IBM Support

How do I find out when a QRadar Asset ID was created?

Question & Answer


Question

During the Asset tuning process, it is helpful to know when any Asset ID were created. How do I find out when an Asset ID under Asset tab is created?

Answer

ON PREMISE
Let's say you wanted to find when Asset ID 1005 was created. 

Follow the steps to get the Asset ID.

  1. Log in to the console as a root
  2. Pass the below command to get the Asset ID. 
    psql -Uqradar -c "select * from asset.asset where id=1005;"
  3. You see the result with the Asset ID information.
    id | isuservalue | created | domainid ------+-------------+-------------------------+---------- 1005 | t | 2022-09-17 04:21:10.642 | 0 (1 row)

Under the created column, you can see that Asset ID 1005 was created in September. 17th 4:21 AM UTC-0 time.
QRadar on the Cloud (QRoC) or when you don't have command-line access
  1. Log in to your QRadar on Cloud environment.
  2. Open the API access by using this browser address: https://<console-address>/api_doc where <console-address> is your IP or FQDN hostname.
  3. Use the latest API Version at the upper-left corner
  4. Open asset_model and click Assets
  5. Scroll down to the filter and under Value enter: ID=1005
  6. Click Try It Out!
  7. Scroll down further under Response Body, you should see something similar to these toward the tail end of the output (I edited out the noise)"risk_score_sum": 0, "hostnames": [], "id": 1005, "users": [], "domain_id": 0, "properties": [ { "last_reported": 1663402870671, "name": "Unified Name", "type_id": 1002, "id": 1011,
    Under hostnames you can confirm Asset ID is 1005 and a few lines down is last_reported value, this is in EPOCH time. You can google any EPOCH to human readable time and convert 1663402870671 to Saturday, September 17, 2022 4:21:10.671 AM, which should match the psql query as well like on-premises. This is all UTC-0 time zone.

[{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwu1AAA","label":"Assets"}],"ARM Case Number":"","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Versions"}]

Document Information

Modified date:
16 November 2022

UID

ibm16621147

Page Feedback