IBM QRadar search event using APIs - qradar

I wanted to know if it is possible to search for an Event using IBM QRadar APIs. please find the screenshot below as an example.
in the above, image when we hit the search button, we will get over events which contain text in the text bar. I want to do the same thing with the help of API. please help.

I found the answer to my question-
to fetch the payload or Event information via QRadar APIs first use the search API to get the search ID
curl --location --request POST 'https://qradar-2.as.local/api/ariel/searches?query_expression=select%20payload%20from%20events%20WHERE%20UTF8%28payload%29%20ILIKE%20%27%25xyz-xyzzyx-07.xy.as.local-51995-596966-1%25%27%20START%20%272020-08-21%2004%3A00%27%20STOP%20%272020-08-21%2006%3A00%27%20' \
--header 'Version: 12.0' \
--header 'Accept: application/json' \
--header 'SEC: {{your token here}}' \
--header 'Cookie: JSESSIONID=F988AE8612EDF61A67249876B783CEA7'
then use this search ID in the API below
curl --location --request GET 'https://qradar-2.as.local/api/ariel/searches/{{search_id}}/results' \
--header 'Range: items=0-49' \
--header 'Version: 12.0' \
--header 'Accept: application/json' \
--header 'SEC: {{your token here}}' \
--header 'Cookie: JSESSIONID=E6568B30B3615UUIUD5672AB56578F9E66'
now the response of this API will be base64 encoded so you visit any site to decode.
eg. https://www.base64decode.org/
hope this will help people

Related

How to get the mobile and desktop API path in page speed insights?

Hi i just want to ask if there's seperated API in pagespeed insight in performance score? Because i only seeing this path to consume in performance score and i don't know if it's for desktop or mobile
lighthouseResult.categories.performance.score
To determine the strategy from result, we can refer to lighthouseResult.emulatedFormFactor
By default it runs for DESKTOP.
To make it run for MOBILE, there exists a query param strategy
Here's sample request for strategy=MOBILE
curl \
'https://pagespeedonline.googleapis.com/pagespeedonline/v5/runPagespeed?url=https%3A%2F%2Fexample.com&strategy=MOBILE&key=[YOUR_API_KEY]' \
--header 'Authorization: Bearer [YOUR_ACCESS_TOKEN]' \
--header 'Accept: application/json' \
--compressed
Reference: here

Google Drives API - retrieve files owned by me

Using the Google Drives API, how do I formulate Q when retrieving the file listing, to only get back files that are owned by me?
I believe your goal as follows.
You want to retrieve the files that you are the owner using the method of "Files: list" in Drive API.
You want to create the search query for achieving this.
For this, how about this answer?
In this case, you can create the search query using owners in the fields.
Sample search query:
'me' in owners
If you want to retrieve the files in the specific folder, you can use the following search query.
'###' in parents and 'me' in owners
Sample curl:
curl \
'https://www.googleapis.com/drive/v3/files?q=%27me%27%20in%20owners&key=[YOUR_API_KEY]' \
--header 'Authorization: Bearer [YOUR_ACCESS_TOKEN]' \
--header 'Accept: application/json' \
--compressed
and
curl \
'https://www.googleapis.com/drive/v3/files?q=%27%23%23%23%27%20in%20parents%20and%20%27me%27%20in%20owners&key=[YOUR_API_KEY]' \
--header 'Authorization: Bearer [YOUR_ACCESS_TOKEN]' \
--header 'Accept: application/json' \
--compressed
Note:
If you want to retrieve the folder without publicly sharing, please use the access token instead of the API key. Please be careful this.
References:
Files: list
Search for Files

