• Custom Action Scripts
• Custom Configurations
• Remote Automation
• Resources

Send text messages from QRadar ”Custom Actions” using Twilio API in a bash file.

Setup

1. Create an account from https://www.twilio.com
2. Retrieve Phone number, Id, and Token generated under your dashboard
3. Apply Phone number, Id, and Token into script
4. Call script into QRadar, see QRadar setup below

QRadar Setup

1. Go to Admin tab and select Define Actions under Custom Actions
2. Select Add from top menu options
3. Provide the following:
   • Name
   • Description
   • Interpreter: Bash
   • Upload SMS Bash/Curl script
   • Parameter Name
   • Fix Property Value
4. Click Add
5. Click Save

To add these entries into the ariel right-click menu, copy this file into /opt/qradar/conf and restart tomcat.

The following options are included:

• Bluecoat
• Cisco Talos
• DomainTools
• Google Cached View
• LOLBAS
• Maclookup
• Robtex
• SpeedGuide
• ThreatCrowd
• URLVoid
• Userstack
• VeriSign

To add these entries into the right-click menu, copy this file into /opt/qradar/conf and restart tomcat.

The following options are included:

• Nmap
• Ping
• Traceroute
• X-Force Exchange
• AbuseIPDB
• AlienVault OTX
• Censys
• Cisco Talos
• DNSlytics
• DShield
• Google Safe Browsing
• GreyNoise
• IPVoid
• MxToolBox Blacklist
• Project Honey Pot
• Robtex
• Shodan
• Spamhaus Reputation Checker
• ThreatCrowd
• ThreatMiner
• VirusTotal

Gathers information and presents an HTML status report about your QRadar deployment.

• QRadar
• QRadar 101
• Reddit

• Jose Bravo Youtube Tutorials
• QRadar Insights Blog

All content is without warranty of any kind. Use at your own risk. I assume no liability for the accuracy, correctness, completeness, usefulness, or any damages.

IBM, the IBM logo, and ibm.com are trademarks or registered trademarks of International Business Machines Corp., registered in many jurisdictions worldwide. Other product and service names might be trademarks of IBM or other companies.