Configuration endpoints

Use the references for REST API 12.0 configuration endpoints.

GET /config/access/security_profiles
Get the list of deployed security profiles available in the system.
GET /config/access/security_profiles/{id}
Get a deployed security profile by ID.
GET /config/access/tenant_management/tenants
Retrieve the list of all tenants ordered by tenant id.
POST /config/access/tenant_management/tenants
Create a new tenant.
DELETE /config/access/tenant_management/tenants/{tenant_id}
Delete a tenant.
GET /config/access/tenant_management/tenants/{tenant_id}
Retrieve a tenant by tenant id.
POST /config/access/tenant_management/tenants/{tenant_id}
Update a tenant
GET /config/access/user_dependent_tasks/{task_id}
Retrieves the dependent user task status.
POST /config/access/user_dependent_tasks/{task_id}
Cancels a dependent user task.
GET /config/access/user_dependent_tasks/{task_id}/results
Retrieves the user dependent task results.
GET /config/access/user_roles
Get the list of deployed user roles available in the system.
GET /config/access/user_roles/{id}
Get a deployed user role by ID.
GET /config/access/users
Retrieve Deployed Users.
GET /config/access/users/{id}
Retrieves a deployed user.
POST /config/access/users/{id}
Update a deployed user.
GET /config/access/users/{id}/dependents
Retrieves the objects that depend on the user.
GET /config/backup_and_restore/scheduled_backup_configurations
Retrieves a list of Backup Configurations.
GET /config/backup_and_restore/scheduled_backup_configurations/{id}
Retrieves a Backup Configuration by ID.
GET /config/deployment/hosts
Retrieves a list of all deployed hosts.
GET /config/deployment/hosts/{id}
Retrieves a deployed host by ID.
POST /config/deployment/hosts/{id}
Updates a host by ID and sends a JMS message to update the pipeline.
GET /config/deployment/hosts/{id}/tunnels
Gets the list of tunnels for the host.
GET /config/deployment/license_pool
Retrieves the deployed license pool information.
GET /config/domain_management/domains
Retrieves the list of all domains, active and deleted (including the default one).
POST /config/domain_management/domains
Creates a new domain.
DELETE /config/domain_management/domains/{domain_id}
Deletes a domain by domain id.
GET /config/domain_management/domains/{domain_id}
Retrieves a domain by domain id.
POST /config/domain_management/domains/{domain_id}
Updates an existing domain.
GET /config/event_retention_buckets
Retrieves a list of event retention buckets.
DELETE /config/event_retention_buckets/{id}
Deletes an event retention bucket.
GET /config/event_retention_buckets/{id}
Retrieves an event retention bucket.
POST /config/event_retention_buckets/{id}
Updates the event retention bucket owner or enabled/disabled only.
GET /config/event_sources/custom_properties/calculated_properties
Retrieves a list of calculated event properties.
POST /config/event_sources/custom_properties/calculated_properties
Creates a new calculated event property.
DELETE /config/event_sources/custom_properties/calculated_properties/{calculated_property_id}
Deletes the event calculated property. To ensure safe deletion, a dependency check is carried out. This check might take some time. An asynchronous task to do is started for this check.
GET /config/event_sources/custom_properties/calculated_properties/{calculated_property_id}
Retrieves a calculated event property based on the supplied calculated property ID.
POST /config/event_sources/custom_properties/calculated_properties/{calculated_property_id}
Updates an existing calculated event property.
GET /config/event_sources/custom_properties/calculated_properties/{calculated_property_id}/dependents
Retrieves the objects that depend on the event calculated property.
GET /config/event_sources/custom_properties/calculated_properties/{calculated_property_id}/dependents/disable
Retrieves the objects that depend on the event calculated property.
GET /config/event_sources/custom_properties/calculated_properties/dep/{calculated_property_id}
Retrieves a calculated event property based on the supplied calculated property ID.
GET /config/event_sources/custom_properties/calculated_property/{calculated_property_name}
Retrieves a list of event calculated properties.
GET /config/event_sources/custom_properties/calculated_property_delete_tasks/{task_id}
Retrieves the status of the event calculated property delete task.
GET /config/event_sources/custom_properties/calculated_property_dependent_tasks/disable/{task_id}
Retrieves the event calculated property dependent task status.
POST /config/event_sources/custom_properties/calculated_property_dependent_tasks/disable/{task_id}
Cancels the calculated property dependent task.
GET /config/event_sources/custom_properties/calculated_property_dependent_tasks/disable/{task_id}/results
Retrieves the calculated property dependent task results.
