IBM QRadar SOAR

IBM QRadar

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only
  • 1.  query_builder query on select fields

    Posted Thu May 02, 2019 08:08 AM
    When building a query, I can't find a way to build the query with a string for a select field, it has to be the numerical ID for the value. 

    for example:

    query_builder.equals(fields.incident.testselect, "Test1")
    query = query_builder.build()
    incidents = helper.findIncidents(query)

    would not work, but replacing the first line with:

    query_builder.equals(fields.incident.testselect, 123)

    would work (replacing 123 with the ID for that value)

    I've tried to find a way of using the label property rather than value, but it doesn't seem possible. Am I doing something wrong, or can you not create a query on a select field with a string?

    ------------------------------
    Thomas Spray
    ------------------------------


  • 2.  RE: query_builder query on select fields

    Posted Fri May 03, 2019 11:13 AM
    Hi Thomas,

    I think you're correct there, there doesn't seem to be a way to specify a string value, only ID from what I can see.
    This is something that will have to be discussed and dealt with by the development team unfortunately.

    Thanks,
    Paul.

    (P.S. if any workarounds present themselves, I will come back here and update the post)

    ------------------------------
    PAUL CURRAN
    ------------------------------



  • 3.  RE: query_builder query on select fields

    Posted Mon November 27, 2023 04:16 PM

    Any update on this? It has been 4 years already 💀



    ------------------------------
    Émilio Gonzalez
    ------------------------------