Import from multiple QRadar instances

TheHive-Project / Synapse

Synapse: a Meta Alert Feeder for TheHive, a Security Incident Response Platform

https://thehive-project.org/

GNU Affero General Public License v3.0

71 stars 47 forks source link

Import from multiple QRadar instances #46

Open schovol opened 4 years ago

schovol commented 4 years ago

As a MSSP we need to import offenses from multiple customer QRadar instances. I am missing a filed for distinguishing between different source in the alerts list. How about adding a tag or setting the source apppropriately?

aymansabri commented 4 years ago

I have the same question , I want to connect multiple QRadar client to thehive4, each QRadar IP linked to an organisation.

How can we do that with just one Synapse instance running ?

ihebski commented 1 year ago

hello @schovol under QRadar2Alert.py you can add a specific tag in line 104 tags = ['QRadar', 'Offense', 'Synapse'] that specify the QR instance name or ID per running Synapse.