Topic
  • No replies
raph.g
raph.g
1 Post

Pinned topic Asset filter for nested objects issue via Rest-API

‏2016-06-23T08:10:07Z |

Hie everyone,

 

I ve some trouble with filters in asset endpoint of the Rest API.

 

I ve created some custom properties like 'usercontact', 'userid', 'usermail' etc.

 

When i request the /asset endpoint without filter i can see my user with my custom properties with all others assets :

{
    
"id": 
1008,
    
"domain_id": 
0,
    
"interfaces": [],
    
"properties": [
      {
        
"id": 
1015,
        
"name": 
"usercontact",
        
"value": 
"dude",
        
"last_reported": 
1466599315670,
        
"type_id": 
1000000005,
        
"last_reported_by": 
"USER:admin"
      },
      {
        
"id": 
1016,
        
"name": 
"usercrit",
        
"value": 
"critical",
        
"last_reported": 
1466599315670,
        
"type_id": 
1000000009,
        
"last_reported_by": 
"USER:admin"
      },
      {
        
"id": 
1017,
        
"name": 
"usersite",
        
"value": 
"here",
        
"last_reported": 
1466599315670,
        
"type_id": 
1000000008,
        
"last_reported_by": 
"USER:admin"
      },
      {
        
"id": 
1018,
        
"name": 
"userreg",
        
"value": 
"warp",
        
"last_reported": 
1466599315670,
        
"type_id": 
1000000007,
        
"last_reported_by": 
"USER:admin"
      },
      {
        
"id": 
1019,
        
"name": 
"username",
        
"value": 
"me",
        
"last_reported": 
1466599315670,
        
"type_id": 
1000000002,
        
"last_reported_by": 
"USER:admin"
      },
      {
        
"id": 
1020,
        
"name": 
"userid",
        
"value": 
"goodid",
        
"last_reported": 
1466599315670,
        
"type_id": 
1000000003,
        
"last_reported_by": 
"USER:admin"
      },
      {
        
"id": 
1021,
        
"name": 
"usercountry",
        
"value": 
"FR",
        
"last_reported": 
1466599315670,
        
"type_id": 
1000000010,
        
"last_reported_by": 
"USER:admin"
      },
      {
        
"id": 
1022,
        
"name": 
"usergrp",
        
"value": 
"group1",
        
"last_reported": 
1466599315670,
        
"type_id": 
1000000004,
        
"last_reported_by": 
"USER:admin"
      },
      {
        
"id": 
1023,
        
"name": 
"usermail",
        
"value": 
"hie@choum.com",
        
"last_reported": 
1466599315670,
        
"type_id": 
1000000006,
        
"last_reported_by": 
"USER:admin"
      },
      {
        
"id": 
1024,
        
"name": 
"customtype",
        
"value": 
"user",
        
"last_reported": 
1466599797107,
        
"type_id": 
1000000011,
        
"last_reported_by": 
"USER:admin"
      }
    ]
  }

 

But i dont know how to filter to a specific userid for example. I ve seen that for nested object you have to use brackets but :

/api/asset_model/assets?filter=properties(userid)%3Dgoodidea

just didn't work cause userid doesn t refer to a specific obect of 'properties'. I can filter via the Qradar Console but i didnt see the request (i just see that Qradar combine two requests, one on the custom type field and one on the value of the field), i ve tried to build such a request but didn t work...

Does anybody know how to filter like this?

 

Thx!