IBM QRadar SOAR

IBM QRadar

Join this online topic group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.


#Security
#QRadar
#SecuringhybridcloudandAI
 View Only
Back to discussions
Expand all | Collapse all

QRadar Reference Set Function Help

  • 1.  QRadar Reference Set Function Help

    Posted 08/14/20 03:14 PM
    Hello All,

    I'm a newb here having an issue with a QRadar Reference Set function when my artifact has an @ character in it. I'm using the functions to check reference sets for an email and then removing it and then adding it to another reference set. It works fine with checking ​and removing an email but it is populating the reference set value for the reference set I'm adding it to with unicode (%40).

    See example below
    - Function 1 (delete artifact value from ref set A) > Function 2 (add artifact value to ref set B)

    Function 1 deletes user@email.com from ref set A as expected
    Function 2 adds user%40email.com to ref set B?

    I could live with this if future rules could observe and search %40 & @ in reference sets interchangeably but it does not. Does anyone know how to work around this? Thanks!

    Mr Coco​

    ------------------------------
    Mr Coco
    ------------------------------


Related Content