Configure manual sighting creation#
This feature is available in Intelligence Center Integration for IBM Resilient starting from release 1.1.2.
Configure IBM QRadar SOAR to enable ad-hoc, manual sighting creation in Intelligence Center.
EclecticIQ Intelligence Center Integration for IBM QRadar SOAR can automatically create sightings, and it can push them to the integrated platform instance whenever selected artifacts in IBM QRadar SOAR have corresponding matching observables in the platform.
To enable automatic sighting creation, set
True in the
Alternatively, you can configure the integration to manually create sightings from the artifacts of an IBM QRadar SOAR incident.
To enable manual sighting creation through the GUI:
Create a menu item to make the feature available in the GUI.
Optionally, Disable automatic sighting creation.
Disable automatic sighting creation#
Optionally, you may want to disable automatic sighting creation after enabling manual sighting creation.
Keeping both features enabled can produce duplicate sightings in the platform.
To disable automatic sighting creation, set
False in the
app.config is stored in
app.configin a text editor such as Vim or Nano:
[eclecticiq]stanza to set
[eclecticiq] # API credentials ... # Sightings parameters sightings_auto_creation=False sightings_group_name=Testing Group
Save your changes.
Reinstall the app and restart the integration#
Every time you edit
app.config and you save your changes, you must:
Reinstall the app.
Stop, and then start the resilient-circuits integration module.
# Go to the '/home/resadmin' directory.
# Reinstall the app.
# 'x.x.x' is a placeholder representing the app release.
# Example: 1.1.2
sudo pip install -e rc-cts-eclecticiq-x.x.x
# After manually stopping the integration module, start it again.
# Successful response.
resilient-circuits has started successfully and is now running...
Subscribe to message destination 'eclecticiq_sighting'
Subscribe to message destination actions.201.eclecticiq_sighting