Hey,
I am looking for a way of how we can bring tickets or use the data of the tickets in Qradar.
E.g.: Admin A creates User X in AD.
If there is no Ticket, Qradar should be able to recognize that there is no ticket but in the logs a user has been created.
If there is a ticket, Qradar should know that Admin A created User X in AD and will compare that to the logs.
Thanks in advance for your help,
Michel
Online forums and learning are now in one easy-to-use experience.
By continuing, you accept the updated Community Terms of Use and acknowledge the Privacy Policy. Your public name, photo, and achievements may be publicly visible and available in search engines.