IBM Security QRadar SOAR

 View Only

  • 1.  Filter by Artifact Type via REST API

    Posted Tue March 16, 2021 04:03 PM
    Hi All,

    I'm looking for a way to get incidents filtering by Artifact Type using REST API. Do you know any way to do it without using search_ex endpoint?


    Thanks,

    ------------------------------
    Ana Gonzalez
    ------------------------------


  • 2.  RE: Filter by Artifact Type via REST API

    Posted Thu March 18, 2021 09:49 AM
    Sorry, I cannot think of any REST API other than the search_ex endpoint to fulfill your need.

    ------------------------------
    GILBERT LIAO
    ------------------------------

    Original Message


  • 3.  RE: Filter by Artifact Type via REST API

    Posted Tue March 23, 2021 10:18 PM
    Instead of IncidentArtifactRest, ArtifactRest can provide filtering with Artifact Type, and then a further query of related_incident_artifacts with artifact_id recursively can provide you a list of incidents. Just you need to handle the aggregation of duplicated incidents.

    ------------------------------
    Leo Kuo
    ------------------------------

    Original Message


  • 4.  RE: Filter by Artifact Type via REST API

    Posted Wed March 24, 2021 12:40 PM
    Thanks!

    I think that the solution of using the Artifact REST is a very good idea, but in the version I have in Resilient (v. 36.2) that endpoint is not there. Do you know from which version this endpoint is available?

    ------------------------------
    Ana Gonzalez
    ------------------------------

    Original Message


  • 5.  RE: Filter by Artifact Type via REST API

    Posted Wed March 24, 2021 01:10 PM
    V39 - Artifact Management feature

    https://www.ibm.com/support/knowledgecenter/SSBRUQ_39.0.0/doc/Release_Notes/Features_0.html

    ------------------------------
    Leo Kuo
    ------------------------------

    Original Message