Question & Answer
Question
Some default artifact types in QRadar SOAR validate the values entered. How can I determine what validation is performed?
Answer
Go to Help/Contact - Interactive REST API - GET /orgs/{org_id}/artifact_types and click Execute.
The JSON returned shows the regex (reg_exp) run against the artifact when it is saved.
{
"id": 2,
"name": "DNS Name",
"desc": "Suspicious DNS name",
"reg_exp": "[_a-zA-Z0-9\\-.]+",
"programmatic_name": "DNS Name",
"uuid": "5b48edb6-786b-46b8-a619-3da03a8adb0d",
"parse_as_csv": false,
"use_for_relationships": true,
"enabled": true,
"version": 0,
"tags": [],
"default_scan_option": "on",
"file": false,
"multi_aware": true,
"system": true
},
[{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSA230","label":"IBM Security QRadar SOAR"},"ARM Category":[{"code":"a8m0z000000cvuvAAA","label":"Integrations-\u003EAPI"}],"ARM Case Number":"TS014344904","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Versions"},{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSEGM63","label":"IBM Security QRadar SOAR on Cloud"},"ARM Category":[{"code":"a8m0z000000cvuvAAA","label":"Integrations-\u003EAPI"}],"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Versions"}]
Was this topic helpful?
Document Information
Modified date:
04 October 2023
UID
ibm17046998