Skip to main content
Get a list of LEEF expressions configured in QRadar.
External DocumentationTo learn more, visit the QRadar documentation.

​
Parameters

ParameterDescription
End IndexThe index of the last item to return. The default is 999.
FieldsA comma separated list of fields to include in the response. Fields that are not named are excluded. To specify subfields, use brackets.

For example: parent_field(subfield1,subfield2),top_level_field
FilterSpecify a filter expression to restrict the returned results. For more information, refer to Qradar documentation.
Start IndexThe index of the first item to return. The default is 0.

​
Example Output

[
	{
		"creation_date": 42,
		"enabled": true,
		"expression": "String",
		"id": 42,
		"identifier": "String",
		"log_source_id": 42,
		"log_source_type_id": 42,
		"low_level_category_id": 42,
		"modification_date": 42,
		"payload": "String",
		"qid": 42,
		"regex_property_identifier": "String",
		"username": "String"
	}
]

​
Workflow Library Example

List Leef Expressions with Qradar and Send Results Via Email
Workflow LibraryPreview this Workflow on desktop