Dear Ben,
Thank you for your information,
I have found this documents: "https://www.ibm.com/docs/en/qradar-common?topic=escalations-automatic".
So best practice answer for the "severity" is [5-9]
------------------------------
On Chi Thanh
------------------------------
Original Message:
Sent: Wed July 17, 2024 04:05 AM
From: BEN WILLIAMS
Subject: Define conditions in IBM QRadar SOAR Plugin to forward Offense Event from SIEM to SOAR
Hi Benny,
The plug-in supports fnmatch which does not have as much of a wide choice of expressions compared with regex.
------------------------------
BEN WILLIAMS
Original Message:
Sent: Tue July 16, 2024 11:26 PM
From: On Chi Thanh
Subject: Define conditions in IBM QRadar SOAR Plugin to forward Offense Event from SIEM to SOAR
Dear everyone, I need to filter the Offense from SIEM to SOAR by conditions like pic below.
Triggered condition is (severity > 4 AND description equal to Bruteforce:*).
The problem is that I don't know how to express the operators for "severity" field with the integer format.
May I define simple like ">4" or "\b-?(4|[5-9]|[1-9][0-9]*)\b" (regular expressions) for this case ?
Regards!
------------------------------
Benny On
------------------------------