I'm trying to work out if there's a way to monitor the status of SIEM jobs that run in QRadar, via the API, so i can determine if we need to take action when something fails to run properly, doesn't complete, exits early, takes too long etc. We use multiple types of SIEM tooling and i want to monitor all of them centrally from a 3rd party application rather than logging into each system.
The jobs would already exist in the interface, having already been setup there by sysadmins. Does the limitations of the API currently mean that i can't query against the status of objects that haven't been setup via other API calls, or can i access the necessary status information somehow?
Perhaps there's another way? Setting up a report to do this and pulling the results from there?