Skip to content
One platform. From customer conversation to completed work.Take a closer look
All connections
Security & Identity ยท CONNECTION

IBM QRadar + NodeHub

Work with your QRadar console: offenses, Ariel searches, reference data, assets, rules, log sources, vulnerability management, health and system configuration.

Explore 588 workflow actions for IBM QRadar, including account permissions and operation limits.

349 read actions239 write actions
WORKFLOW ACTIONS

What you can configure.

Choose an action in the workflow builder, connect an account, and map its inputs. These actions are available in the catalog; your account access and a successful test determine whether they work for your setup.

DELETE /analytics/ade_rules/{id}

Write

Deletes an ADE rule.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

DELETE /analytics/building_blocks/{id}

Write

Deletes the building block rule.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

DELETE /analytics/rules/{id}

Write

Delete the rule.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

DELETE /ariel/event_saved_search_groups/{group_id}

Write

Deletes an event Ariel saved search group.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

DELETE /ariel/flow_saved_search_groups/{group_id}

Write

Deletes a flow Ariel saved search group.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

DELETE /ariel/flow_vlans/{id}

Write

Deletes a flow VLAN ID with specified enterprise and customer VLAN ID's and removes any associated domain mappings.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

DELETE /ariel/lookups/{name}

Write

Deletes a tagged field lookup with particular name.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

DELETE /ariel/saved_searches/{id}

Write

Deletes an Ariel saved search.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

DELETE /ariel/searches/{search_id}

Write

Deletes an Ariel search.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

DELETE /ariel/taggedfieldcategories/{id}

Write

Removes the category for tagged fields from the system.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

DELETE /ariel/taggedfields/{id}

Write

Removes a tagged field from the system.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

DELETE /asset_model/assets/{asset_id}

Write

Deletes a Asset by ID.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

DELETE /asset_model/saved_search_groups/{group_id}

Write

Deletes an asset saved search group.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

DELETE /asset_model/saved_searches/{saved_search_id}

Write

Deletes an asset saved search.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

DELETE /bandwidth_manager/configurations/{id}

Write

Delete a bandwidth manager configuration by ID.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

DELETE /bandwidth_manager/filters/{id}

Write

Update a filter by ID.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

DELETE /config/access/tenant_management/tenants/{tenant_id}

Write

Delete a tenant.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

DELETE /config/domain_management/domains/{domain_id}

Write

Deletes a domain by domain id.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

DELETE /config/event_retention_buckets/{id}

Write

Deletes an event retention bucket.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

DELETE /config/event_sources/custom_properties/calculated_properties/{calculated_property_id}

Write

Deletes the event calculated property.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

DELETE /config/event_sources/custom_properties/property_aql_expressions/{expression_id}

Write

Deletes a Custom Property AQL expression based on the supplied expression ID.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

DELETE /config/event_sources/custom_properties/property_calculated_expressions/{expression_id}

Write

Deletes a Custom Property Calculated Expression based on the supplied expression ID.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

DELETE /config/event_sources/custom_properties/property_cef_expressions/{expression_id}

Write

Deletes a CEF expression based on the supplied identifier.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

DELETE /config/event_sources/custom_properties/property_expressions/{expression_id}

Write

Deletes an event regex property expression based on the supplied identifier.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

DELETE /config/event_sources/custom_properties/property_genericlist_expressions/{expression_id}

Write

Deletes a Generic List expression based on the supplied identifier.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

DELETE /config/event_sources/custom_properties/property_json_expressions/{expression_id}

Write

Deletes a JSON expression based on the supplied identifier.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

DELETE /config/event_sources/custom_properties/property_leef_expressions/{expression_id}

Write

Deletes a LEEF Expression based on the supplied identifier.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

DELETE /config/event_sources/custom_properties/property_nvp_expressions/{expression_id}

Write

Deletes a Name Value Pair expression based on the supplied identifier.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

DELETE /config/event_sources/custom_properties/property_xml_expressions/{expression_id}

Write

Deletes an XML expression based on the supplied identifier.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

DELETE /config/event_sources/custom_properties/regex_properties/{regex_property_id}

Write

Deletes an event regex property.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

DELETE /config/event_sources/disconnected_log_collectors/{id}

Write

Deletes a Disconnected Log Collector by ID.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

DELETE /config/event_sources/log_source_management/log_source_types/{id}

Write

Deletes a custom log source type by ID.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

DELETE /config/event_sources/log_source_management/log_source_types/dsm_parameter_configuration/dsm_parameter_allowed_values/{id}

Write

Deletes a dsm paramater allowed value by ID.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

DELETE /config/event_sources/log_source_management/log_source_types/dsm_parameter_configuration/dsm_parameters/{id}

Write

Deletes a dsm paramater by ID.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

DELETE /config/event_sources/log_source_management/log_sources/{id}

Write

Deletes a log source by ID.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

DELETE /config/flow_retention_buckets/{id}

Write

Deletes a flow retention bucket.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

DELETE /config/flow_sources/custom_properties/calculated_properties/{calculated_property_id}

Write

Deletes the flow calculated property.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

DELETE /config/flow_sources/custom_properties/property_expressions/{expression_id}

Write

Deletes a flow regex property expression based on the supplied expression ID.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

DELETE /config/flow_sources/custom_properties/regex_properties/{regex_property_id}

Write

Deletes a flow regex property.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

DELETE /config/flow/common_destination_ports/active_configurations/{id}

Write

Removes the active configuration for the specified ID from the system.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

DELETE /config/resource_restrictions/{resource_restriction_id}

Write

Deletes a resource restriction consumer by ID.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

DELETE /config/store_and_forward/policies/{id}

Write

Deletes a store and forward policy.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

DELETE /dynamic_search/saved_queries/{id}

Write

Removes the specified query from the system.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

DELETE /dynamic_search/searches/{handle}

Write

Deletes a search and any stored results.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

DELETE /qni/stacking/stacks/{stack_id}

Write

Deletes a QNI stack, as specified by the stack ID.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

DELETE /qrm/model_groups/{group_id}

Write

Deletes a model group.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

DELETE /qrm/qrm_saved_search_groups/{group_id}

Write

Deletes a QRM saved search group.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

DELETE /qrm/question_groups/{group_id}

Write

Deletes a question group.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

DELETE /qrm/simulation_groups/{group_id}

Write

Deletes a simulation group.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

DELETE /qrm/topology_saved_search_groups/{group_id}

Write

Deletes a topology saved search group.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

DELETE /qvm/saved_search_groups/{group_id}

Write

Deletes a vulnerability saved search group.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

DELETE /qvm/saved_searches/{saved_search_id}

Write

Deletes a vulnerability saved search.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

DELETE /reference_data_collections/sets/{id}

Write

Delete a set by starting an asynchronous task

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

DELETE /reference_data/map_of_sets/{name}

Write

Removes a map of sets or purges its contents.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

DELETE /reference_data/map_of_sets/{name}/{key}

Write

Remove a value from a reference map of sets.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

DELETE /reference_data/maps/{name}

Write

Removes a reference map or purges its contents.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

DELETE /reference_data/maps/{name}/{key}

Write

Remove a value from a reference map.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

DELETE /reference_data/tables/{name}

Write

Remove a reference table or purge its contents.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

DELETE /reference_data/tables/{name}/{outer_key}/{inner_key}

Write

Remove a value from a reference table.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

DELETE /siem/offense_saved_search_groups/{group_id}

Write

Deletes an offense saved search group.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

DELETE /siem/offense_saved_searches/{id}

Write

Deletes an offense saved search.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

DELETE /staged_config/access/users/{id}

Write

Deletes a user from staging.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

