Skip to main content

TIM - QRadar Add Url Indicators

Supported versions

Supported Cortex XSOAR versions: 5.5.0 and later.

This playbook queries indicators based on a pre-defined query or results from a parent playbook, and adds the resulting indicators to a QRadar Reference Set. The Reference Set name must be defined in the playbook inputs.

Dependencies#

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks#

This playbook does not use any sub-playbooks.

Integrations#

  • QRadar_v2
  • QRadar

Scripts#

This playbook does not use any scripts.

Commands#

  • appendIndicatorField
  • qradar-update-reference-set-value

Playbook Inputs#


NameDescriptionDefault ValueRequired
QRadarBlackListUrlReferenceSetNameThe name of the QRadar black list Url reference set to insert the data in to.Optional
Indicator QueryIndicators matching the indicator query will be used as playbook inputOptional
QRadarWhiteListUrlReferenceSetNameThe name of the QRadar white list Url reference set to insert the data in to.Optional
QRadarWatchListUrlReferenceSetNameThe name of the QRadar watch list Url reference set to insert the data in to.Optional

Playbook Outputs#


There are no outputs for this playbook.

Playbook Image#


Playbook Image