Guillaume BOURGEOIS
fd64c245f4
QRadar REST API, 8 commands: list/get offenses, update offense (close/assign), list reference sets, add/remove reference-set value (block lists), list assets. SEC-token auth, stdlib-only. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
102 lines
3.7 KiB
YAML
102 lines
3.7 KiB
YAML
id: qradar
|
|
name: IBM QRadar
|
|
version: 1.0.0
|
|
description: "IBM QRadar (REST API) — SIEM investigation and response: list and read offenses, update/close an offense, list reference sets and add/remove values (block/allow lists used by rules), and list assets. SEC-token authentication; stdlib-only, no extra Python dependencies."
|
|
changelog: "1.0.0 — Initial release: list/get offenses, update offense, list reference sets, add/remove reference-set value, list assets."
|
|
category: siem
|
|
|
|
# Per-instance configuration. The API token is sent as the 'SEC' header.
|
|
config_schema:
|
|
properties:
|
|
base_url:
|
|
type: string
|
|
description: "QRadar console URL (e.g. https://qradar.example.com)"
|
|
api_token:
|
|
type: string
|
|
description: "QRadar authorized service (SEC) token"
|
|
x-soar-sensitive: true
|
|
insecure:
|
|
type: boolean
|
|
description: "Trust any TLS certificate (not secure)"
|
|
default: false
|
|
required:
|
|
- base_url
|
|
- api_token
|
|
|
|
commands:
|
|
- id: list_offenses
|
|
name: qradar-list-offenses
|
|
description: "List offenses (optionally filtered)."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
filter: { type: string, description: "QRadar filter expression (e.g. status=OPEN)" }
|
|
limit: { type: number, description: "Max offenses (default 50)" }
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
- id: get_offense
|
|
name: qradar-get-offense
|
|
description: "Get a single offense by ID."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
offense_id: { type: string, description: "Offense ID" }
|
|
required: [offense_id]
|
|
outputs_schema: { properties: {} }
|
|
- id: update_offense
|
|
name: qradar-update-offense
|
|
description: "Update an offense (status, assignee, or close with a reason)."
|
|
inputs_schema:
|
|
properties:
|
|
offense_id: { type: string, description: "Offense ID" }
|
|
status: { type: string, description: "OPEN, HIDDEN, or CLOSED" }
|
|
assigned_to: { type: string, description: "Assignee username" }
|
|
closing_reason_id: { type: string, description: "Closing reason ID (required when status=CLOSED)" }
|
|
required: [offense_id]
|
|
outputs_schema: { properties: {} }
|
|
- id: list_reference_sets
|
|
name: qradar-list-reference-sets
|
|
description: "List reference sets."
|
|
risk: read
|
|
inputs_schema:
|
|
properties: {}
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
- id: add_to_reference_set
|
|
name: qradar-add-to-reference-set
|
|
description: "Add a value to a reference set (e.g. a block list consumed by rules)."
|
|
inputs_schema:
|
|
properties:
|
|
set_name: { type: string, description: "Reference set name" }
|
|
value: { type: string, description: "Value to add" }
|
|
required: [set_name, value]
|
|
outputs_schema: { properties: {} }
|
|
- id: delete_from_reference_set
|
|
name: qradar-delete-from-reference-set
|
|
description: "Remove a value from a reference set."
|
|
inputs_schema:
|
|
properties:
|
|
set_name: { type: string, description: "Reference set name" }
|
|
value: { type: string, description: "Value to remove" }
|
|
required: [set_name, value]
|
|
outputs_schema: { properties: {} }
|
|
- id: list_assets
|
|
name: qradar-list-assets
|
|
description: "List assets from the asset model."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
filter: { type: string, description: "Optional filter expression" }
|
|
limit: { type: number, description: "Max assets (default 50)" }
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: test_connection
|
|
name: qradar-test-connection
|
|
description: "Verify connectivity and the SEC token (used by the Test button)."
|
|
risk: read
|
|
inputs_schema:
|
|
properties: {}
|
|
required: []
|
|
outputs_schema: { properties: {} }
|