DELETE /staged_config/flow/applications/active_applications/{id}

Write

Removes the active flow application from the staged configuration area, as specified by the application ID.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

DELETE /staged_config/remote_networks/{network_id}

Write

Deletes an existing staged remote network.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

DELETE /staged_config/remote_services/{service_id}

Write

Deletes an existing staged remote service.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

DELETE /system/email_servers/{email_server_id}

Write

Deletes an email server.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

GET /access/login_attempts

Read

Gets the list of login attempts.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /analytics/ade_rules

Read

Retrieves a list of ADE rules.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /analytics/ade_rules/{id}

Read

Retrieves an ADE rule.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /analytics/ade_rules/{id}/dependents

Read

Retrieves the objects that depend on the ADE rule.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /analytics/ade_rules/ade_rule_delete_tasks/{task_id}

Read

Retrieves the delete the ADE rule task status.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /analytics/ade_rules/ade_rule_dependent_tasks/{task_id}

Read

Retrieves the dependent the ADE rule task status.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /analytics/ade_rules/ade_rule_dependent_tasks/{task_id}/results

Read

Retrieves the ADE rule dependent task results.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /analytics/building_blocks

Read

Retrieves a list of building block rules.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /analytics/building_blocks/{id}

Read

Retrieves a building block rule.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /analytics/building_blocks/{id}/dependents

Read

Retrieves the objects that depend on the building block rule.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /analytics/building_blocks/building_block_delete_tasks/{task_id}

Read

Retrieves the delete the building block rule task status.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /analytics/building_blocks/building_block_dependent_tasks/{task_id}

Read

Retrieves the dependent the building block rule task status.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /analytics/building_blocks/building_block_dependent_tasks/{task_id}/results

Read

Retrieves the building block rule dependent task results.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /analytics/rule_groups

Read

Retrieves a list of the rule groups.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /analytics/rule_groups/{group_id}

Read

Retrieves a rule group.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /analytics/rules

Read

Retrieves a list of rules.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /analytics/rules_offense_contributions

Read

Retrieves Rule Offense contributions Retieves Rule and Offense references in the system.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /analytics/rules/{id}

Read

Retrieves a rule.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /analytics/rules/{id}/dependents

Read

Retrieves the objects that depend on the rule.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /analytics/rules/rule_delete_tasks/{task_id}

Read

Retrieves the delete the rule task status.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /analytics/rules/rule_dependent_tasks/{task_id}

Read

Retrieves the dependent rule task status.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /analytics/rules/rule_dependent_tasks/{task_id}/results

Read

Retrieves the rule dependent task results.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /ariel/databases

Read

Retrieves a list of available Ariel database names

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /ariel/databases/{database_name}

Read

Retrieve the columns that are defined for a specific Ariel database.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /ariel/event_saved_search_groups

Read

Retrieves a list the event Ariel saved search groups.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /ariel/event_saved_search_groups/{group_id}

Read

Retrieves an event Ariel saved search group.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /ariel/flow_saved_search_groups

Read

Retrieves a list of flow Ariel saved search groups.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /ariel/flow_saved_search_groups/{group_id}

Read

Retrieves a flow Ariel saved search group.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /ariel/flow_vlans

Read

Retrieves a list of available flow VLAN IDs in the Ariel database.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /ariel/flow_vlans/{id}

Read

Retrieves a flow VLAN ID object by VLAN ID.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /ariel/functions

Read

Retrieves AQL Functions for given .

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /ariel/functions/{function_name}

Read

Retrieves AQL Function with given name for a given database.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /ariel/lookups

Read

Retrieves a list of all tagged field lookups.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /ariel/lookups/{name}

Read

Retrieves a tagged field lookup by name.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /ariel/parser_keywords

Read

Retrieves keywords applicable to AQL Parser.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /ariel/saved_search_delete_tasks/{task_id}

Read

Retrieves the delete the Ariel saved search task status.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /ariel/saved_search_dependent_tasks/{task_id}

Read

Retrieves the dependent the Ariel saved search task status.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /ariel/saved_search_dependent_tasks/{task_id}/results

Read

Retrieves the Ariel saved search dependent task results.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /ariel/saved_searches

Read

Retrieves a list of Ariel saved searches.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /ariel/saved_searches/{id}

Read

Retrieves an Ariel saved search.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /ariel/saved_searches/{id}/dependents

Read

Retrieves the objects that depend on the Ariel saved search.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /ariel/searches

Read

Retrieves the list of Ariel searches.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /ariel/searches/{search_id}

Read

Retrieves information about an Ariel search.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /ariel/searches/{search_id}/metadata

Read

Retrieve the columns that are defined for a specific Ariel search id.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /ariel/searches/{search_id}/results

Read

Retrieves search results in the requested format.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /ariel/taggedfieldcategories

Read

Gets the list of categories for tagged fields.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /ariel/taggedfieldcategories/{id}

Read

Gets a category for tagged fields.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /ariel/taggedfields

Read

Gets the list of tagged fields.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /ariel/taggedfields/{id}

Read

Gets an individual tagged field.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /asset_model/asset_bulk_tasks/{id}

Read

Retrieves the current status of a bulk asset operation task by ID.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /asset_model/assets

Read

This lists all assets found in the model.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /asset_model/configuration

Read

Retrieve the current configuration settings pertaining to assets.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /asset_model/properties

Read

Get a list of available asset property types that can be used.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /asset_model/saved_search_groups

Read

Retrieves a list the asset saved search groups.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /asset_model/saved_search_groups/{group_id}

Read

Retrieves an asset saved search group.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /asset_model/saved_searches

Read

Retrieves a list of saved searches that can be used or applied against the /asset_model/saved_searches/{saved_search_id}/results query.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /asset_model/saved_searches/{saved_search_id}

Read

Retrieves an asset saved search.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /asset_model/saved_searches/{saved_search_id}/results

Read

Retrieves a list of assets based on the results of an asset saved search.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /bandwidth_manager/configurations

Read

Retrieves a list of configurations.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /bandwidth_manager/configurations/{id}

Read

Retrieves a configuration.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /bandwidth_manager/filters

Read

Retrieves a list of egress filters.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /bandwidth_manager/filters/{id}

Read

Retrieves a filter.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/access/security_profiles

Read

Get the list of deployed security profiles available in the system.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/access/security_profiles/{id}

Read

Get a deployed security profile by ID.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/access/tenant_management/tenants

Read

Retrieve the list of all tenants ordered by tenant id.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/access/tenant_management/tenants/{tenant_id}

Read

Retrieve a tenant by tenant id.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/access/user_dependent_tasks/{task_id}

Read

Retrieves the dependent user task status.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/access/user_dependent_tasks/{task_id}/results

Read

Retrieves the user dependent task results.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/access/user_roles

Read

Get the list of deployed user roles available in the system.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/access/user_roles/{id}

Read

Get a deployed user role by ID.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/access/users

Read

Retrieve Deployed Users.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/access/users/{id}

Read

Retrieves a deployed user.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/access/users/{id}/dependents

Read

Retrieves the objects that depend on the user.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/backup_and_restore/scheduled_backup_configurations

Read

Retrieves a list of Backup Configurations.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/backup_and_restore/scheduled_backup_configurations/{id}

Read

Retrieves a Backup Configuration by ID.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/deployment/hosts

Read

Retrieves a list of all deployed hosts.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/deployment/hosts/{id}

Read

Retrieves a deployed host by ID.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/deployment/hosts/{id}/tunnels

Read

Gets the list of tunnels for the host.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/deployment/license_pool

Read

Retrieves the deployed license pool information.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/domain_management/domains

Read

Gets the list of domains.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/domain_management/domains/{domain_id}

