Hi Community,
We have IBM QRadar SIEM and IBM SOAR running on-premises and the QRadar SOAR Plugin is working - offenses are successfully escalating into SOAR as incidents.
However, the plugin only brings in the summarized Offense-level fields. We need the full raw event data associated with the offense to also appear inside the SOAR incident - things like resolved IPs, usernames, raw log payloads, event names, ports and protocols.
We already confirmed with IBM Support that this is not natively supported by the plugin and their recommendation was to use the REST API approach.
We also came across a previous community post recommending the use of fn_qradar_integration from the App Exchange with the qradar_search function and an AQL query using UTF8(payload) to capture raw event data.
Before we implement this we have a few questions:
1. Is fn_qradar_search the right function for this use case?
2. How do we correctly pass the offense start_time and stop_time into the AQL query from inside a SOAR Playbook?
3. Is UTF8(payload) the correct field for capturing the full raw log?
4. Any known limitations or gotchas we should be aware of?
Has anyone implemented this successfully and can share any tips?
Thank you.
------------------------------
Danial Maqsood
------------------------------