How to Export JSON of a Specific QRadar Offense for XSOAR Use

[JesusAngel]

Hi everyone,

I’m working on a QRadar integration (v2.5.7) in Cortex XSOAR (v6.12) and need to generate a JSON file for a specific offense to use in several scenarios, such as configuring an incident classifier. For example, in the classifier editor, you can upload a JSON file to analyze the data structure and map the fields correctly.

Here’s the situation:

• When I use the "Pull from instance" option with the QRadar v3 integration, XSOAR loads random incident data instead of the one I want.
• I want to export the JSON for a specific offense, such as #12 509 Impossible Travel Detected containing Primary Authentication Success.

I’ve tried running !js script="return ${.}" in the War Room of the specific incident, but the JSON it returns contains significantly more fields than the one shown in the classifier editor when pulling data from QRadar.

I’ve also considered using the command:

!get-remote-data id=<offense_id> lastUpdate=<date_str>  

to fetch the JSON for this specific offense. Is this the right approach to generate the JSON, or is there a better method?

Additionally, is it possible to extract the exact JSON used by XSOAR when it pulls data for the incident directly from QRadar, without additional fields or transformations?

Thanks in advance for your help!