Read

Gets an individual domain by ID

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/event_retention_buckets

Read

Retrieves a list of event retention buckets.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/event_retention_buckets/{id}

Read

Retrieves an event retention bucket.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/event_sources/custom_properties/calculated_properties

Read

Retrieves a list of calculated event properties.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/event_sources/custom_properties/calculated_properties/{calculated_property_id}

Read

Retrieves a calculated event property based on the supplied calculated property identifier.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/event_sources/custom_properties/calculated_properties/{calculated_property_id}/dependents

Read

Retrieves the objects that depend on the event calculated property.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/event_sources/custom_properties/calculated_properties/{calculated_property_id}/dependents/disable

Read

Retrieves the objects that depend on the event calculated property.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/event_sources/custom_properties/calculated_properties/dep/{calculated_property_id}

Read

Retrieves a calculated event property based on the supplied calculated property ID.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/event_sources/custom_properties/calculated_property_delete_tasks/{task_id}

Read

Retrieves the status of the event calculated property delete task.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/event_sources/custom_properties/calculated_property_dependent_tasks/{task_id}

Read

Retrieves the status of the event calculated property dependents task.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/event_sources/custom_properties/calculated_property_dependent_tasks/{task_id}/results

Read

Retrieves the calculated property dependent task results.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/event_sources/custom_properties/calculated_property_dependent_tasks/disable/{task_id}

Read

Retrieves the event calculated property dependent task status.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/event_sources/custom_properties/calculated_property_dependent_tasks/disable/{task_id}/results

Read

Retrieves the calculated property dependent task results.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/event_sources/custom_properties/calculated_property_operands

Read

Retrieves the list of available options for calculated event property operand.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/event_sources/custom_properties/calculated_property/{calculated_property_name}

Read

Retrieves a list of event calculated properties.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/event_sources/custom_properties/property_aql_expressions

Read

Gets the list of Custom Property AQL Expressions.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/event_sources/custom_properties/property_aql_expressions/{expression_id}

Read

Gets a Custom Property AQL Expression by ID.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/event_sources/custom_properties/property_calculated_expressions

Read

Gets the list of Custom Property Calculated Expressions.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/event_sources/custom_properties/property_calculated_expressions/{expression_id}

Read

Gets a Custom Property Calculated Expression by ID.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/event_sources/custom_properties/property_cef_expressions

Read

Retrieves a list of CEF expressions.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/event_sources/custom_properties/property_cef_expressions/{expression_id}

Read

Retrieves a CEF expression based on the supplied identifier.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/event_sources/custom_properties/property_expressions

Read

Retrieves a list of event regex property expressions.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/event_sources/custom_properties/property_expressions/{expression_id}

Read

Retrieves a event regex property expression based on the supplied identifier.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/event_sources/custom_properties/property_genericlist_expressions

Read

Retrieves a list of Generic List expressions.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/event_sources/custom_properties/property_genericlist_expressions/{expression_id}

Read

Retrieves a Generic List expression based on the supplied identifier.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/event_sources/custom_properties/property_json_expressions

Read

Retrieves a list of JSON expressions.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/event_sources/custom_properties/property_json_expressions/{expression_id}

Read

Retrieves a JSON expression based on the supplied identifier.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/event_sources/custom_properties/property_leef_expressions

Read

Retrieves the list of LEEF Expressions.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/event_sources/custom_properties/property_leef_expressions/{expression_id}

Read

Retrieves a LEEF Expression based on the supplied identifier.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/event_sources/custom_properties/property_nvp_expressions

Read

Retrieves a list of Name Value Pair expressions.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/event_sources/custom_properties/property_nvp_expressions/{expression_id}

Read

Retrieves a Name Value Pair expression based on the supplied identifier.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/event_sources/custom_properties/property_xml_expressions

Read

Retrieves a list of XML expressions.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/event_sources/custom_properties/property_xml_expressions/{expression_id}

Read

Retrieves a XML expression based on the supplied identifier.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/event_sources/custom_properties/regex_properties

Read

Retrieves a list of event regex properties.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/event_sources/custom_properties/regex_properties/{regex_property_id}

Read

Retrieves a event regex property based on the supplied regex property ID.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/event_sources/custom_properties/regex_properties/{regex_property_id}/dependents

Read

Retrieves the objects that depend on the event regex property.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/event_sources/custom_properties/regex_properties/{regex_property_id}/dependents/change_field_type

Read

Retrieves the objects that depend on the event regex property for changing type of field for it.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/event_sources/custom_properties/regex_properties/{regex_property_id}/dependents/disable

Read

Retrieves the objects that depend on the event regex property for disabling it.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/event_sources/custom_properties/regex_property_delete_tasks/{task_id}

Read

Retrieves the event regex property delete task status.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/event_sources/custom_properties/regex_property_dependent_tasks/{task_id}

Read

Retrieves the event regex property dependent task status.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/event_sources/custom_properties/regex_property_dependent_tasks/{task_id}/results

Read

Retrieves the regex property dependent task results.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/event_sources/custom_properties/regex_property_dependent_tasks/change_field_type/{task_id}

Read

Retrieves the event regex property dependent task status.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/event_sources/custom_properties/regex_property_dependent_tasks/change_field_type/{task_id}/results

Read

Retrieves the regex property dependent task results.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/event_sources/custom_properties/regex_property_dependent_tasks/disable/{task_id}

Read

Retrieves the event regex property dependent task status.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/event_sources/custom_properties/regex_property_dependent_tasks/disable/{task_id}/results

Read

Retrieves the regex property dependent task results.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/event_sources/disconnected_log_collectors

Read

Retrieves a list of disconnected log collectors.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/event_sources/disconnected_log_collectors/{id}

Read

Retrieves an disconnected log collector by ID..

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/event_sources/event_collectors

Read

Retrieves a list of event collectors..

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/event_sources/event_collectors/{id}

Read

Retrieves an event collector by ID..

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/event_sources/log_source_management/autodetection/config_records

Read

Retrieves the list of Autodetection Config Records.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/event_sources/log_source_management/autodetection/config_records/{config_id}

Read

Gets an individual Autodetection Config Record by id.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/event_sources/log_source_management/log_source_bulk_tasks/{id}

Read

Retrieves a log source bulk task by ID.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/event_sources/log_source_management/log_source_extensions

Read

Retrieves the list of log source extensions.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/event_sources/log_source_management/log_source_extensions/{id}

Read

Retrieves a log source extension by ID.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/event_sources/log_source_management/log_source_groups

Read

Retrieves the list of log source groups.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/event_sources/log_source_management/log_source_groups/{id}

Read

Retrieves a log source group by ID.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/event_sources/log_source_management/log_source_languages

Read

Retrieves the list of log source languages.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/event_sources/log_source_management/log_source_languages/{id}

Read

Retrieves a log source language by ID.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/event_sources/log_source_management/log_source_types

Read

Retrieves a list of log source types.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/event_sources/log_source_management/log_source_types/{id}

Read

Retrieves a log source type by ID.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/event_sources/log_source_management/log_source_types/dsm_parameter_configuration/dsm_parameter_allowed_values

Read

Retrieve dsm parameter allowed values.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/event_sources/log_source_management/log_source_types/dsm_parameter_configuration/dsm_parameter_allowed_values/{id}

Read

Retrieve a dsm parameter allowed value by id.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/event_sources/log_source_management/log_source_types/dsm_parameter_configuration/dsm_parameter_definition

Read

Retrieve dsm parameter definitions.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/event_sources/log_source_management/log_source_types/dsm_parameter_configuration/dsm_parameters

Read

Retrieve dsm parameters.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/event_sources/log_source_management/log_source_types/dsm_parameter_configuration/dsm_parameters/{id}

Read

Retrieve a dsm parameter by id.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/event_sources/log_source_management/log_sources

