IBM QRadar

IBM QRadar

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only
  • 1.  Extract events members of an offense by API

    Posted Tue March 24, 2020 01:15 PM
    Hello,

    I would like to find the offense number where my CRE Events (that my fired rule response generates) are member of.
    As there is no "offense number tag" in the event properties, I can test if I find my CRE Event in any opened offenses (by filtering on startime)

    And it works.
    When I POST this search to /ariel/searches :
    SELECT starttime,logsourceid,LOGSOURCENAME(logsourceid),qid,QIDNAME(qid),QIDDESCRIPTION(qid) FROM events WHERE InOffense(27)​ LAST 5 HOURS
    I obtain following result :
    {
      "events": [
        {
          "starttime": 1585067137697,
          "logsourceid": 163,
          "logsourcename_logsourceid": "MainCampusFW",
          "qid": 2000001,
          "qidname_qid": "Traffic Accept",
          "qiddescription_qid": "A packet has been accepted by FW"
        },
        {
          "starttime": 1585067138058,
          "logsourceid": 63,
          "logsourcename_logsourceid": "Custom Rule Engine-8 :: xxxxx0ap",
          "qid": 67500131,
          "qidname_qid": "Compromised Server previously Infected participate to Botnet",
          "qiddescription_qid": "A outgoing connexion happens from previously infected server to C&C (UC #43)"
        }
      ]
    }

    By deduction, if I have a result with my event startime, it means that I have tested the right offense number.

    But this output show only 2 results, whereas in this offense I have multiple times this two types of events :
    qradar offenses

    Why it shows only the first event of each type ? How can I obtain the other events ?

    Thank you so much,

    ------------------------------
    Clément
    ------------------------------


  • 2.  RE: Extract events members of an offense by API

    Posted Wed March 25, 2020 03:01 PM
    Hi Clement
    Just an idea. It should be related with time frame you are using which is 5 hours. Wat is start column show in summary of offenses?
    I just used you AQL to understand what is happening. My start column show 21 March and 5 hours time frame give me only 200 events. But when I increased the time frame 10 days it show me all events related with offenses.

    May be help?
    thanks

    ------------------------------
    Hasan Erhan AYDINOĞLU
    ------------------------------



  • 3.  RE: Extract events members of an offense by API

    Posted Fri March 27, 2020 04:30 AM
    Hello,

    The offense is open since 2 days.
    I found the issue, the events doesn't appear immediately, I try to wait up to 20 minutes yesterday, and nothing (whereas it is in the Offense detail on GUI).

    This morning, my events appears with same AQL request...

    ------------------------------
    Clément
    ------------------------------