IBM QRadar SOAR

IBM QRadar SOAR

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only
  • 1.  search_ex API usage question

    Posted Wed May 15, 2024 04:18 AM

    Hello community

    I have a question about search_ex api.

    If we need a query all data from datatables from all Incidents Active, can we use search_ex api?

    The thing is seach_ex api requires a specific value to search.

    If we specify a value, we're unable to get the whole datatables. Is there any appropriate approach to do?



    ------------------------------
    Yohji Amano
    ------------------------------


  • 2.  RE: search_ex API usage question

    Posted Wed May 15, 2024 04:10 PM

    Hi Yohji -

    If anyone else sees this and has a better answer, please feel free. But from what I know, I am not certain that search_ex can achieve this.

    You can, however, use the GET /incidents/{incident_id}/table_data/{table_api_name} endpoint to get the data in a datatable for a given incident. And then you could loop this over all incidents, and go from there... That's not to say that search_ex won't work for you, but that's the best I can think of that will certainly get the job done.



    ------------------------------
    Bo Bleckel
    ------------------------------



  • 3.  RE: search_ex API usage question

    Posted Wed May 15, 2024 10:09 PM
    Hi BO, thank you for your suggestion.
     
    I understand that two steps (1. scan incidents / 2. table search ) approach would be an alternative way. 
     
    I feel search_ex api may less consume resources compared to "heler.findIncidents(query)".
    So if we can use regular expressions such as ".*" for the value of search_ex api or other option to select all,  
    I thought it would be convenient to achieve the requirements to get all child objects in an organization. 


    ------------------------------
    Yohji Amano
    ------------------------------



  • 4.  RE: search_ex API usage question

    Posted Thu May 16, 2024 09:52 AM

    Absolutely. And I'd be really curious to know if you figure out a way to use that endpoint for that purpose!



    ------------------------------
    Bo Bleckel
    ------------------------------