Hi,

With qradar application, only artifact with ip types can added to incident. I  have seen a macro for additional artifacts in template:

{%- macro artifact(type, value, description, properties=()) -%}
	   {"value": "{{ value }}",
	    "type": "{{ type }}",
	    "description": "{{ description }}",
         "properties": [
                     {% for property in properties -%}
                     {"name": "{{ property.name }}",
                      "value": "{{ property.value }}"
                     }{% if not(loop.last) %},{% endif %}
                     {%- endfor %}
      ]
	   }
{%- endmacro %}​

But it couldn't add any artifact (only ip). 
Any advice would be appreciated.

Regards

------------------------------
Jasmine
------------------------------

Hi Jasmine,
Thank you for raising this in the community. 

I took a look at this and feel I have some insight to share: 
These macros are a concept from Jinja. 
https://jinja.palletsprojects.com/en/2.11.x/templates/#macros

When I look at the same template which I think is the most recent version, lower in the file I see this logic : 

{%- if offense.offense_type in (0, 10) -%}
     {{ artifact("IP Address", offense.offense_source, description, properties=[{"name": "source", "value": "true"}]) }}
     {% elif offense.offense_type in (1, 11) %}
     {{ artifact("IP Address", offense.offense_source, description, properties=[{"name": "destination", "value": "true"}]) }}
     {% elif offense.offense_type == 3 %}
     {{ artifact("User Account", offense.offense_source, description) }}
     {% elif offense.offense_type == 4 %}
     {{ artifact("MAC Address", offense.offense_source, description, properties=[{"name": "source", "value": "true"}]) }}
     {% elif offense.offense_type == 5 %}
     {{ artifact("MAC Address", offense.offense_source, description, properties=[{"name": "destination", "value": "true"}]) }}
     {% elif offense.offense_type == 7 %}​

This could be the reason only IP artifacts are being raised. 
My understanding here is that based on the offense type an artifact of a specific type is raised. But due to the first two parts of this : 

{%- if offense.offense_type in (0, 10) -%}

AND 

{%- elif offense.offense_type in (1, 11) -%}

Only IP Address is added. Could you confirm if the offenses you are dealing with are these type ID's ? If your offense_type is 0,1,10 or 11 an IP will be added. If all of this is true for you what other artifacts would you be looking to raise in this case ? 


Hoping others from my team can comment but let me know if the above is helpful.

------------------------------
Ryan Gordon
Security Software Engineer
IBM
------------------------------

Hi Ryan,

I appreciated your anwser. Seems that default template couldn't add required artifacts. I have to fetch from event.

Best


------------------------------
Jasmine
------------------------------

Original Message:
Sent: Tue June 16, 2020 12:32 PM
From: Ryan Gordon
Subject: Qradar - Resilient Application : Adding More Artifacts

Hi Jasmine,
Thank you for raising this in the community. 

I took a look at this and feel I have some insight to share: 
These macros are a concept from Jinja. 
https://jinja.palletsprojects.com/en/2.11.x/templates/#macros

When I look at the same template which I think is the most recent version, lower in the file I see this logic : 

{%- if offense.offense_type in (0, 10) -%}     {{ artifact("IP Address", offense.offense_source, description, properties=[{"name": "source", "value": "true"}]) }}     {% elif offense.offense_type in (1, 11) %}     {{ artifact("IP Address", offense.offense_source, description, properties=[{"name": "destination", "value": "true"}]) }}     {% elif offense.offense_type == 3 %}     {{ artifact("User Account", offense.offense_source, description) }}     {% elif offense.offense_type == 4 %}     {{ artifact("MAC Address", offense.offense_source, description, properties=[{"name": "source", "value": "true"}]) }}     {% elif offense.offense_type == 5 %}     {{ artifact("MAC Address", offense.offense_source, description, properties=[{"name": "destination", "value": "true"}]) }}     {% elif offense.offense_type == 7 %}​

This could be the reason only IP artifacts are being raised. 
My understanding here is that based on the offense type an artifact of a specific type is raised. But due to the first two parts of this : 

{%- if offense.offense_type in (0, 10) -%}AND {%- elif offense.offense_type in (1, 11) -%}

Only IP Address is added. Could you confirm if the offenses you are dealing with are these type ID's ? If your offense_type is 0,1,10 or 11 an IP will be added. If all of this is true for you what other artifacts would you be looking to raise in this case ? 


Hoping others from my team can comment but let me know if the above is helpful.

------------------------------
Ryan Gordon
Security Software Engineer
IBM
------------------------------