Read

Retrieves a list of log sources.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/event_sources/log_source_management/log_sources/{id}

Read

Retrieves a log source by ID.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/event_sources/log_source_management/protocol_types

Read

Retrieves the list of protocol types.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/event_sources/log_source_management/protocol_types/{id}

Read

Retrieves a protocol type by ID.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/event_sources/property_discovery_profiles

Read

Gets all PropertyDiscoveryProfiles currently in the system.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/event_sources/property_discovery_profiles/{id}

Read

Gets a PropertyDiscoveryProfile based on the information supplied by the property_discovery_profile corresponding to the supplied ID.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/event_sources/wincollect/wincollect_agents

Read

Retrieves a list of WinCollect agents.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/event_sources/wincollect/wincollect_agents/{id}

Read

Retrieves a WinCollect agent by ID.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/event_sources/wincollect/wincollect_destinations

Read

Retrieves a list of WinCollect destinations.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/event_sources/wincollect/wincollect_destinations/{id}

Read

Retrieves a WinCollect destination by ID.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/flow_retention_buckets

Read

Retrieves a list of flow retention buckets.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/flow_retention_buckets/{id}

Read

Retrieves a flow retention bucket.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/flow_sources/custom_properties/calculated_properties

Read

Retrieves a list of calculated flow properties.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/flow_sources/custom_properties/calculated_properties/{calculated_property_id}

Read

Retrieves a calculated flow property based on the supplied calculated property ID.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/flow_sources/custom_properties/calculated_properties/{calculated_property_id}/dependents

Read

Retrieves the objects that depend on the flow calculated property.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/flow_sources/custom_properties/calculated_properties/{calculated_property_id}/dependents/disable

Read

Retrieves the objects that depend on the flow calculated property.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/flow_sources/custom_properties/calculated_properties/dep/{calculated_property_id}

Read

Retrieves a calculated flow property based on the supplied calculated property ID.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/flow_sources/custom_properties/calculated_property_delete_tasks/{task_id}

Read

Retrieves the status of the flow calculated property delete task.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/flow_sources/custom_properties/calculated_property_dependent_tasks/{task_id}

Read

Retrieves the status of the flow calculated property dependents task.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/flow_sources/custom_properties/calculated_property_dependent_tasks/{task_id}/results

Read

Retrieves the calculated property dependent task results.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/flow_sources/custom_properties/calculated_property_dependent_tasks/disable/{task_id}

Read

Retrieves the flow calculated property dependent task status.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/flow_sources/custom_properties/calculated_property_dependent_tasks/disable/{task_id}/results

Read

Retrieves the calculated property dependent task results.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/flow_sources/custom_properties/calculated_property_operands

Read

Retrieves the list of available options for calculated flow property operand.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/flow_sources/custom_properties/calculated_property/{calculated_property_name}

Read

Retrieves a list of flow calculated properties.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/flow_sources/custom_properties/property_expressions

Read

Retrieve a list of flow regex property expressions.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/flow_sources/custom_properties/property_expressions/{expression_id}

Read

Retrieves a flow regex property expression based on the supplied expression ID.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/flow_sources/custom_properties/regex_properties

Read

Retrieves a list of flow regex properties.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/flow_sources/custom_properties/regex_properties/{regex_property_id}

Read

Retrieves a flow regex property based on the supplied regex property ID.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/flow_sources/custom_properties/regex_properties/{regex_property_id}/dependents

Read

Retrieves the objects that depend on the flow regex property.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/flow_sources/custom_properties/regex_properties/{regex_property_id}/dependents/change_field_type

Read

Retrieves the objects that depend on the flow regex property for changing type of field for it.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/flow_sources/custom_properties/regex_properties/{regex_property_id}/disabling_dependents

Read

Retrieves the objects that depend on the flow regex property.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/flow_sources/custom_properties/regex_property_delete_tasks/{task_id}

Read

Retrieves the flow regex property delete task status.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/flow_sources/custom_properties/regex_property_dependent_tasks/{task_id}

Read

Retrieves the flow regex property dependent task status.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/flow_sources/custom_properties/regex_property_dependent_tasks/{task_id}/results

Read

Retrieves the regex property dependent task results.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/flow_sources/custom_properties/regex_property_dependent_tasks/change_field_type/{task_id}

Read

Retrieves the flow regex property dependent task status.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/flow_sources/custom_properties/regex_property_dependent_tasks/change_field_type/{task_id}/results

Read

Retrieves the regex property dependent task results.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/flow_sources/custom_properties/regex_property_dependent_tasks/disable/{task_id}

Read

Retrieves the flow regex property dependent task status.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/flow_sources/custom_properties/regex_property_dependent_tasks/disable/{task_id}/results

Read

Retrieves the regex property dependent task results.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/flow_sources/flow_source_management/flowSources

Read

Gets the list of flow sources that are available to the current user.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/flow_sources/flow_source_management/flowSources/{id}

Read

Gets an individual Flow Source as specified by the ID.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/flow/applications/active_applications

Read

Gets the list of active flow applications.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/flow/applications/active_applications/{id}

Read

Gets an individual active flow application that is currently deployed in the system, as specified by the application ID.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/flow/applications/default_applications

Read

Gets the list of default flow applications.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/flow/applications/default_applications/{id}

Read

Gets an individual default flow application, as specified by an ID.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/flow/common_destination_ports/active_configurations

Read

Gets the list of active configurations for common destination ports.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/flow/common_destination_ports/active_configurations/{id}

Read

Gets the active configuration for a common destination port, as specified by an ID.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/flow/common_destination_ports/default_configurations

Read

Gets the list of default configurations for common destination ports.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/flow/common_destination_ports/default_configurations/{id}

Read

Gets the default configuration for a common destination port, as specified by an ID.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/network_hierarchy/networks

Read

Retrieves the deployed network hierarchy.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/network_hierarchy/staged_networks

Read

Retrieves the staged network hierarchy.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/remote_networks

Read

Retrieves a list of deployed remote networks.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/remote_networks/{network_id}

Read

Retrieves a deployed remote network by ID.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/remote_services

Read

Retrieves a list of deployed remote services.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/remote_services/{service_id}

Read

Retrieves a deployed remote service by ID.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/resilient/test/{task_id}

Read

Get the test Resilient connection task status You must have the System Administrator or Security Admin permission (ADMIN | SAASADMIN capability) to use this endpoint.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/resource_restrictions

Read

Retrieves a list of all resource restrictions.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/resource_restrictions/{resource_restriction_id}

Read

Retrieves a resource restriction consumer by ID.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/store_and_forward/policies

Read

Retrieves a list of store and forward policies.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/store_and_forward/policies/{id}

Read

Retrieves a store and forward policy.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/tiered_storage/policies

Read

Retrieve all tiered storage policies

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /config/tiered_storage/policies/{id}

Read

Retrieve a specific tiered storage policy

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /data_classification/dsm_event_mappings

Read

Retrieve a list of DSM event mappings.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /data_classification/dsm_event_mappings/{dsm_event_mapping_id}

Read

Retrieves a DSM event mapping based on the supplied DSM event mapping ID.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /data_classification/high_level_categories

Read

Retrieves a list of high level categories.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /data_classification/low_level_categories

Read

Retrieves a list of low level categories.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /data_classification/low_level_categories/{low_level_category_id}

Read

Retrieves a low level category based on the supplied low level category ID.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /data_classification/qid_records/{qid_record_id}

Read

Retrieves a QID record that is based on the supplied qid_record_id.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /dynamic_search/saved_queries

Read

Returns a list of all queries to which the caller has access.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /dynamic_search/saved_queries/{id}

