03-29-2023 07:50 AM - edited 03-29-2023 08:46 AM
Hi all, I have a problem with QRadar integration. Let me summarize my environment and basic configuration.
Cortex XSoar version: 6.10.0
QRadar integration version: IBM QRadar v3
Mapper: QRadar - Generic Incoming Mapper
Incident type: Qradar Generic
Event an fields to return from the events query: QIDNAME(qid), LOGSOURCENAME(logsourceid), CATEGORYNAME(highlevelcategory), CATEGORYNAME(category), PROTOCOLNAME(protocolid), sourceip, sourceport, destinationip, destinationport, QIDDESCRIPTION(qid), username, PROTOCOLNAME(protocolid), RULENAME("creEventList"), sourcegeographiclocation, sourceMAC, sourcev6, destinationgeographiclocation, destinationv6, LOGSOURCETYPENAME(devicetype), credibility, severity, magnitude, eventcount, eventDirection, postNatDestinationIP, postNatDestinationPort, postNatSourceIP, postNatSourcePort, preNatDestinationPort, preNatSourceIP, preNatSourcePort, UTF8(payload), starttime, devicetime (Note: it is the default one).
The connection with QRadar istance works fine and I'm able to fetch offenses.
When an incident is pulled, for every incident, the associated PlayBook ends with following error:
Failed to execute qradar-searches command. Error: Could not create search for offense_id:
Now, I attached other QRadar istances to our cortex XSoar and never got this error. So, there is a difference between this specific istances and the current one? Yes, we have some custom fields created for reports and Offense ID is one of them.
So, my assumptions/doubts are:
03-30-2023 08:50 PM
since you are working with Qradar V3 and need to retrive events try the below search, feel free to change the event ID.
!qradar-search-retrieve-events query_expression="SELECT * from events where \"EventID\"='4624' limit 2 "
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!