Skip to content

Can't retrieve Destination IPs from Qradar #50

@N4Z4

Description

@N4Z4

Hi,

I can create alert on thehive with the Qradar workflow and add observables.

The problem is, when i watch the code of the Qradar2Alert is calling 2 methods for observable creation getSourceIPs and getDestinationIPs. Those functions catch from Qradar offenses the fields "source_address_ids" for source address and "local_destination_addresses" for destination address.
It work very well for source IPs but often it don't work for destination IPs because this field is empty despite "the remote_destination_count" is not equal to zero.
I've no idea where the destination IPs are stored and how can i catch them.

Someone already encountered this issue or can help me please ?

Thanks.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions