IBM Security QRadar SOAR

 View Only
  • 1.  How can I trigger workflow without IBM Qradar offense in Qradar SOAR?

    Posted Thu April 21, 2022 07:52 AM
    Hi team,

    How can we run a workflow on IBM Resilient based on a query from Splunk? For example, workflow runs automatically when there is a malware type offense from IBM Qradar. But can I automatically trigger a workflow in IBM Resilient with the output of a query that runs at certain intervals in Splunk?

    tHANKS


    ------------------------------
    Betul Uyanik
    ------------------------------


  • 2.  RE: How can I trigger workflow without IBM Qradar offense in Qradar SOAR?

    Posted Fri April 22, 2022 08:33 AM
    Hi Betul,

    Take a look at our fn_scheduler app: https://exchange.xforce.ibmcloud.com/hub/extension/4917b8a4bb53c46a7c63efa4e65238e4. There are a number of ways to schedule rules (ie workflows) from a function.  We're adding capability to work with playbooks now as that is our new capability replacing rules/workflows ongoing.

    Regards,
    Mark

    ------------------------------
    Mark Scherfling
    ------------------------------



  • 3.  RE: How can I trigger workflow without IBM Qradar offense in Qradar SOAR?

    Posted Mon April 25, 2022 11:57 AM

    Hi Betul,

    How is the output of Splunk query presented to SOAR? If that is stored in an incident field - you can configure an automatic rule to trigger whenever that fields changes or has a certain value. There are other objects on which the automatic rule can also be configured to trigger



    ------------------------------
    Chaitanya Challa
    ------------------------------



  • 4.  RE: How can I trigger workflow without IBM Qradar offense in Qradar SOAR?

    Posted 30 days ago
    If you choose to go this route I recommend using Playbook instead of a Rule. Playbooks are the way of the future.

    Ben

    ------------------------------
    Ben Lurie
    ------------------------------