IBM QRadar SOAR

IBM QRadar

Join this online topic group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.


#Security
#QRadar
#SecuringhybridcloudandAI
 View Only

  • 1.  How to use : ConditionDTO

    Posted 01/25/21 09:52 AM
    Edited by Paul Bradley 01/28/21 05:11 PM
    Hello,

    Has anyone used a ConditionDTO succesfully before?
    Please let me know how you did it!


    I would like to use the following endpoint to get only incidents of a certain custom type ("Compromised Credentials")

    POST    /orgs/{org_id}/incidents/query_paged
    However, I do not know how to use a QueryPagedDTO. I believe my problem is with the ConditionDTO (a component of QueryPagedDTO).


    From GET /orgs/{org_id}/incidents/{inc_id}, I know that an incident of type "Compromised Credentials" has the following "incident_type_ids"
    if : handle_format = names  
    "incident_type_ids": [ "Compromised Credentials" ],     
    if : handle_format = id
    "incident_type_ids": [ 1014 ],


    Results of POST    /orgs/{org_id}/incidents/query_paged if the body is left empty:
    {
    "recordsTotal": 264,
    "recordsFiltered": 264,
    "data": [
    {
    "name": "test-Compromised-Credentials",
    "description": null,
    "phase_id": 1007,
    "inc_training": true,
    "id": 2599,
    "sequence_code": "06A9-95",
    "discovered_date": 1611257642811,
    "due_date": null,
    "create_date": 1611257672822,
    "owner_id": 32,
    "severity_code": 100,
    "plan_status": "A"
    },
    {...},
    {...}
    ]
    }
    ​

    Thanks!

    ------------------------------
    Louis Roy Therrien
    ------------------------------


  • 2.  RE: How to use : ConditionDTO

    Posted 01/26/21 01:38 AM
    Hello,

    I am sharing my query paged payload. It has conditions.

     query = {

                "filters":
                    [
                        {
                            "conditions":[
                                {
                                    "field_name":"create_date",
                                    "method":"gt",
                                    "value":INTERVAL)
                                },
                                {
                                    "field_name":"inc_training",
                                    "method": "equals",
                                    "value": False
                                }
                            ]
                        }
                    ],
                "start":0,
                "length":1000,
                "sorts":[{
                    "field_name":"id",
                    "type":"asc"
                }]
            }
​


    ------------------------------
    Burak Karaduman
    ------------------------------



Related Content