List Leef Expressions - BlinkOps Documentation

Get a list of LEEF expressions configured in QRadar.

External DocumentationTo learn more, visit the QRadar documentation.

Parameters

Parameter	Description
End Index	The index of the last item to return. The default is 999.
Fields	A comma separated list of fields to include in the response. Fields that are not named are excluded. To specify subfields, use brackets. For example: `parent_field(subfield1,subfield2),top_level_field`
Filter	Specify a filter expression to restrict the returned results. For more information, refer to Qradar documentation.
Start Index	The index of the first item to return. The default is 0.

Example Output

[
	{
		"creation_date": 42,
		"enabled": true,
		"expression": "String",
		"id": 42,
		"identifier": "String",
		"log_source_id": 42,
		"log_source_type_id": 42,
		"low_level_category_id": 42,
		"modification_date": 42,
		"payload": "String",
		"qid": 42,
		"regex_property_identifier": "String",
		"username": "String"
	}
]

Workflow Library Example

List Leef Expressions with Qradar and Send Results Via Email

Preview this Workflow on desktop