Skip to content

QRadarAutoClose#

README

Simple responder to close a QRadar Offense through a simple clic !

If you need to change the customfield which contain the QRadar Offense ID, change the "externalReferences" from QRadarAutoClose.py line 15. Be careful this have to be fulfill with the "Internal Reference" of the customfield, not it's name !

QRadar_Auto_Closing_Offense#

Author: Florian Perret
License: AGPL-V3
Version: 1.0
Supported data types:
- thehive:case
Registration required: N/A
Subscription required: N/A
Free subscription: N/A
Third party service: N/A

Description#

Closing the QRadar Offense associated to your case in one clic !

Configuration#

QRadar_API_Key A QRadar API key with sufficent rights to close an offense
Default value if not configured N/A
Type of the configuration item string
The configuration item can contain multiple values False
Is required True
QRadar_Url URL of your QRadar API, must be accessible from Cortex server. eg: myqradar.myorg.com/api/siem/offenses
Default value if not configured N/A
Type of the configuration item string
The configuration item can contain multiple values False
Is required True
Cert_Path If you need a certificate to authentificate to your QRadar API, please provide the path here
Default value if not configured N/A
Type of the configuration item string
The configuration item can contain multiple values False
Is required False

Last update: October 16, 2020 10:16:06