topic Re: QRadar API get assets query in Cortex XSOAR Discussions

QRadar API get assets query

jboyd98 — Thu, 28 Apr 2022 14:36:10 GMT

Does anyone know with QRadar Integration: "qradar-assets-list"

This retrieves information such as

The above asset (1278) has vulnerabilities and 2 products installed, but it only provides me with a vulnerability count and product IDs.

1. How do I query what those products are or what those vulnerabilities are?
2. I was exploring using the "https://www.ibm.com/docs/en/qradar-common?topic=endpoints-get-qvmassets"
but was also having trouble interpreting how to filter by assetId.
This didn't seem to work: filters%20contains%20assetId%20%3D%201278

Re: QRadar API get assets query

jfernandes1 — Fri, 29 Apr 2022 03:45:36 GMT

Hi @jboyd98,

Can you try the `qradar-get-asset-by-id` command instead. This should list all the vulnerabilities.

Thanks, Jeremy.

Re: QRadar API get assets query

jboyd98 — Fri, 29 Apr 2022 13:46:42 GMT

Hi Jeremy,

Thanks for the suggestion, although it looks like it returns similar data to the assets-list:

I'm trying to get the Products installed; which right now the "Products" row shows an Id number and I don't know the corresponding qradar api to translate.

And the vulnerability is just a count VS what vulnerabilities at risk...

Let me know your thoughts and if you know how to query the details -

Thanks again,

Boyd

Re: QRadar API get assets query

jfernandes1 — Mon, 02 May 2022 08:41:37 GMT

Hi Byod,

Integrations developed by XSOAR do NOT drop or modify data from an API call. I would suggest running the command with the `raw-response=true` parameter. This would show you all the data returned by the API call. If you find the missing information there you can use the `extend-context=` parameter. For more information refer -https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-6/cortex-xsoar-admin/playbooks/extend-context/extend-context-using-the-command-line

If the information is still missing, it is a limitation the QRadar API. I would suggest raising a support case with them.

Thanks,

Jeremy.

Re: QRadar API get assets query

jboyd98 — Mon, 02 May 2022 16:10:13 GMT

Thanks Jeremy,

You're correct. This is more a QRadar API question, but I don't have current access to post the question on IBM forum. Just was wondering if anyone had tried to get this data into XSOAR from QRadar previously.

Thanks,

Boyd