IBM QRadar SOAR

IBM QRadar

Join this online topic group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.


#Security
#QRadar
#SecuringhybridcloudandAI
 View Only

  • 1.  Resilient App for Qradar : Automatic Escalation Problem

    Posted 05/26/20 10:06 AM

    Hi,

    I want to escalate offense with description 'VPN - User not logged in for 3 days' automatically into Resilient from QRadar using below rule:



    But, it doesn't automatically escalated. Is there any way to configure this?
    Thank you.


    ------------------------------
    Futuhal Annasri
    ------------------------------


  • 2.  RE: Resilient App for Qradar : Automatic Escalation Problem

    Posted 06/03/20 02:57 PM
    Hi Futuhal

    Your rule looks correct...but it will only escalate offenses that occur in the future (not the past).


    ------------------------------
    AnnMarie Norcross
    ------------------------------



  • 3.  RE: Resilient App for Qradar : Automatic Escalation Problem

    Posted 06/04/20 08:46 AM
    Futuhal,

    Does your escalation template (improper usage) fill in all the required fields for an incident to be created? (the red star is next to them on the template)

    Also you can check the logs for the app (inside the app host or wherever it is installed) to see if you can gleam something else.

    Rich

    ------------------------------
    Richard Giesige
    Security Engineer
    Oshkosh Corporation
    Oshkosh
    ------------------------------



Related Content