External DocumentationTo learn more, visit the QRadar documentation.
Parameters
| Parameter | Description |
|---|---|
| Fields | Use this parameter to specify which fields you would like to get back in the response. Fields that are not named are excluded. Specify subfields in brackets and multiple fields in the same object are separated by commas. |
| Filter | This parameter is used to restrict the elements in a list base on the contents of various fields. |
| Limit | The amount of items to be returned. The default is 1000. |
Example Output
[
{
"last_persisted_time": 1759366954361,
"username_count": 1,
"description": "<string>",
"rules": [
{
"id": 31496,
"type": "<string>"
},
{
"id": 105308,
"type": "<string>"
}
],
"event_count": 9,
"flow_count": 2,
"assigned_to": null,
"security_category_count": 4,
"follow_up": false,
"source_address_ids": [
3052
],
"source_count": 2,
"inactive": false,
"protected": false,
"closing_user": null,
"destination_networks": [
"<string>"
],
"source_network": "<string>",
"category_count": 6,
"close_time": null,
"remote_destination_count": 2,
"start_time": 61675019991,
"magnitude": 0,
"last_updated_time": 1522199112291,
"credibility": 4,
"id": 3454,
"categories": [
"<string>",
"<string>"
],
"severity": 8,
"policy_category_count": 1,
"log_sources": [
{
"type_name": "<string>",
"type_id": 7450,
"name": "<string>",
"id": 196
},
{
"type_name": "<string>",
"type_id": 36,
"name": "<string>",
"id": 57
}
],
"closing_reason_id": null,
"device_count": 3,
"first_persisted_time": 594230603242,
"offense_type": 0,
"relevance": 2,
"domain_id": 2,
"offense_source": "<string>",
"local_destination_address_ids": [
261
],
"local_destination_count": 2,
"status": "<string>"
},
{
"last_persisted_time": 2794834496455,
"username_count": 2,
"description": "<string>",
"rules": [
{
"id": 221100,
"type": "<string>"
}
],
"event_count": 7,
"flow_count": 1,
"assigned_to": null,
"security_category_count": 1,
"follow_up": false,
"source_address_ids": [
25807
],
"source_count": 1,
"inactive": false,
"protected": false,
"closing_user": null,
"destination_networks": [
"<string>",
"<string>"
],
"source_network": "<string>",
"category_count": 3,
"close_time": null,
"remote_destination_count": 0,
"start_time": 299247450809,
"magnitude": 5,
"last_updated_time": 1967953122980,
"credibility": 4,
"id": 28316,
"categories": [
"<string>",
"<string>"
],
"severity": 1,
"policy_category_count": 2,
"log_sources": [
{
"type_name": "<string>",
"type_id": 53,
"name": "<string>",
"id": 1100
},
{
"type_name": "<string>",
"type_id": 7,
"name": "<string>",
"id": 98
}
],
"closing_reason_id": null,
"device_count": 2,
"first_persisted_time": 280236988039,
"offense_type": 1,
"relevance": 7,
"domain_id": 0,
"offense_source": "<string>",
"local_destination_address_ids": [
30064
],
"local_destination_count": 1,
"status": "<string>"
}
]
Workflow Library Example
List Offenses with Qradar and Send Results Via Email