IBM QRadar SOAR

IBM QRadar

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  Enhance Email Parser Function and add results in Notes and Artifact Description

    Posted Wed August 28, 2019 09:48 AM
      |   view attached
    Prerequisit : have the Utility Functions  integration installed and configured  Link to App Exchange
    Purpose : Enhance the standard information given by this integration in Artifact Description & Note
    and remove the Action button Email Parsing (Artifact) if already done
    Changes :
    • New Rule Email Parsing (Artifact) and Email Parsing (Attachment)
    • New Workflows
      • Email Parsing Artifact as duplicate of the Example: Email Parsing Artifact with changes in post process scripts
      • Email Parsing Attachment as duplicate of the Example: Email Parsing Attachment with changes in post process scripts
    Previous Rules from this package can be desactivated or removed

    Results in Note:
    from Attachement

    from Artifact
    and in Artifact description:
    Attached is the res file to import this configuration.
    Feel free to use, change, adapt this code to your usage.

    Building the res file:
    resilient-circuits extract --workflow "email_parsing_artifact" "email_parsing_attachment" --rule "Email Parsing (Artifact)" "Email Parsing (Attachment)" -o config_MAILparser.res --zip


    ------------------------------
    BENOIT ROSTAGNI
    ------------------------------

    Attachment(s)

    zip
    config_MAILparser.res.zip   23 KB 1 version


  • 2.  RE: Enhance Email Parser Function and add results in Notes and Artifact Description

    Posted Thu January 09, 2020 06:17 PM
    Has anyone increased the usability of this function by adding the ability to parse the incident notes field as well?

    ------------------------------
    Ryan Terry
    ------------------------------

    Original Message


  • 3.  RE: Enhance Email Parser Function and add results in Notes and Artifact Description

    Posted Fri January 10, 2020 11:19 AM
    Ryan,

    Can you explain what you mean?

    ------------------------------
    Jared Fagel
    Cyber Security Analyst I
    Public Utility
    ------------------------------

    Original Message


  • 4.  RE: Enhance Email Parser Function and add results in Notes and Artifact Description

    Posted Fri January 10, 2020 12:07 PM
    I mistakenly replied to this thread. I meant to add the question to the IOC Parser Function thread.

    ------------------------------
    Ryan Terry
    ------------------------------

    Original Message