GET /config/event_sources/custom_properties/calculated_property_dependent_tasks/{task_id}
Retrieves the status of the event calculated property dependents task.
POST /config/event_sources/custom_properties/calculated_property_dependent_tasks/{task_id}
Cancels the event calculated property dependent task.
GET /config/event_sources/custom_properties/calculated_property_dependent_tasks/{task_id}/results
Retrieves the calculated property dependent task results.
GET /config/event_sources/custom_properties/calculated_property_operands
Retrieves the list of available options for calculated event property operand.
GET /config/event_sources/custom_properties/property_cef_expressions
Retrieves a list of Ariel property CEF expressions.
POST /config/event_sources/custom_properties/property_cef_expressions
Creates a new Ariel property CEF expression.
DELETE /config/event_sources/custom_properties/property_cef_expressions/{expression_id}
Deletes an Ariel property CEF expression based on the supplied expression ID.
GET /config/event_sources/custom_properties/property_cef_expressions/{expression_id}
Retrieves an Ariel property CEF expression based on the supplied expression ID.
POST /config/event_sources/custom_properties/property_cef_expressions/{expression_id}
Updates an existing Ariel property CEF expression.
GET /config/event_sources/custom_properties/property_expressions
Retrieves a list of event regex property expressions.
POST /config/event_sources/custom_properties/property_expressions
Creates a new event regex property expression.
DELETE /config/event_sources/custom_properties/property_expressions/{expression_id}
Deletes an event regex property expression based on the supplied expression ID.
GET /config/event_sources/custom_properties/property_expressions/{expression_id}
Retrieves an event regex property expression based on the supplied expression ID.
POST /config/event_sources/custom_properties/property_expressions/{expression_id}
Updates an existing event regex property expression.
GET /config/event_sources/custom_properties/property_genericlist_expressions
Retrieves a list of Ariel property Generic List expressions.
POST /config/event_sources/custom_properties/property_genericlist_expressions
Creates a new Ariel property Generic List expression.
DELETE /config/event_sources/custom_properties/property_genericlist_expressions/{expression_id}
Deletes an Ariel property Generic List expression based on the supplied expression ID.
GET /config/event_sources/custom_properties/property_genericlist_expressions/{expression_id}
Retrieves an Ariel property Generic List expression based on the supplied expression ID.
POST /config/event_sources/custom_properties/property_genericlist_expressions/{expression_id}
Updates an existing Ariel property Generic List expression.
GET /config/event_sources/custom_properties/property_json_expressions
Retrieves a list of Ariel property JSON expressions.
POST /config/event_sources/custom_properties/property_json_expressions
Creates a new Ariel property JSON expression.
DELETE /config/event_sources/custom_properties/property_json_expressions/{expression_id}
Deletes an Ariel property JSON expression based on the supplied expression ID.
GET /config/event_sources/custom_properties/property_json_expressions/{expression_id}
Retrieves an Ariel property JSON expression based on the supplied expression ID.
POST /config/event_sources/custom_properties/property_json_expressions/{expression_id}
Updates an existing Ariel property JSON expression.
GET /config/event_sources/custom_properties/property_leef_expressions
Retrieves the list of Ariel Property LEEF Expressions.
POST /config/event_sources/custom_properties/property_leef_expressions
Creates a new Ariel Property LEEF Expression.
DELETE /config/event_sources/custom_properties/property_leef_expressions/{expression_id}
Deletes an Ariel Property LEEF Expression based on the supplied expression ID.
GET /config/event_sources/custom_properties/property_leef_expressions/{expression_id}
Retrieves an Ariel Property LEEF Expression based on the supplied expression ID.
POST /config/event_sources/custom_properties/property_leef_expressions/{expression_id}
Updates an existing Ariel Property LEEF Expression.
GET /config/event_sources/custom_properties/property_nvp_expressions
Retrieves a list of Ariel property Name Value Pair expressions.
POST /config/event_sources/custom_properties/property_nvp_expressions
Creates a new Ariel property Name Value Pair expression.
DELETE /config/event_sources/custom_properties/property_nvp_expressions/{expression_id}
Deletes an Ariel property Name Value Pair expression based on the supplied expression ID.
GET /config/event_sources/custom_properties/property_nvp_expressions/{expression_id}
Retrieves an Ariel property Name Value Pair expression based on the supplied expression ID.
POST /config/event_sources/custom_properties/property_nvp_expressions/{expression_id}
Updates an existing Ariel property Name Value Pair expression.
GET /config/event_sources/custom_properties/regex_properties
Retrieves a list of event regex properties.
POST /config/event_sources/custom_properties/regex_properties
Creates a new event regex property.
