID": 1009,
                "Properties": [
                    {
                        "id": 1008,
                        "last_reported": "2021-02-02T19:05:12.646000+00:00",
                        "last_reported_by": "IDENTITY:112",
                        "name": "Unified Name",
                        "type_id": 1002,
                        "value": "EC2AMAZ-ETKN6IA"
                    }
                ],
                "RiskScoreSum": 0,
                "Users": [
                    {
                        "first_seen_profiler": "2021-02-02T19:05:12.140000+00:00",
                        "id": 1009,
                        "last_seen_profiler": "2021-02-15T13:20:23.532000+00:00",
                        "username": "Administrator"
                    }
                ],
                "VulnerabilityCount": 0
            }
        ]
    }
}

Human Readable Output#

Assets List#
DomainID Hostnames ID Properties RiskScoreSum Users VulnerabilityCount
0 {'last_seen_profiler': '2021-02-15T13:20:23.530000+00:00', 'created': '2021-02-02T19:05:12.138000+00:00', 'name': 'HOST1233X11', 'id': 1007, 'type': 'NETBIOS', 'first_seen_profiler': '2021-02-02T19:05:12.138000+00:00'} 1007 {'last_reported': '2021-02-02T19:05:12.643000+00:00', 'name': 'Unified Name', 'type_id': 1002, 'id': 1006, 'last_reported_by': 'IDENTITY:112', 'value': 'HOST1233X11'} 0.0 {'last_seen_profiler': '2021-02-15T13:20:23.530000+00:00', 'id': 1007, 'first_seen_profiler': '2021-02-02T19:05:12.138000+00:00', 'username': 'Administrator'} 0
0 {'last_seen_profiler': '2021-02-15T13:20:23.532000+00:00', 'created': '2021-02-02T19:05:12.139000+00:00', 'name': '-', 'id': 1008, 'type': 'NETBIOS', 'first_seen_profiler': '2021-02-02T19:05:12.139000+00:00'} 1008 {'last_reported': '2021-02-02T19:05:12.645000+00:00', 'name': 'Unified Name', 'type_id': 1002, 'id': 1007, 'last_reported_by': 'IDENTITY:112', 'value': '-'} 0.0 {'last_seen_profiler': '2021-02-15T13:20:23.532000+00:00', 'id': 1008, 'first_seen_profiler': '2021-02-02T19:05:12.139000+00:00', 'username': 'DWM-3'} 0
0 {'last_seen_profiler': '2021-02-15T13:20:23.532000+00:00', 'created': '2021-02-02T19:05:12.140000+00:00', 'name': 'EC2AMAZ-ETKN6IA', 'id': 1009, 'type': 'NETBIOS', 'first_seen_profiler': '2021-02-02T19:05:12.140000+00:00'} 1009 {'last_reported': '2021-02-02T19:05:12.646000+00:00', 'name': 'Unified Name', 'type_id': 1002, 'id': 1008, 'last_reported_by': 'IDENTITY:112', 'value': 'EC2AMAZ-ETKN6IA'} 0.0 {'last_seen_profiler': '2021-02-15T13:20:23.532000+00:00', 'id': 1009, 'first_seen_profiler': '2021-02-02T19:05:12.140000+00:00', 'username': 'Administrator'} 0

Hostnames	ID	Properties	Users
{'last_seen_profiler': '2021-02-15T13:20:23.530000+00:00', 'created': '2021-02-02T19:05:12.138000+00:00', 'name': 'HOST1233X11', 'id': 1007, 'type': 'NETBIOS', 'first_seen_profiler': '2021-02-02T19:05:12.138000+00:00'}	1007	{'last_reported': '2021-02-02T19:05:12.643000+00:00', 'name': 'Unified Name', 'type_id': 1002, 'id': 1006, 'last_reported_by': 'IDENTITY:112', 'value': 'HOST1233X11'}	{'last_seen_profiler': '2021-02-15T13:20:23.530000+00:00', 'id': 1007, 'first_seen_profiler': '2021-02-02T19:05:12.138000+00:00', 'username': 'Administrator'}
{'last_seen_profiler': '2021-02-15T13:20:23.532000+00:00', 'created': '2021-02-02T19:05:12.139000+00:00', 'name': '-', 'id': 1008, 'type': 'NETBIOS', 'first_seen_profiler': '2021-02-02T19:05:12.139000+00:00'}	1008	{'last_reported': '2021-02-02T19:05:12.645000+00:00', 'name': 'Unified Name', 'type_id': 1002, 'id': 1007, 'last_reported_by': 'IDENTITY:112', 'value': '-'}	{'last_seen_profiler': '2021-02-15T13:20:23.532000+00:00', 'id': 1008, 'first_seen_profiler': '2021-02-02T19:05:12.139000+00:00', 'username': 'DWM-3'}
{'last_seen_profiler': '2021-02-15T13:20:23.532000+00:00', 'created': '2021-02-02T19:05:12.140000+00:00', 'name': 'EC2AMAZ-ETKN6IA', 'id': 1009, 'type': 'NETBIOS', 'first_seen_profiler': '2021-02-02T19:05:12.140000+00:00'}	1009	{'last_reported': '2021-02-02T19:05:12.646000+00:00', 'name': 'Unified Name', 'type_id': 1002, 'id': 1008, 'last_reported_by': 'IDENTITY:112', 'value': 'EC2AMAZ-ETKN6IA'}	{'last_seen_profiler': '2021-02-15T13:20:23.532000+00:00', 'id': 1009, 'first_seen_profiler': '2021-02-02T19:05:12.140000+00:00', 'username': 'Administrator'}

qradar-saved-searches-list#

Retrieves a list of Ariel saved searches.

Base Command#

qradar-saved-searches-list

Input#

Argument Name	Description	Required
saved_search_id	The saved search ID for which to retrieve its details. Specify saved_search_id to get details about a specific saved search.	Optional
timeout	Number of seconds until timeout for the specified command. Default is 35.	Optional
range	Range of results to return (e.g.: 0-20, 3-5, 3-3). Default is 0-49.	Optional
filter	Query by which to filter saved searches, e.g., "database=EVENTS and is_dashboard=true". For reference, see: https://www.ibm.com/support/knowledgecenter/SS42VS_SHR/com.ibm.qradarapi.doc/c_rest_api_filtering.html.	Optional
fields	Comma-separated list of fields to retrieve in the response. Fields that are not explicitly named are excluded. E.g., "id,owner,description". Specify subfields in brackets and multiple fields in the same object separated by commas. For a full list of available fields, see: https://www.ibm.com/support/knowledgecenter/SS42VS_SHR/com.ibm.qradarapi140.doc/14.0--ariel-saved_searches-GET.html.	Optional

Context Output#

Path	Type	Description
QRadar.SavedSearch.Owner	String	Owner of the saved search.
QRadar.SavedSearch.Description	String	Description of the saved search.
QRadar.SavedSearch.CreationDate	Date	Date when saved search was created.
QRadar.SavedSearch.UID	String	UID of the saved search.
QRadar.SavedSearch.Database	String	The database of the Ariel saved search, events, or flows.
QRadar.SavedSearch.QuickSearch	Boolean	Whether the saved search is a quick search.
QRadar.SavedSearch.Name	String	Name of the saved search.
QRadar.SavedSearch.ModifiedDate	Date	Date when the saved search was most recently modified.
QRadar.SavedSearch.ID	Number	ID of the saved search.
QRadar.SavedSearch.AQL	String	The AQL query.
QRadar.SavedSearch.IsShared	Boolean	Whether the saved search is shared with other users.

Command Example#

!qradar-saved-searches-list range=0-1

Context Example#

{
    "QRadar": {
        "SavedSearch": [
            {
                "AQL": "SELECT \"destinationPort\" AS 'Destination Port', UniqueCount(\"sourceIP\") AS 'Source IP (Unique Count)', UniqueCount(\"destinationIP\") AS 'Destination IP (Unique Count)', UniqueCount(qid) AS 'Event Name (Unique Count)', UniqueCount(logSourceId) AS 'Log Source (Unique Count)', UniqueCount(category) AS 'Low Level Category (Unique Count)', UniqueCount(\"protocolId\") AS 'Protocol (Unique Count)', UniqueCount(\"userName\") AS 'Username (Unique Count)', MAX(\"magnitude\") AS 'Magnitude (Maximum)', SUM(\"eventCount\") AS 'Event Count (Sum)', COUNT(*) AS 'Count' from events where ( (\"creEventList\"='100120') or (\"creEventList\"='100122') or (\"creEventList\"='100135') AND \"eventDirection\"='R2L' ) GROUP BY \"destinationPort\" order by \"Event Count (Sum)\" desc last 6 hours",
                "CreationDate": "2010-08-04T19:44:51.630000+00:00",
                "Database": "EVENTS",
                "Description": "",
                "ID": 2776,
                "IsShared": true,
                "ModifiedDate": "2020-10-18T19:39:16.160000+00:00",
                "Name": "Remote Recon and Scanning Activity by Destination Port",
                "Owner": "admin",
                "QuickSearch": true,
                "UID": "0d3cc801-52c3-4dbd-a43c-320cca195adc"
            },
            {
                "AQL": "SELECT \"flowBias\" AS 'Flow Bias', UniqueCount(\"sourceIP\") AS 'Source IP (Unique Count)', UniqueCount(\"destinationIP\") AS 'Destination IP (Unique Count)', UniqueCount(\"destinationPort\") AS 'Destination Port (Unique Count)', UniqueCount(APPLICATIONNAME(applicationid)) AS 'Application (Unique Count)', UniqueCount(\"protocolId\") AS 'Protocol (Unique Count)', SUM(\"sourceBytes\") AS 'Source Bytes (Sum)', SUM(\"destinationBytes\") AS 'Destination Bytes (Sum)', SUM((SourceBytes + DestinationBytes)) AS 'Total Bytes (Sum)', SUM(\"sourcePackets\") AS 'Source Packets (Sum)', SUM(\"destinationPackets\") AS 'Destination Packets (Sum)', SUM((SourcePackets + DestinationPackets)) AS 'Total Packets (Sum)', COUNT(*) AS 'Count' from flows where ( ( (\"flowDirection\"='L2R') or (\"flowDirection\"='R2L') or (\"flowDirection\"='R2R') AND \"endTime\">='1284540300000' ) AND \"endTime\"<='1284561900000' ) GROUP BY \"flowBias\" order by \"Total Bytes (Sum)\" desc last 6 hours",
                "CreationDate": "2010-07-22T17:33:06.761000+00:00",
                "Database": "FLOWS",
                "Description": "",
                "ID": 2792,
                "IsShared": true,
                "ModifiedDate": "2020-10-18T19:39:16.043000+00:00",
                "Name": "Flow Bias",
                "Owner": "admin",
                "QuickSearch": true,
                "UID": "0fe9b644-2660-4465-a2a5-ccaf7c167b1f"
            }
        ]
    }
}

Human Readable Output#

Saved Searches List#
ID Name ModifiedDate Owner AQL IsShared UID Database QuickSearch CreationDate
2776 Remote Recon and Scanning Activity by Destination Port 2020-10-18T19:39:16.160000+00:00 admin SELECT "destinationPort" AS 'Destination Port', UniqueCount("sourceIP") AS 'Source IP (Unique Count)', UniqueCount("destinationIP") AS 'Destination IP (Unique Count)', UniqueCount(qid) AS 'Event Name (Unique Count)', UniqueCount(logSourceId) AS 'Log Source (Unique Count)', UniqueCount(category) AS 'Low Level Category (Unique Count)', UniqueCount("protocolId") AS 'Protocol (Unique Count)', UniqueCount("userName") AS 'Username (Unique Count)', MAX("magnitude") AS 'Magnitude (Maximum)', SUM("eventCount") AS 'Event Count (Sum)', COUNT(*) AS 'Count' from events where ( ("creEventList"='100120') or ("creEventList"='100122') or ("creEventList"='100135') AND "eventDirection"='R2L' ) GROUP BY "destinationPort" order by "Event Count (Sum)" desc last 6 hours true 0d3cc801-52c3-4dbd-a43c-320cca195adc EVENTS true 2010-08-04T19:44:51.630000+00:00
2792 Flow Bias 2020-10-18T19:39:16.043000+00:00 admin SELECT "flowBias" AS 'Flow Bias', UniqueCount("sourceIP") AS 'Source IP (Unique Count)', UniqueCount("destinationIP") AS 'Destination IP (Unique Count)', UniqueCount("destinationPort") AS 'Destination Port (Unique Count)', UniqueCount(APPLICATIONNAME(applicationid)) AS 'Application (Unique Count)', UniqueCount("protocolId") AS 'Protocol (Unique Count)', SUM("sourceBytes") AS 'Source Bytes (Sum)', SUM("destinationBytes") AS 'Destination Bytes (Sum)', SUM((SourceBytes + DestinationBytes)) AS 'Total Bytes (Sum)', SUM("sourcePackets") AS 'Source Packets (Sum)', SUM("destinationPackets") AS 'Destination Packets (Sum)', SUM((SourcePackets + DestinationPackets)) AS 'Total Packets (Sum)', COUNT(*) AS 'Count' from flows where ( ( ("flowDirection"='L2R') or ("flowDirection"='R2L') or ("flowDirection"='R2R') AND "endTime">='1284540300000' ) AND "endTime"<='1284561900000' ) GROUP BY "flowBias" order by "Total Bytes (Sum)" desc last 6 hours true 0fe9b644-2660-4465-a2a5-ccaf7c167b1f FLOWS true 2010-07-22T17:33:06.761000+00:00

ID	Name	ModifiedDate	Owner	AQL	IsShared	UID	Database	QuickSearch	CreationDate
2776	Remote Recon and Scanning Activity by Destination Port	2020-10-18T19:39:16.160000+00:00	admin	SELECT "destinationPort" AS 'Destination Port', UniqueCount("sourceIP") AS 'Source IP (Unique Count)', UniqueCount("destinationIP") AS 'Destination IP (Unique Count)', UniqueCount(qid) AS 'Event Name (Unique Count)', UniqueCount(logSourceId) AS 'Log Source (Unique Count)', UniqueCount(category) AS 'Low Level Category (Unique Count)', UniqueCount("protocolId") AS 'Protocol (Unique Count)', UniqueCount("userName") AS 'Username (Unique Count)', MAX("magnitude") AS 'Magnitude (Maximum)', SUM("eventCount") AS 'Event Count (Sum)', COUNT(*) AS 'Count' from events where ( ("creEventList"='100120') or ("creEventList"='100122') or ("creEventList"='100135') AND "eventDirection"='R2L' ) GROUP BY "destinationPort" order by "Event Count (Sum)" desc last 6 hours	true	0d3cc801-52c3-4dbd-a43c-320cca195adc	EVENTS	true	2010-08-04T19:44:51.630000+00:00
2792	Flow Bias	2020-10-18T19:39:16.043000+00:00	admin	SELECT "flowBias" AS 'Flow Bias', UniqueCount("sourceIP") AS 'Source IP (Unique Count)', UniqueCount("destinationIP") AS 'Destination IP (Unique Count)', UniqueCount("destinationPort") AS 'Destination Port (Unique Count)', UniqueCount(APPLICATIONNAME(applicationid)) AS 'Application (Unique Count)', UniqueCount("protocolId") AS 'Protocol (Unique Count)', SUM("sourceBytes") AS 'Source Bytes (Sum)', SUM("destinationBytes") AS 'Destination Bytes (Sum)', SUM((SourceBytes + DestinationBytes)) AS 'Total Bytes (Sum)', SUM("sourcePackets") AS 'Source Packets (Sum)', SUM("destinationPackets") AS 'Destination Packets (Sum)', SUM((SourcePackets + DestinationPackets)) AS 'Total Packets (Sum)', COUNT(*) AS 'Count' from flows where ( ( ("flowDirection"='L2R') or ("flowDirection"='R2L') or ("flowDirection"='R2R') AND "endTime">='1284540300000' ) AND "endTime"<='1284561900000' ) GROUP BY "flowBias" order by "Total Bytes (Sum)" desc last 6 hours	true	0fe9b644-2660-4465-a2a5-ccaf7c167b1f	FLOWS	true	2010-07-22T17:33:06.761000+00:00

qradar-searches-list#

Retrieves the list of Ariel searches IDs. Search status and results can be polled by sending the search ID to the 'qradar-search-status-get' and 'qradar-search-results-get' commands.

Base Command#

qradar-searches-list

Input#

Argument Name	Description	Required
range	Range of results to return (e.g.: 0-20, 3-5, 3-3). Default is 0-49.	Optional

Context Output#

Path	Type	Description
QRadar.SearchID.SearchID	String	ID of the search.

