IBM QRadar SOAR

IBM QRadar

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  Search Qradar for offense id

    Posted Mon November 25, 2019 08:05 AM
    Hello, 
     Im trying to get some more queries on the workflow. I want to add source IP and destination IP for example.

    DATEFORMAT (startime, 'YYYY-MM-dd HH:mm') as StartTime, NETWORKNAME(sourceip), NETWORKNAME(destinationip), CATEGORYNAME(category), LOGSOURCENAME(logsourceid), PROTOCOLNAME(protocolid),UTF8(payload),RULENAME(creeventlist)

    But the workflow is not working when I add source ip and destination ip. Could be that the NETWORKNAME is innapropiate? Any documentation about thet?

    Thank you.

    ------------------------------
    Aitor Vivanco Santa Cruz
    ------------------------------


  • 2.  RE: Search Qradar for offense id

    Posted Mon December 09, 2019 08:38 AM
    Hello Aitor,

    Thanks for contacting us for information.

    Please double check the spelling. There is a typo "startime" in the DATEFORMAT function call. That could be the reason.

    Also, if you want to verify your AQL query, you can do it from the console. Go to the "Log Activity" tab and select "Advanced Search", and you can paste your AQL query there. This can tell you whether it is a problem of the AQL query or the function integration.

    Thanks,

    Yongjian

    ------------------------------
    Yongjian Feng
    ------------------------------

    Original Message


  • 3.  RE: Search Qradar for offense id

    Posted Mon December 09, 2019 08:39 AM
    First, there is a typo: "startime" should be "starttime".  Second, I cannot exactly tell what info you want, but FYI, you can try out your queries in QRadar's "Log Activity" tab, using "Advanced Search" (be sure to update the drop-down lists for Start Time and End Time accordingly).

    ------------------------------
    Carol Namkoong
    ------------------------------

    Original Message


Related Content