External DocumentationTo learn more, visit the QRadar documentation.
Parameters
| Parameter | Description |
|---|---|
| Assign to | A user to assign the offense to. |
| Closing Reason ID | The ID of a closing reason. You must provide a valid closing_reason_id when you close an offense. |
| Offense ID | The ID of the offense to update. |
| Status | The new status for the offense. Set to one of: OPEN, HIDDEN, CLOSED. When the status of an offense is being set to CLOSED, a valid closing_reason_id must be provided. To hide an offense, use the HIDDEN status. To show a previously hidden offense, use the OPEN status. |
Example Output
{
"last_persisted_time": 392126779240,
"username_count": 1,
"description": "<string>",
"rules": [
{
"id": 74300,
"type": "<string>"
}
],
"event_count": 3,
"flow_count": 2,
"assigned_to": "<string>",
"security_category_count": 4,
"follow_up": false,
"source_address_ids": [
107794
],
"source_count": 1,
"inactive": false,
"protected": false,
"closing_user": null,
"destination_networks": [
"<string>"
],
"source_network": "<string>",
"category_count": 0,
"close_time": null,
"remote_destination_count": 1,
"start_time": 1322355746223,
"magnitude": 2,
"last_updated_time": 2162697652069,
"credibility": 2,
"id": 91520,
"categories": [
"<string>",
"<string>"
],
"severity": 5,
"policy_category_count": 1,
"log_sources": [
{
"type_name": "<string>",
"type_id": 623,
"name": "<string>",
"id": 1660
},
{
"type_name": "<string>",
"type_id": 6,
"name": "<string>",
"id": 123
}
],
"closing_reason_id": null,
"device_count": 2,
"first_persisted_time": 1273299772162,
"offense_type": 2,
"relevance": 1,
"domain_id": 0,
"offense_source": "<string>",
"local_destination_address_ids": [],
"local_destination_count": 1,
"status": "<string>"
}
Workflow Library Example
Update Offense with Qradar and Send Results Via Email