Command Example#

!qradar-searches-list

Context Example#

{
    "QRadar": {
        "SearchID": [
            {
                "SearchID": "a0dc7945-9e5b-4637-b4b9-024844a9d209"
            },
            {
                "SearchID": "8081d060-9ee0-4d03-810c-d730ffb885be"
            },
            {
                "SearchID": "37e58ffa-8e4d-48eb-b9d3-c4ff673b99e3"
            },
            {
                "SearchID": "8c5517d0-b37f-45f7-b2e0-5b496d644991"
            },
            {
                "SearchID": "63710473-4a8a-4d2e-b346-9cac9db59ab7"
            },
            {
                "SearchID": "c39e4674-97c3-4123-b439-934f6ac7b5fd"
            },
            {
                "SearchID": "3753e94a-1b3b-4fc6-b923-ec0d04769f2b"
            },
            {
                "SearchID": "b01c9d11-02d0-4693-8df9-70883d6c9b65"
            },
            {
                "SearchID": "10120fba-56f5-4c5c-ab55-cb79bb9890d2"
            },
            {
                "SearchID": "4ef25d6f-e19a-4bef-9a29-dfd5d29aaeae"
            },
            {
                "SearchID": "94f4fecb-114a-41d5-a636-c1bcec09e9ca"
            },
            {
                "SearchID": "0044ffa4-850f-47ed-b79c-1ac298a8a4e3"
            },
            {
                "SearchID": "4e2e81e2-9565-444f-8e06-5aecc0cb156c"
            },
            {
                "SearchID": "2768aca6-52ff-45a0-8343-7470afe1ec54"
            },
            {
                "SearchID": "20b09e0a-1df1-452b-8284-49cc66ea6b32"
            },
            {
                "SearchID": "8c0b8293-7257-450d-92fd-f8701dbde9f3"
            },
            {
                "SearchID": "52bcd78c-cf23-4ad9-beba-aac80e7880da"
            },
            {
                "SearchID": "814b79c1-515a-4a54-90d7-cb0c5a7920c1"
            },
            {
                "SearchID": "f19a88bb-2da7-40d2-8f26-77eac3f84e7d"
            },
            {
                "SearchID": "14478391-2a3c-45f1-910e-3373addd7efe"
            },
            {
                "SearchID": "98176f19-0a4c-454a-8275-ba72f9ffcc0f"
            },
            {
                "SearchID": "12a7d8f0-851d-4b85-9246-c9b0f9239b96"
            },
            {
                "SearchID": "b301b7a3-a524-4870-ac9c-471b907055e6"
            },
            {
                "SearchID": "681c44d1-962c-4fcd-9b7a-53873741e658"
            },
            {
                "SearchID": "800b8bd4-fa8f-48b3-ad6c-3343e65c6613"
            },
            {
                "SearchID": "9322aa46-e30e-41d8-8df6-640fe8a8386b"
            },
            {
                "SearchID": "254c810b-7e29-4e39-b49d-ab4c07bbe4f4"
            },
            {
                "SearchID": "d3190c66-ed5e-4fca-99f8-50a95f498739"
            },
            {
                "SearchID": "f04eabee-aebd-4a46-b76c-dceb80d022ee"
            },
            {
                "SearchID": "6b97b870-f65f-47b0-8179-8d63eb38b3e9"
            },
            {
                "SearchID": "b836df2c-b963-4bb9-9373-7d1bc8b8cdfe"
            },
            {
                "SearchID": "1e4124e6-39a7-42c8-a4db-460aa8304fbd"
            },
            {
                "SearchID": "fa98cf29-1356-48c1-9b3d-36d9bd6cbf34"
            },
            {
                "SearchID": "fd0f3871-1737-4148-93c9-29b11acf57d4"
            },
            {
                "SearchID": "dac2ae5a-26c6-4242-8743-978e20d07325"
            },
            {
                "SearchID": "1fc95e9b-1779-4a2f-a06a-70781b2e0575"
            },
            {
                "SearchID": "94bc9927-4eab-4709-a3e4-df844205d669"
            },
            {
                "SearchID": "df7e25af-a602-42c1-b917-123718d187a2"
            },
            {
                "SearchID": "dece365c-a76b-4774-bd8b-668907a28d27"
            },
            {
                "SearchID": "fc37e5a1-2ea1-4e68-8b71-968f7df91aef"
            },
            {
                "SearchID": "1d021ac3-8e64-4094-99f6-d7db0d04a59a"
            },
            {
                "SearchID": "df9a8e6a-1c9e-4274-9af5-ae09dfc1b7c0"
            },
            {
                "SearchID": "2476a797-ff1b-41c4-9b03-898f1cb4802a"
            },
            {
                "SearchID": "4dfd311b-7190-43b5-9fc1-60bb5382b670"
            },
            {
                "SearchID": "bbde3030-465f-4528-be91-ad69393064fa"
            },
            {
                "SearchID": "678c257f-a3ad-4341-9192-ad6346ea899e"
            },
            {
                "SearchID": "ca6ccbeb-b9fb-4f4a-bdec-ae1323da5d41"
            },
            {
                "SearchID": "9aa18e0a-73b5-4ae7-9cb5-1d40dc9ace7c"
            },
            {
                "SearchID": "dc27202b-5484-41d6-b095-bd9a31b852e3"
            },
            {
                "SearchID": "484a28cf-a984-4e3a-9fd4-0c8f490c7e23"
            }
        ]
    }
}

Human Readable Output#

Search ID List#
SearchID
a0dc7945-9e5b-4637-b4b9-024844a9d209
8081d060-9ee0-4d03-810c-d730ffb885be
37e58ffa-8e4d-48eb-b9d3-c4ff673b99e3
8c5517d0-b37f-45f7-b2e0-5b496d644991
63710473-4a8a-4d2e-b346-9cac9db59ab7
c39e4674-97c3-4123-b439-934f6ac7b5fd
3753e94a-1b3b-4fc6-b923-ec0d04769f2b
b01c9d11-02d0-4693-8df9-70883d6c9b65
10120fba-56f5-4c5c-ab55-cb79bb9890d2
4ef25d6f-e19a-4bef-9a29-dfd5d29aaeae
94f4fecb-114a-41d5-a636-c1bcec09e9ca
0044ffa4-850f-47ed-b79c-1ac298a8a4e3
4e2e81e2-9565-444f-8e06-5aecc0cb156c
2768aca6-52ff-45a0-8343-7470afe1ec54
20b09e0a-1df1-452b-8284-49cc66ea6b32
8c0b8293-7257-450d-92fd-f8701dbde9f3
52bcd78c-cf23-4ad9-beba-aac80e7880da
814b79c1-515a-4a54-90d7-cb0c5a7920c1
f19a88bb-2da7-40d2-8f26-77eac3f84e7d
14478391-2a3c-45f1-910e-3373addd7efe
98176f19-0a4c-454a-8275-ba72f9ffcc0f
12a7d8f0-851d-4b85-9246-c9b0f9239b96
b301b7a3-a524-4870-ac9c-471b907055e6
681c44d1-962c-4fcd-9b7a-53873741e658
800b8bd4-fa8f-48b3-ad6c-3343e65c6613
9322aa46-e30e-41d8-8df6-640fe8a8386b
254c810b-7e29-4e39-b49d-ab4c07bbe4f4
d3190c66-ed5e-4fca-99f8-50a95f498739
f04eabee-aebd-4a46-b76c-dceb80d022ee
6b97b870-f65f-47b0-8179-8d63eb38b3e9
b836df2c-b963-4bb9-9373-7d1bc8b8cdfe
1e4124e6-39a7-42c8-a4db-460aa8304fbd
fa98cf29-1356-48c1-9b3d-36d9bd6cbf34
fd0f3871-1737-4148-93c9-29b11acf57d4
dac2ae5a-26c6-4242-8743-978e20d07325
1fc95e9b-1779-4a2f-a06a-70781b2e0575
94bc9927-4eab-4709-a3e4-df844205d669
df7e25af-a602-42c1-b917-123718d187a2
dece365c-a76b-4774-bd8b-668907a28d27
fc37e5a1-2ea1-4e68-8b71-968f7df91aef
1d021ac3-8e64-4094-99f6-d7db0d04a59a
df9a8e6a-1c9e-4274-9af5-ae09dfc1b7c0
2476a797-ff1b-41c4-9b03-898f1cb4802a
4dfd311b-7190-43b5-9fc1-60bb5382b670
bbde3030-465f-4528-be91-ad69393064fa
678c257f-a3ad-4341-9192-ad6346ea899e
ca6ccbeb-b9fb-4f4a-bdec-ae1323da5d41
9aa18e0a-73b5-4ae7-9cb5-1d40dc9ace7c
dc27202b-5484-41d6-b095-bd9a31b852e3
484a28cf-a984-4e3a-9fd4-0c8f490c7e23

SearchID
a0dc7945-9e5b-4637-b4b9-024844a9d209
8081d060-9ee0-4d03-810c-d730ffb885be
37e58ffa-8e4d-48eb-b9d3-c4ff673b99e3
8c5517d0-b37f-45f7-b2e0-5b496d644991
63710473-4a8a-4d2e-b346-9cac9db59ab7
c39e4674-97c3-4123-b439-934f6ac7b5fd
3753e94a-1b3b-4fc6-b923-ec0d04769f2b
b01c9d11-02d0-4693-8df9-70883d6c9b65
10120fba-56f5-4c5c-ab55-cb79bb9890d2
4ef25d6f-e19a-4bef-9a29-dfd5d29aaeae
94f4fecb-114a-41d5-a636-c1bcec09e9ca
0044ffa4-850f-47ed-b79c-1ac298a8a4e3
4e2e81e2-9565-444f-8e06-5aecc0cb156c
2768aca6-52ff-45a0-8343-7470afe1ec54
20b09e0a-1df1-452b-8284-49cc66ea6b32
8c0b8293-7257-450d-92fd-f8701dbde9f3
52bcd78c-cf23-4ad9-beba-aac80e7880da
814b79c1-515a-4a54-90d7-cb0c5a7920c1
f19a88bb-2da7-40d2-8f26-77eac3f84e7d
14478391-2a3c-45f1-910e-3373addd7efe
98176f19-0a4c-454a-8275-ba72f9ffcc0f
12a7d8f0-851d-4b85-9246-c9b0f9239b96
b301b7a3-a524-4870-ac9c-471b907055e6
681c44d1-962c-4fcd-9b7a-53873741e658
800b8bd4-fa8f-48b3-ad6c-3343e65c6613
9322aa46-e30e-41d8-8df6-640fe8a8386b
254c810b-7e29-4e39-b49d-ab4c07bbe4f4
d3190c66-ed5e-4fca-99f8-50a95f498739
f04eabee-aebd-4a46-b76c-dceb80d022ee
6b97b870-f65f-47b0-8179-8d63eb38b3e9
b836df2c-b963-4bb9-9373-7d1bc8b8cdfe
1e4124e6-39a7-42c8-a4db-460aa8304fbd
fa98cf29-1356-48c1-9b3d-36d9bd6cbf34
fd0f3871-1737-4148-93c9-29b11acf57d4
dac2ae5a-26c6-4242-8743-978e20d07325
1fc95e9b-1779-4a2f-a06a-70781b2e0575
94bc9927-4eab-4709-a3e4-df844205d669
df7e25af-a602-42c1-b917-123718d187a2
dece365c-a76b-4774-bd8b-668907a28d27
fc37e5a1-2ea1-4e68-8b71-968f7df91aef
1d021ac3-8e64-4094-99f6-d7db0d04a59a
df9a8e6a-1c9e-4274-9af5-ae09dfc1b7c0
2476a797-ff1b-41c4-9b03-898f1cb4802a
4dfd311b-7190-43b5-9fc1-60bb5382b670
bbde3030-465f-4528-be91-ad69393064fa
678c257f-a3ad-4341-9192-ad6346ea899e
ca6ccbeb-b9fb-4f4a-bdec-ae1323da5d41
9aa18e0a-73b5-4ae7-9cb5-1d40dc9ace7c
dc27202b-5484-41d6-b095-bd9a31b852e3
484a28cf-a984-4e3a-9fd4-0c8f490c7e23

qradar-search-create#

Creates a new asynchronous Ariel search. Returns the search ID. Search status and results can be polled by sending the search ID to the 'qradar-search-status-get' and 'qradar-search-results-get' commands. Accepts SELECT query expressions only.

Base Command#

qradar-search-create

Input#

Argument Name	Description	Required
query_expression	The AQL query to execute. Mutually exclusive with saved_search_id.	Optional
saved_search_id	Saved search ID to execute. Mutually exclusive with query_expression. Saved search ID is the 'id' field returned by the 'qradar-saved-searches-list' command.	Optional

Context Output#

Path	Type	Description
QRadar.Search.Status	String	Status of the newly created search.
QRadar.Search.ID	String	ID of the newly created search.

Command Example#

!qradar-search-create query_expression="""SELECT "destinationPort" AS 'Destination Port', UniqueCount("sourceIP") AS 'Source IP (Unique Count)', UniqueCount("destinationIP") AS 'Destination IP (Unique Count)', UniqueCount(qid) AS 'Event Name (Unique Count)', UniqueCount(logSourceId) AS 'Log Source (Unique Count)', UniqueCount(category) AS 'Low Level Category (Unique Count)', UniqueCount("protocolId") AS 'Protocol (Unique Count)', UniqueCount("userName") AS 'Username (Unique Count)', MAX("magnitude") AS 'Magnitude (Maximum)', SUM("eventCount") AS 'Event Count (Sum)', COUNT(*) AS 'Count' from events where ( ("creEventList"='100120') or ("creEventList"='100122') or ("creEventList"='100135') AND "eventDirection"='R2L' ) GROUP BY "destinationPort" order by "Event Count (Sum)" desc last 6 hours"""

Context Example#

{
    "QRadar": {
        "Search": {
            "ID": "a1ecef62-5d18-4a84-ba1d-b6c2645e419b",
            "Status": "WAIT"
        }
    }
}

Human Readable Output#

Create Search#
ID Status
a1ecef62-5d18-4a84-ba1d-b6c2645e419b WAIT

ID	Status
a1ecef62-5d18-4a84-ba1d-b6c2645e419b	WAIT

qradar-search-status-get#

Retrieves status information for a search, based on the search ID.

Base Command#

qradar-search-status-get

Input#

Argument Name	Description	Required
search_id	The identifier for an Ariel search.	Required

Context Output#

Path	Type	Description
QRadar.Search.Status	String	Status of the search.
QRadar.Search.ID	String	ID of the search.

Command Example#

!qradar-search-status-get search_id=e69df023-fff8-4d8c-a3b3-04d2b4b4af8a

Context Example#

{
    "QRadar": {
        "Search": {
            "ID": "e69df023-fff8-4d8c-a3b3-04d2b4b4af8a",
            "Status": "COMPLETED"
        }
    }
}

Human Readable Output#

Search Status For Search ID e69df023-fff8-4d8c-a3b3-04d2b4b4af8a#
ID Status
e69df023-fff8-4d8c-a3b3-04d2b4b4af8a COMPLETED

ID	Status
e69df023-fff8-4d8c-a3b3-04d2b4b4af8a	COMPLETED

qradar-search-results-get#

Retrieves search results.

Base Command#

qradar-search-results-get

Input#

Argument Name	Description	Required
search_id	The identifier for an Ariel search.	Required
output_path	Replaces the default context output path for the query result (QRadar.Search.Result). E.g., for output_path=QRadar.Correlations, the result will be under the 'QRadar.Correlations' key in the context data.	Optional
range	Range of events to return. (e.g.: 0-20, 3-5, 3-3). Default is 0-49.	Optional

Context Output#

Path	Type	Description
QRadar.Search.Result	Unknown	The result of the search.

Command Example#

!qradar-search-results-get search_id=e69df023-fff8-4d8c-a3b3-04d2b4b4af8a range=0-3

Context Example#

{
    "QRadar": {
        "SearchResult": [
        {
            "Destination Port": 5123,
            "Source IP (Unique Count)": 1.0,
            "Destination IP (Unique Count)": 1.0,
            "Event Name (Unique Count)": 1.0,
            "Log Source (Unique Count)": 1.0,
            "Low Level Category (Unique Count)": 1.0,
            "Protocol (Unique Count)": 1.0,
            "Username (Unique Count)": 0.0,
            "Magnitude (Maximum)": 9.0,
            "Event Count (Sum)": 3.0,
            "Count": 3.0
        },
        {
            "Destination Port": 52310,
            "Source IP (Unique Count)": 1.0,
            "Destination IP (Unique Count)": 1.0,
            "Event Name (Unique Count)": 1.0,
            "Log Source (Unique Count)": 1.0,
            "Low Level Category (Unique Count)": 1.0,
            "Protocol (Unique Count)": 1.0,
            "Username (Unique Count)": 0.0,
            "Magnitude (Maximum)": 9.0,
            "Event Count (Sum)": 1.0,
            "Count": 1.0
        },
        {
            "Destination Port": 54131,
            "Source IP (Unique Count)": 1.0,
            "Destination IP (Unique Count)": 1.0,
            "Event Name (Unique Count)": 1.0,
            "Log Source (Unique Count)": 1.0,
            "Low Level Category (Unique Count)": 1.0,
            "Protocol (Unique Count)": 1.0,
            "Username (Unique Count)": 0.0,
            "Magnitude (Maximum)": 9.0,
            "Event Count (Sum)": 1.0,
            "Count": 1.0
        },
        {
            "Destination Port": 51263,
            "Source IP (Unique Count)": 1.0,
            "Destination IP (Unique Count)": 1.0,
            "Event Name (Unique Count)": 1.0,
            "Log Source (Unique Count)": 1.0,
            "Low Level Category (Unique Count)": 1.0,
            "Protocol (Unique Count)": 1.0,
            "Username (Unique Count)": 0.0,
            "Magnitude (Maximum)": 9.0,
            "Event Count (Sum)": 1.0,
            "Count": 1.0
        }
        ]
    }
}

Human Readable Output#

Search Results For Search ID e69df023-fff8-4d8c-a3b3-04d2b4b4af8a#
Count Destination IP (Unique Count) Destination Port Event Count (Sum) Event Name (Unique Count) Log Source (Unique Count) Low Level Category (Unique Count) Magnitude (Maximum) Protocol (Unique Count) Source IP (Unique Count) Username (Unique Count)
3.0 1.0 5123 3.0 1.0 1.0 1.0 9.0 1.0 1.0 0.0
1.0 1.0 52310 1.0 1.0 1.0 1.0 9.0 1.0 1.0 0.0
1.0 1.0 54131 1.0 1.0 1.0 1.0 9.0 1.0 1.0 0.0
1.0 1.0 51263 1.0 1.0 1.0 1.0 9.0 1.0 1.0 0.0

Count	Destination IP (Unique Count)	Destination Port	Event Count (Sum)	Event Name (Unique Count)	Log Source (Unique Count)	Low Level Category (Unique Count)	Magnitude (Maximum)	Protocol (Unique Count)	Source IP (Unique Count)
3.0	1.0	5123	3.0	1.0	1.0	1.0	9.0	1.0	1.0
1.0	1.0	52310	1.0	1.0	1.0	1.0	9.0	1.0	1.0
1.0	1.0	54131	1.0	1.0	1.0	1.0	9.0	1.0	1.0
1.0	1.0	51263	1.0	1.0	1.0	1.0	9.0	1.0	1.0

qradar-reference-sets-list#

Retrieves a list of reference sets.

Base Command#

qradar-reference-sets-list

Input#

Argument Name	Description	Required
ref_name	The reference name of the reference set for which to retrieve its details. Specify ref_name to get details about a specific reference set.	Optional
date_value	If set to true will try to convert the data values to ISO-8601 string. Possible values are: True, False. Default is False.	Optional
range	Range of results to return (e.g.: 0-20, 3-5, 3-3). Default is 0-49.	Optional
filter	Query by which to filter reference sets, e.g., "timeout_type=FIRST_SEEN". For reference, see: https://www.ibm.com/support/knowledgecenter/SS42VS_SHR/com.ibm.qradarapi.doc/c_rest_api_filtering.html.	Optional
fields	Comma-separated list of fields to retrieve in the response. Fields that are not explicitly named are excluded. E.g., "name,timeout_type". Specify subfields in brackets and multiple fields in the same object separated by commas. For a full list of available fields, see: https://www.ibm.com/support/knowledgecenter/SS42VS_SHR/com.ibm.qradarapi140.doc/14.0--reference_data-sets-GET.html.	Optional

Context Output#

Path	Type	Description
QRadar.Reference.TimeoutType	String	Timeout type of the reference set. Possible values: "UNKNOWN", "FIRST_SEEN", "LAST_SEEN".
QRadar.Reference.NumberOfElements	Number	Number of elements in the reference set.
QRadar.Reference.TimeToLive	String	Time left to live for the reference.
QRadar.Reference.Data.LastSeen	Date	Date when this data was last seen.
QRadar.Reference.Data.FirstSeen	Date	Date when this data was first seen.
QRadar.Reference.Data.Source	String	Source of this data.
QRadar.Reference.Data.Value	String	Data value.
QRadar.Reference.CreationTime	Date	Date when the reference set was created.
QRadar.Reference.Name	String	Name of the reference set.
QRadar.Reference.ElementType	String	Type of the elements in the reference set.

