The "Fetch New QRadar Offenses with Pagination" workflow template is designed for threat hunting by automating the retrieval of open offenses from IBM QRadar. It runs on a schedule, checking for offenses within a specified time frame, and uses pagination to efficiently gather results. If offenses are found, they are returned; otherwise, an empty array is provided. This workflow is ideal for security teams looking to streamline their incident response processes.
Optional Triggers
["Schedule","Slack","Microsoft Teams"]
Use Cases
Threat Hunting
Workflow Breakdown
Execute nested workflow on a schedule
Check if the workflow start time is set in a global variable
Gather open offenses in QRadar and collect any results using pagination
On exit, provide the results of the offenses. If no results are found return an empty array.
Vendors
Utils, Torq, IBM QRadar
Workflow Output
On exit the results of the open offenses in QRadar.