IBM QRadar SOAR

IBM QRadar SOAR

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  REST API endpoint - Action Status

    Posted Fri March 11, 2022 09:57 AM
      |   view attached

    Action status can currently be viewed in the UI for each incident. I need an API call that tells me the action status because when it is on status "Timed Out" I want to send over the automation to a failover server. However, I can't find an endpoint that gives me this information. 

    Does anyone have a suggestion on how to retrieve this? or if there is an API I'm possibly missing that will give me this?

    Thanks



    ------------------------------
    Nahla Youssef
    ------------------------------


  • 2.  RE: REST API endpoint - Action Status

    Posted Mon March 14, 2022 02:56 AM
    Hi Nahla,

    There are for sure APIs for that as everything in the GUI runs in the back through APIs.
    however they might not be documented/Supported but it is still fun for me to try every now and then.
    I checked quickly I founds the below API nodes they might be helpful for you :

    orgs/201/incidents/{inc}/action_invocations

    Sample query: /rest/orgs/201/incidents/2253/action_invocations
    Query String Parameters
    want_children: true
    status: 0
    status: 1
    status: 2
    status: 3

    Result should be usually with status 0 if completed however the time out comes with status 3.

    Let me know If you where able to use it or if you need more info.

    Regards,

    ------------------------------
    Amr I. Awad
    ------------------------------

    Original Message