Command Example#

!qradar-reference-sets-list filter="timeout_type=FIRST_SEEN"

Context Example#

{
    "QRadar": {
        "Reference": [
            {
                "CreationTime": "2015-08-27T19:29:30.114000+00:00",
                "ElementType": "IP",
                "Name": "Mail Servers",
                "NumberOfElements": 8,
                "TimeoutType": "FIRST_SEEN"
            },
            {
                "CreationTime": "2015-08-27T19:30:46.455000+00:00",
                "ElementType": "IP",
                "Name": "Web Servers",
                "NumberOfElements": 0,
                "TimeoutType": "FIRST_SEEN"
            },
            {
                "CreationTime": "2015-08-27T19:28:55.265000+00:00",
                "ElementType": "IP",
                "Name": "DNS Servers",
                "NumberOfElements": 0,
                "TimeoutType": "FIRST_SEEN"
            }
        ]
    }
}

Human Readable Output#

Reference Sets List#
Name ElementType TimeToLive TimeoutType NumberOfElements CreationTime
Mail Servers IP FIRST_SEEN 8 2015-08-27T19:29:30.114000+00:00
Web Servers IP FIRST_SEEN 0 2015-08-27T19:30:46.455000+00:00
DNS Servers IP FIRST_SEEN 0 2015-08-27T19:28:55.265000+00:00

Name	ElementType	TimeoutType	NumberOfElements	CreationTime
Mail Servers	IP	FIRST_SEEN	8	2015-08-27T19:29:30.114000+00:00
Web Servers	IP	FIRST_SEEN	0	2015-08-27T19:30:46.455000+00:00
DNS Servers	IP	FIRST_SEEN	0	2015-08-27T19:28:55.265000+00:00

qradar-reference-set-create#

Creates a new reference set.

Base Command#

qradar-reference-set-create

Input#

Argument Name	Description	Required
ref_name	The name of the reference set to be created. Reference names can be found by 'Name' field in 'qradar-reference-sets-list' command.	Required
element_type	The element type for the values allowed in the reference set. Possible values are: ALN, ALNIC, NUM, IP, PORT, DATE.	Required
timeout_type	Indicates if the time_to_live interval is based on when the data was first seen or last seen. Possible values are: FIRST_SEEN, LAST_SEEN, UNKNOWN. Default is UNKNOWN.	Optional
time_to_live	The time to live interval, time range. for example: '1 month' or '5 minutes'.	Optional
fields	Comma-separated list of fields to retrieve in the response. Fields that are not explicitly named are excluded. E.g., "name,timeout_type". Specify subfields in brackets and multiple fields in the same object separated by commas. For a full list of available fields, see: https://www.ibm.com/support/knowledgecenter/SS42VS_SHR/com.ibm.qradarapi140.doc/14.0--reference_data-sets-POST.html.	Optional

Context Output#

Path	Type	Description
QRadar.Reference.TimeoutType	String	Timeout type of the reference set. Possible values: "UNKNOWN", "FIRST_SEEN", "LAST_SEEN".
QRadar.Reference.NumberOfElements	Number	Number of elements in the reference set.
QRadar.Reference.TimeToLive	String	Time left to live for the reference.
QRadar.Reference.Data.LastSeen	Date	Date when this data was last seen.
QRadar.Reference.Data.FirstSeen	Date	Date when this data was first seen.
QRadar.Reference.Data.Source	String	Source of this data.
QRadar.Reference.Data.Value	String	Data value.
QRadar.Reference.CreationTime	Date	Date when the reference set was created.
QRadar.Reference.Name	String	Name of the reference set.
QRadar.Reference.ElementType	String	Type of the elements in the reference set.

Command Example#

!qradar-reference-set-create element_type=IP ref_name="Malicious IPs" time_to_live="1 year" timeout_type=FIRST_SEEN

Context Example#

{
    "QRadar": {
        "Reference": {
            "CreationTime": "2021-03-03T08:36:41.077000+00:00",
            "ElementType": "IP",
            "Name": "Malicious IPs",
            "NumberOfElements": 0,
            "TimeToLive": "1 years 0 mons 0 days 0 hours 0 mins 0.00 secs",
            "TimeoutType": "FIRST_SEEN"
        }
    }
}

Human Readable Output#

Reference Set Create#
Name ElementType TimeToLive TimeoutType NumberOfElements CreationTime
Malicious IPs IP 1 years 0 mons 0 days 0 hours 0 mins 0.00 secs FIRST_SEEN 0 2021-03-03T08:36:41.077000+00:00

Name	ElementType	TimeToLive	TimeoutType	NumberOfElements	CreationTime
Malicious IPs	IP	1 years 0 mons 0 days 0 hours 0 mins 0.00 secs	FIRST_SEEN	0	2021-03-03T08:36:41.077000+00:00

qradar-reference-set-delete#

Removes a reference set or purges its contents.

Base Command#

qradar-reference-set-delete

Input#

Argument Name	Description	Required
ref_name	The name of the reference set to be deleted. Reference names can be found by 'Name' field in 'qradar-reference-sets-list' command.	Required
purge_only	Indicates if the reference set should have its contents purged (true), keeping the reference set structure. If the value is 'false', or not specified the reference set is removed completely. Possible values are: true, false. Default is false.	Optional

Context Output#

There is no context output for this command.

Command Example#

!qradar-reference-set-delete ref_name="Malicious IPs"

Human Readable Output#

Reference Malicious IPs Was Asked To Be Deleted. Current Deletion Status: QUEUED#

qradar-reference-set-value-upsert#

Adds or updates an element in a reference set.

Base Command#

qradar-reference-set-value-upsert

Input#

Argument Name	Description	Required
ref_name	The name of the reference set to add or update an element in. Reference names can be found by the 'Name' field in the 'qradar-reference-sets-list' command.	Required
value	Comma-separated list of the values to add or update in the reference set. If the values are dates, the supported date formats are: epoch, ISO, and time range (<number> <time unit>', e.g., 12 hours, 7 days.).	Required
source	An indication of where the data originated. Default is reference data api.	Optional
date_value	True if the specified value type was date. Possible values are: true, false.	Optional
fields	Comma-separated list of fields to retrieve in the response. Fields that are not explicitly named are excluded. E.g., "name,timeout_type". Specify subfields in brackets and multiple fields in the same object separated by commas. For a full list of available fields, see: https://www.ibm.com/support/knowledgecenter/SS42VS_SHR/com.ibm.qradarapi140.doc/14.0--reference_data-sets-name-POST.html.	Optional

Context Output#

Path	Type	Description
QRadar.Reference.TimeoutType	String	Timeout type of the reference set. Possible values: "UNKNOWN", "FIRST_SEEN", "LAST_SEEN".
QRadar.Reference.NumberOfElements	Number	Number of elements in the reference set.
QRadar.Reference.TimeToLive	String	Time left to live for the reference.
QRadar.Reference.Data.LastSeen	Date	Date when this data was last seen.
QRadar.Reference.Data.FirstSeen	Date	Date when this data was first seen.
QRadar.Reference.Data.Source	String	Source of this data.
QRadar.Reference.Data.Value	String	Data value.
QRadar.Reference.CreationTime	Date	Date when the reference set was created.
QRadar.Reference.Name	String	Name of the reference set.
QRadar.Reference.ElementType	String	Type of the elements in the reference set.

Command Example#

!qradar-reference-set-value-upsert ref_name="Malicious IPs" value="1.2.3.4,1.2.3.5,192.168.1.3"

Context Example#

{
    "QRadar": {
        "Reference": {
            "CreationTime": "2021-03-03T08:36:41.077000+00:00",
            "ElementType": "IP",
            "Name": "Malicious IPs",
            "NumberOfElements": 3,
            "TimeToLive": "1 years 0 mons 0 days 0 hours 0 mins 0.00 secs",
            "TimeoutType": "FIRST_SEEN"
        }
    }
}

Human Readable Output#

Reference Update Create#
Name ElementType TimeToLive TimeoutType NumberOfElements CreationTime
Malicious IPs IP 1 years 0 mons 0 days 0 hours 0 mins 0.00 secs FIRST_SEEN 3 2021-03-03T08:36:41.077000+00:00

qradar-reference-set-value-delete#

Removes a value from a reference set.

Base Command#

qradar-reference-set-value-delete

Input#

Argument Name	Description	Required
ref_name	The name of the reference set from which to remove a value. Reference names can be found by the 'Name' field in the 'qradar-reference-sets-list' command.	Required
value	The value to remove from the reference set. If the specified value is date, the supported date formats are: epoch, ISO, and time range (<number> <time unit>, e.g., 12 hours, 7 days.).	Required
date_value	True if the specified value type was date. Possible values are: True, False.	Optional

Context Output#

There is no context output for this command.

Command Example#

!qradar-reference-set-value-delete ref_name="Malicious IPs" value="1.2.3.4"

Human Readable Output#

value: 1.2.3.4 of reference: Malicious IPs was deleted successfully#

qradar-domains-list#

Gets the list of domains. You must have System Administrator or Security Administrator permissions to call this endpoint if you are trying to retrieve the details of all domains. You can retrieve details of domains that are assigned to your Security Profile without having the System Administrator or Security Administrator permissions. If you do not have the System Administrator or Security Administrator permissions, then for each domain assigned to your security profile you can only view the values for the ID and name fields. All other values return null.

Base Command#

qradar-domains-list

Input#

Argument Name	Description	Required
domain_id	The domain ID from which to retrieve its details. Specify domain_id to get details about a specific domain.	Optional
range	Range of results to return (e.g.: 0-20, 3-5, 3-3). Default is 0-49.	Optional
filter	Query by which to filter domains, e.g., "id > 3". For reference, see: https://www.ibm.com/support/knowledgecenter/SS42VS_SHR/com.ibm.qradarapi.doc/c_rest_api_filtering.html.	Optional
fields	Comma-separated list of fields to retrieve in the response. Fields that are not explicitly named are excluded. E.g., "id,name". Specify subfields in brackets and multiple fields in the same object separated by commas. For a full list of available fields, see: https://www.ibm.com/support/knowledgecenter/SS42VS_SHR/com.ibm.qradarapi140.doc/14.0--config-domain_management-domains-GET.html.	Optional

Context Output#

Path	Type	Description
QRadar.Domains.AssetScannerIDs	Number	Asset scanner IDs that are associated with the domain.
QRadar.Domains.CustomProperties	Unknown	Custom properties of the domain.
QRadar.Domains.Deleted	Boolean	Whether the domain has been deleted.
QRadar.Domains.Description	String	Description of the domain.
QRadar.Domains.EventCollectorIDs	Number	Event collector IDs that are assigned to this domain.
QRadar.Domains.FlowCollectorIDs	Number	Flow collector IDs that are assigned to this domain.
QRadar.Domains.FlowSourceIDs	Number	Flow source IDs that are assigned to this domain.
QRadar.Domains.ID	Number	ID of the domain.
QRadar.Domains.LogSourceGroupIDs	Number	Log source group IDs that are assigned to this domain.
QRadar.Domains.LogSourceIDs	Number	Log source IDs that are assigned to this domain.
QRadar.Domains.Name	String	Name of the domain.
QRadar.Domains.QVMScannerIDs	Number	QVM scanner IDs that are assigned to this domain.
QRadar.Domains.TenantID	Number	ID of the tenant that this domain belongs to.

Command Example#

!qradar-domains-list

Context Example#

{
    "QRadar": {
        "Domains": {
            "Deleted": false,
            "Description": "",
            "ID": 0,
            "Name": "",
            "TenantID": 0
        }
    }
}

Human Readable Output#

Domains List#
Deleted ID TenantID
false 0 0

qradar-indicators-upload#

Uploads indicators to QRadar.

Base Command#

qradar-indicators-upload

Input#

Argument Name	Description	Required
ref_name	The name of set to add or update data in. Reference names can be found by the 'Name' field in the 'qradar-reference-sets-list' command.	Required
query	The query for getting indicators from Cortex XSOAR.	Optional
limit	The maximum number of indicators to fetch from Cortex XSOAR. Default is 50.	Optional
page	The page from which to get the indicators.	Optional
fields	Comma-separated list of fields to retrieve in the response. Fields that are not explicitly named are excluded. E.g., "name,timeout_type". Specify subfields in brackets and multiple fields in the same object separated by commas. For a full list of available fields, see: https://www.ibm.com/support/knowledgecenter/SS42VS_SHR/com.ibm.qradarapi140.doc/14.0--reference_data-maps-bulk_load-name-POST.html.	Optional

Context Output#

Path	Type	Description
QRadar.Reference.TimeoutType	String	Timeout type of the reference set. Possible values: "UNKNOWN", "FIRST_SEEN", "LAST_SEEN".
QRadar.Reference.NumberOfElements	Number	Number of elements in the reference set.
QRadar.Reference.TimeToLive	String	Time left to live for the reference.
QRadar.Reference.Data.LastSeen	Date	Date when this data was last seen.
QRadar.Reference.Data.FirstSeen	Date	Date when this data was first seen.
QRadar.Reference.Data.Source	String	Source of this data.
QRadar.Reference.Data.Value	String	Data value.
QRadar.Reference.CreationTime	Date	Date when the reference set was created.
QRadar.Reference.Name	String	Name of the reference set.
QRadar.Reference.ElementType	String	Type of the elements in the reference set.

Command Example#

!qradar-indicators-upload ref_name="Mail Servers" limit=2 query="type:IP"

Context Example#

{
    "QRadar": {
        "Reference": {
            "creation_time": "2015-08-27T19:29:30.114000+00:00",
            "element_type": "IP",
            "name": "Mail Servers",
            "number_of_elements": 8,
            "timeout_type": "FIRST_SEEN"
        }
    }
}

Human Readable Output#

Indicators Upload For Reference Set Mail Servers#
creation_time element_type name number_of_elements timeout_type
2015-08-27T19:29:30.114000+00:00 IP Mail Servers 8 FIRST_SEEN
Indicators Uploaded#
Indicator Type Indicator Value
IP 1.2.3.4
IP 192.168.1.3

qradar-geolocations-for-ip#

Retrieves the MaxMind GeoIP data for the specified IP address.

Base Command#

qradar-geolocations-for-ip

Input#

Argument Name	Description	Required
ip	Comma-separated list of IPs from which to retrieve their geolocation.	Required
fields	Comma-separated list of fields to retrieve in the response. Fields that are not explicitly named are excluded. E.g., "continent,ip_address". Specify subfields in brackets and multiple fields in the same object separated by commas. For a full list of available fields, see: https://www.ibm.com/support/knowledgecenter/SS42VS_SHR/com.ibm.qradarapi140.doc/14.0--services-geolocations-GET.html.	Optional

Context Output#

Path	Type	Description
QRadar.GeoForIP.CityName	String	Name of the city that is associated with the IP address.
QRadar.GeoForIP.ContinentName	String	Name of the continent that is associated with the IP address.
QRadar.GeoForIP.LocationAccuracyRadius	Number	The approximate accuracy radius in kilometers around the latitude and longitude for the IP address.
QRadar.GeoForIP.LocationAverageIncome	Number	The average income associated with the IP address.
QRadar.GeoForIP.LocationLatitude	Number	The approximate latitude of the location associated with the IP address.
QRadar.GeoForIP.LocationTimezone	String	Timezone of the location.
QRadar.GeoForIP.LocationLongitude	Number	The approximate longitude of the location associated with the IP address.
QRadar.GeoForIP.LocationMetroCode	Number	The metro code associated with the IP address. These are only available for IP addresses in the US. Returns the same metro codes as the Google AdWords API.
QRadar.GeoForIP.LocationPopulationDensity	Number	The estimated number of people per square kilometer.
QRadar.GeoForIP.PhysicalCountryIsoCode	String	ISO code of country where MaxMind believes the end user is located.
QRadar.GeoForIP.PhysicalCountryName	String	Name of country where MaxMind believes the end user is located.
QRadar.GeoForIP.RegisteredCountryIsoCode	String	ISO code of the country that the ISP has registered the IP address.
QRadar.GeoForIP.RegisteredCountryName	String	Name of the country that the ISP has registered the IP address.
QRadar.GeoForIP.RepresentedCountryIsoCode	String	ISO code of the country that is represented by users of the IP address.
QRadar.GeoForIP.RepresentedCountryName	String	Name of the country that is represented by users of the IP address.
QRadar.GeoForIP.RepresentedCountryConfidence	Number	Value between 0-100 that represents MaxMind's confidence that the represented country is correct.
QRadar.GeoForIP.IPAddress	String	IP address to look up.
QRadar.GeoForIP.Traits.autonomous_system_number	Number	The autonomous system number associated with the IP address.
QRadar.GeoForIP.Traits.autonomous_system_organization	String	The organization associated with the registered autonomous system number for the IP address.
QRadar.GeoForIP.Traits.domain	String	The second level domain associated with the IP address.
QRadar.GeoForIP.Traits.internet_service_provider	String	The name of the internet service provider associated with the IP address.
QRadar.GeoForIP.Traits.organization	String	The name of the organization associated with the IP address.
QRadar.GeoForIP.Traits.user_type	String	The user type associated with the IP address.
QRadar.GeoForIP.Coordinates	Number	Latitude and longitude by MaxMind.
QRadar.GeoForIP.PostalCode	String	The postal code associated with the IP address.
QRadar.GeoForIP.PostalCodeConfidence	Number	Value between 0-100 that represents MaxMind's confidence that the postal code is correct.

Command Example#

!qradar-geolocations-for-ip ip="1.2.3.4,1.2.3.5" range=0-1

Context Example#

{
    "QRadar": {
        "GeoForIP": [
            {
                "CityName": "Mukilteo",
                "ContinentName": "NorthAmerica",
                "Coordinates": [
                    47.913,
                    -122.3042
                ],
                "IPAddress": "1.2.3.4",
                "LocationAccuracyRadius": 1000,
                "LocationLatitude": 47.913,
                "LocationLongitude": -122.3042,
                "LocationMetroCode": 819,
                "LocationTimezone": "America/Los_Angeles",
                "PhysicalCountryIsoCode": "US",
                "PhysicalCountryName": "United States",
                "PostalCode": "98275",
                "RegisteredCountryIsoCode": "US",
                "RegisteredCountryName": "United States"
            },
            {
                "CityName": "Mukilteo",
                "ContinentName": "NorthAmerica",
                "Coordinates": [
                    47.913,
                    -122.3042
                ],
                "IPAddress": "1.2.3.5",
                "LocationAccuracyRadius": 1000,
                "LocationLatitude": 47.913,
                "LocationLongitude": -122.3042,
                "LocationMetroCode": 819,
                "LocationTimezone": "America/Los_Angeles",
                "PhysicalCountryIsoCode": "US",
                "PhysicalCountryName": "United States",
                "PostalCode": "98275",
                "RegisteredCountryIsoCode": "US",
                "RegisteredCountryName": "United States"
            }
        ]
    }
}

Human Readable Output#

Geolocation For IP#
CityName ContinentName Coordinates IPAddress LocationAccuracyRadius LocationLatitude LocationLongitude LocationMetroCode LocationTimezone PhysicalCountryIsoCode PhysicalCountryName PostalCode RegisteredCountryIsoCode RegisteredCountryName
Mukilteo NorthAmerica 47.913,
-122.3042 1.2.3.4 1000 47.913 -122.3042 819 America/Los_Angeles US United States 98275 US United States
Mukilteo NorthAmerica 47.913,
-122.3042 1.2.3.5 1000 47.913 -122.3042 819 America/Los_Angeles US United States 98275 US United States

qradar-log-sources-list#

Retrieves a list of log sources.

