IBM QRadar SOAR

IBM QRadar

Join this online topic group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.


#Security
#QRadar
#SecuringhybridcloudandAI
 View Only

  • 1.  How to query for nested fields

    Posted 05/19/20 06:58 AM
    Hi,
    I want to perform a nested query
    {
    "creator": {
    "lname": "gilbert",
    "locked": false,
    "password_changed": false,
    "status": "A",
    "system_permission_handles": [],
    "ui_theme": "lightmode"
    }
    }

    i need to query for "lname" in "creator" object.

    I tried
    "filters": [
    {
    "conditions": [
    {
    "method": "equals",
    "field_name": "creator.lname",
    "value": "gilbert"
    }
    ]
    }
    ]

    Error:
    Bad Request: {"success":false,"title":null,"message":"Invalid field name: creator.lname","hints":["field_defs"],"error_code":"generic"}

    How do i perform a nested query
    Thx,
    Gilbert

    ------------------------------
    Apronti Gilbert
    ------------------------------


  • 2.  RE: How to query for nested fields
    Best Answer

    Posted 05/19/20 10:25 AM
    Hi Apronti,
    Are you trying to perform this query using the search_ex API endpoint ? 

    If so this query should help you. 

    {
    "query": "creator.lname='Ryan'",
    "org_id": <your_org_id>,
    "filters": {
        "incident": [
            {
                "conditions": []
            }
        ]
    },
    "types": [
        "incident"
    ]
}​
    Note the "types" attribute meaning this query will only be done on incidents. Remove the term incident for a fuller search but this may take longer. 


    If this is what you're looking for could you 'Recommend' the answer or mark it as best answer so others can find this info in future. 

    Hope this helps,
    Ryan 

    ------------------------------
    Ryan Gordon
    Security Software Engineer
    IBM
    ------------------------------



  • 3.  RE: How to query for nested fields

    Posted 05/19/20 10:39 AM
    Hi Ryna,
    I am using the "query_paged" endpoint. Sorry I should have provided more context.

    Snippet below;
    def search():
    payload={"filters": [
    {
    "conditions": [
    {
    "method": "equals",
    "field_name": "creator.email" ,
    "value": "user@email.com"
    }
    ]
    }
    ],
    "sorts": [{ "field_name": "name", "type": "desc" }],
    "start": 0,
    "length": 0,
    "recordsTotal": 0
    }
    }
    client = resilient.get_client(config)
    url = "/incidents/query_paged?return_level=full&field_handle=-1"
    try:
    res = client.post(url, payload)
    return res
    except Exception as e:
    print(e)
    return "error"

    Funny thing is, this field works "
    properties.c_requester_internet_email"


    Thanks

    ------------------------------
    Apronti Gilbert
    ------------------------------

    Original Message


  • 4.  RE: How to query for nested fields

    Posted 05/19/20 10:50 AM
    Hi Ryan,
    I just used your suggested endpoint i.e("search_ex"), it works.

    Thanks for your prompt response.

    Thanks,
    Gilbert

    ------------------------------
    Apronti Gilbert
    ------------------------------

    Original Message


  • 5.  RE: How to query for nested fields

    Posted 05/19/20 12:56 PM
    Hi Ryan,
    For the "search_ex" endpoint, how can I add more than one criteria in the query. For instance, "conditions" accepts  a list of criterias, though it flags some fields as invalid.

    Thanks

    ------------------------------
    Apronti Gilbert
    ------------------------------

    Original Message


  • 6.  RE: How to query for nested fields

    Posted 05/20/20 07:49 AM
    Here is an example of the POST body for search_ex where multiple filters are used:

    {
      "query": "foobar",
      "org_id": 202,
      "filters": {
        "incident": [
          {
            "conditions": [
              {
                "field_name": "id",
                "method": "equals",
                "value": 1
              },
              {
                "field_name": "owner_id",
                "method": "in",
                "value": [
                  61,
                  254
                ]
              }
            ]
          }
        ]
      },
      "types": null
    }

    I use the Resilient UI to get this data from the browser:


    ------------------------------
    Ben Lurie
    ------------------------------

    Original Message