DELETE /config/event_sources/custom_properties/regex_properties/{regex_property_id}
Deletes an event regex property. To ensure safe deletion, a dependency check is carried out. This check might take some time. An asynchronous task is started to do this check.
GET /config/event_sources/custom_properties/regex_properties/{regex_property_id}
Retrieves a event regex property based on the supplied regex property ID.
POST /config/event_sources/custom_properties/regex_properties/{regex_property_id}
Updates an existing event regex property.
GET /config/event_sources/custom_properties/regex_properties/{regex_property_id}/dependents
Retrieves the objects that depend on the event regex property.
GET /config/event_sources/custom_properties/regex_properties/{regex_property_id}/dependents/change_field_type
Retrieves the objects that depend on the event regex property for changing type of field for it.
GET /config/event_sources/custom_properties/regex_properties/{regex_property_id}/dependents/disable
Retrieves the objects that depend on the event regex property for disabling it.
GET /config/event_sources/custom_properties/regex_property_delete_tasks/{task_id}
Retrieves the event regex property delete task status.
GET /config/event_sources/custom_properties/regex_property_dependent_tasks/change_field_type/{task_id}
Retrieves the event regex property dependent task status.
POST /config/event_sources/custom_properties/regex_property_dependent_tasks/change_field_type/{task_id}
Cancels the regex property dependent task.
GET /config/event_sources/custom_properties/regex_property_dependent_tasks/change_field_type/{task_id}/results
Retrieves the regex property dependent task results.
GET /config/event_sources/custom_properties/regex_property_dependent_tasks/disable/{task_id}
Retrieves the event regex property dependent task status.
POST /config/event_sources/custom_properties/regex_property_dependent_tasks/disable/{task_id}
Cancels the regex property dependent task.
GET /config/event_sources/custom_properties/regex_property_dependent_tasks/disable/{task_id}/results
Retrieves the regex property dependent task results.
GET /config/event_sources/custom_properties/regex_property_dependent_tasks/{task_id}
Retrieves the event regex property dependent task status.
POST /config/event_sources/custom_properties/regex_property_dependent_tasks/{task_id}
Cancels the regex property dependent task.
GET /config/event_sources/custom_properties/regex_property_dependent_tasks/{task_id}/results
Retrieves the regex property dependent task results.
GET /config/event_sources/event_collectors
Retrieves a list of event collectors..
GET /config/event_sources/event_collectors/{id}
Retrieves an event collector by ID..
GET /config/event_sources/log_source_management/autodetection/config_records
Retrieves the list of Autodetection Config Records.
POST /config/event_sources/log_source_management/autodetection/config_records
Creates an Autodetection Config Record.
GET /config/event_sources/log_source_management/autodetection/config_records/{config_id}
Gets an individual Autodetection Config Record by id.
POST /config/event_sources/log_source_management/autodetection/config_records/{config_id}
Updates an Autodetection Config Record.
GET /config/event_sources/log_source_management/log_source_bulk_tasks/{id}
Retrieves a log source bulk task by ID.
POST /config/event_sources/log_source_management/log_source_bulk_tasks/{id}
Updates a log source bulk task. The only field that can be updated is the 'status' field, and the only allowed value is 'CANCELLED'.
GET /config/event_sources/log_source_management/log_source_extensions
Retrieves the list of log source extensions.
GET /config/event_sources/log_source_management/log_source_extensions/{id}
Retrieves a log source extension by ID.
GET /config/event_sources/log_source_management/log_source_groups
Retrieves the list of log source groups.
POST /config/event_sources/log_source_management/log_source_groups
Creates a new log source group.
GET /config/event_sources/log_source_management/log_source_groups/{id}
Retrieves a log source group by ID.
GET /config/event_sources/log_source_management/log_source_languages
Retrieves the list of log source languages.
GET /config/event_sources/log_source_management/log_source_languages/{id}
Retrieves a log source language by ID.
POST /config/event_sources/log_source_management/log_source_statistics
Creates log source statistics
GET /config/event_sources/log_source_management/log_source_types
Retrieves a list of log source types.
POST /config/event_sources/log_source_management/log_source_types
Create a new custom log source type. Log source types do not need to be deployed.
DELETE /config/event_sources/log_source_management/log_source_types/{id}
Deletes a custom log source type by ID.
GET /config/event_sources/log_source_management/log_source_types/{id}
Retrieves a log source type by ID.
POST /config/event_sources/log_source_management/log_source_types/{id}
Updates a log source type by ID.
GET /config/event_sources/log_source_management/log_sources
Retrieves a list of log sources.
PATCH /config/event_sources/log_source_management/log_sources
Patches an array of log sources. Capable of creating, updating and deleting multiple log sources in the same transaction.
