IBM QRadar SOAR

IBM QRadar

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  Accept FQDN or Domain name as URL

    Posted Mon May 27, 2019 08:20 AM
    Hi All,
    We are having error messages on integration trying to fill in artifact type URL.
    Some times the field is a URL like http:// or https://
    sometimes the field value is just a FQDN or domain name.

    Currently, the inciedent creation is being rejected by Resilient because of mismatch of type
    Is it possible to accept the FQDN or domain name as URLs?
    Thanks,

    ------------------------------
    Qing Lan
    ------------------------------


  • 2.  RE: Accept FQDN or Domain name as URL

    Posted Mon May 27, 2019 08:45 PM
    Edited by LILY WANG Mon May 27, 2019 08:45 PM
    Hi Qing,

    When you create an artifact with URL type, the value has to match the format "(http|https|file|gopher|ftp):\/\/[^\s]+", so it's not possible to add a URL type artifact using domain name only. 
    For FQDN or domain name, you can consider to add as a "DNS" type artifacrt which has the format "[a-zA-Z0-9\-.]+".

    ------------------------------
    LILY WANG
    ------------------------------

    Original Message


  • 3.  RE: Accept FQDN or Domain name as URL

    Posted Tue May 28, 2019 01:25 AM
    You can create a new artifact type called URL that will not have this rule. You'll have to rename the original URL one.

    We did the same for File Path that was requiring the file to be able to add it.

    ------------------------------
    Clément Fouque
    ------------------------------

    Original Message