Read

Returns a single query with the specified ID.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /dynamic_search/schemas

Read

Gets the list of all schemas available to the user.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /dynamic_search/schemas/{name}

Read

Gets the list of all schemas available to the user.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /dynamic_search/schemas/{name}/fields

Read

Gets the list of all available Fields

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /dynamic_search/schemas/{name}/functions

Read

Gets the list of all available Functions

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /dynamic_search/schemas/{name}/operators

Read

Gets the list of all available relational Operators

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /dynamic_search/searches

Read

Gets the list of all searches performed by this user.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /dynamic_search/searches/{handle}

Read

Gets the specific search performed by this user.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /dynamic_search/searches/{handle}/results

Read

Gets the specific search performed by this user.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /health_data/security_data_count

Read

Retrieves count of security artifacts in QRadar

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /health_data/top_offenses

Read

Retrieves Top Offenses in the system sorted by update count.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /health_data/top_rules

Read

Retrieves Top Rules in the system sorted by response count.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /health/metrics/qradar_metrics

Read

Gets the list of QRadar component metrics

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /health/metrics/qradar_metrics/{id}

Read

Retrieves the QRadar health metric identified by ID.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /health/metrics/system_metrics

Read

Gets the list of system metrics.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /health/metrics/system_metrics/{id}

Read

Retrieves the system health metric identified by metric ID.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /help/endpoints

Read

Retrieves a list of endpoint documentation objects that are currently in the system.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /help/endpoints/{endpoint_id}

Read

Retrieves a single endpoint documentation object.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /help/resources

Read

Retrieves a list of resource documentation objects currently in the system.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /help/resources/{resource_id}

Read

Retrieves a single resource documentation object.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /help/versions

Read

Retrieves a list of version documentation objects currently in the system.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /help/versions/{version_id}

Read

Retrieves a single version documentation object.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /qni/hosts/{host_id}/configs

Read

Retrieves a list of QNI configurations.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /qni/stacking/stacks

Read

Retrieves a list of all QNI stacks in the system.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /qni/stacking/stacks/{stack_id}

Read

Retrieves a QNI stack, as specified by the stack ID.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /qni/stacking/standalone_hosts

Read

Retrieves a list of all standalone QNI hosts that can be added to a stack.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /qrm/model_groups

Read

Retrieves a list of model groups.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /qrm/model_groups/{group_id}

Read

Retrieves a model group.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /qrm/qrm_saved_search_groups

Read

Retrieves a list of QRM saved search groups.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /qrm/qrm_saved_search_groups/{group_id}

Read

Retrieves a QRM saved search group.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /qrm/question_groups

Read

Retrieves a list of question groups.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /qrm/question_groups/{group_id}

Read

Retrieves a question group.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /qrm/simulation_groups

Read

Retrieves a of list the simulation groups.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /qrm/simulation_groups/{group_id}

Read

Retrieves a simulation group.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /qrm/topology_saved_search_groups

Read

Retrieves a list of topology saved search groups.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /qrm/topology_saved_search_groups/{group_id}

Read

Retrieves a topology saved search group.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /qvm/saved_search_groups

Read

Retrieves a list of vulnerability saved search groups.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /qvm/saved_search_groups/{group_id}

Read

Retrieves a vulnerability saved search group.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /qvm/saved_searches

Read

Retrieves a list of vulnerability instance saved searches.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /qvm/saved_searches/{saved_search_id}

Read

Retrieves a vulnerability instance saved search.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /qvm/saved_searches/{saved_search_id}/vuln_instances

Read

Creates the Vulnerability Instances search.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /qvm/saved_searches/vuln_instances/{task_id}/results/assets

Read

Lists the Vulnerability Instances assets that are returned from the vulnerability instance saved search.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /qvm/saved_searches/vuln_instances/{task_id}/results/vuln_instances

Read

Lists the Vulnerability Instances returned from a vulnerability instance saved search.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /qvm/saved_searches/vuln_instances/{task_id}/results/vulnerabilities

Read

List the Vulnerability Instances vulnerabilities returned from the saved search.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /qvm/saved_searches/vuln_instances/{task_id}/status

Read

Retrieves the current status of a vulnerability instance search that was initiated.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /reference_data_collections/set_bulk_update_tasks/{task_status_id}

Read

Get the Bulk Update status

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /reference_data_collections/set_bulk_update_tasks/{task_status_id}/results

Read

Get the results of the Bulk Update task

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /reference_data_collections/set_delete_tasks/{task_status_id}

Read

Get results of the asynchronous delete Set task

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /reference_data_collections/set_dependents_tasks/{task_status_id}

Read

Get the status of the Get Dependents task

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /reference_data_collections/set_dependents_tasks/{task_status_id}/results

Read

Get the results of the Get Dependents task

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /reference_data_collections/set_entries

Read

Get a list of set entries which match a search criteria.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /reference_data_collections/set_entries/{id}

Read

Get a set entry

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /reference_data_collections/sets

Read

Get a list of set meta data information based on search criteria

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /reference_data_collections/sets/{id}

Read

Get the meta data information for a specific set

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /reference_data_collections/sets/{id}/dependents

Read

Create an asynchronous task to get the dependents of a Set

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /reference_data/map_delete_tasks/{task_id}

Read

Retrieves the delete reference data map task status.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /reference_data/map_dependent_tasks/{task_id}

Read

Retrieves the dependent reference data map task status.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /reference_data/map_dependent_tasks/{task_id}/results

Read

Retrieves the reference data map dependent task results.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /reference_data/map_of_sets

Read

Retrieve a list of all reference map of sets.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /reference_data/map_of_sets_delete_tasks/{task_id}

Read

Retrieves the delete reference data map of sets task status.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /reference_data/map_of_sets_dependent_tasks/{task_id}

Read

Retrieves the dependent reference data map of sets task status.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /reference_data/map_of_sets_dependent_tasks/{task_id}/results

Read

Retrieves the reference data map of sets dependent task results.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /reference_data/map_of_sets/{name}

Read

Return the reference map of sets identified by name.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /reference_data/map_of_sets/{name}/dependents

Read

Retrieves the objects that depend on the reference data map of sets.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /reference_data/maps

Read

Retrieve a list of all reference maps.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /reference_data/maps/{name}

Read

Retrieve the reference map identified by name.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /reference_data/maps/{name}/dependents

Read

Retrieves the objects that depend on the reference data map.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /reference_data/tables

Read

Retrieve a list of all reference tables.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /reference_data/tables_delete_tasks/{task_id}

Read

Retrieve the delete the Reference Data Tables task status.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /reference_data/tables_dependent_tasks/{task_id}

Read

Retrieve the dependent the Reference Data Tables task status.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /reference_data/tables_dependent_tasks/{task_id}/results

Read

Retrieve the Reference Data Tables Dependent Task Results

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /reference_data/tables/{name}

Read

Return the reference table identified by name.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /reference_data/tables/{name}/dependents

Read

Find the objects that depend on the Reference Data Tables

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /services/dig_lookups/{dig_lookup_id}

Read

Retrieves the DIG lookup status.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /services/dns_lookups/{dns_lookup_id}

Read

Retrieves the DNS lookup status.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /services/geolocations

Read

Retrieves the MaxMind geoip data for the given IP address.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /services/port_scans/{port_scan_id}

Read

Retrieves the port scan status.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /services/whois_lookups/{whois_lookup_id}

Read

Retrieves the WHOIS lookup status.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /siem/local_destination_addresses

Read

Retrieve a list offense local destination addresses currently in the system.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /siem/local_destination_addresses/{local_destination_address_id}

Read

Retrieve an offense local destination address.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /siem/milestone_generation_tasks

Read

Retrieves task list for logged-in user and applicable filter criteria.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /siem/milestone_generation_tasks/{task_id}

