IBM QRadar SOAR

IBM QRadar

Join this online topic group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.


#Security
#QRadar
#SecuringhybridcloudandAI
 View Only

  • 1.  Single API Endpoint for all child orgs at one place

    Posted 10/26/20 06:17 AM
    team, one of my partner implementing qradar / resilient integration and have the following query. they are mssp provider.

    API is standard Resilient API. For example:

    /orgs/{org_id}/incidents/{inc_id}/table_data/{table_id}

    They want to know that is there an API endpoint that provide all child orgs at one place independent from organization id.

    ------------------------------
    Ganesan Lakshmanan
    ------------------------------


  • 2.  RE: Single API Endpoint for all child orgs at one place

    Posted 10/27/20 06:22 AM
    Thanks Ganesan I have reached out to one of our Qradar team to help you with your query.

    ------------------------------
    John Quirke
    ------------------------------



  • 3.  RE: Single API Endpoint for all child orgs at one place

    Posted 10/27/20 08:45 AM
    Resilent MSSP has different org types in a hierarchy:

    configuration->dashboard->child

    Certain APIs are supported for different orgs. For example, all the administration apis are available from the configuration org, but none of the "data" apis (like about incidents). In the child org all of the "data" apis are available but none of the administration apis.

    The dashboard organization is intended to provide "data" visibility across all child orgs. Currently there are a very limited set of API supported in the dashboard organization. One of those apis is a query paged api for incidents (though not the one you referenced above).

    You can see here this API returning incident data from multiple child organizations:



    Here is an example of using the api against a dashboard org (org id 275):

    curl 'https://staging2.internal.com/rest/orgs/275/incidents/query_paged?return_level=normal&field_handle=' -H 'User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:81.0) Gecko/20100101 Firefox/81.0' -H 'Accept: application/json, text/javascript, */*; q=0.01' -H 'Accept-Language: en-US,en;q=0.5' --compressed -H 'Content-Type: application/json; charset=utf-8' -H 'X-sess-id: 1522d119a0b5df76db5c3f977f2d12cb' -H 'handle_format: objects' -H 'text_content_output_format: objects_convert' -H 'X-Requested-With: XMLHttpRequest' -H 'Origin: https://staging2.internal.resilientsystems.com' -H 'Connection: keep-alive' -H 'Referer: https://staging2.internal.resilientsystems.com/' -H 'Cookie: _ga=GA1.2.1382814266.1575940211; JSESSIONID=2ADC341BB400B33AAA986F7D8AF11F05; CSRF_TOKEN=7b2276616c7565223a226131373463393634343163316533346436386433313265633361663037313936227d' --data-raw '{"filters":[{"conditions":[{"field_name":"confirmed","method":"equals","value":[true,false]},{"field_name":"plan_status","method":"in","value":["A"]}]}],"sorts":[{"field_name":"due_date","type":"asc"}],"start":0,"length":10}'




    Here is some of the data returned:

    {
      "recordsTotal": 32,
      "recordsFiltered": 32,
      "data": [
        {
          "name": "Test Incident from Child org",
          "description": null,
          "phase_id": {
            "id": 2119,
            "name": "Respond"
          },
          "inc_training": true,
          "vers": 2,
          "addr": null,
          "city": null,

          "exposure_type_id": {
            "id": 1,
            "name": "Unknown"
          },
          "incident_type_ids": [],
          "reporter": null,
          "state": null,
          "country": null,
          "zip": null,
          "workspace": {
            "id": 225,
            "name": "Default workspace"
          },
          "exposure": 12000000,
          "org_handle": {
            "id": 277,
            "name": "Bank of England"
          },

    Notice the org_handle. It is from the child org.

    Ben

    ------------------------------
    Ben Lurie
    ------------------------------



  • 4.  RE: Single API Endpoint for all child orgs at one place

    Posted 10/28/20 04:41 AM
    Thanks Ben. Much appreciated.

    ------------------------------
    Ganesan Lakshmanan
    ------------------------------

    Original Message