IBM QRadar SOAR

IBM QRadar

Join this online topic group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.


#Security
#QRadar
#SecuringhybridcloudandAI
 View Only

  • 1.  Artifacts are Missing when Send from QRadar to SOAR

    Posted 10/13/21 07:36 AM
    Dear All,

    We are facing a Problem that when we Send Incident From QRadar to IBM SOAR using some incident type where we have multiple artifacts.
    In my case I have single source IP but multiple Destination IPs but when we escalate the case from QRadar to SOAR some time we get only source IP some time we only get Destination IP and some time both. We need to get both SOURCE AND DESTINATION IP for every incident. Kindly tell me if I am missing something.

    Regards
    ASAD AFTAB

    ------------------------------
    Asad Aftab
    ------------------------------


  • 2.  RE: Artifacts are Missing when Send from QRadar to SOAR

    Posted 10/13/21 05:29 PM
    it depends on the configuration you have in the offense, and in the send to SOAR from QRadar, the mapping template:
    of the element are not visible, it is because it does not match the criterias here, like for custom properties.

    I suggest that you look at the App on App Exchange:
    • QRadar Functions for SOAR to get any custom properties using Ariel queries to build inside the app
    • QRadar Enhanced Data Migration to get a list of OOTB information from the offense



    ------------------------------
    BENOIT ROSTAGNI
    ------------------------------



  • 3.  RE: Artifacts are Missing when Send from QRadar to SOAR

    Posted 10/15/21 02:20 AM
    Hello @BENOIT ROSTAGNI

    We ​already check configuration  in the offense, and in the send to SOAR from QRadar, the mapping template. The configuration satisficed the condition but still we are not able to get the whole artifacts set(Source IP and Destination IP).
    ​​

    ------------------------------
    Asad Aftab
    ------------------------------

    Original Message


Related Content