Read

Retrieves task status by given task ID for attack timeline.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /siem/milestones

Read

Retrieves milestone list for logged-in user and applicable filter criteria.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /siem/milestones/{milestone_id}

Read

Retrieves an individual milestone by ID.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /siem/offense_closing_reasons

Read

Retrieve a list of all offense closing reasons.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /siem/offense_closing_reasons/{closing_reason_id}

Read

Retrieve an offense closing reason.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /siem/offense_saved_search_delete_tasks/{task_id}

Read

Retrieves the delete the offense saved search task status.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /siem/offense_saved_search_dependent_tasks/{task_id}

Read

Retrieves the dependent the offense saved search task status.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /siem/offense_saved_search_dependent_tasks/{task_id}/results

Read

Retrieves the offense saved search dependent task results.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /siem/offense_saved_search_groups

Read

Retrieves a list of offense saved search groups.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /siem/offense_saved_search_groups/{group_id}

Read

Retrieves an offense saved search group.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /siem/offense_saved_searches

Read

Retrieves a list of offense saved searches.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /siem/offense_saved_searches/{id}

Read

Retrieves an offense saved search.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /siem/offense_saved_searches/{id}/dependents

Read

Retrieves the objects that depend on an offense saved search.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /siem/offense_types

Read

Retrieve all the Offense Types

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /siem/offense_types/{offense_type_id}

Read

Retrieve an offense type structure that describes the properties of an offense type.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /siem/offenses

Read

Retrieve a list of offenses currently in the system.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /siem/offenses/{offense_id}

Read

Retrieve an offense structure that describes properties of an offense

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /siem/offenses/{offense_id}/assignable_actors

Read

Retrieve assignable actors.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /siem/offenses/{offense_id}/notes

Read

Retrieve a list of notes for an offense.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /siem/offenses/{offense_id}/notes/{note_id}

Read

Retrieve a note for an offense.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /siem/source_addresses

Read

Retrieve a list offense source addresses currently in the system.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /siem/source_addresses/{source_address_id}

Read

Retrieve an offense source address.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /staged_config/access/security_profiles

Read

Get the list of staged security profiles available in the system.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /staged_config/access/security_profiles/{id}

Read

Get a staged security profile by ID.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /staged_config/access/user_delete_tasks/{task_id}

Read

Retrieves the delete user task status.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /staged_config/access/user_roles

Read

Get the list of staged user roles available in the system.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /staged_config/access/user_roles/{id}

Read

Get a staged user role by ID.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /staged_config/access/users

Read

Retrieves a list of all staged users.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /staged_config/access/users/{id}

Read

Retrieves a staged user.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /staged_config/backup_and_restore/scheduled_backup_configurations

Read

Retrieves a list of the Staged Backup Configurations.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /staged_config/backup_and_restore/scheduled_backup_configurations/{id}

Read

Retrieves a Staged Backup Configuration by ID.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /staged_config/deploy_status

Read

Retrieves the status of a deploy in progress.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /staged_config/deployment/hosts

Read

Retrieves a list of all staged hosts.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /staged_config/deployment/hosts/{id}

Read

Retrieves a staged host by ID.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /staged_config/deployment/hosts/{id}/tunnels

Read

Gets the list of tunnels for the host.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /staged_config/flow/applications/active_applications

Read

Gets the list of active flow applications that are in the staged configuration area.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /staged_config/flow/applications/active_applications/{id}

Read

Gets an individual active flow application that is in the staged configuration area, as specified by the application ID.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /staged_config/remote_networks

Read

Retrieves a list of staged remote networks.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /staged_config/remote_networks/{network_id}

Read

Retrieves a staged remote network by ID.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /staged_config/remote_services

Read

Retrieves a list of staged remote services.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /staged_config/remote_services/{service_id}

Read

Retrieves a staged remote service by ID.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /system/about

Read

Retrieves the current system information

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /system/email_servers

Read

Retrieves a list of all email servers.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /system/email_servers/{email_server_id}

Read

Retrieves an email server based on the supplied email server ID.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /system/eula_acceptances

Read

Retrieves the list of EULA acceptance statuses that the caller has permission to see.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /system/eula_acceptances/{id}

Read

Retrieves an individual EULA Acceptance by id.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /system/eulas

Read

Retrieves a list of EULAs.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /system/information/encodings

Read

Retrieves the list of encodings that are supported by the system for event data..

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /system/servers

Read

Retrieves a list of all server hosts in the deployment.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /system/servers/{server_id}

Read

Retrieves a server host based on the supplied server ID.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /system/servers/{server_id}/firewall_rules

Read

Retrieves a list of access control firewall rules based on the supplied server ID.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /system/servers/{server_id}/network_interfaces/bonded

Read

Retrieves a list of the bonded network interfaces based on the supplied server ID.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /system/servers/{server_id}/network_interfaces/ethernet

Read

Retrieves a list of the ethernet network interfaces based on the supplied server ID.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /system/servers/{server_id}/system_time_settings

Read

Retrieves the system time and time zone settings of a server host based on the supplied server ID.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

GET /system/servers/{server_id}/timezones

Read

Retrieves all the available time zones that can be set for a server.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

PATCH /config/event_sources/log_source_management/log_source_types/dsm_parameter_configuration/dsm_parameter_allowed_values

Write

Create new dsm parameter allowed values or Update available dsm parameter allowed values.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

PATCH /config/event_sources/log_source_management/log_source_types/dsm_parameter_configuration/dsm_parameters

Write

Create new dsm parameters or Update available dsm parameters.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

PATCH /reference_data_collections/set_entries

Write

Perform asynchronous bulk update - series of add and updates

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /analytics/ade_rules/{id}

Write

Updates the ADE rule owner or enabled/disabled only.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /analytics/ade_rules/ade_rule_dependent_tasks/{task_id}

Write

Cancels a dependent the ADE rule task.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /analytics/building_blocks/{id}

Write

Updates the building block rule owner or enabled/disabled only.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /analytics/building_blocks/building_block_dependent_tasks/{task_id}

Write

Cancels the dependent the building block rule task.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /analytics/rule_groups/{group_id}

Write

Updates the owner of a rule group.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /analytics/rules/{id}

Write

Updates the rule owner or enabled/disabled only.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /analytics/rules/rule_dependent_tasks/{task_id}

Write

Cancels the dependent the rule task.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /ariel/event_saved_search_groups/{group_id}

Write

Updates the owner of an event Ariel saved search group.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /ariel/flow_saved_search_groups/{group_id}

Write

Updates the owner of a flow Ariel saved search group.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /ariel/flow_vlans

Write

Creates a new flow VLAN field as specified by input parameters.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /ariel/lookups

Write

Creates a new tagged field lookup.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /ariel/lookups/{name}

Write

Updates a tagged field lookup with particular name.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /ariel/processors/aql_metadata

Write

Parses the AQL query expression and returns metadata for this query

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /ariel/saved_search_dependent_tasks/{task_id}

Write

Cancels the dependent Ariel saved search task.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /ariel/saved_searches/{id}

Write

Updates the Ariel saved search.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /ariel/searches

Write

Create a new asynchronous Ariel search.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /ariel/searches/{search_id}

Write

Updates an Ariel search.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /ariel/taggedfieldcategories

Write

Creates a new category for tagged fields.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /ariel/taggedfieldcategories/{id}

Write

Updates a category for tagged fields.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /ariel/taggedfields

Write

Creates a new tagged field.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /ariel/taggedfields/{id}

Write

Updates a tagged field specified by an id.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /ariel/validators/aql

Write

Validates the AQL query expression.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /asset_model/assets

Write

Creates a new asset.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /asset_model/configuration

