IBM QRadar

IBM QRadar

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only
  • 1.  Offense URL

    Posted Wed December 28, 2022 09:31 AM

    Hello,

    I wrote a custom script using API and python, which sends the URL of the offense to the Slack channel. Scrips works URL is sent. The problem is when a custom action runs it sends an incorrect URL. It sends the previous URL of the offense, not a valid offense URL. I try some custom rules, but the result is the same. I also try to add sleep time in the script, but the script did not run. I tried adding a custom action when creating an offense log, but the result is the same URL is incorrect. I also try the app in QIN-Incident-Notifier, but it has not to feature which I need. I need information on how to add a trigger when creating an offense URL and after running a custom script or any information which helps me to send offense URL to Slack channel



    ------------------------------
    Nikoloz Tsiklauri
    ------------------------------


  • 2.  RE: Offense URL

    Posted Fri January 06, 2023 06:23 AM

    Nikoloz


    you ran into a problem with offense response. When calling your script offense ID and URL does not exist yet.
    so the only way to parse IDs and corresponding URLs is to search for your existing offenses first and parse data to your script.
    when using offense names, magnitude or other values that apply you can identify the correct offense that just triggered.

    regards 
    Karl



    ------------------------------
    [Karl] [Jaeger] [Business Partner]
    [QRadar Specialist]
    [pro4bizz]
    [Karlsruhe] [Germany]
    [4972190981722]
    ------------------------------



  • 3.  RE: Offense URL

    Posted Fri February 03, 2023 04:31 AM
    Karl,

    thank you for your response.

    But offense names, magnitude and other values are not unique and result is same

    ------------------------------
    Nikoloz Tsiklauri
    ------------------------------



  • 4.  RE: Offense URL

    Posted Fri February 03, 2023 05:39 AM
    Nikoloz
    Im terribly sorry cause my explanation was misunderstood. I'll try again. Your script is ok. However while you walk trhough your response process you work on events identified in the 1st place, right? If that is the case your offense id shown in offense summary doesnt exist yet cause the offense isnt fully created yet.
    So you have to wait for the offense id and URL be created in the first place. Of course all other offense attributes are not unique but you can use them to filter your offense search. Your custom offense description can be used for searching unique rules matching. When your rule index is source IP the offenses generated by that rule matching that source will be correlated automatically. You just need to make sure that your offense search runs "neartime" in order to grab the right offense id, e.g. during the next minute. The offense id found would be the one your script is executed on using the source IP found in your offense context.
    Hope this helps.
    Karl

    ------------------------------
    [Karl] [Jaeger] [Business Partner]
    [QRadar Specialist]
    [pro4bizz]
    [Karlsruhe] [Germany]
    [4972190981722]
    ------------------------------



  • 5.  RE: Offense URL

    Posted Thu February 16, 2023 01:22 AM

    Hi Nikoloz

    I have seen strange failures in parameter handover and execution of custom action Scripts, when the script is written on a Windows-System. .
    For some reason, which I can´t excplain it makes a difference if your custom action script has CR/LF line breaks like in Windows or jusr or just CR line breaks. 
    Maybe you can give it a try to convert your script with dos2unix prior to uploading. 

    One hint before adding delay: custom action scripts are killed automatically by Qradar if their execution time exceeds 15 seconds. 

    As the chroot-environment for custom action scripts is very limited, we use our ca scripts only to store the received parameters and process the output later with an external application. 

    Regards
    Thomas



    ------------------------------
    SIEM-2020
    ------------------------------