IBM Support

QRadar: Starting and stopping an application from the API



The procedure in this document outlines how administrators can verify the application ID to Start or Stop an application from the QRadar API. These steps are useful when applications cannot be installed or are installed in an error state.

Resolving The Problem

This page outlines important information about the how to stop and start applications.

  1. Log in to QRadar.
  2. From the menu, click Interactive API for developers. The interactive API is displayed. QRadar ships with several API versions, with the latest version being indicated by the highest version number. QRadar Support always recommends using the most recent API version  (highest number).
  3. Select the /gui_app_framework endpoint.
  4. Click /applications:

    image 2803
  5. Scroll to bottom, click the Try It Out button. The GET command returns the application_id for the application. Optionally, you can use the command line and the recon utility to retrieve the application ID.
    image 2809
  6. Click /{application_id} that is located under /applications:
    image 2811
  7. Click the POST tab.
  8. In the application_id field, type the application id number.
  9. To stop or start your application, type one of the following options:
    1. STOPPED - this value stops the application after you click the Try it Out button.
    2. RUNNING - this value starts the application after you click the Try it Out button.
  10. Verify the response field returned for the command displays 200 (OK).  The response code returned allows you to verify that the command was successfully sent to the QRadar API. This status can be confirmed using the recon utility.

    If you continue to have issues attempting to stop and restart a specific application, you can delete and reinstall the application to determine if this resolves your issue.
To delete an application via the API, read the QRadar: Deleting an Application from the API technote.

Document Location


[{"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000GnbvAAC","label":"QRadar->Apps"}],"ARM Case Number":"","Platform":[{"code":"PF016","label":"Linux"}],"Version":"7.2;7.3.3","Edition":"","Line of Business":{"code":"LOB24","label":"Security Software"}}]

Document Information

Modified date:
27 May 2020