.. _ibm.qradar.offense_action_module: ************************* ibm.qradar.offense_action ************************* **Take action on a QRadar Offense** Version added: 1.0.0 .. contents:: :local: :depth: 1 Synopsis -------- - This module allows to assign, protect, follow up, set status, and assign closing reason to QRadar Offenses Parameters ---------- .. raw:: html
Parameter Choices/Defaults Comments
assigned_to
string
Assign to an user, the QRadar username should be provided
closing_reason
string
Assign a predefined closing reason here, by name.
closing_reason_id
integer
Assign a predefined closing reason here, by id.
follow_up
boolean
    Choices:
  • no
  • yes
Set or unset the flag to follow up on a QRadar Offense
id
integer / required
ID of Offense
protected
boolean
    Choices:
  • no
  • yes
Set or unset the flag to protect a QRadar Offense
status
string
    Choices:
  • open
  • OPEN
  • hidden
  • HIDDEN
  • closed
  • CLOSED
One of "open", "hidden" or "closed". (Either all lower case or all caps)

Notes ----- .. note:: - Requires one of ``name`` or ``id`` be provided - Only one of ``closing_reason`` or ``closing_reason_id`` can be provided Status ------ Authors ~~~~~~~ - Ansible Security Automation Team (@maxamillion)