Convert cURL To Applescript

I am trying to convert a cURL command to AppleScript Using "do shell script".
I've used various hints from previous posts but I'm still running into errors.
Can anyone point out errors in my syntax.
The below script works fine when run in terminal.
curl -X POST https://content.dropboxapi.com/2/files/upload \
--header 'Authorization: Bearer MYTOKEN' \
--header 'Content-Type: application/octet-stream' \
--header 'Dropbox-API-Arg: {"path":"/RoomVT/Clown2.jpeg"}'
--data-binary #"/Splash.jpeg"
I then adapt as.
--Add do shell script Command--
--Place The cURL Inside Double Quotes--
--Replace Double Quotes With Single Quotes--
--Remove Backslashes At End Of Lines--
--You May Also Need To Place All In A Single Line--
do shell script "curl -X POST https://content.dropboxapi.com/2/files/upload --header 'Authorization: Bearer MYTOKEN' --header 'Content-Type: application/octet-stream' --header 'Dropbox-API-Arg: {'path':'/RoomVT/Clown2.jpeg'}' --data-binary #'/Splash.jpeg'"
I still get the error.
"Error in call to API function \"files/upload\": HTTP header \"Dropbox-API-Arg\": could not decode input as JSON"
Thanks for your comments.
I went with #RobC suggestion and it worked first time.
do shell script "curl -X POST https://content.dropboxapi.com/2/files/upload --header 'Authorization: Bearer b4Itg9wetFIAAAAAAAAD7PPkCmoIE2oXvkx_-nq1L2D5G7Bfla-5LHKHtJqoeBMc' --header 'Content-Type: application/octet-stream' --header 'Dropbox-API-Arg: {\"path\":\"/EngineRoomVT/Clown2.jpeg\"}' --data-binary #\"/Splash.jpeg\""

JSON data is invalid

I am trying to cURL an API for speech transcription, but am getting the error JSON data is invalid. It is very likely that this is an API specific error, however, I was wondering whether it was an issue with my cURL command.
curl --request POST --url "https://api.assemblyai.com/transcript" \
--header "authorization: abc123" --data \
"{audio_src_url: https://s3-us-west-2.amazonaws.com/blog.assemblyai.com/audio/8-7-2018-post/7510.mp3}"
The documentation is the first example at this link and I am using Windows cmd.
You need double quotes around the keys and the values.
curl --request POST --url "https://api.assemblyai.com/transcript" \
--header "authorization: abc123" --data \
"{\"audio_src_url\": \"https://s3-us-west-2.amazonaws.com/blog.assemblyai.com/audio/8-7-2018-post/7510.mp3\"}"

Is it possible to tag TeamCity builds using service messages (or some other programatic way)?

Is it possible to tag TeamCity builds using service messages or some other programmatic way from a build step maybe...?
How can this be done?
See also the following stackoverflow discussion:
Programatically pin a build in Teamcity
Moreover, since there were two open questions on stackoverflow and I had the same problem, I wrote a TeamCity plugin that solves it:
https://github.com/echocat/teamcity-buildTagsViaBuildLog-plugin
There is a VCS labelling in TeamCity, you can tag when a build successful, or on each build. Does it correspond to what you're looking for?
Yes, there is. You can use the REST API, as described here. Basically,
Adding a tag using plain text
curl -s --header "Authorization: Bearer $TOKEN" \
-H 'Content-Type: text/plain' \
"https://ci.ACME.com/app/rest/builds/5375/tags --data tag-1
tag-1
Reading the list of tags as json
curl -s -H 'Accept: application/json' \
-H "Authorization: Bearer $TOKEN" \
"https://ci.ACME.com/app/rest/builds/5375/tags"
{"count":1,"tag":[{"name":"tag-1"}]}
Overwriting tags using json, getting it back as xml (the default)
curl -s --header "Authorization: Bearer $TOKEN" \
-H 'Content-Type: application/json' -X PUT \
"https://ci.ACME.com/app/rest/builds/5375/tags \
--data '{"count":2,"tag":[{"name":"tag-A"},{"name":"tag-B"}]}'
<?xml version="1.0" encoding="UTF-8" standalone="yes"?><tags count="2"><tag name="tag-A"/><tag name="tag-B"/></tags>