IBM QRadar SOAR

IBM QRadar

Join this online topic group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.


#Security
#QRadar
#SecuringhybridcloudandAI
 View Only

  • 1.  Bulk artifacts creation - In-script Vs API Calls

    Posted 10/24/19 06:41 AM
    Hello,

    I was designing a process for team where in they upload CSV files with bulk hashes (500+) and those needs to be converted to artifacts. I want to know which will be the best approach to process the same. Reading the CSV content and executing API calls for creating each artifact or somehow read the content in resilient and process it via in-script or post process of functions.


    ------------------------------
    Mihir Ashar
    ------------------------------


  • 2.  RE: Bulk artifacts creation - In-script Vs API Calls

    Posted 10/24/19 03:55 PM

    This could be done by creating an action to run on attachment artifacts called "Create Artifacts from CSV" -- I was unable to locate this in the Community Apps, so you'd likely want to create this yourself. It would be fairly simple.

    You could either have two columns in the CSV like [artifact type, value] or you could have just one column and a drop-down on the action to select the artifact type (would require all values be the same, ie all hashes in the CSV).


    Maybe someone else can point you to or has something that can do this now.



    ------------------------------
    Jared Fagel
    Cyber Security Analyst Intern
    Public Utility
    ------------------------------



  • 3.  RE: Bulk artifacts creation - In-script Vs API Calls

    Posted 10/29/19 05:08 AM
    Hi Jared,

    Thanks for suggestion, I have developed an integration to process the same. But after observing the same in actual usage, I observed that when the content of CSV is uploaded as Artifacts it raises 500+ API calls to create artifacts and keeps other integrations waiting till all the content of CSV is processed. Also, if there can be any REST API call to create bulk artifacts in single API calls that will improve the performance of the integration and reduce the API calls as it also impacts the performance of STOMP.

    ------------------------------
    Mihir Ashar
    ------------------------------

    Original Message


  • 4.  RE: Bulk artifacts creation - In-script Vs API Calls

    Posted 10/25/19 08:59 AM
    There is a Utility Function on the app exchange which provides a function to add artifacts from a spreadsheet, here is a similar community post with some solutions:
    https://community.ibm.com/community/user/security/communities/community-home/digestviewer/viewthread?MessageKey=1da48e3c-82de-436e-a19d-54a30ca4c708&CommunityKey=d2f71e8c-108e-4652-b59c-29d61af7163e&tab=digestviewer#bm1da48e3c-82de-436e-a19d-54a30ca4c708

    ------------------------------
    Elizabeth Hecht
    ------------------------------



  • 5.  RE: Bulk artifacts creation - In-script Vs API Calls

    Posted 10/29/19 05:18 AM
    Hi Elizabeth, 

    Thanks for the suggestion, I will explore the approach suggested in the link you shared. It might be a showstopper in-case it prompts for user confirmation. Still i will try to explore the approach.


    ------------------------------
    Mihir Ashar
    ------------------------------

    Original Message


Related Content