IBM Security QRadar SOAR

 View Only
Expand all | Collapse all

Incidents which has been updated recently (API)

  • 1.  Incidents which has been updated recently (API)

    Posted Tue August 13, 2019 02:51 AM
    Hi all,

    I was wondering how do I go about checking for incidents which has been
    updated recently by the users through API?

    Many thanks,

    ------------------------------
    Lavesh
    ------------------------------


  • 2.  RE: Incidents which has been updated recently (API)

    Posted Tue September 17, 2019 01:01 PM
    Hi Lavesh,

    Starting in v32.1, you can use the incident query API and check the inc_last_modified_date field. I tested this with added notes and artifacts and confirmed that the date field was changed. The payload with the filters would look like the following.

    https://<host>/rest/orgs/<org>/incidents/query?field_handle=-1&return_level=full

    {
      "filters": [
        {
           "conditions": [
             {
               "field_name": "inc_last_modified_date",
               "method": "gt",
               "value": 1568739158980
             }
           ]
        }
      ]
    }



    ------------------------------
    Mark Scherfling
    ------------------------------

    Original Message