IBM Security QRadar SOAR

 View Only
  • 1.  search_ex API usage question

    Posted Wed May 15, 2024 04:18 AM

    Hello community

    I have a question about search_ex api.

    If we need a query all data from datatables from all Incidents Active, can we use search_ex api?

    The thing is seach_ex api requires a specific value to search.

    If we specify a value, we're unable to get the whole datatables. Is there any appropriate approach to do?



    ------------------------------
    Yohji Amano
    ------------------------------


  • 2.  RE: search_ex API usage question

    Posted Wed May 15, 2024 04:10 PM

    Hi Yohji -

    If anyone else sees this and has a better answer, please feel free. But from what I know, I am not certain that search_ex can achieve this.

    You can, however, use the GET /incidents/{incident_id}/table_data/{table_api_name} endpoint to get the data in a datatable for a given incident. And then you could loop this over all incidents, and go from there... That's not to say that search_ex won't work for you, but that's the best I can think of that will certainly get the job done.



    ------------------------------
    Bo Bleckel
    ------------------------------



  • 3.  RE: search_ex API usage question

    Posted Wed May 15, 2024 10:09 PM
    Hi BO, thank you for your suggestion.
     
    I understand that two steps (1. scan incidents / 2. table search ) approach would be an alternative way. 
     
    I feel search_ex api may less consume resources compared to "heler.findIncidents(query)".
    So if we can use regular expressions such as ".*" for the value of search_ex api or other option to select all,  
    I thought it would be convenient to achieve the requirements to get all child objects in an organization. 


    ------------------------------
    Yohji Amano
    ------------------------------



  • 4.  RE: search_ex API usage question

    Posted Thu May 16, 2024 09:52 AM

    Absolutely. And I'd be really curious to know if you figure out a way to use that endpoint for that purpose!



    ------------------------------
    Bo Bleckel
    ------------------------------