Adding data to a QRadar reference set
You can configure the IBM® QRadar® SOAR Plug-in app so that you can add data to QRadar reference sets directly from SOAR.
You can use reference sets to track QRadar offense data that is not valuable to SOAR, such as the IP addresses of internal systems. Used with the Ignored Artifacts capability, this capability prevents including unwanted artifacts in SOAR cases.
If Multiple Organization Support is enabled, you cannot use this feature.
- Log in to the QRadar Console as an administrator.
- On the Admin tab, in the IBM QRadar SOAR Plugin section, click Configuration.
- On the Preferences tab, click the Enable Adding Reference Entries From SOAR checkbox.
Select the reference sets that you want to make available to SOAR.
The QRadar reference sets appear in the Reference Sets list.
- On the Escalation tab, under Ignored Artifacts, specify which reference sets to use to suppress artifact creation.
The reference sets are configured for use in SOAR.
What to do next
In SOAR, open a case. On the Artifacts tab, under the Actions menu, select the reference set to add the information to.
Choose the reference set to add the data to.
- On the Admin tab, in the System Configuration section, click Reference Set Management.
- Select the reference set and click View contents.
The reference set values appear in the Content list.