Hii,
first thanks for your answer!
it's a problem because the event gives me only the offense created.
not the domain, and the description of the domain.
------------------------------
Raz Rossaby
------------------------------
Original Message:
Sent: Tue December 06, 2022 03:27 AM
From: Dusan VIDOVIC
Subject: offenses report
Maybe you can use the search on OffenseCreated event (QID 28250369) generated by internal SIM Audit log source.
------------------------------
Dusan VIDOVIC
Original Message:
Sent: Mon December 05, 2022 10:13 AM
From: Raz Rossaby
Subject: offenses report
Hello,
I want to create monthly offenses report for one domain.
the problem is that I want only those fields: ID, description, created time.
I know how to create custom events report but offenses only the default fields of the Qradar.
thanks!
------------------------------
Raz Rossaby
------------------------------