IBM Security Resilient

Expand all | Collapse all

Adding offenses to existing incidents

  • 1.  Adding offenses to existing incidents

    Posted 4 days ago
    Hi,

    Is it possible to assign/add Offenses to existing incidents -like through Offense ID artifacts-?
    It would be useful when we find out that other offenses are related to one incident after escalation.

    Thank you.

    Adam

    ------------------------------
    Adam
    ------------------------------


  • 2.  RE: Adding offenses to existing incidents

    Posted 3 days ago
    Hi Adam

    The relationship to QRadar Offenses to Resilient Incident is 1:1.
    However, incidents can be related to each other via artifacts, if you choose the
    proper "Related" option on the artifact.  If an artifact exists in more than
    incident, you can see the related incidents in the Artifacts tab when in
    "Graph" mode.

    Hope that helps!

    AnnMarie

    ------------------------------
    AnnMarie Norcross
    ------------------------------