Template mapping in the IBM QRadar SOAR Plug-in app

The fields in the QRadar® offense are different than the fields in an IBM® Security SOAR case.

The IBM QRadar SOAR Plug-in app uses templates to map the QRadar offense fields to the case fields in IBM Security SOAR.

You manage templates on the Escalation tab in the configuration settings for the QRadar SOAR Plug-in app. You can use the default template, or use the Case Mapping Tool to create your own custom templates.

Alternatively, you can download an existing template and customize it manually to create more advanced templates. Both methods use the Jinja2 template language.