Case artifact mapping in QRadar SOAR Plug-in app

You can use the Case Mapping Template to specify which artifacts that you want to create from the IBM® QRadar® offense.

You can create artifacts from source addresses, local destination addresses, and offense source of the IBM QRadar offense. New artifacts are added to the SOAR case as the offense fields are updated. You can also create artifacts from other normalized offense fields by adding your own artifact definitions to the case-mapping template.

Important: The Case Mapping Template does not support custom artifact types that support file attachments.

The offense might have source and local destination addresses that you do not want to be used to create artifacts. For example, you might not want addresses for known local systems to be used to create artifacts. To exclude these addresses, add them to a QRadar reference set, and then add the reference set to the Ignored Artifacts section in the template.