Custom actions

The IBM® QRadar® SOAR Plug-in app runs a background process that connects to the IBM Security SOAR Action Module, which makes several custom actions available within the SOAR platform.

You can enable the following custom actions on the Preferences tab in the QRadar SOAR Plug-in app configuration settings:

Enable SOAR users to search the Ariel databases from a SOAR case.
Send case artifacts from SOAR to the reference sets in QRadar.

Important: If Multiple Organization Support is enabled, you must limit the Ariel search to the proper domain by ensuring that the custom action syntax contains the domainid={{qradar_dom_id}} token in all proper places.

Also, when Multiple Organization Support is enabled, the Enable Adding Reference Entries From SOAR checkbox is not selectable. Currently, the IBM QRadar API does not support adding reference entries to a specific domain.