IBM QRadar SOAR

IBM QRadar

Join this online topic group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.


#Security
#QRadar
#SecuringhybridcloudandAI
 View Only

  • 1.  Clarification on scheduler application

    Posted 09/03/21 05:45 PM
    The documentation for the scheduler application is pretty lacking.

    Can the scheduler be used to launch functions / workflows within the resilient applciation. For instance, a function in resilient named Qradar Add to Reference Set. If so can you provide an example.

    Or can anyone share examples of what they have done with the scheduler app.

    ------------------------------
    Tyler Bennett
    ------------------------------


  • 2.  RE: Clarification on scheduler application

    Posted 09/09/21 03:23 AM
    I did use the scheduler to launch a rule every hour, on some incident type, as long as the incident was open, I was looking for the new correlation rules from the QRadar offense. The Offense is modified by new correlation rule, but the information is not pushed to the SOAR. This was allowing me to check this, and update the table.
    I am using a simple menu item rule, when QRadar ID as a value that run the OOTB QRadar fetching contributing rules for Offense (I may have changed the name)

    ------------------------------
    BENOIT ROSTAGNI
    ------------------------------



Related Content