IBM QRadar SOAR

IBM QRadar SOAR

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  How to specify a date range in the query_builder?

    Posted 07/01/22 01:47 AM
    Hi,

    How to specify a date range ( like incident create datetime ) in the query_builder?
    Please point me to any related example or document.

    Thank you.

    ------------------------------
    Meghana Medasani
    ------------------------------


  • 2.  RE: How to specify a date range in the query_builder?

    Posted 07/01/22 11:33 AM
    Hi Meghana

    Here is an example:

    # find all incidents created from midnight today
query_builder.isGreaterThan(fields.incident.create_date, dt_midnight_ms)
query = query_builder.build()
incidents = helper.findIncidents(query) ​

    dt_midnight_ms is epoch in milliseconds.

    AnnMarie



    ------------------------------
    AnnMarie Norcross
    ------------------------------



Related Content