Base Command#

qradar-log-sources-list

Input#

Argument Name	Description	Required
qrd_encryption_password	The password to use for encrypting the sensitive data of this endpoint. If password was not given, random password will be generated.	Optional
range	Range of results to return (e.g.: 0-20, 3-5, 3-3). Default is 0-49.	Optional
filter	Query by which to filter log sources, e.g., "auto_discovered=false". For reference, see: https://www.ibm.com/support/knowledgecenter/SS42VS_SHR/com.ibm.qradarapi.doc/c_rest_api_filtering.html.	Optional
fields	Comma-separated list of fields to retrieve in the response. Fields that are not explicitly named are excluded. E.g., "id,name,status". Specify subfields in brackets and multiple fields in the same object separated by commas. For a full list of available fields, see: https://www.ibm.com/support/knowledgecenter/SS42VS_SHR/com.ibm.qradarapi140.doc/14.0--config-event_sources-log_source_management-log_sources-GET.html.	Optional

Context Output#

Path	Type	Description
QRadar.LogSource.SendingIP	String	IP of the system which the log source is associated with, or fed by.
QRadar.LogSource.Internal	Boolean	Whether log source is internal.
QRadar.LogSource.ProtocolParameters	Unknown	Protocol parameters.
QRadar.LogSource.Description	String	Description of the log source.
QRadar.LogSource.Enabled	Boolean	Whether log source is enabled.
QRadar.LogSource.GroupIDs	Number	Log source group IDs.
QRadar.LogSource.Credibility	Number	Credibility of the log source.
QRadar.LogSource.ID	Number	ID of the log source.
QRadar.LogSource.ProtocolTypeID	Number	Protocol type used by log source.
QRadar.LogSource.CreationDate	Date	Date when log source was created.
QRadar.LogSource.Name	String	Name of the log source.
QRadar.LogSource.AutoDiscovered	Boolean	Whether log source was auto discovered.
QRadar.LogSource.ModifiedDate	Date	Date when log source was last modified.
QRadar.LogSource.TypeID	Number	The log source type.
QRadar.LogSource.LastEventTime	Date	Date when the last event was received by the log source.
QRadar.LogSource.Gateway	Boolean	Whether log source is configured as a gateway.
QRadar.LogSource.Status	Unknown	Status of the log source.

Command Example#

!qradar-log-sources-list qrd_encryption_algorithm=AES128

Context Example#

{
    "QRadar": {
        "LogSource": [
            {
                "AutoDiscovered": false,
                "CreationDate": "2020-10-18T19:40:19.701000+00:00",
                "Credibility": 10,
                "Description": "Anomaly Detection Engine",
                "Enabled": true,
                "Gateway": false,
                "GroupIDs": [
                    0
                ],
                "ID": 66,
                "Internal": true,
                "LastEventTime": "1970-01-01T00:00:00+00:00",
                "ModifiedDate": "2020-10-18T19:40:19.701000+00:00",
                "Name": "Anomaly Detection Engine-2 :: ip-192.168.1.3",
                "ProtocolParameters": [
                    {
                        "id": 0,
                        "name": "identifier",
                        "value": "127.0.0.1"
                    },
                    {
                        "id": 1,
                        "name": "incomingPayloadEncoding",
                        "value": "UTF-8"
                    }
                ],
                "ProtocolTypeID": 0,
                "Status": {
                    "last_updated": 0,
                    "status": "NA"
                },
                "TypeID": 207
            },
            {
                "AutoDiscovered": false,
                "CreationDate": "2020-10-18T19:40:19.705000+00:00",
                "Credibility": 10,
                "Description": "Search Results",
                "Enabled": true,
                "Gateway": false,
                "GroupIDs": [
                    0
                ],
                "ID": 68,
                "Internal": true,
                "LastEventTime": "2020-10-18T20:44:40.857000+00:00",
                "ModifiedDate": "2020-10-18T19:40:19.705000+00:00",
                "Name": "Search Results-2 :: ip-192.168.1.3",
                "ProtocolParameters": [
                    {
                        "id": 0,
                        "name": "identifier",
                        "value": "127.0.0.1"
                    },
                    {
                        "id": 1,
                        "name": "incomingPayloadEncoding",
                        "value": "UTF-8"
                    }
                ],
                "ProtocolTypeID": 0,
                "Status": {
                    "last_updated": 0,
                    "messages": [
                        {
                            "severity": "ERROR",
                            "text": "Events have not been received from this Log Source in over 720 minutes."
                        }
                    ],
                    "status": "ERROR"
                },
                "TypeID": 355
            },
            {
                "AutoDiscovered": false,
                "CreationDate": "2020-10-18T19:40:19.703000+00:00",
                "Credibility": 10,
                "Description": "Asset Profiler",
                "Enabled": true,
                "Gateway": false,
                "GroupIDs": [
                    0
                ],
                "ID": 67,
                "Internal": true,
                "LastEventTime": "2021-03-02T13:51:53.892000+00:00",
                "ModifiedDate": "2020-10-18T19:40:19.703000+00:00",
                "Name": "Asset Profiler-2 :: ip-192.168.1.3",
                "ProtocolParameters": [
                    {
                        "id": 0,
                        "name": "identifier",
                        "value": "127.0.0.1"
                    },
                    {
                        "id": 1,
                        "name": "incomingPayloadEncoding",
                        "value": "UTF-8"
                    }
                ],
                "ProtocolTypeID": 0,
                "Status": {
                    "last_updated": 0,
                    "messages": [
                        {
                            "severity": "ERROR",
                            "text": "Events have not been received from this Log Source in over 720 minutes."
                        }
                    ],
                    "status": "ERROR"
                },
                "TypeID": 267
            }
        ]
    }
}

Human Readable Output#

Log Sources List#
ID Name Description SendingIP LastEventTime CreationDate ProtocolParameters TypeID Internal Gateway ProtocolTypeID Status GroupIDs Credibility AutoDiscovered ModifiedDate Enabled
66 Anomaly Detection Engine-2 :: ip-192.168.1.3 Anomaly Detection Engine 1970-01-01T00:00:00+00:00 2020-10-18T19:40:19.701000+00:00 {'name': 'identifier', 'id': 0, 'value': '127.0.0.1'},
{'name': 'incomingPayloadEncoding', 'id': 1, 'value': 'UTF-8'} 207 true false 0 last_updated: 0
status: NA 0 10 false 2020-10-18T19:40:19.701000+00:00 true
68 Search Results-2 :: ip-192.168.1.3 Search Results 2020-10-18T20:44:40.857000+00:00 2020-10-18T19:40:19.705000+00:00 {'name': 'identifier', 'id': 0, 'value': '127.0.0.1'},
{'name': 'incomingPayloadEncoding', 'id': 1, 'value': 'UTF-8'} 355 true false 0 last_updated: 0
messages: {'severity': 'ERROR', 'text': 'Events have not been received from this Log Source in over 720 minutes.'}
status: ERROR 0 10 false 2020-10-18T19:40:19.705000+00:00 true
67 Asset Profiler-2 :: ip-192.168.1.3 Asset Profiler 2021-03-02T13:51:53.892000+00:00 2020-10-18T19:40:19.703000+00:00 {'name': 'identifier', 'id': 0, 'value': '127.0.0.1'},
{'name': 'incomingPayloadEncoding', 'id': 1, 'value': 'UTF-8'} 267 true false 0 last_updated: 0
messages: {'severity': 'ERROR', 'text': 'Events have not been received from this Log Source in over 720 minutes.'}
status: ERROR 0 10 false 2020-10-18T19:40:19.703000+00:00 true

qradar-get-custom-properties#

Retrieves a list of event regex properties.

Base Command#

qradar-get-custom-properties

Input#

Argument Name	Description	Required
field_name	A comma-separated list of names of the exact properties to search for.	Optional
range	Range of results to return (e.g.: 0-20, 3-5, 3-3). Default is 0-49.	Optional
filter	Query by which to filter regex properties, e.g., "auto_discovered=false". For reference, see: https://www.ibm.com/support/knowledgecenter/SS42VS_SHR/com.ibm.qradarapi.doc/c_rest_api_filtering.html.	Optional
fields	Comma-separated list of fields to retrieve in the response. Fields that are not explicitly named are excluded. E.g., "id,gateway". Specify subfields in brackets and multiple fields in the same object separated by commas. For a full list of available fields, see: https://www.ibm.com/support/knowledgecenter/SS42VS_SHR/com.ibm.qradarapi140.doc/14.0--config-event_sources-custom_properties-regex_properties-GET.html.	Optional

Context Output#

Path	Type	Description
QRadar.Properties.identifier	String	ID of the event regex property.
QRadar.Properties.modification_date	Date	Date when the event regex property was last updated.
QRadar.Properties.datetime_format	String	Date/time pattern that the event regex property matches.
QRadar.Properties.property_type	String	Property type. Possible values: "STRING", "NUMERIC", "IP", "PORT", "TIME".
QRadar.Properties.name	String	Name of the event regex property.
QRadar.Properties.auto_discovered	Boolean	Whether the event regex property was auto discovered.
QRadar.Properties.description	String	Description of the event regex property.
QRadar.Properties.id	Number	ID of the event regex property.
QRadar.Properties.use_for_rule_engine	Boolean	Whether the event regex property is parsed when the event is received.
QRadar.Properties.creation_date	Date	Date when the event regex property was created.
QRadar.Properties.locale	String	Language tag of what locale the property matches.
QRadar.Properties.username	String	The owner of the event regex property.

Command Example#

!qradar-get-custom-properties filter="id between 90 and 100" range=1-1231

Context Example#

{
    "QRadar": {
        "Properties": [
            {
                "auto_discovered": false,
                "creation_date": "2008-09-13T00:52:08.857000+00:00",
                "description": "Default custom extraction of the duration in minutes from DSM payload.",
                "id": 98,
                "identifier": "DEFAULTCUSTOMEVENT3",
                "modification_date": "2008-09-13T00:52:08.857000+00:00",
                "name": "Duration_Minutes",
                "property_type": "numeric",
                "use_for_rule_engine": false,
                "username": "admin"
            },
            {
                "auto_discovered": false,
                "creation_date": "2008-09-13T00:52:08.857000+00:00",
                "description": "Default custom extraction of the duration in seconds from DSM payload.",
                "id": 99,
                "identifier": "DEFAULTCUSTOMEVENT4",
                "modification_date": "2008-09-13T00:52:08.857000+00:00",
                "name": "Duration_Seconds",
                "property_type": "numeric",
                "use_for_rule_engine": false,
                "username": "admin"
            },
            {
                "auto_discovered": false,
                "creation_date": "2008-09-13T00:52:08.857000+00:00",
                "description": "Default custom extraction of realm from DSM payload.",
                "id": 100,
                "identifier": "DEFAULTCUSTOMEVENT5",
                "modification_date": "2008-09-13T00:52:08.857000+00:00",
                "name": "Realm",
                "property_type": "string",
                "use_for_rule_engine": false,
                "username": "admin"
            },
            {
                "auto_discovered": false,
                "creation_date": "2008-09-13T00:52:08.857000+00:00",
                "description": "Default custom extraction of role from DSM payload.",
                "id": 96,
                "identifier": "DEFAULTCUSTOMEVENT1",
                "modification_date": "2008-09-13T00:52:08.857000+00:00",
                "name": "Role",
                "property_type": "string",
                "use_for_rule_engine": false,
                "username": "admin"
            }
        ]
    }
}

Human Readable Output#

Custom Properties#
auto_discovered creation_date description id identifier modification_date name property_type use_for_rule_engine username
false 2008-09-13T00:52:08.857000+00:00 Default custom extraction of the duration in minutes from DSM payload. 98 DEFAULTCUSTOMEVENT3 2008-09-13T00:52:08.857000+00:00 Duration_Minutes numeric false admin
false 2008-09-13T00:52:08.857000+00:00 Default custom extraction of the duration in seconds from DSM payload. 99 DEFAULTCUSTOMEVENT4 2008-09-13T00:52:08.857000+00:00 Duration_Seconds numeric false admin
false 2008-09-13T00:52:08.857000+00:00 Default custom extraction of realm from DSM payload. 100 DEFAULTCUSTOMEVENT5 2008-09-13T00:52:08.857000+00:00 Realm string false admin
false 2008-09-13T00:52:08.857000+00:00 Default custom extraction of role from DSM payload. 96 DEFAULTCUSTOMEVENT1 2008-09-13T00:52:08.857000+00:00 Role string false admin

qradar-reset-last-run#

Resets the fetch incidents last run value, which resets the fetch to its initial fetch state. (Will try to fetch the first available offense). Please Note: It is recommended to disable and then enable the QRadar instance for the reset to take effect immediately.

Base Command#

qradar-reset-last-run

Input#

There are no input arguments for this command.

Context Output#

There is no context output for this command.

Command Example#

!qradar-reset-last-run

Human Readable Output#

fetch-incidents was reset successfully.

qradar-ips-source-get#

Get Source IPs

Base Command#

qradar-ips-source-get

Input#

Argument Name	Description	Required
source_ip	Comma separated list. Source IPs to retrieve their data, E.g "192.168.0.1,192.160.0.2".	Optional
filter	Query to filter IPs. E.g, filter=`source_ip="192.168.0.1"`. For reference please consult: https://www.ibm.com/support/knowledgecenter/SS42VS_SHR/com.ibm.qradarapi.doc/c_rest_api_filtering.html.	Optional
fields	If used, will filter all fields except for the ones specified. Use this argument to specify which fields should be returned in the response. Fields that are not named are excluded. Specify subfields in brackets and multiple fields in the same object separated by commas. The filter uses QRadar's field names, for reference, consult: https://www.ibm.com/docs/en/qradar-common?topic=endpoints-get-siemsource-addresses	Optional
range	Range of results to return. e.g.: 0-20.	Optional

Context Output#

Path	Type	Description
QRadar.SourceIP.ID	Number	The ID of the destination address.
QRadar.SourceIP.DomainID	String	The ID of associated domain.
QRadar.SourceIP.EventFlowCount	Number	The number of events and flows that are associated with the destination address.
QRadar.SourceIP.FirstEventFlowSeen	Date	Date when the first event or flow was seen.
QRadar.SourceIP.LastEventFlowSeen	Date	Date when the last event or flow was seen.
QRadar.SourceIP.SourceIP	String	The IP address.
QRadar.SourceIP.Magnitude	Number	The magnitude of the destination address.
QRadar.SourceIP.Network	String	The network of the destination address.
QRadar.SourceIP.OffenseIDs	Unknown	List of offense IDs the destination address is part of.
QRadar.SourceIP.LocalDestinationAddressIDs	Unknown	List of local destination address IDs associated with the source address.

Command Example#

!qradar-ips-source-get filter=`source_ip="172.42.18.211"` range=0-2

Context Example#

{
    "QRadar": {
        "SourceIP": {
            "DomainID": 0,
            "EventFlowCount": 1081,
            "FirstEventFlowSeen": "2021-03-31T10:02:25.972000+00:00",
            "ID": 1,
            "LastEventFlowSeen": "2021-08-14T09:59:52.596000+00:00",
            "LocalDestinationAddressIDs": [
                1,
                2,
                3,
                4,
                5
            ],
            "Magnitude": 0,
            "Network": "Net-10-172-192.Net_172_16_0_0",
            "OffenseIDs": [
                1,
                4,
                5,
                9,
                10,
                11
            ],
            "SourceIP": "172.42.18.211"
        }
    }
}

Human Readable Output#

Source IPs#
DomainID EventFlowCount FirstEventFlowSeen ID LastEventFlowSeen LocalDestinationAddressIDs Magnitude Network OffenseIDs SourceIP
0 1081 2021-03-31T10:02:25.972000+00:00 1 2021-08-14T09:59:52.596000+00:00 1,
2,
3,
4,
5 0 Net-10-172-192.Net_172_16_0_0 1,
4,
5,
9,
10,
11,
12,
13,
14,
15,
16,
17,
18,
19,
20,
21,
22,
23,
24,
25,
27,
28,
29,
30,
31,
32,
33,
34,
35,
36,
37,
38,
39,
40,
41,
42 172.42.18.211

qradar-ips-local-destination-get#

Get Source IPs

Base Command#

qradar-ips-local-destination-get

Input#

Argument Name	Description	Required
local_destination_ip	Comma separated list. Local destination IPs to retrieve their data, E.g "192.168.0.1,192.160.0.2".	Optional
filter	If used, will filter all fields except for the ones specified. Use this argument to specify which fields should be returned in the response. Fields that are not named are excluded. Specify subfields in brackets and multiple fields in the same object separated by commas. The filter uses QRadar's field names, for reference, consult: https://www.ibm.com/docs/en/qradar-common?topic=endpoints-get-siemlocal-destination-addresses	Optional
fields	If used, will filter all fields except for the specified ones. Use this parameter to specify which fields you would like to get back in the response. Fields that are not named are excluded. Specify subfields in brackets and multiple fields in the same object separated by commas. The filter uses QRadar's field names, for reference, consult: https://www.ibm.com/docs/en/qradar-common?topic=endpoints-get-siemlocal-destination-addresses.	Optional
range	Range of results to return. e.g.: 0-20.	Optional

Context Output#

Path	Type	Description
QRadar.LocalDestinationIP.ID	Number	The ID of the destination address.
QRadar.LocalDestinationIP.DomainID	String	The ID of associated domain.
QRadar.LocalDestinationIP.EventFlowCount	Number	The number of events and flows that are associated with the destination address.
QRadar.LocalDestinationIP.FirstEventFlowSeen	Date	Date when the first event or flow was seen.
QRadar.LocalDestinationIP.LastEventFlowSeen	Date	Date when the last event or flow was seen.
QRadar.LocalDestinationIP.LocalDestinationIP	String	The IP address.
QRadar.LocalDestinationIP.Magnitude	Number	The magnitude of the destination address.
QRadar.LocalDestinationIP.Network	String	The network of the destination address.
QRadar.LocalDestinationIP.OffenseIDs	Unknown	List of offense IDs the destination address is part of.
QRadar.LocalDestinationIP.SourceAddressIDs	Unknown	List of source address IDs associated with the destination address.

