IBM Security QRadar SOAR

 View Only
Expand all | Collapse all

How to use : ConditionDTO

  • 1.  How to use : ConditionDTO

    Posted Mon January 25, 2021 09:52 AM
    Edited by Paul Bradley Thu January 28, 2021 05:11 PM
    Hello,

    Has anyone used a ConditionDTO succesfully before?
    Please let me know how you did it!


    I would like to use the following endpoint to get only incidents of a certain custom type ("Compromised Credentials")

    POST    /orgs/{org_id}/incidents/query_paged
    However, I do not know how to use a QueryPagedDTO. I believe my problem is with the ConditionDTO (a component of QueryPagedDTO).


    From GET /orgs/{org_id}/incidents/{inc_id}, I know that an incident of type "Compromised Credentials" has the following "incident_type_ids"
    if : handle_format = names  
    "incident_type_ids": [ "Compromised Credentials" ],     
    if : handle_format = id
    "incident_type_ids": [ 1014 ],


    Results of POST    /orgs/{org_id}/incidents/query_paged if the body is left empty:
    {
    "recordsTotal": 264,
    "recordsFiltered": 264,
    "data": [
    {
    "name": "test-Compromised-Credentials",
    "description": null,
    "phase_id": 1007,
    "inc_training": true,
    "id": 2599,
    "sequence_code": "06A9-95",
    "discovered_date": 1611257642811,
    "due_date": null,
    "create_date": 1611257672822,
    "owner_id": 32,
    "severity_code": 100,
    "plan_status": "A"
    },
    {...},
    {...}
    ]
    }


    Thanks!

    ------------------------------
    Louis Roy Therrien
    ------------------------------


  • 2.  RE: How to use : ConditionDTO

    Posted Tue January 26, 2021 01:38 AM
    Hello,

    I am sharing my query paged payload. It has conditions.

     query = {
    
                    "filters":
                        [
                            {
                                "conditions":[
                                    {
                                        "field_name":"create_date",
                                        "method":"gt",
                                        "value":INTERVAL)
                                    },
                                    {
                                        "field_name":"inc_training",
                                        "method": "equals",
                                        "value": False
                                    }
                                ]
                            }
                        ],
                    "start":0,
                    "length":1000,
                    "sorts":[{
                        "field_name":"id",
                        "type":"asc"
                    }]
                }
    ​


    ------------------------------
    Burak Karaduman
    ------------------------------