Write

Update asset configuration fields.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /asset_model/saved_search_groups/{group_id}

Write

Updates the owner of an asset saved search group.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /asset_model/saved_searches/{saved_search_id}

Write

Updates the asset saved search owner only.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /bandwidth_manager/configurations

Write

Creates a bandwidth manager configuration

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /bandwidth_manager/configurations/{id}

Write

Update a bandwidth manager configuration by ID.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /bandwidth_manager/filters

Write

Creates a bandwidth manager filter

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /bandwidth_manager/filters/{id}

Write

Delete a filter by sequence ID.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /config/access/tenant_management/tenants

Write

Create a new tenant.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /config/access/tenant_management/tenants/{tenant_id}

Write

Update a tenant

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /config/access/user_dependent_tasks/{task_id}

Write

Cancels a dependent user task.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /config/domain_management/domains

Write

Creates a new domain.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /config/domain_management/domains/{domain_id}

Write

Updates an existing domain.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /config/event_retention_buckets/{id}

Write

Updates the event retention bucket owner or enabled/disabled only.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /config/event_sources/custom_properties/calculated_properties

Write

Creates a new calculated event property.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /config/event_sources/custom_properties/calculated_properties/{calculated_property_id}

Write

Updates an existing calculated event property.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /config/event_sources/custom_properties/calculated_property_dependent_tasks/{task_id}

Write

Cancels the event calculated property dependent task.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /config/event_sources/custom_properties/calculated_property_dependent_tasks/disable/{task_id}

Write

Cancels the calculated property dependent task.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /config/event_sources/custom_properties/property_aql_expressions

Write

Creates a new Custom Property AQL expression.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /config/event_sources/custom_properties/property_aql_expressions/{expression_id}

Write

Updates a Custom Property AQL expression.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /config/event_sources/custom_properties/property_calculated_expressions

Write

Creates a new Custom Property Calculated Expression.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /config/event_sources/custom_properties/property_calculated_expressions/{expression_id}

Write

Updates a Custom Property Calculated Expression.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /config/event_sources/custom_properties/property_cef_expressions

Write

Creates a new CEF expression.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /config/event_sources/custom_properties/property_cef_expressions/{expression_id}

Write

Updates an existing CEF expression.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /config/event_sources/custom_properties/property_expressions

Write

Creates a new event regex property expression.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /config/event_sources/custom_properties/property_expressions/{expression_id}

Write

Updates an existing event regex property expression.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /config/event_sources/custom_properties/property_genericlist_expressions

Write

Creates a new Generic List expression.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /config/event_sources/custom_properties/property_genericlist_expressions/{expression_id}

Write

Updates an existing Generic List expression.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /config/event_sources/custom_properties/property_json_expressions

Write

Creates a new JSON expression.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /config/event_sources/custom_properties/property_json_expressions/{expression_id}

Write

Updates an existing JSON expression.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /config/event_sources/custom_properties/property_leef_expressions

Write

Creates a new LEEF Expression.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /config/event_sources/custom_properties/property_leef_expressions/{expression_id}

Write

Updates an existing LEEF Expression.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /config/event_sources/custom_properties/property_nvp_expressions

Write

Creates a new Name Value Pair expression.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /config/event_sources/custom_properties/property_nvp_expressions/{expression_id}

Write

Updates an existing Name Value Pair expression.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /config/event_sources/custom_properties/property_xml_expressions

Write

Creates a new XML expression.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /config/event_sources/custom_properties/property_xml_expressions/{expression_id}

Write

Updates an existing XML expression.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /config/event_sources/custom_properties/regex_properties

Write

Creates a new event regex property.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /config/event_sources/custom_properties/regex_properties/{regex_property_id}

Write

Updates an existing event regex property.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /config/event_sources/custom_properties/regex_property_dependent_tasks/{task_id}

Write

Cancels the regex property dependent task.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /config/event_sources/custom_properties/regex_property_dependent_tasks/change_field_type/{task_id}

Write

Cancels the regex property dependent task.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /config/event_sources/custom_properties/regex_property_dependent_tasks/disable/{task_id}

Write

Cancels the regex property dependent task.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /config/event_sources/generated_regexes

Write

Retrieves a regex pattern

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /config/event_sources/log_source_management/autodetection/config_records

Write

Creates an Autodetection Config Record.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /config/event_sources/log_source_management/autodetection/config_records/{config_id}

Write

Updates an Autodetection Config Record.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /config/event_sources/log_source_management/log_source_bulk_tasks/{id}

Write

Updates a log source bulk task.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /config/event_sources/log_source_management/log_source_groups

Write

Creates a new log source group.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /config/event_sources/log_source_management/log_source_statistics

Write

Creates log source statistics Log source statistics contains the following fields: LogSourceFieldValueStatistic contains the following fields:

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /config/event_sources/log_source_management/log_source_types

Write

Create a new custom log source type.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /config/event_sources/log_source_management/log_source_types/{id}

Write

Updates a log source type by ID.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /config/event_sources/log_source_management/log_source_types/dsm_parameter_configuration/dsm_parameter_allowed_values/{id}

Write

Update a dsm parameter allowed value by id.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /config/event_sources/log_source_management/log_source_types/dsm_parameter_configuration/dsm_parameters/{id}

Write

Update a dsm parameter by id.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /config/event_sources/property_discovery_profiles

Write

Creates a PropertyDiscoveryProfile based on the information supplied by the property_discovery_profile JSON object.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /config/event_sources/property_discovery_profiles/{id}

Write

Updates a PropertyDiscoveryProfile based on the information supplied via the property_discovery_profile JSON object.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /config/flow_retention_buckets/{id}

Write

Updates the flow retention bucket owner, or enabled/disabled only.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /config/flow_sources/custom_properties/calculated_properties

Write

Creates a new calculated flow property.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /config/flow_sources/custom_properties/calculated_properties/{calculated_property_id}

Write

Updates an existing calculated flow property.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /config/flow_sources/custom_properties/calculated_property_dependent_tasks/{task_id}

Write

Cancels the flow calculated property dependent task.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /config/flow_sources/custom_properties/calculated_property_dependent_tasks/disable/{task_id}

Write

Cancels the calculated property dependent task.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /config/flow_sources/custom_properties/property_expressions

Write

Creates a new flow regex property expression.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /config/flow_sources/custom_properties/property_expressions/{expression_id}

Write

Updates an existing flow regex property expression.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /config/flow_sources/custom_properties/regex_properties

Write

Creates a new flow regex property.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /config/flow_sources/custom_properties/regex_properties/{regex_property_id}

Write

Updates an existing flow regex property.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /config/flow_sources/custom_properties/regex_property_dependent_tasks/{task_id}

Write

Cancels the flow regex property dependent task.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /config/flow_sources/custom_properties/regex_property_dependent_tasks/change_field_type/{task_id}

Write

Cancels the regex property dependent task.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /config/flow_sources/custom_properties/regex_property_dependent_tasks/disable/{task_id}

Write

Cancels the regex property dependent task.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /config/flow/common_destination_ports/active_configurations

Write

Creates a new active configuration.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /config/flow/common_destination_ports/active_configurations/{id}

Write

Updates the active configuration for a common destination port, as specified by the ID.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /config/resilient/test

Write

Perform asynchronous test Resilient connection

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /config/resilient/test/{id}

Write

Test the Resilient connection by using the connection ID.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /config/resource_restrictions

Write

Creates a new resource restriction.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /config/store_and_forward/policies/{id}

Write

Updates the store and forward policy owner only.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /config/tiered_storage/policies

Write

Update multiple tiered storage policies

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /config/tiered_storage/policies/{id}

Write

Update a tiered storage policy

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /data_classification/dsm_event_mappings

