Technical Tip: How to customize filter query or jinja to fetch offenses from Qradar

To fetch records from QRadar, the FortiSOAR connector action 'Get Offense' uses the following default query:

{{vars.filter_string}} and (start_time > '{{vars.qradar_epoch}}' or last_updated_time > '{{vars.qradar_epoch}}')

This query automatically appends conditions with logical operators, checking for either the 'start_time' or 'last_updated_time' in addition to the 'filter query' configured by the user during ingestion.

However, in some scenarios, simply updating the 'filter_string' value may not suffice, as the connector always includes the 'start_time' and 'last_updated_time' conditions by default.

Example 1:
If a user wants to fetch all 'open offenses' from QRadar, the resulting query will be:

status="Open" and (start_time > '{{vars.qradar_epoch}}' or last_updated_time > '{{vars.qradar_epoch}}')

Example 2:
If a user needs to fetch 'closed offenses' for a specific 'domain', the query should be:

status="Closed" and domain_id=XX and (close_time > '{{vars.qradar_epoch}}')

Similarly, the query can be modified as needed based on specific use case requirements.