XSOAR Qradar Ingestion

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

XSOAR Qradar Ingestion

L2 Linker

I am attempting to ingest Qradar into the XSOAR using the Integration. I need to pull custom fields from the SIEM  and what I need to understand is as follows;

Is it preferable to pull these fields within an AQL Search at the playbook stage ?

Or is it preferable to pull these fields from Qradar Integration setting ? 

The use case is as follows;

I am dealing with a SIEM that has different fields assigned per offence type. For example, Target Domain(Custom) appears in a particular offence and under a different name in a different offence. I do not have access to change the Qradar Fields.

My preferable solution would be to perform a search according to each type within the playbook. 

Can someone provide me with an example of a simple AQL Query for pulling a Custom field and its contents for a specific offence ?

Thanks in Advanced

1 ACCEPTED SOLUTION

Accepted Solutions

L3 Networker

Hi,

Unless you have a special reason to do it form the playbook then to set it in the integration instance setting would be proffered:
1. You'll save resources by not executing unnecessary commands in the playbook
2. You'll be able to map those Qradar custom fields using the Classification & Mapping XSOAR feature, which will also allow the optimal usage of pre-processing rules and more.

In this care you I think that it all depends on the amount of custom fields, and based on that you'll know which approach is better for you.

Please contact IBM regarding technical questions for Qradar's AQL, examples can be found here:
https://www.ibm.com/docs/en/qsip/7.4?topic=aql-ariel-query-language

thanks.


View solution in original post

1 REPLY 1

L3 Networker

Hi,

Unless you have a special reason to do it form the playbook then to set it in the integration instance setting would be proffered:
1. You'll save resources by not executing unnecessary commands in the playbook
2. You'll be able to map those Qradar custom fields using the Classification & Mapping XSOAR feature, which will also allow the optimal usage of pre-processing rules and more.

In this care you I think that it all depends on the amount of custom fields, and based on that you'll know which approach is better for you.

Please contact IBM regarding technical questions for Qradar's AQL, examples can be found here:
https://www.ibm.com/docs/en/qsip/7.4?topic=aql-ariel-query-language

thanks.


Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!