Hi Team

I have a scenario where I need to access the list of tasks for an incident and modify them based on certain conditions from within scripts. Any help regarding the same would be appreciated.

Thanks
Preetham

------------------------------
Fnu Preetham Nagesh
------------------------------

Hi,

I am answering this question cause its quite typical these days. Here is my 101 for asking questions to the QRadar community.

1. what is your environment based on? because of the rapid development of our QRadar security suite its quite unclear where your question comes from. For your help here is the new architecture as of April 2023. for classical environments  additional info about on prem / cloud and VM based vs. appliance can help
2. incidents in classic QRadar are named offenses. While you are anylyzing it, you decide if it is a (security) incident or not! The response can be scripted.
3. when using scripts to work on incidents name of the program language helps a lot. Even standard Qradar SIEM has several options and QRadar+ has much more for programming playbooks and making SOAR even more exciting!
4. when you place your question here the assumtion always is you talk about standard QRadar. In that case your design on how to handle offenses using script based decisions is very vague. Best tip I can give based on your input is have a look at QRadar+ and SOAR suite first!

Best Regards

Karl

------------------------------
[Karl] [Jaeger] [Business Partner]
[QRadar Specialist]
[pro4bizz]
[Karlsruhe] [Germany]
[4972190981722]
------------------------------