POST /config/event_sources/log_source_management/log_sources
Creates a new log source.
DELETE /config/event_sources/log_source_management/log_sources/{id}
Deletes a log source by ID.
GET /config/event_sources/log_source_management/log_sources/{id}
Retrieves a log source by ID.
POST /config/event_sources/log_source_management/log_sources/{id}
Updates a log source by ID.
GET /config/event_sources/log_source_management/protocol_types
Retrieves the list of protocol types.
GET /config/event_sources/log_source_management/protocol_types/{id}
Retrieves a protocol type by ID.
GET /config/event_sources/property_discovery_profiles
Gets all PropertyDiscoveryProfiles currently in the system.
POST /config/event_sources/property_discovery_profiles
Creates a PropertyDiscoveryProfile based on the information supplied by the property_discovery_profile JSON object.
DELETE /config/event_sources/property_discovery_profiles/{id}
Deletes the specified PropertyDiscoveryProfile.
GET /config/event_sources/property_discovery_profiles/{id}
Gets a PropertyDiscoveryProfile based on the information supplied by the property_discovery_profile corresponding to the supplied ID.
POST /config/event_sources/property_discovery_profiles/{id}
Updates a PropertyDiscoveryProfile based on the information supplied via the property_discovery_profile JSON object.
GET /config/event_sources/wincollect/wincollect_agents
Retrieves a list of WinCollect agents.
GET /config/event_sources/wincollect/wincollect_agents/{id}
Retrieves a WinCollect agent by ID.
GET /config/event_sources/wincollect/wincollect_destinations
Retrieves a list of WinCollect destinations.
GET /config/event_sources/wincollect/wincollect_destinations/{id}
Retrieves a WinCollect destination by ID.
POST /config/extension_management/extension_export_tasks
Exports an extension.
GET /config/extension_management/extension_export_tasks/{task_id}
Retrieves the tasks status based on the task_id.
GET /config/extension_management/extension_export_tasks/{task_id}/extension_export
Retrieves the exported extension based on the task_id.
GET /config/extension_management/extension_export_tasks/{task_id}/results
Retrieves the tasks status results based on the task_id.
GET /config/extension_management/extensions
Retrieve a list of extensions.
POST /config/extension_management/extensions
Uploads the supplied extension file to the QRadar system.
DELETE /config/extension_management/extensions/{extension_id}
Uninstall an extension based on the supplied extension_id. This is an asynchronous action.
GET /config/extension_management/extensions/{extension_id}
Retrieves an extension based on the supplied extension_id.
POST /config/extension_management/extensions/{extension_id}
Install an extension based on the supplied extension_id. This is an asynchronous action.
POST /config/extension_management/extensions/{extension_id}/metadata
Adds metadata to the Extension corresponding to the supplied extension_id.
GET /config/extension_management/extensions_task_status/{status_id}
Retrieves the tasks status based on the status_id.
GET /config/extension_management/extensions_task_status/{status_id}/results
Retrieves the tasks status results based on the status_id.
GET /config/flow_retention_buckets
Retrieves a list of flow retention buckets.
DELETE /config/flow_retention_buckets/{id}
Deletes a flow retention bucket.
GET /config/flow_retention_buckets/{id}
Retrieves a flow retention bucket.
POST /config/flow_retention_buckets/{id}
Updates the flow retention bucket owner, or enabled/disabled only.
GET /config/flow_sources/custom_properties/calculated_properties
Retrieves a list of calculated flow properties.
POST /config/flow_sources/custom_properties/calculated_properties
Creates a new calculated flow property.
DELETE /config/flow_sources/custom_properties/calculated_properties/{calculated_property_id}
Deletes the flow calculated property. To ensure safe deletion, a dependency check is carried out. This check might take some time. An asynchronous task to do is started for this check.
GET /config/flow_sources/custom_properties/calculated_properties/{calculated_property_id}
Retrieves a calculated flow property based on the supplied calculated property ID.
POST /config/flow_sources/custom_properties/calculated_properties/{calculated_property_id}
Updates an existing calculated flow property.
GET /config/flow_sources/custom_properties/calculated_properties/{calculated_property_id}/dependents
Retrieves the objects that depend on the flow calculated property.
GET /config/flow_sources/custom_properties/calculated_properties/{calculated_property_id}/dependents/disable
Retrieves the objects that depend on the flow calculated property.
GET /config/flow_sources/custom_properties/calculated_properties/dep/{calculated_property_id}
Retrieves a calculated flow property based on the supplied calculated property ID.
