https://live.paloaltonetworks.com/t5/cortex-xsoar-discussions/get-raw-log-with-ibm-qradar-integrations-for-corex-xsoar/m-p/547016#M2264 <P>Hi all, we are bulding a playbook on our XSOAR integration that, after pulling an offense from a QRadar istance, send a mail related to it and enrich the message with some html code and other customizations.</P> <P>Our SOC asked us to include, in the mail sent by SOAR, the raw log of the event that generate the offese.</P> <P>So for example, if we have a succesfull brut force, the mail must send all required data and the raw log of succesfull login.&nbsp;</P> <P>If, on SOAR, we go on an incident page and see available field, we can see that there is a field "raw log", but is empty; our suspect is that it is not gained when SOAR pull data with the API call.<BR />In QRadar integration documentation we didn't find a method able to pull the raw log; our mistake or this method does not exist?</P> Fri, 23 Jun 2023 14:36:08 GMT lsepe434 2023-06-23T14:36:08Z https://live.paloaltonetworks.com/t5/cortex-xsoar-discussions/get-raw-log-with-ibm-qradar-integrations-for-corex-xsoar/m-p/547016#M2264 <P>Hi all, we are bulding a playbook on our XSOAR integration that, after pulling an offense from a QRadar istance, send a mail related to it and enrich the message with some html code and other customizations.</P> <P>Our SOC asked us to include, in the mail sent by SOAR, the raw log of the event that generate the offese.</P> <P>So for example, if we have a succesfull brut force, the mail must send all required data and the raw log of succesfull login.&nbsp;</P> <P>If, on SOAR, we go on an incident page and see available field, we can see that there is a field "raw log", but is empty; our suspect is that it is not gained when SOAR pull data with the API call.<BR />In QRadar integration documentation we didn't find a method able to pull the raw log; our mistake or this method does not exist?</P> Fri, 23 Jun 2023 14:36:08 GMT https://live.paloaltonetworks.com/t5/cortex-xsoar-discussions/get-raw-log-with-ibm-qradar-integrations-for-corex-xsoar/m-p/547016#M2264 lsepe434 2023-06-23T14:36:08Z https://live.paloaltonetworks.com/t5/cortex-xsoar-discussions/get-raw-log-with-ibm-qradar-integrations-for-corex-xsoar/m-p/547025#M2268 <P>Hello, you can pull the raw log into xSoar using the integration setting for "event fields to return". You can add the name of the rawlog field in Qradar(I think the rawlog field is called payload) and xSoar will pull that into the mapper, then you can map that an incident field and it will be available in your playbooks.&nbsp;<A href="https://xsoar.pan.dev/docs/reference/integrations/q-radar-v3#configure-qradar-v3-on-cortex-xsoar" target="_blank">https://xsoar.pan.dev/docs/reference/integrations/q-radar-v3#configure-qradar-v3-on-cortex-xsoar</A></P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="nnieuwendam_0-1687533503224.png" style="width: 400px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/51112i9EAA6AC296090EFF/image-size/medium/is-moderation-mode/true?v=v2&amp;px=400" role="button" title="nnieuwendam_0-1687533503224.png" alt="nnieuwendam_0-1687533503224.png" /></span></P> <P>&nbsp;</P> Fri, 23 Jun 2023 15:22:59 GMT https://live.paloaltonetworks.com/t5/cortex-xsoar-discussions/get-raw-log-with-ibm-qradar-integrations-for-corex-xsoar/m-p/547025#M2268 JP_Nieuwendam 2023-06-23T15:22:59Z