Offenses
Polls QRadar offenses and summarises each; group, filter and disposition them in a live feed; notes and closes are written back to QRadar; one offense can be investigated.
Offenses is a tab of the Security posture page. Offenses are raised by QRadar rules; the gateway syncs them, summarises them, tracks dispositions, and writes notes / closes back to the Console. Sync and dispositions are free; offense investigation is paid.
Sync
"Sync settings" at the bottom of the page:
| Setting | Meaning |
|---|---|
| Polling on | The gateway polls /api/siem/offenses on the interval; on by default (RST_OFFENSE_INGEST_ENABLED) |
| Poll interval | 30 s by default |
| Minimum magnitude | Offenses below it (0–10) are neither stored nor pushed; 0 = all |
| Cursor | The start_time / last_updated_time reached so far; "Sync now" runs one tick by hand |
Two cursors: new offenses come in by start_time; stored ones are refreshed by last_updated_time, so a close, an assignment or a growing event count in the Console is reflected. The first sync looks back RST_OFFENSE_INGEST_LOOKBACK (7 days) for OPEN offenses; each tick reads at most 10 pages × 100 rows and a larger backlog continues next tick.
Each new offense gets one model call for a one-line summary (RST_ALERT_SUMMARY=0 disables it, RST_ALERT_SUMMARY_MIN_SEVERITY restricts it to higher levels); concurrency is RST_OFFENSE_INGEST_CONCURRENCY. A row whose summary ran out of budget shows "not generated".
The token's security profile decides which offenses the gateway can see. If the list stays empty, check Token permissions first, then whether any offense is OPEN within the lookback.
Overview
Three cards: offenses in the window, critical + high, handled / false positive; below, the rate chart (1 h / 6 h / 24 h / 7 d) and the noisiest rule in the window. Severity derives from QRadar magnitude.
Feed
- Live: new offenses arrive at the top over SSE. Scrolling down pauses the feed ("paused, scrolled away from the top"); back at the top it resumes.
- Grouping: same rule + same offense_source fold into one row; expand for children.
- Filters: severity, time range, rule name / ID.
- Views: save the current filter set under a name and switch to it later.
- Disposition: open / handled / false positive / escalated, shared with the team, gateway-side only, never written to QRadar; select rows to mark in bulk, with "Undo".
- Handled / false positives are hidden by default; "Show handled / false positives" reveals them.
Offense detail
Click a row for the drawer: AI summary, description, magnitude, status (with QRadar's assigned_to), event / flow / device counts, categories, log sources, networks, rule, subject, last update, raw JSON.
Write back to QRadar holds the only writes the product makes to the Console:
| Action | Effect |
|---|---|
| Add note | POST /api/siem/offenses/{id}/notes, prefixed "RST Copilot · username" so the Console shows who wrote it |
| Close offense | Pick a closing reason (from /api/siem/offense_closing_reasons), optional note; POST /api/siem/offenses/{id}?status=CLOSED&closing_reason_id= |
| Assign / follow-up | Same endpoint's assigned_to / follow_up; no button in this release, available through POST /api/alerts/{id}/actions |
On the QRadar side these are attributed to the token's authorized service; who clicked is in the audit log. Viewers do not see this section.
"Related events" carries SELECT … FROM events WHERE INOFFENSE(<id>) into Ask AI; "Send to triage" hands the offense to Triage; "Open in QRadar Console" goes to the Offense Summary page.
Offense investigation
Paid capability, Standard tier (including the 14-day trial) and up.
"Investigate" in the drawer. The gateway first pulls the events behind the offense with INOFFENSE(), then gathers evidence around the subject (source IP / destination host / account) over several rounds, and ends with a verdict. The default is agentic (RST_AGENTIC_INVESTIGATE=1): the model decides what to query through the aql_search tool, every AQL passes the read-only check and the whitelist, and the whole run is capped by RST_AGENTIC_DEADLINE_S (180 s). A model without function calling falls back to a single pass.
Report structure:
| Section | Content |
|---|---|
| Header tags | Severity, suspected false positive, confidence, how many agentic rounds, how many events pulled |
| Verdict | What this is and whether it matters |
| False-positive call | Why it is or is not one |
| Timeline | Related events in order |
| MITRE ATT&CK | Tactics / techniques matched |
| Affected assets | Hosts / IPs / accounts involved |
| Recommended action | Numbered concrete steps |
| Evidence trail | Each AQL run, hits, elapsed time; failed steps (such as a log source outside the whitelist) are listed too |
At the bottom: change disposition, turn into a rule design (handed to Rule copilot), push the verdict to Outbound channels, generate an incident report, export / share. Every investigation is archived under Investigations.
10.30.x.x in the screenshots is cloud masking: IPs and accounts are replaced before reaching the model. Air-gapped / private modes show real values.
Push
New offenses above a threshold go to Feishu / DingTalk / WeCom / Teams / Slack / mail automatically; set the "alert threshold" and bind targets in Outbound channels.
Investigations
Automatic archive of offense investigations, triage runs and result readings, visible to the whole team; jump from a record straight to querying its subject.
Triage
A batch of offenses clustered by rule and source; the model rates each cluster's severity, calls false positives, recommends action, and queues them by priority. Paid capability.