IBM QRadar

IBM QRadar

Join this online topic group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.


#Security
#QRadar
#SecuringhybridcloudandAI
 View Only
Expand all | Collapse all

how we can make create for new assets using API

  • 1.  how we can make create for new assets using API

    Posted 10/31/20 09:00 AM

    I want to know if there is way to make a new assets using API



    #QRadar
    #Support
    #SupportMigration


  • 2.  RE: how we can make create for new assets using API

    Posted 11/01/20 11:06 AM

    Hello a.madhoun,

    Yes of course :)

    You can update an asset via the /asset_model/assets/<asset_id> interface

    For my own, i get all the information on my IPAM then i post them on QRadar.

    Here is an extract example using Bash Shell (with completed variables of my phpipam) :

    ....

    curl="curl -k -s -X"

    appjson="Accept: application/json"

    ....

    $curl POST -H "SEC: $qradar_token" -H "Content-Type: application/json" -H "Version: $qradar_ver" -H "Accept: text/plain" \

    -d "{'properties':[ \

    {'type_id':$qradar_descriptionid,'value':'$phpipam_description'}, \

    {'type_id':$qradar_macvendorid,'value':'$phpipam_macvendor'}, \

    {'type_id':$qradar_locationid,'value':'$phpipam_location'}, \

    {'type_id':$qradar_vlanid,'value':'$phpipam_vlan'}, \

    {'type_id':$qradar_tagid,'value':'$phpipam_tag'}]}" \

    "$qradar_url/asset_model/assets/$qradar_id"

    You can i have a look at this great example on Github using Python script that allows you to import data from a CSV file into the asset model :

    https://github.com/ibm-security-intelligence/data-import/tree/master/assets

    Hope this helps,

    Regards,

    Zoldax



    #QRadar
    #Support
    #SupportMigration