How To
Summary
API requests can be made to various endpoints within QRadar to pull and/or update data. This can be done within the Interactive API in the UI of QRadar, or from the command line on the Console or Managed Host of QRadar.
Endpoints hold different types of data for QRadar, including Reference Sets, Event and Flow Data, Log Sources, Assets, Rules, and Offenses, among other things. Customers can make these queries one at a time as needed, or incorporate them into scripts that gather information or do other functions.
IBM QRadar support is not responsible for helping create queries or scripts for customers. It is not officially supported and customers must use supplied QRadar documentation to build and test queries themselves. Any support questions can be posted to the QRadar Forums.
In the case of unexpected errors for queries that should be working, a best-effort can be applied in helping to find the cause. This does not include network issues if running the queries from a third-party system into QRadar.
Document Location
Worldwide
Log InLog in to view more of this document
Was this topic helpful?
Document Information
Modified date:
16 February 2023
UID
ibm16954749