QRadar Integration Magnitude Query not returning expected results

[jboyd98]

Got a QRadar integration. 
It's suppose to pull back offenses with magnitude > 4

However, our metrics are much higher than what the client expects.

When reviewing this case got pulled into XSOAR:

However, when exporting QRadar, the incident has the following:

In the second column you can see magnitude has a value of 2; so in theory I don't think this should have ever created an incident within XSOAR.

Any thoughts?

Thanks!

[jgomes]

Can you kindly share the integration instance settings? namely the query used for fetch. If set correctly, XSOAR should not be returning any incidents from the API with 'magnitudes' under threshold - used to filter 'fetch'

I also suggest test query in Qradar API playground to ensure it performs as expected. If it doesn't, cross reference the search/query syntax with Qradar documentation, test again Qradar API playground, then update you integration instance in XSOAR.

Hope this helps.

[jboyd98]

Whats confusing is if look at example incident 201769, the magnitude is recorded as 5 under the incident's QRadar Offense tab.

Then if I go run the following in the playground it shows a magnitude of 2.

!qradar-offenses-list offense_id=201769 fields=magnitude

Magnitude

2

Not familiar with QRadar; can a user modify the magnitude of an offense?
Only thing I can think is that we're recording the incident when it's created and then the magnitude is changing on the qradar side.

Though xsoar recorded 400+ incidents for March, and QRadar only has 13 offenses that are >4 in March.  Client says they're not changing.

[vidurasupun]

Can a user modify the  magnitude of an offense?

No, This is a calculation based on the Severity, Relevance and Credibility.  

From the details you have given so far, there is a discrepancy between Q and XSOAR. What you can do here is to use the same query in the QR interactive API guide and find out if the returned result is the same if it is this has to be raised with QR support.

Query Examples  : https://www.ibm.com/docs/en/qsip/7.3.3?topic=api-filter-syntax

API Access guide : https://www.ibm.com/docs/en/qradar-on-cloud?topic=api-accessing-interactive-documentation-page