Skip to main content

QRadar - Get Offense Logs

This Playbook is part of the IBM QRadar Pack.#

Supported versions

Supported Cortex XSOAR versions: 6.0.0 and later.

Works for QRadar integration version 3, v1 and v2 are deprecated.

Note: You can use the integration to fetch the offense event logs according to the limit defined in the instance settings. Using this playbook you can define an additional search to query a larger number of logs.

Default playbook inputs use QRadar incident fields such as idoffense and starttime. These fields can be replaced, but need to point to relevant offense ID and starttime fields. (Available from Cortex XSOAR 6.0.0).

Dependencies#

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks#

  • QRadarFullSearch

Integrations#

This playbook does not use any integrations.

Scripts#

  • SetAndHandleEmpty
  • Set
  • ChangeContext

Commands#

  • setIncident

Playbook Inputs#


NameDescriptionDefault ValueRequired
MaxLogsCountMaximum number of log entires to query from QRadar50Optional
IDThe QRadar offense ID. Uses the ID offense incident field.incident.idoffenseRequired
StartTimeThe QRadar offense start timeincident.starttimeRequired
GetOnlyCREEventsIf value "OnlyCRE", get only events made by CRE.
Values can be "OnlyCRE", "OnlyNotCRE", "All".
AllOptional
FieldsA comma-separated list of extra fields to get from each event.
You can use different fields or rename the existing fields.
QIDNAME(qid), LOGSOURCENAME(logsourceid), CATEGORYNAME(highlevelcategory), CATEGORYNAME(category), PROTOCOLNAME(protocolid), sourceip, sourceport, destinationip, destinationport, QIDDESCRIPTION(qid), username, PROTOCOLNAME(protocolid), RULENAME("creEventList"), sourcegeographiclocation, sourceMAC, sourcev6, destinationgeographiclocation, destinationv6, LOGSOURCETYPENAME(devicetype), credibility, severity, magnitude, eventcount, eventDirection, postNatDestinationIP, postNatDestinationPort, postNatSourceIP, postNatSourcePort, preNatDestinationPort, preNatSourceIP, preNatSourcePort, UTF8(payload), starttime, devicetimeOptional

Playbook Outputs#


PathDescriptionType
QRadarThe QRadar offense logs.string
QRadar.SourceIPThe unique source IPs.string
QRadar.DestinationIPThe unique destination IPs.string
QRadar.UsernameThe unique user names.string
QRadar.HighLevelCategoryThe unique high level categories.string
QRadar.LowLevelCategoryThe unique low level categories.string
QRadar.QidNameThe unique QID names.string
QRadar.StartTimeThe start time of the first event.string

Playbook Image#


QRadar - Get Offense Logs