topic Re: Demisto Siem integration in Cortex XSOAR Discussions

Demisto Siem integration

DanielBenistiPel — Wed, 01 Jul 2020 01:49:47 GMT

Hi,

I want to add Demsito to our soc and integrate it with Qradar.

i saw that Demisto supports this integration, but i didn't find documentation on such operatation.

Thanks!!

Re: Demisto Siem integration

dfalcon — Wed, 03 Jun 2020 04:49:14 GMT

Hi @DanielBenistiPel -

Start off by going to settings and searching for the integration. From there, you can configure the integration and show the commands that are available.

Also, you may get a faster response on XSOAR questions by posting to the Cortex XSOAR section.

Re: Demisto Siem integration

DanielBenistiPel — Wed, 03 Jun 2020 06:15:24 GMT

Thank you!

the reason i'm asking this question is that i want to know the capabilities that i will receive after that i integrate this two products.

for example can i close a case on Qradar when i closed a case on Demisto.

Re: Demisto Siem integration

GShriki — Wed, 03 Jun 2020 15:02:23 GMT

hi,

in general, all integration reference documentation is located here: https://xsoar.pan.dev/docs/reference/index

Specifically, the IBM Qradar: https://xsoar.pan.dev/docs/reference/integrations/q-radar

Also, you can click on the "Show command" under the integration name to actually see the commands it is exposing once an instance is set up

Re: Demisto Siem integration

goasutlor — Wed, 20 Jan 2021 15:11:43 GMT

How about your integrate with Qradar? so far so good?

Because i have problem when i closed incident in demisto and let close offense in Qradar if

there are rule in the offense that use time to be condition in rule and it close before it came

to cold period, the next offense name will display wrong description.

So, Right now i don't close the offense anymore prevent this problem happen again.

Thanks,

Son

Re: Demisto Siem integration

dbaumstein — Wed, 20 Jan 2021 20:08:34 GMT

Hi Son

Could you please elaborate with regards to the flow here? I didn't understand how does closing the incident on XSOAR affects the name of the new offense on QRadar's side, as XSOAR isn't creating the offenses just ingesting them.

Re: Demisto Siem integration

DUhrlaub — Tue, 09 Nov 2021 14:44:30 GMT

Information on the QRADAR integration with XSOAR is at Cortex XSOAR Integration Documentation