Command Example#

``!qradar-ips-local-destination-get filter=local_destination_ip="172.42.18.211"````

Context Example#

{
    "QRadar": {
        "LocalDestinationIP": {
            "DomainID": 0,
            "EventFlowCount": 1635,
            "FirstEventFlowSeen": "2021-03-31T10:02:25.965000+00:00",
            "ID": 1,
            "LastEventFlowSeen": "2021-08-14T09:59:52.596000+00:00",
            "LocalDestinationIP": "172.42.18.211",
            "Magnitude": 0,
            "Network": "Net-10-172-192.Net_172_16_0_0",
            "OffenseIDs": [
                1,
                4,
                5
            ],
            "SourceAddressIDs": [
                1,
                2
            ]
        }
    }
}

Human Readable Output#

Local Destination IPs#
DomainID EventFlowCount FirstEventFlowSeen ID LastEventFlowSeen LocalDestinationIP Magnitude Network OffenseIDs SourceAddressIDs
0 1635 2021-03-31T10:02:25.965000+00:00 1 2021-08-14T09:59:52.596000+00:00 172.42.18.211 0 Net-10-172-192.Net_172_16_0_0 1,
4,
5,
9,
10,
11,
12,
13,
14,
15,
16,
17,
18,
19,
20,
21,
22,
23,
24,
25,
26,
27,
28,
29,
30,
31,
32,
33,
34,
35,
36,
37,
38,
39,
40,
41,
42 1,
2
qradar-search-retrieve-events#
Polling command to search for events of a specific offense. This uses the instance parameters to create the AQL search query for the events.

Base Command#

qradar-search-retrieve-events

Input#

Argument Name	Description	Required
offense_id	The ID of the offense to retrieve.	Optional
query_expression	The AQL query to execute. Mutually exclusive with the other arguments.	Optional
retry_if_not_all_fetched	Whether to retry until all events are polled or stop when the first search is completed.	Optional
search_id	The search id to query the results.	Optional
events_limit	The number of events to return. Mutually exclusive with query_expression.	Optional
events_columns	TComma separated list of columns to return. Mutually exclusive with query_expression.	Optional
fetch_mode	The mode to use when fetching events. Mutually exclusive with query_expression.	Optional
start_time	The start time of the search. Mutually exclusive with query_expression	Optional
search_id	The search id to query the results.	Optional
search_id	The search id to query the results.	Optional

Context Output#

Path	Type	Description
QRadar.SearchEvents.Events	Unknown	The events from QRadar search.
QRadar.SearchEvents.ID	String	The search id.
QRadar.SearchEvents.Status	String	The status of the search.

"wait": The search status is waiting for results. "partial": The search returned partial results. "sucecss": The search returned desired results |

