Nikoloz
Im terribly sorry cause my explanation was misunderstood. I'll try again. Your script is ok. However while you walk trhough your response process you work on events identified in the 1st place, right? If that is the case your offense id shown in offense summary doesnt exist yet cause the offense isnt fully created yet.
So you have to wait for the offense id and URL be created in the first place. Of course all other offense attributes are not unique but you can use them to filter your offense search. Your custom offense description can be used for searching unique rules matching. When your rule index is source IP the offenses generated by that rule matching that source will be correlated automatically. You just need to make sure that your offense search runs "neartime" in order to grab the right offense id, e.g. during the next minute. The offense id found would be the one your script is executed on using the source IP found in your offense context.
Hope this helps.
Karl
------------------------------
[Karl] [Jaeger] [Business Partner]
[QRadar Specialist]
[pro4bizz]
[Karlsruhe] [Germany]
[4972190981722]
------------------------------
Original Message:
Sent: Fri February 03, 2023 04:30 AM
From: Nikoloz Tsiklauri
Subject: Offense URL
Karl,
thank you for your response.
But offense names, magnitude and other values are not unique and result is same
------------------------------
Nikoloz Tsiklauri
Original Message:
Sent: Fri January 06, 2023 06:22 AM
From: Karl Jaeger
Subject: Offense URL
Nikoloz
you ran into a problem with offense response. When calling your script offense ID and URL does not exist yet.
so the only way to parse IDs and corresponding URLs is to search for your existing offenses first and parse data to your script.
when using offense names, magnitude or other values that apply you can identify the correct offense that just triggered.
regards
Karl
------------------------------
[Karl] [Jaeger] [Business Partner]
[QRadar Specialist]
[pro4bizz]
[Karlsruhe] [Germany]
[4972190981722]
Original Message:
Sent: Wed December 28, 2022 04:37 AM
From: Nikoloz Tsiklauri
Subject: Offense URL
Hello,
I wrote a custom script using API and python, which sends the URL of the offense to the Slack channel. Scrips works URL is sent. The problem is when a custom action runs it sends an incorrect URL. It sends the previous URL of the offense, not a valid offense URL. I try some custom rules, but the result is the same. I also try to add sleep time in the script, but the script did not run. I tried adding a custom action when creating an offense log, but the result is the same URL is incorrect. I also try the app in QIN-Incident-Notifier, but it has not to feature which I need. I need information on how to add a trigger when creating an offense URL and after running a custom script or any information which helps me to send offense URL to Slack channel
------------------------------
Nikoloz Tsiklauri
------------------------------