IBM QRadar

IBM QRadar

Join this online topic group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.


#Security
#QRadar
#SecuringhybridcloudandAI
 View Only
Back to discussions
Expand all | Collapse all

API REST - Get incidents from a date

  • 1.  API REST - Get incidents from a date

    Posted 12/29/22 08:10 AM
    Hi,

    I'm currently trying to export the list of incidents that was created after the 28th of December 2022. So I'm using rest/orgs/[org_id]/incidents/query_paged POST request to see if I can retrieve those incidents.

    However I keep having an error 400 which means bad request.

    Is there something wrong with my code ?

    import json
    import requests
    import configparser
    from requests.auth import HTTPBasicAuth

    config = configparser.ConfigParser()
    config.read('config.cfg')

    APIkeyID = config.get('CONFIG', 'APIkeyID')
    APIkeySecret = config.get('CONFIG', 'APIkeySecret')

    headers = {"Content-Type": "application/json; charset=UTF-8"}
    auth = HTTPBasicAuth(APIkeyID, APIkeySecret)
    url = "https://[Resilient_srv]/rest/orgs/[org_id]/incidents/query_paged?return_level=normal"
    query = {
    'filter': [
    {
       'conditions': [
       {
          'field_name': 'create_date',
          'method': 'gt',
          'value': 1672185886800
        }
        ]
    }
    ],
       'start': 0,
       'length': 10,
       'sorts': [
       {
          'field_name': 'id',
          'type': 'asc'
       }
    ]
    }

    request = requests.post(url, query, auth=auth, headers=headers, verify=True)
    print(request)

    1672185886800 = 28th December 2022 in epoch time.

    Regards,
    Olivier

    ------------------------------
    Olivier Leung
    ------------------------------


Related Content