IBM QRadar SOAR

IBM QRadar

Join this online topic group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.


#Security
#QRadar
#SecuringhybridcloudandAI
 View Only
  • 1.  Perch Integration

    Posted 08/16/19 12:02 PM
    Good Morning Community

    I am looking for some kind of documentation or help for Perch Integration with Resilient through Email Parsing or any other way which works

    Thank you ​

    ------------------------------
    Fawad Majid
    ------------------------------


  • 2.  RE: Perch Integration

    Posted 08/19/19 03:16 PM
    Hi Fawad,

    We don't have a specific integration for Perch CRM. Depending on what you need to include from Perch in a created incident, it may be have the basics you need to get you started.  Review the documentation for the Email Parsing script to understand its behavior. Here's an excerpt: 

    The script is intended to perform generic email parsing on newly created email message objects. It performs the following:
    * Checks if an existing incident exists whose title reflects the email message received.
    * If so, it associates the email message with the existing incident.
    * If not, it:
    * Creates a new incident with a suitable title.
    * Associates the email message with the new incident.
    * Adds the email message's subject as an artifact to the new incident.
    * Sets the incident's reporter field to be the email address that sent the message.
    * Parses the email body text looking for URLs, IP addresses and file hashes. After filtering out invalid and whitelisted values, it adds the remaining data to the incident as artifacts.
    * Adds non-inline email message attachments to the incident.

    Good luck.

    ------------------------------
    Mark Scherfling
    ------------------------------