IBM QRadar SOAR

IBM QRadar

Join this online topic group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.


#Security
#QRadar
#SecuringhybridcloudandAI
 View Only

  • 1.  Inquiry for POST /orgs/{org_id}/incidents/query_paged

    Posted 08/08/19 12:55 PM
    Edited by Andrew Ku 08/08/19 02:20 PM
    Hi, 

    Using  POST /orgs/{org_id}/incidents/query_paged in conjunction with the python sdk works perfectly. 

    however, when I attempt to use it through requests, it returns error 401 or 500 depending on what I put after the uri (ex:  ?format=names, etc). The interactive api reference says to use:

    /rest/orgs/201/incidents/query?field_handle=-1

    but i'm unable to get a good request. Using the other REST api endpoints, they work perfectly so authentication isn't the issue. 

    Any suggestions to solve this issue? My intent to use query_paged is to grab the total number of incidents on resilient, so if there is another endpoint that does the same job, that would be helpful too. 

    Thanks 

    ------------------------------
    Andrew Ku
    ------------------------------


  • 2.  RE: Inquiry for POST /orgs/{org_id}/incidents/query_paged

    Posted 08/12/19 03:36 PM
    I'm not sure what requests is, but here is an example of a curl command using the query paged endpoint:

    curl 'https://server/rest/orgs/202/incidents/query_paged?return_level=partial' -H 'Cookie: _ga=GA1.2.310013028.1554732927; CSRF_TOKEN=7b2276616c7565223a226265313261663836313362393534313563316161343264656366393661666633227d; JSESSIONID=61B558A4E7CCFAE7C22BBDCBE573584D' -H 'handle_format: objects' -H 'Content-Type: application/json; charset=UTF-8' -H 'Accept: application/json, text/javascript, */*; q=0.01' -H 'X-sess-id: 5ed84e5954aadbd01f7b5514d3ab9b16' -H 'Connection: keep-alive' --data-binary '{"filters":[],"start":0,"length":1}' --compressed --insecure

    This returns the following:

    {"recordsTotal":707,"recordsFiltered":707,"data":[{"name":"inc1 v1 by temp user1","description":null,"phase_id":{"id":1013,"name":"Initial"},"inc_training":false,"id":26214,"discovered_date":1565123397022,"due_date":null,"create_date":1565123476355,"owner_id":{"id":232,"name":"jones@foobar.com","type":"user","display_name":"Jones Smith"},"severity_code":null,"plan_status":"A"}]}

    Notice the recordsTotal, which is what I think you are looking for.


    ------------------------------
    Ben Lurie
    ------------------------------