IBM QRadar

IBM QRadar

Join this online topic group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.


#Security
#QRadar
#SecuringhybridcloudandAI
 View Only
  • 1.  API

    Posted 11/24/20 11:16 AM

    Hi, I need to know how to determine the remote IP addresses of the offenses through the QRADAR API



    #QRadar
    #Support
    #SupportMigration


  • 2.  RE: API

    Posted 02/24/22 10:49 PM

    Do you mean the destination IP addresses?

    One way is to use the API to execute an AQL search to get the events in the offense, then look at the destination addresses in the events.

    If you really mean "remote", then you can use the API to fetch the remove vs local info and use that.



    #QRadar
    #Support
    #SupportMigration