Skip to main content

QRadar - Get Offense Logs

This Playbook is part of the IBM QRadar Pack.#

Supported versions

Supported Cortex XSOAR versions: 6.0.0 and later.

Works for QRadar integration version 3, v1 and v2 are deprecated.

Note: You can use the integration to fetch the events with the offense however it will fetch the events according to the specified limit defined in the instance settings. By using this playbook you can define an additional search to query a larger number of logs.

Default playbook inputs use the QRadar incident fields such as idoffense, starttime. These fields can be replaced but need to point to relevant offense ID and starttime fields.


This playbook uses the following sub-playbooks, integrations, and scripts.


This playbook does not use any sub-playbooks.


  • QRadar_v3


  • Set
  • SetAndHandleEmpty
  • IsIntegrationAvailable
  • ChangeContext


  • qradar-search-retrieve-events
  • setIncident

Playbook Inputs#

NameDescriptionDefault ValueRequired
MaxLogsCountMaximum number of log entires to query from QRadar (default: 50)50Optional
IDThe QRadar offense ID. Uses the id offense incident field.incident.idoffenseRequired
StartTimeThe QRadar offense start timeincident.starttimeRequired
GetOnlyCREEventsIf value "OnlyCRE" get only events made by CRE.
Values can be "OnlyCRE", "OnlyNotCRE", "All".
FieldsA comma-separated list of extra fields to get from each event.
You can replace with different fields as well as rename the field names.
QIDNAME(qid), LOGSOURCENAME(logsourceid), CATEGORYNAME(highlevelcategory), CATEGORYNAME(category), PROTOCOLNAME(protocolid), sourceip, sourceport, destinationip, destinationport, QIDDESCRIPTION(qid), username, PROTOCOLNAME(protocolid), RULENAME("creEventList"), sourcegeographiclocation, sourceMAC, sourcev6, destinationgeographiclocation, destinationv6, LOGSOURCETYPENAME(devicetype), credibility, severity, magnitude, eventcount, eventDirection, postNatDestinationIP, postNatDestinationPort, postNatSourceIP, postNatSourcePort, preNatDestinationPort, preNatSourceIP, preNatSourcePort, UTF8(payload), starttime, devicetimeOptional
ApiVersionThe API version for the timestamp format changes between versions17Optional

Playbook Outputs#

QRadarThe QRadar offense logs.string
QRadar.SourceIPThe unique source ips.string
QRadar.DestinationIPThe unique destination ips.string
QRadar.UsernameThe unique usernames.string
QRadar.HighLevelCategoryThe unique high level categories.string
QRadar.LowLevelCategoryThe unique high low categories.string
QRadar.QidNameThe unique QID names.string
QRadar.StartTimeThe start time of the first event.string

Playbook Image#

QRadar - Get Offense Logs