I'm working with IBM SOAR integrated with QRadar. Currently, when an offense is triggered, SOAR runs an AQL search in QRadar, retrieves the data, parses it, then creates a ticket in my ITSM system and sends an email notification. This works fine for single offenses.

However, in my manual monitoring process, we handle repeated offenses differently. When the same type of offense occurs again, instead of creating a new ticket, we either:

• Reply to the previous email, adding the new offense details there, or

• Keep a single ITSM ticket open and update it with information about all repeated offenses of the same type.

I want to achieve this same behavior in SOAR - so that repeated offenses don't generate new tickets every time, but instead update the existing ticket or email thread with the new data. How can I configure SOAR to handle offenses in this way?

Hi Ajay,

There is no functionality in SOAR that does this. When you refer to "SOAR" are you referring to a playbook or workflow utilising one or more applications? If yes, then this is not SOAR making these AQL or API calls but applications or more specifically functions inside a workflow or playbook.

The plug-in (https://apps.xforce.ibmcloud.com/extension/af77a0cbaed13627810099dfc57db6d2) does this. It stores the offense ID in incident.properties.qradar_id. If there is an update to the offense the plug-in will search SOAR for the offense ID and if it is found it will update that incident as opposed to creating a new one. I suppose a similar process could be used in your case. You are free to download the plug-in and examine the code to see for yourself how it works.