How to use filter based on rules for IBM Qradar Offenses via REST api?

Question

I'm new to Qradar and facing difficulties in understanding filter parameter in Qradar REST api /siem/offenses. Can anyone suggest me how to use filter based on offense 'rules' field? As rules is a list of JSON objects, i'm finding it difficult to write filter.

sample offense with rules field

{
    "username_count": 1,
    "description": "String",
    "rules": [
      {
        "id": 1,
        "type": "String <one of: ADE_RULE, BUILDING_BLOCK_RULE, CRE_RULE>"
      }```
    ]
}

score 2 · Answer 1 · edited Dec 26 '19 at 17:19

2

We experienced a similar issue and find a way out, you can use 'contains' keyword to access list elements. For example, to filter rules[0]["id"] you could use:

rules contains (id = 42)

edited Dec 26 '19 at 17:19

סטנלי גרונן

2,917
23
46
68

answered Dec 26 '19 at 16:38

init ramfs

21
2

How to use filter based on rules for IBM Qradar Offenses via REST api?

1 Answers1