IBM QRadar

IBM QRadar

Join this online topic group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.


#Security
#QRadar
#SecuringhybridcloudandAI
 View Only
  • 1.  Qradar API using Powershell

    Posted 04/21/20 11:02 AM
    Hi

    I have a working solution for GET using PowerShell. Can anyone help me to convert this to POST or share their working solution please?

    i'd like to POST values from a CSV into a reference set.

    if ("TrustAllCertsPolicy" -as [type]) {} else {
            Add-Type "using System.Net;using System.Security.Cryptography.X509Certificates;public class TrustAllCertsPolicy : ICertificatePolicy {public bool CheckValidationResult(ServicePoint srvPoint, X509Certificate certificate, WebRequest request, int certificateProblem) {return true;}}"
            [System.Net.ServicePointManager]::CertificatePolicy = New-Object TrustAllCertsPolicy
    }
    
    
    $headers = @{}
    $headers.add("Version","10.1")
    $headers.add("Content-Type","application/JSON")
    $Headers.add("SEC","token")
    
    $url = "https://consoleip/api/reference_data/sets"
    $ListAllSets = Invoke-RestMethod -Method GET -Headers $headers -Uri $url
    ​


    ------------------------------
    Q SIEM
    ------------------------------


  • 2.  RE: Qradar API using Powershell

    Posted 05/05/20 12:18 PM
    Interesting. I haven't tried this yet... So here's what I did:

    $data = "someString05","someString06","someString07","someString08"
    $jsonData = $data | convertto-json
    $loadURL = "https://qrc.vertexinc.com/api/reference_data/sets/bulk_load/testSet"
    $url = $loadURL
    Invoke-RestMethod -Method POST -Headers $headers -body $jsonData -Uri $url

    This worked. The data posted into that reference set (testSet) overwriting any old data in the reference set.

    ------------------------------
    Michael Erana
    ------------------------------