IBM QRadar

IBM QRadar

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only
Back to discussions
Expand all | Collapse all

Using Parameters in a Pulse View with Generic API Call

  • 1.  Using Parameters in a Pulse View with Generic API Call

    Posted Wed May 19, 2021 01:11 PM

    I am using latest Pulse Version 1.9.16 and want to create a Pulse View where I handover an existing parameter in a Generic API call.

    For example I want to fetch all Offenses for a Source-IP via SIEM-API and use an already specified Parameter {ip address}

    Tried to achieve this by coding the URL in several ways. For example:

    /api/siem/source_addresses?fields=offense_ids&filter=source_ip%3D%22{ip address}%22

    /api/siem/source_addresses?fields=offense_ids&filter=source_ip%3D%22'{ip address}'%22

    /api/siem/source_addresses?fields=offense_ids&filter=source_ip%3D%22"{ip address}"%22

    but it looks like Pulse can only replace Parameters for AQL queries but not in Generic API calls

    If I replace everything between %22 and %22 with an unquoted IP address the API call works fine.



    #QRadar
    #Support
    #SupportMigration


  • 2.  RE: Using Parameters in a Pulse View with Generic API Call
    Best Answer

    Posted Thu June 03, 2021 12:47 PM

    Generic API parameters have been added to Pulse version 2.2.6. This version of Pulse is built on the QRadar App Framework v2, and is supported on specific versions of QRadar.



    #QRadar
    #Support
    #SupportMigration


Related Content