IBM QRadar SOAR

IBM QRadar

Join this online topic group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.


#Security
#QRadar
#SecuringhybridcloudandAI
 View Only
  • 1.  ObjectHandle and Custom Fields

    Posted 01/09/20 12:36 PM
    Edited by Liam Mahoney 01/09/20 01:20 PM
    All, 

    Please disregard the title, I thought I had a different issue but now it looks like it's this.

    I'm trying to update fields via the API call PATCH /orgs/{org_id}/incidents/{id}. It's working fine for most field types, but I'm having issues when I try to edit a Boolean field.

    This PatchDTO works (for a select field)
    {
      "changes": [
        {
          "field": {
            "name": "select_field_api_name"
          },
    	  "old_value": {
               "object": {
                 "id": 840
               }
          },
          "new_value": {
               "object": {
                  "id": 841
                }
           }
        }
      ]
    }​

    But this PatchDTO doesn't (for a boolean field):
    {
      "changes": [
        {
          "field": {
            "name": "boolean_field_api_name"
          },
    	  "old_value": {
               "object": {
                 "boolean": false
               }
          },
          "new_value": {
               "object": {
                  "boolean": true
                }
           }
        }
      ]
    }​


    here's the response I get from the Interactive API page for the boolean field:

    {
      "success": false,
      "title": null,
      "message": "Bad Request",
      "hints": [],
      "error_code": "generic"
    }


    If anyone has any ideas I'd greatly appreciate it! 

    Thanks!



  • 2.  RE: ObjectHandle and Custom Fields

    Posted 01/09/20 02:36 PM

    Discovered that the following will work:

    {
      "changes": [
        {
          "field": {
            "name": "boolean_field_api_name"
          },
    	  "old_value": {
               "boolean": false
          },
          "new_value": {
               "boolean": true
           }
        }
      ]
    }​


    I think I was interpreting the PatchValueDTO documentation incorrectly



    ------------------------------
    Liam Mahoney
    ------------------------------