Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add fields in offensesummary query #82

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

IMSdevsecu
Copy link

Description

Add usefull fields in offensesummary query to populate result and therefore be able to run logic on those result fields : status, domain, startTime and lastUpdatedTime

Motivation and Context

I would like to have those fields to run playbooks that check the offense status and domain before doing other checks.
Getting offense status from Qradar is usefull in case sync between QRadar and SOAR is down for some times. Status is never updated for old offense then. Returning those fields allows to create a playbook that would, for example, resync status for offense comparing status in QRadar and Resilient to ensure consistancy.
StartTime and LastUpdatedTime will be usefull for futur playbook I plan to create.

How Has This Been Tested?

Query tested on : https://qradar_instance/console/graphql

Checklist:

  • I have added a Signed-off-by
  • Either no new documentation is required by this change, OR I added new documentation
  • Either no new tests are required by this change, OR I added new tests
  • I have run pep8 and pylint. I have cleaned up all valid errors and warnings in code I have added or modified. These tools may generate false positives. Don't be worried about ignoring some errors or warnings. The goal is clean, consistent, and readable code.

Signed-off-by: IMSdevsecu [email protected]

Add usefull fields in offensesummary query to populate result and therefore be able to run logic on those result fields : status, domain, startTime and lastUpdatedTime
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant