Security Incident Response form after offense ingestion
Summarize
Summary of Security Incident Response form after offense ingestion
After an IBM QRadar offense is ingested into ServiceNow, a corresponding security incident record is created and updated automatically. This integration enables seamless tracking and management of offenses within the Security Incident Response (SIR) application, improving visibility and response efficiency.
Show less
Key Features
- Worknotes: Detailed notes related to the triggering offense are posted on the security incident record. Users can navigate directly to the offense or the IBM QRadar dashboard for additional context.
- Offense Aggregation: Multiple offenses can be aggregated under a single security incident. Worknotes are optionally logged when new offenses are aggregated based on configured criteria.
- Actions on Offenses: Users can select individual offenses to either create a new security incident (de-aggregating the offense) or delete the offense record directly from the incident form.
- Offense Updates Tracking: The integration tracks changes in both standard and custom offense fields during each polling interval, showing previous and current values for easy comparison without navigating away from ServiceNow. This feature can be enabled in the IBM QRadar Integration Settings.
- Recent IBM QRadar Events: Users can fetch and view up to 100 recent events related to the offense directly in ServiceNow. This limit is configurable.
- Recent IBM QRadar Flows: Leveraging Integration Hub and Flow Designer, users can retrieve and review recent flows associated with offenses. This also supports viewing custom flow fields and is configurable up to 100 flows by default.
Practical Benefits for ServiceNow Customers
- Improved incident management by consolidating offense details and updates within a single security incident record.
- Enhanced visibility into offense evolution through tracked updates and direct links to QRadar offenses and dashboards.
- Flexibility to manage offenses via creation of new incidents or deletion as appropriate, streamlining workload.
- Access to recent events and flows related to offenses aids in comprehensive investigation and response.
- Configurable settings allow customization to fit organizational needs, such as adjusting the number of events or flows displayed and enabling offense update tracking.
After an IBM QRadar offense has been ingested, a security incident is created and the corresponding updates are made to the security incident record.
Worknotes
Click the offense link to navigate to the internal security incident record. The Click here hyperlink takes you to the IBM QRadar dashboard where you can view the offense details.
If you had selected the Log work note for new offense option in the Offense Aggregation Criteria as described in the Mapping IBM QRadar offense fields to security incident response fields, a worknote is posted when the offense is aggregated.
Aggregated offenses
Create security incident: Select an offense from the list, click the Actions menu, and click Create security incident. This option creates a security incident for the offense and this offense is de-aggregated from the parent security incident.
IBM QRadar offense updates
This shows the standard and custom offense fields and tracks changes to the offense during every polling interval. This is helpful as you can view any offense updates directly without navigating to the IBM QRadar dashboard. Any changes to the values are displayed in the Previous value and Current value fields.
To enable the offense updates feature navigate to and enable Set this property to activate the Offense Updates feature. By default, this setting is disabled.
Recent IBM QRadar events
By default, a maximum number of 100 events are displayed. You can modify this default setting in the Configuration settings.