IBM QRadar SOAR

 View Only
Expand all | Collapse all

How to handle Private IPs coming as artifacts in the SOAR from Qradar

  • 1.  How to handle Private IPs coming as artifacts in the SOAR from Qradar

    Posted 3 days ago

    Hi community , 

    As you know , the QRadar plugin APP will populate IPs and other artifacts in the artifacts tab of an incident in the SOAR , one issue I'm facing is that some of the IPs are Private IPs (which imo should not populate there) , how do you handle excluding these IPs.

    I can see in the plugin page that we can exclude a reference set created in QRadar , but from my understanding you cant add IP ranges in references lists.



    ------------------------------
    mohamad islam hamadieh
    ------------------------------