Write

Creates a new custom DSM event mapping.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /data_classification/dsm_event_mappings/{dsm_event_mapping_id}

Write

Updates an existing custom DSM event mapping.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /data_classification/qid_records

Write

Creates a new QID record.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /data_classification/qid_records/{qid_record_id}

Write

Updates an existing QID record.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /dynamic_search/saved_queries

Write

Creates a query to be saved for use in dynamic searches.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /dynamic_search/searches

Write

Posts a search to be performed by the service.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /health/metrics/qradar_metrics_global_config

Write

Updates the frequency and enabled fields of all the qradar metrics.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /health/metrics/qradar_metrics/{id}

Write

Updates the time_resolution and enable field of a QRadar metric identified by metric ID.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /health/metrics/system_metrics_global_config

Write

Updates the frequency and enabled value of all the qradar metrics identified by metric_id parameter.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /health/metrics/system_metrics/{id}

Write

Enable or disable a system metric identified by metric ID

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /qni/hosts/{host_id}/configs/{id}

Write

Updates the configuration of a QNI host.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /qni/stacking/stacks

Write

Creates a QNI stack.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /qni/stacking/stacks/{stack_id}

Write

Updates a QNI stack, as specified by the stack ID.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /qrm/model_groups/{group_id}

Write

Updates the owner of a model group.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /qrm/qrm_saved_search_groups/{group_id}

Write

Updates the owner of a QRM saved search group.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /qrm/question_groups/{group_id}

Write

Updates the owner of a question group.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /qrm/simulation_groups/{group_id}

Write

Updates the owner of a simulation group.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /qrm/topology_saved_search_groups/{group_id}

Write

Updates the owner of an topology saved search group.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /qvm/saved_search_groups/{group_id}

Write

Updates the owner of an vulnerability saved search group.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /qvm/saved_searches/{saved_search_id}

Write

Updates the vulnerability saved search owner only.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /qvm/saved_searches/vuln_instances/{task_id}/status

Write

Updates the status of a vulnerability instance saved search.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /reference_data_collections/set_dependents_tasks/{task_status_id}

Write

Cancel the Get Dependents request

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /reference_data_collections/set_entries

Write

Create an entry within a set

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /reference_data_collections/set_entries/{id}

Write

Update a Set Entry given the properties based in the body DTO.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /reference_data_collections/sets

Write

Create a set given the properties based in the body DTO

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /reference_data_collections/sets/{id}

Write

Update a Set given the properties based in the body DTO

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /reference_data/map_dependent_tasks/{task_id}

Write

Cancels the dependent reference data map task.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /reference_data/map_of_sets

Write

Create a new reference map of sets.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /reference_data/map_of_sets_dependent_tasks/{task_id}

Write

Cancels the dependent reference data map of sets task.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /reference_data/map_of_sets/{name}

Write

Add or update an element in a reference map of sets.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /reference_data/map_of_sets/{name}/description

Write

Add or update description a reference map of sets.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /reference_data/map_of_sets/bulk_load/{name}

Write

Adds or updates data in a reference map of sets.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /reference_data/map_of_sets/bulk_load/{namespace}/{name}/{domain_id}

Write

Adds or updates data in a reference map of sets.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /reference_data/maps

Write

Create a new reference map.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /reference_data/maps/{name}

Write

Add or update an element in a reference map.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /reference_data/maps/{name}/description

Write

Add or update description a reference map.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /reference_data/maps/bulk_load/{name}

Write

Adds or updates data in a reference map.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /reference_data/maps/bulk_load/{namespace}/{name}/{domain_id}

Write

Adds or updates data in a reference map.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /reference_data/tables

Write

Create a new reference table.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /reference_data/tables_dependent_tasks/{task_id}

Write

Cancel the dependent the Reference Data Tables task.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /reference_data/tables/{name}

Write

Add or update an element in a reference table.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /reference_data/tables/{name}/description

Write

Add or update description for a reference table.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /reference_data/tables/bulk_load/{name}

Write

Adds or updates data in a reference table.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /reference_data/tables/bulk_load/{namespace}/{name}/{domain_id}

Write

Adds or updates data in a reference table.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /services/dig_lookups

Write

Creates a new DIG lookup.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /services/dns_lookups

Write

Creates a new DNS lookup.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /services/port_scans

Write

Creates a new PortScans lookup.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /services/whois_lookups

Write

Creates a new WHOIS lookup.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /siem/milestone_generation_tasks

Write

Creates a milestone generation task for an offense.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /siem/milestone_statistics

Write

Retrieves milestone filter statistics with distinct values and counts

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /siem/offense_closing_reasons

Write

Create an offense closing reason.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /siem/offense_saved_search_dependent_tasks/{task_id}

Write

Cancels the dependent the offense saved search task.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /siem/offense_saved_search_groups/{group_id}

Write

Updates the owner of an offense saved search group.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /siem/offense_saved_searches/{id}

Write

Updates the offense saved search owner only.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /siem/offenses/{offense_id}

Write

Update an offense.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /siem/offenses/{offense_id}/notes

Write

Create a note on an offense.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /staged_config/backup_and_restore/scheduled_backup_configurations/{id}

Write

Updates a Staged Backup Configuration.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /staged_config/deploy_status

Write

Executes a deploy.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /staged_config/deployment/hosts/{id}/tunnels/{name}

Write

Updates a tunnel by host ID and tunnel name.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /staged_config/flow/applications/active_applications

Write

Create a new active flow application in the staged configuration area.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /staged_config/flow/applications/active_applications/{id}

Write

Updates an active flow application that is in the staged configuration area, as specified by the application ID.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /staged_config/remote_networks

Write

Adds a new staged remote network.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /staged_config/remote_networks/{network_id}

Write

Updates an existing staged remote network.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /staged_config/remote_services

Write

Adds a staged remote service.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /staged_config/remote_services/{service_id}

Write

Updates an existing staged remote service.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /system/eula_acceptances/{id}

Write

Updates an individual EULA acceptance.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /system/server_connection_validator

Write

Creates a server connection validator for the provided hostname and port, based on the provided host ids.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /system/servers/{server_id}

Write

Updates an existing server.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /system/servers/{server_id}/network_interfaces/bonded

Write

Creates a new bonded network interface.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /system/servers/{server_id}/network_interfaces/bonded/{device_name}

Write

Updates an existing bonded network interface.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /system/servers/{server_id}/network_interfaces/ethernet/{device_name}

Write

Updates an ethernet network interface based on the suppied server_Id and device_name.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

POST /system/servers/{server_id}/system_time_settings

Write

Sets the system time and time zone settings of to a server host.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

PUT /config/network_hierarchy/staged_networks

Write

Replaces the current network hierarchy with the input that is provided.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

PUT /config/resource_restrictions/{resource_restriction_id}

Write

Updates a resource restriction consumer by ID.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

PUT /system/servers/{server_id}/firewall_rules

Write

Sets the access control firewall rules based on the supplied server ID.

Permissions and limits

Account permissions

  • A QRadar authorized service token whose role and security profile reach the resource

A repeated request may repeat the external action. Review the previous result before retrying a write.

SETUP

Start with a controlled test.

01Connect the intended account

Use the account and permissions required for your process. Review the connection check before configuring a workflow action.

02Review inputs and access

Select a listed operation and map its required inputs. Use test records and add a human approval before writes that need review.

03Confirm the result

Inspect step outputs and confirm the result in IBM QRadar. A saved workflow is not a completed provider action.

Follow the workflow quickstart
EXPLORE YOUR STACK

More in Security & Identity.

AbuseIPDBAlienVault OTXAllowlyAmbriel
IBM QRadar integration | NodeHub