06-23-2023 07:36 AM
Hi all, we are bulding a playbook on our XSOAR integration that, after pulling an offense from a QRadar istance, send a mail related to it and enrich the message with some html code and other customizations.
Our SOC asked us to include, in the mail sent by SOAR, the raw log of the event that generate the offese.
So for example, if we have a succesfull brut force, the mail must send all required data and the raw log of succesfull login.
If, on SOAR, we go on an incident page and see available field, we can see that there is a field "raw log", but is empty; our suspect is that it is not gained when SOAR pull data with the API call.
In QRadar integration documentation we didn't find a method able to pull the raw log; our mistake or this method does not exist?
06-23-2023 08:22 AM
Hello, you can pull the raw log into xSoar using the integration setting for "event fields to return". You can add the name of the rawlog field in Qradar(I think the rawlog field is called payload) and xSoar will pull that into the mapper, then you can map that an incident field and it will be available in your playbooks. https://xsoar.pan.dev/docs/reference/integrations/q-radar-v3#configure-qradar-v3-on-cortex-xsoar
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
