IBM Support

QRadar SOAR: What validation is performed when default artifact type values are saved?

Question & Answer


Question

Some default artifact types in QRadar SOAR validate the values entered. How can I determine what validation is performed?

Answer

Go to Help/Contact - Interactive REST API - GET /orgs/{org_id}/artifact_types and click Execute.
The JSON returned shows the regex (reg_exp) run against the artifact when it is saved.
    {
      "id": 2,
      "name": "DNS Name",
      "desc": "Suspicious DNS name",
      "reg_exp": "[_a-zA-Z0-9\\-.]+",
      "programmatic_name": "DNS Name",
      "uuid": "5b48edb6-786b-46b8-a619-3da03a8adb0d",
      "parse_as_csv": false,
      "use_for_relationships": true,
      "enabled": true,
      "version": 0,
      "tags": [],
      "default_scan_option": "on",
      "file": false,
      "multi_aware": true,
      "system": true
    },

[{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSA230","label":"IBM Security QRadar SOAR"},"ARM Category":[{"code":"a8m0z000000cvuvAAA","label":"Integrations-\u003EAPI"}],"ARM Case Number":"TS014344904","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Versions"},{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSEGM63","label":"IBM Security QRadar SOAR on Cloud"},"ARM Category":[{"code":"a8m0z000000cvuvAAA","label":"Integrations-\u003EAPI"}],"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Versions"}]

Document Information

Modified date:
04 October 2023

UID

ibm17046998

Page Feedback