IBM QRadar SOAR

IBM QRadar

Join this online topic group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.


#Security
#QRadar
#SecuringhybridcloudandAI
 View Only

  • 1.  Incident PUT vs PATCH

    Posted 05/03/19 10:34 AM
    Hello,

    I would like to know what are the differences/advantages of using either PUT or PATCH methods for updating an incident. Basically I want to change a field in an incident and it can be achieved using either endpoint, but I'm not clear about why I should choose one of them specifically.

    Regards,

    ------------------------------
    Carlos Ortigoza
    ------------------------------


  • 2.  RE: Incident PUT vs PATCH

    Posted 05/06/19 08:45 AM
    Resilient performs optimistic locking for incident updates. When PUT is used the locking is against the entire incident. When PATCH is used it is only for the specific field(s) being updated. On a busy system where an incident is being updated frequently it is very likely a client may encounter optimistic locking failures. Using PATCH is less likely to encounter optimistic locking failures.

    ------------------------------
    Ben Lurie
    ------------------------------



  • 3.  RE: Incident PUT vs PATCH

    Posted 05/06/19 09:51 AM
    Hi,

    I would know if is possible to PATCH/PUT the same field in multiple Incidents in one query. In other words, update multiple tickets in one query. I found the method PATCH in IncidentREST endpoint in the Interactive and Reference API page, but any payload example is shown there. Could you provide some?

    Thanks in advance,

    Dídac Cornet.

    ------------------------------
    Dídac Cornet
    ------------------------------

    Original Message


  • 4.  RE: Incident PUT vs PATCH

    Posted 05/06/19 04:30 PM
    It is possible to update multiple incidents with PATCH at the same time. To find out how you can use the UI, go to the incident list, select multiple incidents with the checkbox, choose Assign To: Me. After this is sent to the server you can use the browser network console to see the URL, Verb and payload sent. 

    Here is an example that I look from my browser console (abbreviated):

    curl 'https://xxxxxxxx/rest/orgs/231/incidents' -X PATCH ' -H 'handle_format: ids' --data-binary '{"patches":{"22244":{"version":2,"changes":[{"old_value":{"object":27},"new_value":{"object":27},"field":{"name":"owner_id","id":null,"null":false}},{"old_value":{"object":null},"new_value":{"object":40012},"field":{"name":"benselecttotext","id":null,"null":false}},{"old_value":{"object":null},"new_value":{"object":"fdfd"},"field":{"name":"required","id":null,"null":false}}]},"22246":{"version":7,"changes":[{"old_value":{"object":788},"new_value":{"object":27},"field":{"name":"owner_id","id":null,"null":false}},{"old_value":{"object":null},"new_value":{"object":40012},"field":{"name":"benselecttotext","id":null,"null":false}},{"old_value":{"object":null},"new_value":{"object":"fdfd"},"field":{"name":"required","id":null,"null":false}}]}}}' --compressed --insecure

    ------------------------------
    Ben Lurie
    ------------------------------

    Original Message


Related Content