Command example#

!qradar-get-events-polling offense_id=194

Human Readable Output#

Events for offense 194#

categoryname_category	categoryname_highlevelcategory	credibility	destinationgeographiclocation	destinationip	destinationv6	devicetime	eventDirection	eventcount	logsourcename_logsourceid	logsourcetypename_devicetype	magnitude	postNatDestinationIP	postNatSourceIP	preNatSourceIP	protocolname_protocolid	qiddescription_qid	qidname_qid	rulename_creEventList	severity	sourceMAC	sourcegeographiclocation	sourceip	sourcev6	starttime	username	utf8_payload
Potential Windows Exploit	Potential Exploit	10	other	1.1.1.1	0:0:0:0:0:0:0:0	2022-07-11T10:00:17.447000+00:00	R2R	1	Custom Rule Engine-8 :: ip-172-31-41-4	Custom Rule Engine	8	0.0.0.0	0.0.0.0	0.0.0.0	Reserved	Blacklisted hash detected in use	Blacklisted hash detected in use	Detected process with blacklist file hash, BB:NetworkDefinition: Honeypot like Addresses, BB:CategoryDefinition: Suspicious Event Categories, BB:CategoryDefinition: Suspicious Events, ECBB:CategoryDefinition: Destination IP is a Third Country/Region, BB:CategoryDefinition: Medium Magnitude Events, BB:CategoryDefinition: High Magnitude Events, Source Asset Weight is Low, Exploits Events with High Magnitude Become Offenses, Source Address is a Bogon IP, Destination Asset Weight is Low, BB:NetworkDefinition: Darknet Addresses, BB:BehaviorDefinition: Compromise Activities, Load Basic Building Blocks	10	00:00:00:00:00:00	other	1.1.1.1	0:0:0:0:0:0:0:0	2022-07-11T10:00:17.447000+00:00	Administrator	<13>Jul 11 10:00:13 1.1.1.1 AgentDevice=WindowsLog AgentLogFile=Microsoft-Windows-Sysmon/Operational PluginVersion=1.1.1.1 Source=Microsoft-Windows-Sysmon Computer=EC2AMAZ-ETKN6IA OriginatingComputer=EC2AMAZ-ETKN6IA User=SYSTEM Domain=NT AUTHORITY EventID=1 EventIDCode=1 EventType=4 EventCategory=1 RecordNumber=1062969 TimeGenerated=1657533610 TimeWritten=1657533610 Level=Informational Keywords=0x8000000000000000 Task=SysmonTask-SYSMON_CREATE_PROCESS Opcode=Info Message=Process Create: RuleName: UtcTime: 2022-07-11 10:00:10.023 ProcessGuid: {E3E61DAB-F4AA-62CB-0100-00105274F412} ProcessId: 2660 Image: C:\Program Files\Internet Explorer\iexplore.exe FileVersion: 11.00.14393.2007 (rs1_release.171231-1800) Description: Internet Explorer Product: Internet Explorer Company: Microsoft Corporation OriginalFileName: IEXPLORE.EXE CommandLine: "C:\Program Files\Internet Explorer\iexplore.exe" CurrentDirectory: C:\Windows\system32\ User: EC2AMAZ-ETKN6IA\Administrator LogonGuid: {E3E61DAB-9C68-5F54-0000-0020EB970200} LogonId: 0x297EB TerminalSessionId: 2 IntegrityLevel: High Hashes: SHA1=D4ABAC114DBE28BAD8855C10D37F2B727177C9CA ParentProcessGuid: {E3E61DAB-F4A1-62CB-0100-0010B14FF412} ParentProcessId: 3248 ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ParentCommandLine: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -F "C:\Users\Administrator\Desktop\playbook.ps1"
Potential Windows Exploit	Potential Exploit	10	other	1.1.1.1	0:0:0:0:0:0:0:0	2022-07-10T10:00:25.313000+00:00	R2R	1	Custom Rule Engine-8 :: ip-172-31-41-4	Custom Rule Engine	8	0.0.0.0	0.0.0.0	0.0.0.0	Reserved	Blacklisted hash detected in use	Blacklisted hash detected in use	Detected process with blacklist file hash, BB:NetworkDefinition: Honeypot like Addresses, BB:CategoryDefinition: Suspicious Event Categories, BB:CategoryDefinition: Suspicious Events, ECBB:CategoryDefinition: Destination IP is a Third Country/Region, BB:CategoryDefinition: Medium Magnitude Events, BB:CategoryDefinition: High Magnitude Events, Source Asset Weight is Low, Exploits Events with High Magnitude Become Offenses, Source Address is a Bogon IP, Destination Asset Weight is Low, BB:NetworkDefinition: Darknet Addresses, BB:BehaviorDefinition: Compromise Activities, Load Basic Building Blocks	10	00:00:00:00:00:00	other	1.1.1.1	0:0:0:0:0:0:0:0	2022-07-10T10:00:25.313000+00:00	Administrator	<13>Jul 10 10:00:13 1.1.1.1 AgentDevice=WindowsLog AgentLogFile=Microsoft-Windows-Sysmon/Operational PluginVersion=1.1.1.1 Source=Microsoft-Windows-Sysmon Computer=EC2AMAZ-ETKN6IA OriginatingComputer=EC2AMAZ-ETKN6IA User=SYSTEM Domain=NT AUTHORITY EventID=1 EventIDCode=1 EventType=4 EventCategory=1 RecordNumber=1056766 TimeGenerated=1657447209 TimeWritten=1657447209 Level=Informational Keywords=0x8000000000000000 Task=SysmonTask-SYSMON_CREATE_PROCESS Opcode=Info Message=Process Create: RuleName: UtcTime: 2022-07-10 10:00:09.706 ProcessGuid: {E3E61DAB-A329-62CA-0100-00105FA97D12} ProcessId: 4092 Image: C:\Program Files\Internet Explorer\iexplore.exe FileVersion: 11.00.14393.2007 (rs1_release.171231-1800) Description: Internet Explorer Product: Internet Explorer Company: Microsoft Corporation OriginalFileName: IEXPLORE.EXE CommandLine: "C:\Program Files\Internet Explorer\iexplore.exe" CurrentDirectory: C:\Windows\system32\ User: EC2AMAZ-ETKN6IA\Administrator LogonGuid: {E3E61DAB-9C68-5F54-0000-0020EB970200} LogonId: 0x297EB TerminalSessionId: 2 IntegrityLevel: High Hashes: SHA1=D4ABAC114DBE28BAD8855C10D37F2B727177C9CA ParentProcessGuid: {E3E61DAB-A321-62CA-0100-0010ED847D12} ParentProcessId: 7100 ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ParentCommandLine: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -F "C:\Users\Administrator\Desktop\playbook.ps1"
Potential Windows Exploit	Potential Exploit	10	other	1.1.1.1	0:0:0:0:0:0:0:0	2022-07-09T10:00:24.260000+00:00	R2R	1	Custom Rule Engine-8 :: ip-172-31-41-4	Custom Rule Engine	8	0.0.0.0	0.0.0.0	0.0.0.0	Reserved	Blacklisted hash detected in use	Blacklisted hash detected in use	Detected process with blacklist file hash, BB:NetworkDefinition: Honeypot like Addresses, BB:CategoryDefinition: Suspicious Event Categories, BB:CategoryDefinition: Suspicious Events, ECBB:CategoryDefinition: Destination IP is a Third Country/Region, BB:CategoryDefinition: Medium Magnitude Events, BB:CategoryDefinition: High Magnitude Events, Source Asset Weight is Low, Exploits Events with High Magnitude Become Offenses, Source Address is a Bogon IP, Destination Asset Weight is Low, BB:NetworkDefinition: Darknet Addresses, BB:BehaviorDefinition: Compromise Activities, Load Basic Building Blocks	10	00:00:00:00:00:00	other	1.1.1.1	0:0:0:0:0:0:0:0	2022-07-09T10:00:24.260000+00:00	Administrator	<13>Jul 09 10:00:10 1.1.1.1 AgentDevice=WindowsLog AgentLogFile=Microsoft-Windows-Sysmon/Operational PluginVersion=1.1.1.1 Source=Microsoft-Windows-Sysmon Computer=EC2AMAZ-ETKN6IA OriginatingComputer=EC2AMAZ-ETKN6IA User=SYSTEM Domain=NT AUTHORITY EventID=1 EventIDCode=1 EventType=4 EventCategory=1 RecordNumber=1049952 TimeGenerated=1657360808 TimeWritten=1657360808 Level=Informational Keywords=0x8000000000000000 Task=SysmonTask-SYSMON_CREATE_PROCESS Opcode=Info Message=Process Create: RuleName: UtcTime: 2022-07-09 10:00:08.781 ProcessGuid: {E3E61DAB-51A8-62C9-0100-0010F8620812} ProcessId: 5900 Image: C:\Program Files\Internet Explorer\iexplore.exe FileVersion: 11.00.14393.2007 (rs1_release.171231-1800) Description: Internet Explorer Product: Internet Explorer Company: Microsoft Corporation OriginalFileName: IEXPLORE.EXE CommandLine: "C:\Program Files\Internet Explorer\iexplore.exe" CurrentDirectory: C:\Windows\system32\ User: EC2AMAZ-ETKN6IA\Administrator LogonGuid: {E3E61DAB-9C68-5F54-0000-0020EB970200} LogonId: 0x297EB TerminalSessionId: 2 IntegrityLevel: High Hashes: SHA1=D4ABAC114DBE28BAD8855C10D37F2B727177C9CA ParentProcessGuid: {E3E61DAB-51A1-62C9-0100-0010013C0812} ParentProcessId: 2336 ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ParentCommandLine: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -F "C:\Users\Administrator\Desktop\playbook.ps1"
Potential Windows Exploit	Potential Exploit	10	other	1.1.1.1	0:0:0:0:0:0:0:0	2022-07-08T10:00:20.193000+00:00	R2R	1	Custom Rule Engine-8 :: ip-172-31-41-4	Custom Rule Engine	8	0.0.0.0	0.0.0.0	0.0.0.0	Reserved	Blacklisted hash detected in use	Blacklisted hash detected in use	Detected process with blacklist file hash, BB:NetworkDefinition: Honeypot like Addresses, BB:CategoryDefinition: Suspicious Event Categories, BB:CategoryDefinition: Suspicious Events, ECBB:CategoryDefinition: Destination IP is a Third Country/Region, BB:CategoryDefinition: Medium Magnitude Events, BB:CategoryDefinition: High Magnitude Events, Source Asset Weight is Low, Exploits Events with High Magnitude Become Offenses, Source Address is a Bogon IP, Destination Asset Weight is Low, BB:NetworkDefinition: Darknet Addresses, BB:BehaviorDefinition: Compromise Activities, Load Basic Building Blocks	10	00:00:00:00:00:00	other	1.1.1.1	0:0:0:0:0:0:0:0	2022-07-08T10:00:20.193000+00:00	Administrator	<13>Jul 08 10:00:10 1.1.1.1 AgentDevice=WindowsLog AgentLogFile=Microsoft-Windows-Sysmon/Operational PluginVersion=1.1.1.1 Source=Microsoft-Windows-Sysmon Computer=EC2AMAZ-ETKN6IA OriginatingComputer=EC2AMAZ-ETKN6IA User=SYSTEM Domain=NT AUTHORITY EventID=1 EventIDCode=1 EventType=4 EventCategory=1 RecordNumber=1043694 TimeGenerated=1657274408 TimeWritten=1657274408 Level=Informational Keywords=0x8000000000000000 Task=SysmonTask-SYSMON_CREATE_PROCESS Opcode=Info Message=Process Create: RuleName: UtcTime: 2022-07-08 10:00:08.715 ProcessGuid: {E3E61DAB-0028-62C8-0100-001084059111} ProcessId: 5192 Image: C:\Program Files\Internet Explorer\iexplore.exe FileVersion: 11.00.14393.2007 (rs1_release.171231-1800) Description: Internet Explorer Product: Internet Explorer Company: Microsoft Corporation OriginalFileName: IEXPLORE.EXE CommandLine: "C:\Program Files\Internet Explorer\iexplore.exe" CurrentDirectory: C:\Windows\system32\ User: EC2AMAZ-ETKN6IA\Administrator LogonGuid: {E3E61DAB-9C68-5F54-0000-0020EB970200} LogonId: 0x297EB TerminalSessionId: 2 IntegrityLevel: High Hashes: SHA1=D4ABAC114DBE28BAD8855C10D37F2B727177C9CA ParentProcessGuid: {E3E61DAB-0021-62C8-0100-001021E19011} ParentProcessId: 1572 ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ParentCommandLine: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -F "C:\Users\Administrator\Desktop\playbook.ps1"
Potential Windows Exploit	Potential Exploit	10	other	1.1.1.1	0:0:0:0:0:0:0:0	2022-07-07T10:00:21.084000+00:00	R2R	1	Custom Rule Engine-8 :: ip-172-31-41-4	Custom Rule Engine	8	0.0.0.0	0.0.0.0	0.0.0.0	Reserved	Blacklisted hash detected in use	Blacklisted hash detected in use	Detected process with blacklist file hash, BB:NetworkDefinition: Honeypot like Addresses, BB:CategoryDefinition: Suspicious Event Categories, BB:CategoryDefinition: Suspicious Events, ECBB:CategoryDefinition: Destination IP is a Third Country/Region, BB:CategoryDefinition: Medium Magnitude Events, BB:CategoryDefinition: High Magnitude Events, Source Asset Weight is Low, Exploits Events with High Magnitude Become Offenses, Source Address is a Bogon IP, Destination Asset Weight is Low, BB:NetworkDefinition: Darknet Addresses, BB:BehaviorDefinition: Compromise Activities, Load Basic Building Blocks	10	00:00:00:00:00:00	other	1.1.1.1	0:0:0:0:0:0:0:0	2022-07-07T10:00:21.084000+00:00	Administrator	<13>Jul 07 10:00:10 1.1.1.1 AgentDevice=WindowsLog AgentLogFile=Microsoft-Windows-Sysmon/Operational PluginVersion=1.1.1.1 Source=Microsoft-Windows-Sysmon Computer=EC2AMAZ-ETKN6IA OriginatingComputer=EC2AMAZ-ETKN6IA User=SYSTEM Domain=NT AUTHORITY EventID=1 EventIDCode=1 EventType=4 EventCategory=1 RecordNumber=1037501 TimeGenerated=1657188009 TimeWritten=1657188009 Level=Informational Keywords=0x8000000000000000 Task=SysmonTask-SYSMON_CREATE_PROCESS Opcode=Info Message=Process Create: RuleName: UtcTime: 2022-07-07 10:00:09.325 ProcessGuid: {E3E61DAB-AEA9-62C6-0100-001085CC1911} ProcessId: 3628 Image: C:\Program Files\Internet Explorer\iexplore.exe FileVersion: 11.00.14393.2007 (rs1_release.171231-1800) Description: Internet Explorer Product: Internet Explorer Company: Microsoft Corporation OriginalFileName: IEXPLORE.EXE CommandLine: "C:\Program Files\Internet Explorer\iexplore.exe" CurrentDirectory: C:\Windows\system32\ User: EC2AMAZ-ETKN6IA\Administrator LogonGuid: {E3E61DAB-9C68-5F54-0000-0020EB970200} LogonId: 0x297EB TerminalSessionId: 2 IntegrityLevel: High Hashes: SHA1=D4ABAC114DBE28BAD8855C10D37F2B727177C9CA ParentProcessGuid: {E3E61DAB-AEA1-62C6-0100-001020A81911} ParentProcessId: 1820 ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ParentCommandLine: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -F "C:\Users\Administrator\Desktop\playbook.ps1"
Potential Windows Exploit	Potential Exploit	10	other	1.1.1.1	0:0:0:0:0:0:0:0	2022-07-06T10:00:20.516000+00:00	R2R	1	Custom Rule Engine-8 :: ip-172-31-41-4	Custom Rule Engine	8	0.0.0.0	0.0.0.0	0.0.0.0	Reserved	Blacklisted hash detected in use	Blacklisted hash detected in use	Detected process with blacklist file hash, BB:NetworkDefinition: Honeypot like Addresses, BB:CategoryDefinition: Suspicious Event Categories, BB:CategoryDefinition: Suspicious Events, ECBB:CategoryDefinition: Destination IP is a Third Country/Region, BB:CategoryDefinition: Medium Magnitude Events, BB:CategoryDefinition: High Magnitude Events, Source Asset Weight is Low, Exploits Events with High Magnitude Become Offenses, Source Address is a Bogon IP, Destination Asset Weight is Low, BB:NetworkDefinition: Darknet Addresses, BB:BehaviorDefinition: Compromise Activities, Load Basic Building Blocks	10	00:00:00:00:00:00	other	1.1.1.1	0:0:0:0:0:0:0:0	2022-07-06T10:00:20.516000+00:00	Administrator	<13>Jul 06 10:00:10 1.1.1.1 AgentDevice=WindowsLog AgentLogFile=Microsoft-Windows-Sysmon/Operational PluginVersion=1.1.1.1 Source=Microsoft-Windows-Sysmon Computer=EC2AMAZ-ETKN6IA OriginatingComputer=EC2AMAZ-ETKN6IA User=SYSTEM Domain=NT AUTHORITY EventID=1 EventIDCode=1 EventType=4 EventCategory=1 RecordNumber=1031296 TimeGenerated=1657101609 TimeWritten=1657101609 Level=Informational Keywords=0x8000000000000000 Task=SysmonTask-SYSMON_CREATE_PROCESS Opcode=Info Message=Process Create: RuleName: UtcTime: 2022-07-06 10:00:09.214 ProcessGuid: {E3E61DAB-5D29-62C5-0100-0010E2D0A210} ProcessId: 1148 Image: C:\Program Files\Internet Explorer\iexplore.exe FileVersion: 11.00.14393.2007 (rs1_release.171231-1800) Description: Internet Explorer Product: Internet Explorer Company: Microsoft Corporation OriginalFileName: IEXPLORE.EXE CommandLine: "C:\Program Files\Internet Explorer\iexplore.exe" CurrentDirectory: C:\Windows\system32\ User: EC2AMAZ-ETKN6IA\Administrator LogonGuid: {E3E61DAB-9C68-5F54-0000-0020EB970200} LogonId: 0x297EB TerminalSessionId: 2 IntegrityLevel: High Hashes: SHA1=D4ABAC114DBE28BAD8855C10D37F2B727177C9CA ParentProcessGuid: {E3E61DAB-5D21-62C5-0100-001046ACA210} ParentProcessId: 3708 ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ParentCommandLine: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -F "C:\Users\Administrator\Desktop\playbook.ps1"
Potential Windows Exploit	Potential Exploit	10	other	1.1.1.1	0:0:0:0:0:0:0:0	2022-07-05T10:00:18.837000+00:00	R2R	1	Custom Rule Engine-8 :: ip-172-31-41-4	Custom Rule Engine	8	0.0.0.0	0.0.0.0	0.0.0.0	Reserved	Blacklisted hash detected in use	Blacklisted hash detected in use	Detected process with blacklist file hash, BB:NetworkDefinition: Honeypot like Addresses, BB:CategoryDefinition: Suspicious Event Categories, BB:CategoryDefinition: Suspicious Events, ECBB:CategoryDefinition: Destination IP is a Third Country/Region, BB:CategoryDefinition: Medium Magnitude Events, BB:CategoryDefinition: High Magnitude Events, Source Asset Weight is Low, Exploits Events with High Magnitude Become Offenses, Source Address is a Bogon IP, Destination Asset Weight is Low, BB:NetworkDefinition: Darknet Addresses, BB:BehaviorDefinition: Compromise Activities, Load Basic Building Blocks	10	00:00:00:00:00:00	other	1.1.1.1	0:0:0:0:0:0:0:0	2022-07-05T10:00:18.837000+00:00	Administrator	<13>Jul 05 10:00:10 1.1.1.1 AgentDevice=WindowsLog AgentLogFile=Microsoft-Windows-Sysmon/Operational PluginVersion=1.1.1.1 Source=Microsoft-Windows-Sysmon Computer=EC2AMAZ-ETKN6IA OriginatingComputer=EC2AMAZ-ETKN6IA User=SYSTEM Domain=NT AUTHORITY EventID=1 EventIDCode=1 EventType=4 EventCategory=1 RecordNumber=1025096 TimeGenerated=1657015208 TimeWritten=1657015208 Level=Informational Keywords=0x8000000000000000 Task=SysmonTask-SYSMON_CREATE_PROCESS Opcode=Info Message=Process Create: RuleName: UtcTime: 2022-07-05 10:00:08.306 ProcessGuid: {E3E61DAB-0BA8-62C4-0100-0010AC8A2B10} ProcessId: 908 Image: C:\Program Files\Internet Explorer\iexplore.exe FileVersion: 11.00.14393.2007 (rs1_release.171231-1800) Description: Internet Explorer Product: Internet Explorer Company: Microsoft Corporation OriginalFileName: IEXPLORE.EXE CommandLine: "C:\Program Files\Internet Explorer\iexplore.exe" CurrentDirectory: C:\Windows\system32\ User: EC2AMAZ-ETKN6IA\Administrator LogonGuid: {E3E61DAB-9C68-5F54-0000-0020EB970200} LogonId: 0x297EB TerminalSessionId: 2 IntegrityLevel: High Hashes: SHA1=D4ABAC114DBE28BAD8855C10D37F2B727177C9CA ParentProcessGuid: {E3E61DAB-0BA1-62C4-0100-001097662B10} ParentProcessId: 6176 ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ParentCommandLine: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -F "C:\Users\Administrator\Desktop\playbook.ps1"
Potential Windows Exploit	Potential Exploit	10	other	1.1.1.1	0:0:0:0:0:0:0:0	2022-07-04T10:00:16.775000+00:00	R2R	1	Custom Rule Engine-8 :: ip-172-31-41-4	Custom Rule Engine	8	0.0.0.0	0.0.0.0	0.0.0.0	Reserved	Blacklisted hash detected in use	Blacklisted hash detected in use	Detected process with blacklist file hash, BB:NetworkDefinition: Honeypot like Addresses, BB:CategoryDefinition: Suspicious Event Categories, BB:CategoryDefinition: Suspicious Events, ECBB:CategoryDefinition: Destination IP is a Third Country/Region, BB:CategoryDefinition: Medium Magnitude Events, BB:CategoryDefinition: High Magnitude Events, Source Asset Weight is Low, Exploits Events with High Magnitude Become Offenses, Source Address is a Bogon IP, Destination Asset Weight is Low, BB:NetworkDefinition: Darknet Addresses, BB:BehaviorDefinition: Compromise Activities, Load Basic Building Blocks	10	00:00:00:00:00:00	other	1.1.1.1	0:0:0:0:0:0:0:0	2022-07-04T10:00:16.775000+00:00	Administrator	<13>Jul 04 10:00:10 1.1.1.1 AgentDevice=WindowsLog AgentLogFile=Microsoft-Windows-Sysmon/Operational PluginVersion=1.1.1.1 Source=Microsoft-Windows-Sysmon Computer=EC2AMAZ-ETKN6IA OriginatingComputer=EC2AMAZ-ETKN6IA User=SYSTEM Domain=NT AUTHORITY EventID=1 EventIDCode=1 EventType=4 EventCategory=1 RecordNumber=1018907 TimeGenerated=1656928809 TimeWritten=1656928809 Level=Informational Keywords=0x8000000000000000 Task=SysmonTask-SYSMON_CREATE_PROCESS Opcode=Info Message=Process Create: RuleName: UtcTime: 2022-07-04 10:00:09.253 ProcessGuid: {E3E61DAB-BA29-62C2-0100-001018BFB40F} ProcessId: 2216 Image: C:\Program Files\Internet Explorer\iexplore.exe FileVersion: 11.00.14393.2007 (rs1_release.171231-1800) Description: Internet Explorer Product: Internet Explorer Company: Microsoft Corporation OriginalFileName: IEXPLORE.EXE CommandLine: "C:\Program Files\Internet Explorer\iexplore.exe" CurrentDirectory: C:\Windows\system32\ User: EC2AMAZ-ETKN6IA\Administrator LogonGuid: {E3E61DAB-9C68-5F54-0000-0020EB970200} LogonId: 0x297EB TerminalSessionId: 2 IntegrityLevel: High Hashes: SHA1=D4ABAC114DBE28BAD8855C10D37F2B727177C9CA ParentProcessGuid: {E3E61DAB-BA21-62C2-0100-0010B19AB40F} ParentProcessId: 1108 ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ParentCommandLine: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -F "C:\Users\Administrator\Desktop\playbook.ps1"
Potential Windows Exploit	Potential Exploit	10	other	1.1.1.1	0:0:0:0:0:0:0:0	2022-07-03T10:00:27.737000+00:00	R2R	1	Custom Rule Engine-8 :: ip-172-31-41-4	Custom Rule Engine	8	0.0.0.0	0.0.0.0	0.0.0.0	Reserved	Blacklisted hash detected in use	Blacklisted hash detected in use	Detected process with blacklist file hash, BB:NetworkDefinition: Honeypot like Addresses, BB:CategoryDefinition: Suspicious Event Categories, BB:CategoryDefinition: Suspicious Events, ECBB:CategoryDefinition: Destination IP is a Third Country/Region, BB:CategoryDefinition: Medium Magnitude Events, BB:CategoryDefinition: High Magnitude Events, Source Asset Weight is Low, Exploits Events with High Magnitude Become Offenses, Source Address is a Bogon IP, Destination Asset Weight is Low, BB:NetworkDefinition: Darknet Addresses, BB:BehaviorDefinition: Compromise Activities, Load Basic Building Blocks	10	00:00:00:00:00:00	other	1.1.1.1	0:0:0:0:0:0:0:0	2022-07-03T10:00:27.737000+00:00	Administrator	<13>Jul 03 10:00:13 1.1.1.1 AgentDevice=WindowsLog AgentLogFile=Microsoft-Windows-Sysmon/Operational PluginVersion=1.1.1.1 Source=Microsoft-Windows-Sysmon Computer=EC2AMAZ-ETKN6IA OriginatingComputer=EC2AMAZ-ETKN6IA User=SYSTEM Domain=NT AUTHORITY EventID=1 EventIDCode=1 EventType=4 EventCategory=1 RecordNumber=1012720 TimeGenerated=1656842409 TimeWritten=1656842409 Level=Informational Keywords=0x8000000000000000 Task=SysmonTask-SYSMON_CREATE_PROCESS Opcode=Info Message=Process Create: RuleName: UtcTime: 2022-07-03 10:00:09.473 ProcessGuid: {E3E61DAB-68A9-62C1-0100-001095953D0F} ProcessId: 304 Image: C:\Program Files\Internet Explorer\iexplore.exe FileVersion: 11.00.14393.2007 (rs1_release.171231-1800) Description: Internet Explorer Product: Internet Explorer Company: Microsoft Corporation OriginalFileName: IEXPLORE.EXE CommandLine: "C:\Program Files\Internet Explorer\iexplore.exe" CurrentDirectory: C:\Windows\system32\ User: EC2AMAZ-ETKN6IA\Administrator LogonGuid: {E3E61DAB-9C68-5F54-0000-0020EB970200} LogonId: 0x297EB TerminalSessionId: 2 IntegrityLevel: High Hashes: SHA1=D4ABAC114DBE28BAD8855C10D37F2B727177C9CA ParentProcessGuid: {E3E61DAB-68A1-62C1-0100-001025713D0F} ParentProcessId: 2588 ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ParentCommandLine: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -F "C:\Users\Administrator\Desktop\playbook.ps1"
Potential Windows Exploit	Potential Exploit	10	other	1.1.1.1	0:0:0:0:0:0:0:0	2022-07-02T10:00:22.691000+00:00	R2R	1	Custom Rule Engine-8 :: ip-172-31-41-4	Custom Rule Engine	8	0.0.0.0	0.0.0.0	0.0.0.0	Reserved	Blacklisted hash detected in use	Blacklisted hash detected in use	Detected process with blacklist file hash, BB:NetworkDefinition: Honeypot like Addresses, BB:CategoryDefinition: Suspicious Event Categories, BB:CategoryDefinition: Suspicious Events, ECBB:CategoryDefinition: Destination IP is a Third Country/Region, BB:CategoryDefinition: Medium Magnitude Events, BB:CategoryDefinition: High Magnitude Events, Source Asset Weight is Low, Exploits Events with High Magnitude Become Offenses, Source Address is a Bogon IP, Destination Asset Weight is Low, BB:NetworkDefinition: Darknet Addresses, BB:BehaviorDefinition: Compromise Activities, Load Basic Building Blocks	10	00:00:00:00:00:00	other	1.1.1.1	0:0:0:0:0:0:0:0	2022-07-02T10:00:22.691000+00:00	Administrator	<13>Jul 02 10:00:10 1.1.1.1 AgentDevice=WindowsLog AgentLogFile=Microsoft-Windows-Sysmon/Operational PluginVersion=1.1.1.1 Source=Microsoft-Windows-Sysmon Computer=EC2AMAZ-ETKN6IA OriginatingComputer=EC2AMAZ-ETKN6IA User=SYSTEM Domain=NT AUTHORITY EventID=1 EventIDCode=1 EventType=4 EventCategory=1 RecordNumber=1006529 TimeGenerated=1656756008 TimeWritten=1656756008 Level=Informational Keywords=0x8000000000000000 Task=SysmonTask-SYSMON_CREATE_PROCESS Opcode=Info Message=Process Create: RuleName: UtcTime: 2022-07-02 10:00:08.470 ProcessGuid: {E3E61DAB-1728-62C0-0100-0010FDDBC60E} ProcessId: 6352 Image: C:\Program Files\Internet Explorer\iexplore.exe FileVersion: 11.00.14393.2007 (rs1_release.171231-1800) Description: Internet Explorer Product: Internet Explorer Company: Microsoft Corporation OriginalFileName: IEXPLORE.EXE CommandLine: "C:\Program Files\Internet Explorer\iexplore.exe" CurrentDirectory: C:\Windows\system32\ User: EC2AMAZ-ETKN6IA\Administrator LogonGuid: {E3E61DAB-9C68-5F54-0000-0020EB970200} LogonId: 0x297EB TerminalSessionId: 2 IntegrityLevel: High Hashes: SHA1=D4ABAC114DBE28BAD8855C10D37F2B727177C9CA ParentProcessGuid: {E3E61DAB-1721-62C0-0100-0010F5B7C60E} ParentProcessId: 5976 ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ParentCommandLine: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -F "C:\Users\Administrator\Desktop\playbook.ps1"
