IBM QRadar SOAR

IBM QRadar

Join this online topic group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.


#Security
#QRadar
#SecuringhybridcloudandAI
 View Only
  • 1.  Can't patch Incident create_date

    Posted 12/10/20 04:17 AM
    I am trying to patch an Incident create_date field with an older value. This is the REST request I am doing from Resilient Interactive API:

    {
      "changes": [
        {
          "field": {
            "name": "create_date"
          },
          "old_value": 1607530048888,
          "new_value": 1607158556000
        }
      ],
      "version": 0
    }​


    I obtain a code 200 and "true" in response body but the Incident Create Date field does not change. Any suggestions ? It's possible to use an older timestamp ?

    Thanks

    ------------------------------
    Lucian Sipos
    ------------------------------


  • 2.  RE: Can't patch Incident create_date

    Posted 12/10/20 05:53 AM
    And nothing, field is Read-Only. It is possible to have a list of all read-only Resilient fields ?

    Thanks

    ------------------------------
    Lucian Sipos
    ------------------------------



  • 3.  RE: Can't patch Incident create_date

    Posted 12/10/20 03:17 PM

    You should be able to get all the permissions on fields through the rest api or the interactive rest api. 

    {server url}/rest/org/{orgNumber}/types/{type}/fields?include_principals={true/false} 

    For each filed in the response it has a "read-only" key that is defined with a Boolean of true/false.



    ------------------------------
    Richard Giesige
    Security Engineer
    Oshkosh Corporation
    Oshkosh
    ------------------------------