Synchronizing notes

Changed in 5.0

The IBM® QRadar® SOAR Plug-in app copies new case notes from SOAR to IBM QRadar.

An automatic custom action in the SOAR platform alerts the app when a new note is added to a case. The new note is then copied to the QRadar offense with the addition of the phrase Added from SOAR appended to the text. The synchronization applies only to notes that are added to cases. It does not apply to notes that are added to tasks.

In QRadar SOAR Plug-in 5.x, the QRadar Enhanced Data Migration app must be used to synchronize QRadar data, such as offense events, flows, and notes, into the related case.

Procedure

  1. Log in to the QRadar Console as an administrator.
  2. On the Admin tab, in the IBM QRadar SOAR Plugin section, click Configuration.
  3. On the Preferences tab, click the Synchronize notes between QRadar and SOAR checkbox.
  4. Click Verify and Configure.
  5. Click Save.