IBM QRadar

IBM QRadar

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  Qradar API using Powershell

    Posted Tue April 21, 2020 11:02 AM
    Hi

    I have a working solution for GET using PowerShell. Can anyone help me to convert this to POST or share their working solution please?

    i'd like to POST values from a CSV into a reference set.

    if ("TrustAllCertsPolicy" -as [type]) {} else {
        Add-Type "using System.Net;using System.Security.Cryptography.X509Certificates;public class TrustAllCertsPolicy : ICertificatePolicy {public bool CheckValidationResult(ServicePoint srvPoint, X509Certificate certificate, WebRequest request, int certificateProblem) {return true;}}"
        [System.Net.ServicePointManager]::CertificatePolicy = New-Object TrustAllCertsPolicy
}


$headers = @{}
$headers.add("Version","10.1")
$headers.add("Content-Type","application/JSON")
$Headers.add("SEC","token")

$url = "https://consoleip/api/reference_data/sets"
$ListAllSets = Invoke-RestMethod -Method GET -Headers $headers -Uri $url
​


    ------------------------------
    Q SIEM
    ------------------------------


  • 2.  RE: Qradar API using Powershell

    Posted Tue May 05, 2020 12:18 PM
    Interesting. I haven't tried this yet... So here's what I did:

    $data = "someString05","someString06","someString07","someString08"
    $jsonData = $data | convertto-json
    $loadURL = "https://qrc.vertexinc.com/api/reference_data/sets/bulk_load/testSet"
    $url = $loadURL
    Invoke-RestMethod -Method POST -Headers $headers -body $jsonData -Uri $url

    This worked. The data posted into that reference set (testSet) overwriting any old data in the reference set.

    ------------------------------
    Michael Erana
    ------------------------------

    Original Message