Potential Windows Exploit	Potential Exploit	10	other	1.1.1.1	0:0:0:0:0:0:0:0	2022-07-01T10:00:27.596000+00:00	R2R	1	Custom Rule Engine-8 :: ip-172-31-41-4	Custom Rule Engine	8	0.0.0.0	0.0.0.0	0.0.0.0	Reserved	Blacklisted hash detected in use	Blacklisted hash detected in use	Detected process with blacklist file hash, BB:NetworkDefinition: Honeypot like Addresses, BB:CategoryDefinition: Suspicious Event Categories, BB:CategoryDefinition: Suspicious Events, ECBB:CategoryDefinition: Destination IP is a Third Country/Region, BB:CategoryDefinition: Medium Magnitude Events, BB:CategoryDefinition: High Magnitude Events, Source Asset Weight is Low, Exploits Events with High Magnitude Become Offenses, Source Address is a Bogon IP, Destination Asset Weight is Low, BB:NetworkDefinition: Darknet Addresses, BB:BehaviorDefinition: Compromise Activities, Load Basic Building Blocks	10	00:00:00:00:00:00	other	1.1.1.1	0:0:0:0:0:0:0:0	2022-07-01T10:00:27.596000+00:00	Administrator	<13>Jul 01 10:00:10 1.1.1.1 AgentDevice=WindowsLog AgentLogFile=Microsoft-Windows-Sysmon/Operational PluginVersion=1.1.1.1 Source=Microsoft-Windows-Sysmon Computer=EC2AMAZ-ETKN6IA OriginatingComputer=EC2AMAZ-ETKN6IA User=SYSTEM Domain=NT AUTHORITY EventID=1 EventIDCode=1 EventType=4 EventCategory=1 RecordNumber=1000331 TimeGenerated=1656669609 TimeWritten=1656669609 Level=Informational Keywords=0x8000000000000000 Task=SysmonTask-SYSMON_CREATE_PROCESS Opcode=Info Message=Process Create: RuleName: UtcTime: 2022-07-01 10:00:09.068 ProcessGuid: {E3E61DAB-C5A9-62BE-0100-00101B5C4F0E} ProcessId: 3688 Image: C:\Program Files\Internet Explorer\iexplore.exe FileVersion: 11.00.14393.2007 (rs1_release.171231-1800) Description: Internet Explorer Product: Internet Explorer Company: Microsoft Corporation OriginalFileName: IEXPLORE.EXE CommandLine: "C:\Program Files\Internet Explorer\iexplore.exe" CurrentDirectory: C:\Windows\system32\ User: EC2AMAZ-ETKN6IA\Administrator LogonGuid: {E3E61DAB-9C68-5F54-0000-0020EB970200} LogonId: 0x297EB TerminalSessionId: 2 IntegrityLevel: High Hashes: SHA1=D4ABAC114DBE28BAD8855C10D37F2B727177C9CA ParentProcessGuid: {E3E61DAB-C5A1-62BE-0100-00105D374F0E} ParentProcessId: 5388 ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ParentCommandLine: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -F "C:\Users\Administrator\Desktop\playbook.ps1"
Potential Windows Exploit	Potential Exploit	10	other	1.1.1.1	0:0:0:0:0:0:0:0	2022-06-30T10:00:23.086000+00:00	R2R	1	Custom Rule Engine-8 :: ip-172-31-41-4	Custom Rule Engine	8	0.0.0.0	0.0.0.0	0.0.0.0	Reserved	Blacklisted hash detected in use	Blacklisted hash detected in use	Detected process with blacklist file hash, BB:NetworkDefinition: Honeypot like Addresses, BB:CategoryDefinition: Suspicious Event Categories, BB:CategoryDefinition: Suspicious Events, ECBB:CategoryDefinition: Destination IP is a Third Country/Region, BB:CategoryDefinition: Medium Magnitude Events, BB:CategoryDefinition: High Magnitude Events, Source Asset Weight is Low, Exploits Events with High Magnitude Become Offenses, Source Address is a Bogon IP, Destination Asset Weight is Low, BB:NetworkDefinition: Darknet Addresses, BB:BehaviorDefinition: Compromise Activities, Load Basic Building Blocks	10	00:00:00:00:00:00	other	1.1.1.1	0:0:0:0:0:0:0:0	2022-06-30T10:00:23.086000+00:00	Administrator	<13>Jun 30 10:00:10 1.1.1.1 AgentDevice=WindowsLog AgentLogFile=Microsoft-Windows-Sysmon/Operational PluginVersion=1.1.1.1 Source=Microsoft-Windows-Sysmon Computer=EC2AMAZ-ETKN6IA OriginatingComputer=EC2AMAZ-ETKN6IA User=SYSTEM Domain=NT AUTHORITY EventID=1 EventIDCode=1 EventType=4 EventCategory=1 RecordNumber=994137 TimeGenerated=1656583208 TimeWritten=1656583208 Level=Informational Keywords=0x8000000000000000 Task=SysmonTask-SYSMON_CREATE_PROCESS Opcode=Info Message=Process Create: RuleName: UtcTime: 2022-06-30 10:00:08.646 ProcessGuid: {E3E61DAB-7428-62BD-0100-00105BDDD70D} ProcessId: 4392 Image: C:\Program Files\Internet Explorer\iexplore.exe FileVersion: 11.00.14393.2007 (rs1_release.171231-1800) Description: Internet Explorer Product: Internet Explorer Company: Microsoft Corporation OriginalFileName: IEXPLORE.EXE CommandLine: "C:\Program Files\Internet Explorer\iexplore.exe" CurrentDirectory: C:\Windows\system32\ User: EC2AMAZ-ETKN6IA\Administrator LogonGuid: {E3E61DAB-9C68-5F54-0000-0020EB970200} LogonId: 0x297EB TerminalSessionId: 2 IntegrityLevel: High Hashes: SHA1=D4ABAC114DBE28BAD8855C10D37F2B727177C9CA ParentProcessGuid: {E3E61DAB-7421-62BD-0100-001093B8D70D} ParentProcessId: 1568 ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ParentCommandLine: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -F "C:\Users\Administrator\Desktop\playbook.ps1"
Potential Windows Exploit	Potential Exploit	10	other	1.1.1.1	0:0:0:0:0:0:0:0	2022-06-28T10:00:18.327000+00:00	R2R	1	Custom Rule Engine-8 :: ip-172-31-41-4	Custom Rule Engine	8	0.0.0.0	0.0.0.0	0.0.0.0	Reserved	Blacklisted hash detected in use	Blacklisted hash detected in use	Detected process with blacklist file hash, BB:NetworkDefinition: Honeypot like Addresses, BB:CategoryDefinition: Suspicious Event Categories, BB:CategoryDefinition: Suspicious Events, ECBB:CategoryDefinition: Destination IP is a Third Country/Region, BB:CategoryDefinition: Medium Magnitude Events, BB:CategoryDefinition: High Magnitude Events, Source Asset Weight is Low, Exploits Events with High Magnitude Become Offenses, Source Address is a Bogon IP, Destination Asset Weight is Low, BB:NetworkDefinition: Darknet Addresses, BB:BehaviorDefinition: Compromise Activities, Load Basic Building Blocks	10	00:00:00:00:00:00	other	1.1.1.1	0:0:0:0:0:0:0:0	2022-06-28T10:00:18.327000+00:00	Administrator	<13>Jun 28 10:00:10 1.1.1.1 AgentDevice=WindowsLog AgentLogFile=Microsoft-Windows-Sysmon/Operational PluginVersion=1.1.1.1 Source=Microsoft-Windows-Sysmon Computer=EC2AMAZ-ETKN6IA OriginatingComputer=EC2AMAZ-ETKN6IA User=SYSTEM Domain=NT AUTHORITY EventID=1 EventIDCode=1 EventType=4 EventCategory=1 RecordNumber=981737 TimeGenerated=1656410408 TimeWritten=1656410408 Level=Informational Keywords=0x8000000000000000 Task=SysmonTask-SYSMON_CREATE_PROCESS Opcode=Info Message=Process Create: RuleName: UtcTime: 2022-06-28 10:00:08.567 ProcessGuid: {E3E61DAB-D128-62BA-0100-00104618EA0C} ProcessId: 4984 Image: C:\Program Files\Internet Explorer\iexplore.exe FileVersion: 11.00.14393.2007 (rs1_release.171231-1800) Description: Internet Explorer Product: Internet Explorer Company: Microsoft Corporation OriginalFileName: IEXPLORE.EXE CommandLine: "C:\Program Files\Internet Explorer\iexplore.exe" CurrentDirectory: C:\Windows\system32\ User: EC2AMAZ-ETKN6IA\Administrator LogonGuid: {E3E61DAB-9C68-5F54-0000-0020EB970200} LogonId: 0x297EB TerminalSessionId: 2 IntegrityLevel: High Hashes: SHA1=D4ABAC114DBE28BAD8855C10D37F2B727177C9CA ParentProcessGuid: {E3E61DAB-D121-62BA-0100-0010EEF3E90C} ParentProcessId: 2008 ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ParentCommandLine: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -F "C:\Users\Administrator\Desktop\playbook.ps1"
Potential Windows Exploit	Potential Exploit	10	other	1.1.1.1	0:0:0:0:0:0:0:0	2022-06-27T10:00:29.288000+00:00	R2R	1	Custom Rule Engine-8 :: ip-172-31-41-4	Custom Rule Engine	8	0.0.0.0	0.0.0.0	0.0.0.0	Reserved	Blacklisted hash detected in use	Blacklisted hash detected in use	Detected process with blacklist file hash, BB:NetworkDefinition: Honeypot like Addresses, BB:CategoryDefinition: Suspicious Event Categories, BB:CategoryDefinition: Suspicious Events, ECBB:CategoryDefinition: Destination IP is a Third Country/Region, BB:CategoryDefinition: Medium Magnitude Events, BB:CategoryDefinition: High Magnitude Events, Source Asset Weight is Low, Exploits Events with High Magnitude Become Offenses, Source Address is a Bogon IP, Destination Asset Weight is Low, BB:NetworkDefinition: Darknet Addresses, BB:BehaviorDefinition: Compromise Activities, Load Basic Building Blocks	10	00:00:00:00:00:00	other	1.1.1.1	0:0:0:0:0:0:0:0	2022-06-27T10:00:29.288000+00:00	Administrator	<13>Jun 27 10:00:13 1.1.1.1 AgentDevice=WindowsLog AgentLogFile=Microsoft-Windows-Sysmon/Operational PluginVersion=1.1.1.1 Source=Microsoft-Windows-Sysmon Computer=EC2AMAZ-ETKN6IA OriginatingComputer=EC2AMAZ-ETKN6IA User=SYSTEM Domain=NT AUTHORITY EventID=1 EventIDCode=1 EventType=4 EventCategory=1 RecordNumber=975545 TimeGenerated=1656324009 TimeWritten=1656324009 Level=Informational Keywords=0x8000000000000000 Task=SysmonTask-SYSMON_CREATE_PROCESS Opcode=Info Message=Process Create: RuleName: UtcTime: 2022-06-27 10:00:09.442 ProcessGuid: {E3E61DAB-7FA9-62B9-0100-001025A5730C} ProcessId: 6868 Image: C:\Program Files\Internet Explorer\iexplore.exe FileVersion: 11.00.14393.2007 (rs1_release.171231-1800) Description: Internet Explorer Product: Internet Explorer Company: Microsoft Corporation OriginalFileName: IEXPLORE.EXE CommandLine: "C:\Program Files\Internet Explorer\iexplore.exe" CurrentDirectory: C:\Windows\system32\ User: EC2AMAZ-ETKN6IA\Administrator LogonGuid: {E3E61DAB-9C68-5F54-0000-0020EB970200} LogonId: 0x297EB TerminalSessionId: 2 IntegrityLevel: High Hashes: SHA1=D4ABAC114DBE28BAD8855C10D37F2B727177C9CA ParentProcessGuid: {E3E61DAB-7FA1-62B9-0100-00106F80730C} ParentProcessId: 2008 ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ParentCommandLine: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -F "C:\Users\Administrator\Desktop\playbook.ps1"
Potential Windows Exploit	Potential Exploit	10	other	1.1.1.1	0:0:0:0:0:0:0:0	2022-06-26T10:00:21.778000+00:00	R2R	1	Custom Rule Engine-8 :: ip-172-31-41-4	Custom Rule Engine	8	0.0.0.0	0.0.0.0	0.0.0.0	Reserved	Blacklisted hash detected in use	Blacklisted hash detected in use	Detected process with blacklist file hash, BB:NetworkDefinition: Honeypot like Addresses, BB:CategoryDefinition: Suspicious Event Categories, BB:CategoryDefinition: Suspicious Events, ECBB:CategoryDefinition: Destination IP is a Third Country/Region, BB:CategoryDefinition: Medium Magnitude Events, BB:CategoryDefinition: High Magnitude Events, Source Asset Weight is Low, Exploits Events with High Magnitude Become Offenses, Source Address is a Bogon IP, Destination Asset Weight is Low, BB:NetworkDefinition: Darknet Addresses, BB:BehaviorDefinition: Compromise Activities, Load Basic Building Blocks	10	00:00:00:00:00:00	other	1.1.1.1	0:0:0:0:0:0:0:0	2022-06-26T10:00:21.778000+00:00	Administrator	<13>Jun 26 10:00:10 1.1.1.1 AgentDevice=WindowsLog AgentLogFile=Microsoft-Windows-Sysmon/Operational PluginVersion=1.1.1.1 Source=Microsoft-Windows-Sysmon Computer=EC2AMAZ-ETKN6IA OriginatingComputer=EC2AMAZ-ETKN6IA User=SYSTEM Domain=NT AUTHORITY EventID=1 EventIDCode=1 EventType=4 EventCategory=1 RecordNumber=969350 TimeGenerated=1656237609 TimeWritten=1656237609 Level=Informational Keywords=0x8000000000000000 Task=SysmonTask-SYSMON_CREATE_PROCESS Opcode=Info Message=Process Create: RuleName: UtcTime: 2022-06-26 10:00:09.233 ProcessGuid: {E3E61DAB-2E29-62B8-0100-0010B33EFC0B} ProcessId: 6956 Image: C:\Program Files\Internet Explorer\iexplore.exe FileVersion: 11.00.14393.2007 (rs1_release.171231-1800) Description: Internet Explorer Product: Internet Explorer Company: Microsoft Corporation OriginalFileName: IEXPLORE.EXE CommandLine: "C:\Program Files\Internet Explorer\iexplore.exe" CurrentDirectory: C:\Windows\system32\ User: EC2AMAZ-ETKN6IA\Administrator LogonGuid: {E3E61DAB-9C68-5F54-0000-0020EB970200} LogonId: 0x297EB TerminalSessionId: 2 IntegrityLevel: High Hashes: SHA1=D4ABAC114DBE28BAD8855C10D37F2B727177C9CA ParentProcessGuid: {E3E61DAB-2E21-62B8-0100-0010B919FC0B} ParentProcessId: 6984 ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ParentCommandLine: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -F "C:\Users\Administrator\Desktop\playbook.ps1"
Potential Windows Exploit	Potential Exploit	10	other	1.1.1.1	0:0:0:0:0:0:0:0	2022-06-25T10:00:25.179000+00:00	R2R	1	Custom Rule Engine-8 :: ip-172-31-41-4	Custom Rule Engine	8	0.0.0.0	0.0.0.0	0.0.0.0	Reserved	Blacklisted hash detected in use	Blacklisted hash detected in use	Detected process with blacklist file hash, BB:NetworkDefinition: Honeypot like Addresses, BB:CategoryDefinition: Suspicious Event Categories, BB:CategoryDefinition: Suspicious Events, ECBB:CategoryDefinition: Destination IP is a Third Country/Region, BB:CategoryDefinition: Medium Magnitude Events, BB:CategoryDefinition: High Magnitude Events, Source Asset Weight is Low, Exploits Events with High Magnitude Become Offenses, Source Address is a Bogon IP, Destination Asset Weight is Low, BB:NetworkDefinition: Darknet Addresses, BB:BehaviorDefinition: Compromise Activities, Load Basic Building Blocks	10	00:00:00:00:00:00	other	1.1.1.1	0:0:0:0:0:0:0:0	2022-06-25T10:00:25.179000+00:00	Administrator	<13>Jun 25 10:00:10 1.1.1.1 AgentDevice=WindowsLog AgentLogFile=Microsoft-Windows-Sysmon/Operational PluginVersion=1.1.1.1 Source=Microsoft-Windows-Sysmon Computer=EC2AMAZ-ETKN6IA OriginatingComputer=EC2AMAZ-ETKN6IA User=SYSTEM Domain=NT AUTHORITY EventID=1 EventIDCode=1 EventType=4 EventCategory=1 RecordNumber=963149 TimeGenerated=1656151209 TimeWritten=1656151209 Level=Informational Keywords=0x8000000000000000 Task=SysmonTask-SYSMON_CREATE_PROCESS Opcode=Info Message=Process Create: RuleName: UtcTime: 2022-06-25 10:00:09.247 ProcessGuid: {E3E61DAB-DCA9-62B6-0100-0010B277850B} ProcessId: 5568 Image: C:\Program Files\Internet Explorer\iexplore.exe FileVersion: 11.00.14393.2007 (rs1_release.171231-1800) Description: Internet Explorer Product: Internet Explorer Company: Microsoft Corporation OriginalFileName: IEXPLORE.EXE CommandLine: "C:\Program Files\Internet Explorer\iexplore.exe" CurrentDirectory: C:\Windows\system32\ User: EC2AMAZ-ETKN6IA\Administrator LogonGuid: {E3E61DAB-9C68-5F54-0000-0020EB970200} LogonId: 0x297EB TerminalSessionId: 2 IntegrityLevel: High Hashes: SHA1=D4ABAC114DBE28BAD8855C10D37F2B727177C9CA ParentProcessGuid: {E3E61DAB-DCA1-62B6-0100-0010C752850B} ParentProcessId: 5188 ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ParentCommandLine: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -F "C:\Users\Administrator\Desktop\playbook.ps1"
Potential Windows Exploit	Potential Exploit	10	other	1.1.1.1	0:0:0:0:0:0:0:0	2022-06-24T10:00:28.082000+00:00	R2R	1	Custom Rule Engine-8 :: ip-172-31-41-4	Custom Rule Engine	8	0.0.0.0	0.0.0.0	0.0.0.0	Reserved	Blacklisted hash detected in use	Blacklisted hash detected in use	Detected process with blacklist file hash, BB:NetworkDefinition: Honeypot like Addresses, BB:CategoryDefinition: Suspicious Event Categories, BB:CategoryDefinition: Suspicious Events, ECBB:CategoryDefinition: Destination IP is a Third Country/Region, BB:CategoryDefinition: Medium Magnitude Events, BB:CategoryDefinition: High Magnitude Events, Source Asset Weight is Low, Exploits Events with High Magnitude Become Offenses, Source Address is a Bogon IP, Destination Asset Weight is Low, BB:NetworkDefinition: Darknet Addresses, BB:BehaviorDefinition: Compromise Activities, Load Basic Building Blocks	10	00:00:00:00:00:00	other	1.1.1.1	0:0:0:0:0:0:0:0	2022-06-24T10:00:28.082000+00:00	Administrator	<13>Jun 24 10:00:10 1.1.1.1 AgentDevice=WindowsLog AgentLogFile=Microsoft-Windows-Sysmon/Operational PluginVersion=1.1.1.1 Source=Microsoft-Windows-Sysmon Computer=EC2AMAZ-ETKN6IA OriginatingComputer=EC2AMAZ-ETKN6IA User=SYSTEM Domain=NT AUTHORITY EventID=1 EventIDCode=1 EventType=4 EventCategory=1 RecordNumber=956953 TimeGenerated=1656064808 TimeWritten=1656064808 Level=Informational Keywords=0x8000000000000000 Task=SysmonTask-SYSMON_CREATE_PROCESS Opcode=Info Message=Process Create: RuleName: UtcTime: 2022-06-24 10:00:08.676 ProcessGuid: {E3E61DAB-8B28-62B5-0100-00104B390E0B} ProcessId: 5216 Image: C:\Program Files\Internet Explorer\iexplore.exe FileVersion: 11.00.14393.2007 (rs1_release.171231-1800) Description: Internet Explorer Product: Internet Explorer Company: Microsoft Corporation OriginalFileName: IEXPLORE.EXE CommandLine: "C:\Program Files\Internet Explorer\iexplore.exe" CurrentDirectory: C:\Windows\system32\ User: EC2AMAZ-ETKN6IA\Administrator LogonGuid: {E3E61DAB-9C68-5F54-0000-0020EB970200} LogonId: 0x297EB TerminalSessionId: 2 IntegrityLevel: High Hashes: SHA1=D4ABAC114DBE28BAD8855C10D37F2B727177C9CA ParentProcessGuid: {E3E61DAB-8B21-62B5-0100-00106C140E0B} ParentProcessId: 6292 ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ParentCommandLine: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -F "C:\Users\Administrator\Desktop\playbook.ps1"
Potential Windows Exploit	Potential Exploit	10	other	1.1.1.1	0:0:0:0:0:0:0:0	2022-06-23T10:00:22.536000+00:00	R2R	1	Custom Rule Engine-8 :: ip-172-31-41-4	Custom Rule Engine	8	0.0.0.0	0.0.0.0	0.0.0.0	Reserved	Blacklisted hash detected in use	Blacklisted hash detected in use	Detected process with blacklist file hash, BB:NetworkDefinition: Honeypot like Addresses, BB:CategoryDefinition: Suspicious Event Categories, BB:CategoryDefinition: Suspicious Events, ECBB:CategoryDefinition: Destination IP is a Third Country/Region, BB:CategoryDefinition: Medium Magnitude Events, BB:CategoryDefinition: High Magnitude Events, Source Asset Weight is Low, Exploits Events with High Magnitude Become Offenses, Source Address is a Bogon IP, Destination Asset Weight is Low, BB:NetworkDefinition: Darknet Addresses, BB:BehaviorDefinition: Compromise Activities, Load Basic Building Blocks	10	00:00:00:00:00:00	other	1.1.1.1	0:0:0:0:0:0:0:0	2022-06-23T10:00:22.536000+00:00	Administrator	<13>Jun 23 10:00:10 1.1.1.1 AgentDevice=WindowsLog AgentLogFile=Microsoft-Windows-Sysmon/Operational PluginVersion=1.1.1.1 Source=Microsoft-Windows-Sysmon Computer=EC2AMAZ-ETKN6IA OriginatingComputer=EC2AMAZ-ETKN6IA User=SYSTEM Domain=NT AUTHORITY EventID=1 EventIDCode=1 EventType=4 EventCategory=1 RecordNumber=950763 TimeGenerated=1655978409 TimeWritten=1655978409 Level=Informational Keywords=0x8000000000000000 Task=SysmonTask-SYSMON_CREATE_PROCESS Opcode=Info Message=Process Create: RuleName: UtcTime: 2022-06-23 10:00:09.018 ProcessGuid: {E3E61DAB-39A9-62B4-0100-00105655970A} ProcessId: 6028 Image: C:\Program Files\Internet Explorer\iexplore.exe FileVersion: 11.00.14393.2007 (rs1_release.171231-1800) Description: Internet Explorer Product: Internet Explorer Company: Microsoft Corporation OriginalFileName: IEXPLORE.EXE CommandLine: "C:\Program Files\Internet Explorer\iexplore.exe" CurrentDirectory: C:\Windows\system32\ User: EC2AMAZ-ETKN6IA\Administrator LogonGuid: {E3E61DAB-9C68-5F54-0000-0020EB970200} LogonId: 0x297EB TerminalSessionId: 2 IntegrityLevel: High Hashes: SHA1=D4ABAC114DBE28BAD8855C10D37F2B727177C9CA ParentProcessGuid: {E3E61DAB-39A1-62B4-0100-00107230970A} ParentProcessId: 4024 ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ParentCommandLine: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -F "C:\Users\Administrator\Desktop\playbook.ps1"
Potential Windows Exploit	Potential Exploit	10	other	1.1.1.1	0:0:0:0:0:0:0:0	2022-06-22T10:00:24.232000+00:00	R2R	1	Custom Rule Engine-8 :: ip-172-31-41-4	Custom Rule Engine	8	0.0.0.0	0.0.0.0	0.0.0.0	Reserved	Blacklisted hash detected in use	Blacklisted hash detected in use	Detected process with blacklist file hash, BB:NetworkDefinition: Honeypot like Addresses, BB:CategoryDefinition: Suspicious Event Categories, BB:CategoryDefinition: Suspicious Events, ECBB:CategoryDefinition: Destination IP is a Third Country/Region, BB:CategoryDefinition: Medium Magnitude Events, BB:CategoryDefinition: High Magnitude Events, Source Asset Weight is Low, Exploits Events with High Magnitude Become Offenses, Source Address is a Bogon IP, Destination Asset Weight is Low, BB:NetworkDefinition: Darknet Addresses, BB:BehaviorDefinition: Compromise Activities, Load Basic Building Blocks	10	00:00:00:00:00:00	other	1.1.1.1	0:0:0:0:0:0:0:0	2022-06-22T10:00:24.232000+00:00	Administrator	<13>Jun 22 10:00:13 1.1.1.1 AgentDevice=WindowsLog AgentLogFile=Microsoft-Windows-Sysmon/Operational PluginVersion=1.1.1.1 Source=Microsoft-Windows-Sysmon Computer=EC2AMAZ-ETKN6IA OriginatingComputer=EC2AMAZ-ETKN6IA User=SYSTEM Domain=NT AUTHORITY EventID=1 EventIDCode=1 EventType=4 EventCategory=1 RecordNumber=944558 TimeGenerated=1655892009 TimeWritten=1655892009 Level=Informational Keywords=0x8000000000000000 Task=SysmonTask-SYSMON_CREATE_PROCESS Opcode=Info Message=Process Create: RuleName: UtcTime: 2022-06-22 10:00:09.689 ProcessGuid: {E3E61DAB-E829-62B2-0100-0010B36C200A} ProcessId: 2016 Image: C:\Program Files\Internet Explorer\iexplore.exe FileVersion: 11.00.14393.2007 (rs1_release.171231-1800) Description: Internet Explorer Product: Internet Explorer Company: Microsoft Corporation OriginalFileName: IEXPLORE.EXE CommandLine: "C:\Program Files\Internet Explorer\iexplore.exe" CurrentDirectory: C:\Windows\system32\ User: EC2AMAZ-ETKN6IA\Administrator LogonGuid: {E3E61DAB-9C68-5F54-0000-0020EB970200} LogonId: 0x297EB TerminalSessionId: 2 IntegrityLevel: High Hashes: SHA1=D4ABAC114DBE28BAD8855C10D37F2B727177C9CA ParentProcessGuid: {E3E61DAB-E821-62B2-0100-0010CC47200A} ParentProcessId: 2340 ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ParentCommandLine: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -F "C:\Users\Administrator\Desktop\playbook.ps1"
Potential Windows Exploit	Potential Exploit	10	other	1.1.1.1	0:0:0:0:0:0:0:0	2022-06-21T10:00:26.080000+00:00	R2R	1	Custom Rule Engine-8 :: ip-172-31-41-4	Custom Rule Engine	8	0.0.0.0	0.0.0.0	0.0.0.0	Reserved	Blacklisted hash detected in use	Blacklisted hash detected in use	Detected process with blacklist file hash, BB:NetworkDefinition: Honeypot like Addresses, BB:CategoryDefinition: Suspicious Event Categories, BB:CategoryDefinition: Suspicious Events, ECBB:CategoryDefinition: Destination IP is a Third Country/Region, BB:CategoryDefinition: Medium Magnitude Events, BB:CategoryDefinition: High Magnitude Events, Source Asset Weight is Low, Exploits Events with High Magnitude Become Offenses, Source Address is a Bogon IP, Destination Asset Weight is Low, BB:NetworkDefinition: Darknet Addresses, BB:BehaviorDefinition: Compromise Activities, Load Basic Building Blocks	10	00:00:00:00:00:00	other	1.1.1.1	0:0:0:0:0:0:0:0	2022-06-21T10:00:26.080000+00:00	Administrator	<13>Jun 21 10:00:10 1.1.1.1 AgentDevice=WindowsLog AgentLogFile=Microsoft-Windows-Sysmon/Operational PluginVersion=1.1.1.1 Source=Microsoft-Windows-Sysmon Computer=EC2AMAZ-ETKN6IA OriginatingComputer=EC2AMAZ-ETKN6IA User=SYSTEM Domain=NT AUTHORITY EventID=1 EventIDCode=1 EventType=4 EventCategory=1 RecordNumber=938367 TimeGenerated=1655805608 TimeWritten=1655805608 Level=Informational Keywords=0x8000000000000000 Task=SysmonTask-SYSMON_CREATE_PROCESS Opcode=Info Message=Process Create: RuleName: UtcTime: 2022-06-21 10:00:08.128 ProcessGuid: {E3E61DAB-96A8-62B1-0100-00108357A909} ProcessId: 5824 Image: C:\Program Files\Internet Explorer\iexplore.exe FileVersion: 11.00.14393.2007 (rs1_release.171231-1800) Description: Internet Explorer Product: Internet Explorer Company: Microsoft Corporation OriginalFileName: IEXPLORE.EXE CommandLine: "C:\Program Files\Internet Explorer\iexplore.exe" CurrentDirectory: C:\Windows\system32\ User: EC2AMAZ-ETKN6IA\Administrator LogonGuid: {E3E61DAB-9C68-5F54-0000-0020EB970200} LogonId: 0x297EB TerminalSessionId: 2 IntegrityLevel: High Hashes: SHA1=D4ABAC114DBE28BAD8855C10D37F2B727177C9CA ParentProcessGuid: {E3E61DAB-96A1-62B1-0100-00103D33A909} ParentProcessId: 4092 ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ParentCommandLine: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -F "C:\Users\Administrator\Desktop\playbook.ps1"

