Security Incident Response form after offense ingestion
Summarize
Summary of Security Incident Response Form After Offense Ingestion
After an IBM QRadar offense is ingested, a corresponding security incident is created in the system. This process involves posting worknotes that detail the offense and allows users to navigate directly to the internal security incident record or the IBM QRadar dashboard for more information.
Show less
Key Features
- Worknotes: Automatically generated when offenses are ingested or aggregated, providing detailed information about the incident.
- Aggregated Offenses: Users can view offenses related to a security incident through the Related Lists section.
- Security Incident Creation: Users can create a new security incident directly from an offense using the Actions menu, which de-aggregates the offense from the parent incident.
- Offense Record Management: Offense records can be deleted from the Actions menu for better incident management.
- Offense Updates: Tracks changes to standard and custom offense fields for visibility during polling intervals, which can be enabled in integration settings.
- Recent Events and Flows: Users can fetch the latest IBM QRadar events and flows, with the option to modify the display settings for the number of retrieved items.
Key Outcomes
This integration streamlines the management of security incidents and offenses, allowing ServiceNow customers to effectively track, create, and manage security incidents triggered by QRadar offenses. By utilizing the worknotes, offense updates, and event flows, customers can enhance their incident response capabilities and ensure timely actions are taken based on the most current information available.
After an IBM QRadar offense has been ingested, a security incident is created and the corresponding updates are made to the security incident record.
Worknotes
Click the offense link to navigate to the internal security incident record. The Click here hyperlink takes you to the IBM QRadar dashboard where you can view the offense details.
If you had selected the Log work note for new offense option in the Offense Aggregation Criteria as described in the Mapping IBM QRadar offense fields to security incident response fields, a worknote is posted when the offense is aggregated.
Aggregated offenses
Create security incident: Select an offense from the list, click the Actions menu, and click Create security incident. This option creates a security incident for the offense and this offense is de-aggregated from the parent security incident.
IBM QRadar offense updates
This shows the standard and custom offense fields and tracks changes to the offense during every polling interval. This is helpful as you can view any offense updates directly without navigating to the IBM QRadar dashboard. Any changes to the values are displayed in the Previous value and Current value fields.
To enable the offense updates feature navigate to and enable Set this property to activate the Offense Updates feature. By default, this setting is disabled.
Recent IBM QRadar events
By default, a maximum number of 100 events are displayed. You can modify this default setting in the IBM QRadar integration configuration settings.