IBM QRadar

IBM QRadar

Join this online topic group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.


#Security
#QRadar
#SecuringhybridcloudandAI
 View Only
  • 1.  Note_text delimiting new lines

    Posted 04/05/21 05:42 PM

    Hello,

    I have a need to create multiple lines within a scripted Qradar note. Using the syntax I observed from a manually created multi-line note - I cannot create a multi-lined note.

    I cannot post an example as the information within is sensitive. The syntax is: 1st new line delimited by \n , all remaining lines are delimited by \r\n . When I use that and other delimiters, they are passed through as text only.

    How can new lines be delimited in a offense note?



    #QRadar
    #Support
    #SupportMigration


  • 2.  RE: Note_text delimiting new lines

    Posted 04/07/21 02:37 PM

    I know that this can be done through the API using %0D%0A where # is the offense ID that needs an updated note.

    curl -S -X POST -H 'Accept: application/json' 'https://CONSOLE/api/siem/offenses/#/notes?note_text=line1%0D%0Aline2%0D%0Aline3'



    #QRadar
    #Support
    #SupportMigration


  • 3.  RE: Note_text delimiting new lines

    Posted 04/07/21 03:30 PM

    Thanks for your response -- I have tried using %0D%0A, however the results are the same. Where I'd expect a new line, I see %0D%0A between the text I wish to separate.



    #QRadar
    #Support
    #SupportMigration