qradar-remote-network-cidr-create#

Create remote network CIDRs.

Base Command#

qradar-remote-network-cidr-create

Input#

Argument Name	Description	Required
cidrs	An input list of CIDRs to add to QRadar (can be obtained automatically from the EDL integrations and playbook). Multiple values in the same object are separated by commas. A CIDR or query is required.	Optional
query	The query for getting indicators from Cortex XSOAR. A CIDR or query is required.	Optional
name	A CIDR (remote network) name that will be displayed for all uploaded values in QRadar.	Required
description	Description that will be displayed and associated with all the newly uploaded CIDRs on QRadar.	Required
group	The exact name of the remote network group that CIDRs should be associated with as it appears in QRadar. A single group can be assigned to each create command. A new remote network group can be created in QRadar by giving a new unique remote network group name (that does not already exist in QRadar remote networks).	Required
fields	Use this parameter to specify which fields you would like to get back in the response. Fields that are not named are excluded from the output. The possible fields are id, group, name, cidr, and description.	Optional

Context Output#

There is no context output for this command.

Command example#

!qradar-remote-network-cidr-create cidrs=1.2.3.4/32,8.8.8.8/2 name=example_name description=example_description group=example_group

Human Readable Output#

The new staged remote network was successfully created.#

cidrs	1.2.3.4/32, 8.8.8.8/2
description	example_description
group	example_group
id	12
name	example_name

qradar-remote-network-cidr-list#

Retrieves a list of staged remote networks.

Base Command#

qradar-remote-network-cidr-list

Input#

Argument Name	Description	Required
limit	The maximum number of results to return. The default is 50.	Optional
page	The page number from which to start getting results.	Optional
page_size	The number of results to return per page.	Optional
group	The name of the remote network group that CIDRs are associated with, as it appears in QRadar.	Optional
id	Id of CIDR (remote network).	Optional
name	The name of the CIDRs (remote network) that appear in QRadar.	Required
filter	Additional options to filter results using a query expression.	Optional
fields	Use this parameter to specify which fields you would like to get back in the response. Fields that are not named are excluded from the output. The possible fields are id, group, name, cidr, and description.	Optional

Context Output#

Path	Type	Description
QRadar.RemoteNetworkCIDR	Number	A list of all the retrieved CIDRs.
QRadar.RemoteNetworkCIDR.id	Number	ID of each CIDR remote network that is part of the group.
QRadar.RemoteNetworkCIDR.name	String	The associated CIDR name as it appears in QRadar.
QRadar.RemoteNetworkCIDR.description	String	The associated CIDR description as it appears in QRadar.

Command example#

!qradar-remote-network-cidr-list range=0-1

Human Readable Output#

List of the staged remote networks#

cidrs	description	group	id	name
1.2.3.4/32, 8.8.8.8/2	example_description	example_group1	12	example_name
127.0.0.1/32	example_description	example_group2	13	example_name

qradar-remote-network-cidr-delete#

Deletes an existing staged remote network.

Base Command#

qradar-remote-network-cidr-delete

Input#

Argument Name	Description	Required
id	ID that is used to locate the staged remote network to remove from QRadar.	Required

Context Output#

There is no context output for this command.

Command example#

!qradar-remote-network-cidr-list id=1,2,3,4

Human Readable Output#

Successfully deleted the following remote network#

ID
1
4

Failed to delete the following remote network#

ID	Error
2	Error in API call [404] - 404 Delete failed. Staged remote network with id=2 does not exist.
3	Error in API call [404] - 404 Delete failed. Staged remote network with id=3 does not exist.

qradar-remote-network-cidr-update#

Updates an existing staged remote network.

Base Command#

qradar-remote-network-cidr-update

Input#

Argument Name	Description	Required
id	The ID that is associated with the CIDR object that needs to be modified.	Required
name	The CIDR name in QRadar. If the CIDR name should be changed, it can be inserted here.	Required
cidrs	An input list of CIDRs to add to QRadar (can be obtained automatically from the EDL integrations and playbook). Multiple values in the same object are separated by commas. A CIDR or query is required.	Optional
query	The query for getting indicators from Cortex XSOAR. A CIDR or query is required.	Optional
description	CIDR associated description presented in QRadar. If the CIDR description should be changed, it can be inserted here.	Required
group	The remote network group that CIDRs should belong to. If the CIDR-associated group should be changed, it can be inserted here.	Required
fields	Use this parameter to specify which fields you would like to get back in the response. Fields that are not named are excluded. Specify subfields in brackets, and multiple fields in the same object are separated by commas. The possible fields are id,group,name,cidr,description.	Optional

Context Output#

Path	Type	Description
QRadar.RemoteNetworkCIDR	Number	A list of all the CIDR ranges that were changed.
QRadar.RemoteNetworkCIDR.id	Number	The associated CIDR ID.
QRadar.RemoteNetworkCIDR.name	String	The associated CIDR name.
QRadar.RemoteNetworkCIDR.group	String	The group to which the remote network belongs.
QRadar.RemoteNetworkCIDR.description	String	The associated CIDR description.

Command example#

!qradar-remote-network-cidr-update id=45 name="Malicious-IPs-for-blocking" description="Malicious-IPs-for-blocking" group=testenv cidrs=1.2.3.4/8,5.6.7.8/32

Human Readable Output#

List of the staged remote networks#

cidrs	1.2.3.4/8, 5.6.7.8/32
description	Malicious-IPs-for-blocking
group	testenv
id	45
name	Malicious-IPs-for-blocking

qradar-remote-network-deploy-execution#

Executes a deployment.

Base Command#

qradar-remote-network-deploy-execution

Input#

Argument Name	Description	Required
host_ip	The IP of the QRadar console host.	Required
status	The deployment status. Must be in capital letters (“INITIATING”).	Optional
deployment_type	The deployment type. Must be in capital letters (“INCREMENTAL” or “FULL”).	Required

Context Output#

Path	Type	Description
QRadar.deploy.status	String	The deployment status (INITIALIZING, IN_PROGRESS, COMPLETE).

Command example#

!qradar-remote-network-deploy-execution status=INITIATING deployment_type=INCREMENTAL host_ip=127.0.0.1

Human Readable Output#

The remote network deploy execution was successfully created.

ID	Description	OffenseType	Status	Severity	LastUpdatedTime	EventCount	Categories	Protected	LinkToOffense	OffenseSource	DestinationAddress	Rules	Magnitude	SourceAddress	DestinationHostname	Credibility	Followup	StartTime
16	Session Closed	Source IP	OPEN	2	2021-02-15T14:24:11.536000+00:00	1	Session Closed	false	https://192.168.0.1/api/console/do/sem/offensesummary?appName=Sem&pageId=OffenseSummary&summaryId=16	192.168.1.3	192.168.1.3	{'id': 100405, 'type': 'CRE_RULE', 'name': 'Fake port scan'}	1	192.168.1.3	Net-10-172-192.Net_192_168_1_3	2	true	2021-02-15T14:24:11.536000+00:00
15	Multiple Login Failures for the Same User containing Failure Audit: The domain controller failed to validate the credentials for an account	Username	OPEN	3	2021-02-15T13:21:46.948000+00:00	15	User Login Failure, General Authentication Failed	false	https://192.168.0.1/api/console/do/sem/offensesummary?appName=Sem&pageId=OffenseSummary&summaryId=15	yarden	192.168.1.3	{'id': 100056, 'type': 'CRE_RULE', 'name': 'Multiple Login Failures for Single Username'}	1	192.168.1.3, ::1	Net-10-172-192.Net_192_168_1_3	2	false	2021-02-15T13:21:36.537000+00:00
14	User Login Success and Session Opened and Session Closed	Source IP	OPEN	1	2021-02-04T22:29:30.742000+00:00	5	User Login Success, Session Opened, Session Closed	false	https://192.168.0.1/api/console/do/sem/offensesummary?appName=Sem&pageId=OffenseSummary&summaryId=14	192.168.1.3	192.168.1.3	{'id': 100405, 'type': 'CRE_RULE', 'name': 'Fake port scan'}	1	192.168.1.3	Net-10-172-192.Net_192_168_1_3	2	false	2021-02-04T12:19:54.402000+00:00

CityName	ContinentName	Coordinates	IPAddress	LocationAccuracyRadius	LocationLatitude	LocationLongitude	LocationMetroCode	LocationTimezone	PhysicalCountryIsoCode	PhysicalCountryName	PostalCode	RegisteredCountryIsoCode	RegisteredCountryName
Mukilteo	NorthAmerica	47.913, -122.3042	1.2.3.4	1000	47.913	-122.3042	819	America/Los_Angeles	US	United States	98275	US	United States
Mukilteo	NorthAmerica	47.913, -122.3042	1.2.3.5	1000	47.913	-122.3042	819	America/Los_Angeles	US	United States	98275	US	United States

ID	Name	Description	LastEventTime	CreationDate	ProtocolParameters	TypeID	Internal	Gateway	Status	Credibility	AutoDiscovered	ModifiedDate	Enabled
66	Anomaly Detection Engine-2 :: ip-192.168.1.3	Anomaly Detection Engine	1970-01-01T00:00:00+00:00	2020-10-18T19:40:19.701000+00:00	{'name': 'identifier', 'id': 0, 'value': '127.0.0.1'}, {'name': 'incomingPayloadEncoding', 'id': 1, 'value': 'UTF-8'}	207	true	false	last_updated: 0 status: NA	10	false	2020-10-18T19:40:19.701000+00:00	true
68	Search Results-2 :: ip-192.168.1.3	Search Results	2020-10-18T20:44:40.857000+00:00	2020-10-18T19:40:19.705000+00:00	{'name': 'identifier', 'id': 0, 'value': '127.0.0.1'}, {'name': 'incomingPayloadEncoding', 'id': 1, 'value': 'UTF-8'}	355	true	false	last_updated: 0 messages: {'severity': 'ERROR', 'text': 'Events have not been received from this Log Source in over 720 minutes.'} status: ERROR	10	false	2020-10-18T19:40:19.705000+00:00	true
67	Asset Profiler-2 :: ip-192.168.1.3	Asset Profiler	2021-03-02T13:51:53.892000+00:00	2020-10-18T19:40:19.703000+00:00	{'name': 'identifier', 'id': 0, 'value': '127.0.0.1'}, {'name': 'incomingPayloadEncoding', 'id': 1, 'value': 'UTF-8'}	267	true	false	last_updated: 0 messages: {'severity': 'ERROR', 'text': 'Events have not been received from this Log Source in over 720 minutes.'} status: ERROR	10	false	2020-10-18T19:40:19.703000+00:00	true

auto_discovered	creation_date	description	id	identifier	modification_date	name	property_type	use_for_rule_engine	username
false	2008-09-13T00:52:08.857000+00:00	Default custom extraction of the duration in minutes from DSM payload.	98	DEFAULTCUSTOMEVENT3	2008-09-13T00:52:08.857000+00:00	Duration_Minutes	numeric	false	admin
false	2008-09-13T00:52:08.857000+00:00	Default custom extraction of the duration in seconds from DSM payload.	99	DEFAULTCUSTOMEVENT4	2008-09-13T00:52:08.857000+00:00	Duration_Seconds	numeric	false	admin
false	2008-09-13T00:52:08.857000+00:00	Default custom extraction of realm from DSM payload.	100	DEFAULTCUSTOMEVENT5	2008-09-13T00:52:08.857000+00:00	Realm	string	false	admin
false	2008-09-13T00:52:08.857000+00:00	Default custom extraction of role from DSM payload.	96	DEFAULTCUSTOMEVENT1	2008-09-13T00:52:08.857000+00:00	Role	string	false	admin