The "Fetch New QRadar Offenses with Pagination" workflow template assists businesses in threat hunting by scheduling periodic checks for open QRadar offenses. It begins by confirming the last scan time is set globally, then it paginates through and collects all current open offenses from QRadar. Upon completion, the workflow outputs the offense details or an empty array if no new offenses were found.
Optional Triggers
Schedule,Slack,Teams
Use Cases
Threat Hunting
Workflow Breakdown
Execute nested workflow on a schedule
Check if the workflow start time is set in a global variable
Gather open offenses in QRadar and collect any results using pagination
On exit, provide the results of the offenses. If no results are found return an empty array.
Vendors
Utils, Torq, IBM QRadar
Workflow Output
On exit the results of the open offenses in QRadar.