Common destination ports

New in 7.4.3

Common destination ports are used by QRadar® to determine the direction of a network communication, and to ensure that the source and destination devices are reported consistently throughout the entire communication session.

Use the Common Destination Ports API to view the common destination ports that are configured in your system, and add new common destination ports.

Note: Earlier versions of QRadar used the appid_map.conf configuration file to determine the list of common destination ports.
You can use the Common Destination Port API to do the following actions:
  • Get a list of the common destination ports that are defined by default.

    config/flow/applications/common_destination_ports/default_configurations

    The default configurations are read-only. They are provided as a system backup in case the configuration is mistakenly deleted or changed.

  • Get information about the common destination ports that are active in the deployed system. This endpoint is also used to create, update, or delete active common destination ports.

    config/flow/applications/common_destination_ports/active_configurations

    When you use the API to change the common destination ports, the QFlow process automatically loads the configuration. You do not need to deploy the configuration to propagate the changes to the system.

For more information about using the QRadar RESTful API, see RESTful API overview.