Hello everyone,

I'm new around here and currently learning how to use QRadar. We've successfully installed the QRadar SIEM plugin for SOAR, and and can now send offenses to SOAR using the "Send to SOAR" button. However, we're facing an issue where the artifact field isn't automatically populated, and we have to fill it in manually. Does anyone have any tips on how to automatically include all IoCs from events in offense into artifacts?

Best regards, Hanif

Hi Hanif,

You can build a new template from escalations tab in QRadar SIEM plugin for SOAR and select the checkbox for "Source Addresses", "Local Destination Addresses " and "Offense Source" to generate artifacts automatically for them in SOAR. You can also map other offense fields (if needed) to create custom artifacts. You need to use this template while escalating offenses to SOAR.