{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":44823,"path":"security-management/security-incident-response/qradar-ibm-sir-changes.md","title":"Security Incident Response form after offense ingestion","bundle":null,"doc_type":null,"release":"australia","body":"\n# Security Incident Response form after offense ingestion\n\nAfter an IBM QRadar offense has been ingested, a security incident is created and the corresponding updates are made to the security incident record.\n\n## Worknotes\n\nA worknote is posted with details of the offense that triggered the security incident.\n\nSelect the offense link to navigate to the internal security incident record. The **Click here** hyperlink takes you to the IBM QRadar dashboard where you can view the offense details.\n\nIf you had selected the **Log work note for new offense** option in the Offense Aggregation Criteria as described in the [Mapping IBM QRadar offense fields to security incident response fields](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/ibm-qradar-mapping-process.md), a worknote is posted when the offense is aggregated.\n\n## Aggregated offenses\n\nSelect **Related Lists** > **Aggregated IBM QRadar offenses** to view the offenses aggregated to the security incident. select the QRadar offense hyperlink to view the offense in the IBM QRadar dashboard.\n\nCreate security incident: Select an offense from the list, select the **Actions** menu, and select **Create security incident**. This option creates a security incident for the offense and this offense is de-aggregated from the parent security incident.\n\nDelete offense record: Select an offense from the list, select the **Actions** menu, and select **Delete**. This option deletes the offense record.\n\n## IBM QRadar offense updates\n\nThis shows the standard and custom offense fields and tracks changes to the offense during every polling interval. This is helpful as you can view any offense updates directly without navigating to the IBM QRadar dashboard. Any changes to the values are displayed in the Previous value and Current value fields.\n\nTo enable the offense updates feature navigate to **IBM QRadar Integration** > **IBM QRadar Integration Settings** and enable **Set this property to activate the Offense Updates feature**. By default, this setting is disabled.\n\n## Recent IBM QRadar events\n\nSelect the **Fetch Recent IBM QRadar Events** option under the **Related Links** to view the most recent IBM QRadar events. By default, a maximum number of 100 events are displayed. You can modify this default setting in the [Configuration settings](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/qradar-ibm-intg-settings.md).\n\n## Recent IBM QRadar Flows\n\nUsing the Integration Hub and Flow Designer, several flows, subflows, actions are available with the IBM QRadar integration. When you select the **Fetch Recent IBM QRadar Flows** option under the Related Links, the most recent flows are retrieved. To view these flows, select **Recent IBM QRadar Flows**.\n\nBy default, a maximum number of 100 flows are displayed. You can modify this default setting in the [Configuration settings](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/qradar-ibm-intg-settings.md).\n\n"}}