Updating the blocklists and allowlists using the RESTful API

You can use the IBM QRadar RESTful API to customize the content of the asset blocklists and allowlists.

About this task

You must specify the exact name of the reference set that you want to view or update.
  • Asset Reconciliation IPv4 Blacklist
  • Asset Reconciliation DNS Blacklist
  • Asset Reconciliation NetBIOS Blacklist
  • Asset Reconciliation MAC Blacklist
  • Asset Reconciliation IPv4 Whitelist
  • Asset Reconciliation DNS Whitelist
  • Asset Reconciliation NetBIOS Whitelist
  • Asset Reconciliation MAC Whitelist

Procedure

  1. Type the following URL in your web browser to access the RESTful API interface: 
    https://ConsoleIPaddress/api_doc
  2. In the navigation pane on the left, find 4.0>/reference_data >/sets > /{name}.
  3. To view the contents of an asset blocklist or allowlist, follow these steps:
    1. Click the GET tab and scroll down to the Parameters section.
    2. In the Value field for the Name parameter, type the name of the asset blocklist or allowlist that you want to view.
    3. Click Try It Out and view the results at the bottom of the screen.
  4. To add a value to an asset blocklist or allowlist, follow these steps:
    1. Click the POST tab and scroll down to the Parameters section.
    2. Type in the values for the following parameters:
      Table 1. Parameters that are required to add new asset data
      Parameter name Parameter description
      name Represents the name of the reference collection that you want to update.
      value Represents the data item that you want to add to the asset blocklist or allowlist. Must exactly match the asset update values that are provided by the originating asset data source.
    3. Click Try It Out to add the new value to the asset allowlist or asset blocklist.

What to do next

For more information about using the RESTful API to change the reference sets, see the IBM QRadar API Guide.