Update an offense.

External Documentation

To learn more, visit the QRadar documentation.

​
Parameters

ParameterDescription
Assign toA user to assign the offense to.
Closing Reason IDThe ID of a closing reason. You must provide a valid closing_reason_id when you close an offense.
Offense IDThe ID of the offense to update.
StatusThe new status for the offense. Set to one of: OPEN, HIDDEN, CLOSED. When the status of an offense is being set to CLOSED, a valid closing_reason_id must be provided. To hide an offense, use the HIDDEN status. To show a previously hidden offense, use the OPEN status.

​
Example Output

{
	"assigned_to": "String",
	"categories": [
		"String"
	],
	"category_count": 42,
	"close_time": 42,
	"closing_reason_id": 42,
	"closing_user": "String",
	"credibility": 42,
	"description": "String",
	"destination_networks": [
		"String"
	],
	"device_count": 42,
	"domain_id": 42,
	"event_count": 42,
	"first_persisted_time": 42,
	"flow_count": 42,
	"follow_up": true,
	"id": 42,
	"inactive": true,
	"last_persisted_time": 42,
	"last_updated_time": 42,
	"local_destination_address_ids": [
		42
	],
	"local_destination_count": 42,
	"log_sources": [
		{
			"id": 42,
			"name": "String",
			"type_id": 42,
			"type_name": "String"
		}
	],
	"magnitude": 42,
	"offense_source": "String",
	"offense_type": 42,
	"policy_category_count": 42,
	"protected": true,
	"relevance": 42,
	"remote_destination_count": 42,
	"rules": [
		{
			"id": 42,
			"type": "String <one of: ADE_RULE, BUILDING_BLOCK_RULE, CRE_RULE>"
		}
	],
	"security_category_count": 42,
	"severity": 42,
	"source_address_ids": [
		42
	],
	"source_count": 42,
	"source_network": "String",
	"start_time": 42,
	"status": "String <one of: OPEN, HIDDEN, CLOSED>",
	"username_count": 42
}

​
Workflow Library Example

Update Offense with Qradar and Send Results Via Email

Preview this Workflow on desktop