IBM QRadar SOAR

IBM QRadar

Join this online topic group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.


#Security
#QRadar
#SecuringhybridcloudandAI
 View Only

  • 1.  Transfer comments to a custom field.

    Posted 06/21/20 10:04 PM
    Hi ,

    he API call GET /orgs/{org_id}/incidents/{inc_id}/comments only allows me to pull 1 by 1 per incident, which is working.

    Is it possible to transfer the notes/comments to a new custom field?

    Thanks

    ------------------------------
    Dan
    ------------------------------


  • 2.  RE: Transfer comments to a custom field.

    Posted 06/22/20 09:15 AM
    Edited by Ben Lurie 06/22/20 09:16 AM
    You can update an incident custom field using the PATCH API for an incident: 

    curl 'https://staging1-02/rest/orgs/230/incidents/26045?return_dto=true' -X PATCH -H 'User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0' -H 'Accept: */*' -H 'Accept-Language: en-US,en;q=0.5' --compressed -H 'Content-Type: application/json' -H 'handle_format: null' -H 'X-sess-id: 2b63678c6de1c578e4cb9f21dde95085' -H 'text_content_output_format: objects_convert' -H 'browser_locale: en' -H 'X-Requested-With: XMLHttpRequest' -H 'Origin: https://staging1-02.internal' -H 'Connection: keep-alive' -H 'Referer: https://staging1-02.internal/' -H 'Cookie: _ga=GA1.2.1382814266.1575940211; JSESSIONID=5618583DCE278405731E0658FEE4; CSRF_TOKEN=7b2276616c7565223a22353661333933316164643235623533366562353233303234653836636237227d' --data-raw '{"changes":[{"field":"custom_text","old_value":{},"new_value":{"text":"fdfdfdfdfd"}}]}'

    Ben

    ------------------------------
    Ben Lurie
    ------------------------------



Related Content