GET /config/flow_sources/custom_properties/calculated_property/{calculated_property_name}
Retrieves a list of flow calculated properties.
GET /config/flow_sources/custom_properties/calculated_property_delete_tasks/{task_id}
Retrieves the status of the flow calculated property delete task.
GET /config/flow_sources/custom_properties/calculated_property_dependent_tasks/disable/{task_id}
Retrieves the flow calculated property dependent task status.
POST /config/flow_sources/custom_properties/calculated_property_dependent_tasks/disable/{task_id}
Cancels the calculated property dependent task.
GET /config/flow_sources/custom_properties/calculated_property_dependent_tasks/disable/{task_id}/results
Retrieves the calculated property dependent task results.
GET /config/flow_sources/custom_properties/calculated_property_dependent_tasks/{task_id}
Retrieves the status of the flow calculated property dependents task.
POST /config/flow_sources/custom_properties/calculated_property_dependent_tasks/{task_id}
Cancels the flow calculated property dependent task.
GET /config/flow_sources/custom_properties/calculated_property_dependent_tasks/{task_id}/results
Retrieves the calculated property dependent task results.
GET /config/flow_sources/custom_properties/calculated_property_operands
Retrieves the list of available options for calculated flow property operand.
GET /config/flow_sources/custom_properties/property_expressions
Retrieve a list of flow regex property expressions.
POST /config/flow_sources/custom_properties/property_expressions
Creates a new flow regex property expression.
DELETE /config/flow_sources/custom_properties/property_expressions/{expression_id}
Deletes a flow regex property expression based on the supplied expression ID.
GET /config/flow_sources/custom_properties/property_expressions/{expression_id}
Retrieves a flow regex property expression based on the supplied expression ID.
POST /config/flow_sources/custom_properties/property_expressions/{expression_id}
Updates an existing flow regex property expression.
GET /config/flow_sources/custom_properties/regex_properties
Retrieves a list of flow regex properties.
POST /config/flow_sources/custom_properties/regex_properties
Creates a new flow regex property.
DELETE /config/flow_sources/custom_properties/regex_properties/{regex_property_id}
Deletes a flow regex property. To ensure safe deletion, a dependency check is carried out. This check might take some time. An asynchronous task is started to do this check.
GET /config/flow_sources/custom_properties/regex_properties/{regex_property_id}
Retrieves a flow regex property based on the supplied regex property ID.
POST /config/flow_sources/custom_properties/regex_properties/{regex_property_id}
Updates an existing flow regex property.
GET /config/flow_sources/custom_properties/regex_properties/{regex_property_id}/dependents
Retrieves the objects that depend on the flow regex property.
GET /config/flow_sources/custom_properties/regex_properties/{regex_property_id}/dependents/change_field_type
Retrieves the objects that depend on the flow regex property for changing type of field for it.
GET /config/flow_sources/custom_properties/regex_properties/{regex_property_id}/disabling_dependents
Retrieves the objects that depend on the flow regex property.
GET /config/flow_sources/custom_properties/regex_property_delete_tasks/{task_id}
Retrieves the flow regex property delete task status.
GET /config/flow_sources/custom_properties/regex_property_dependent_tasks/change_field_type/{task_id}
Retrieves the flow regex property dependent task status.
POST /config/flow_sources/custom_properties/regex_property_dependent_tasks/change_field_type/{task_id}
Cancels the regex property dependent task.
GET /config/flow_sources/custom_properties/regex_property_dependent_tasks/change_field_type/{task_id}/results
Retrieves the regex property dependent task results.
GET /config/flow_sources/custom_properties/regex_property_dependent_tasks/disable/{task_id}
Retrieves the flow regex property dependent task status.
POST /config/flow_sources/custom_properties/regex_property_dependent_tasks/disable/{task_id}
Cancels the regex property dependent task.
GET /config/flow_sources/custom_properties/regex_property_dependent_tasks/disable/{task_id}/results
Retrieves the regex property dependent task results.
GET /config/flow_sources/custom_properties/regex_property_dependent_tasks/{task_id}
Retrieves the flow regex property dependent task status.
POST /config/flow_sources/custom_properties/regex_property_dependent_tasks/{task_id}
Cancels the flow regex property dependent task.
GET /config/flow_sources/custom_properties/regex_property_dependent_tasks/{task_id}/results
Retrieves the regex property dependent task results.
GET /config/network_hierarchy/networks
Retrieves the deployed network hierarchy.
GET /config/network_hierarchy/staged_networks
Retrieves the staged network hierarchy.
PUT /config/network_hierarchy/staged_networks
Replaces the current network hierarchy with the input that is provided.
GET /config/remote_networks
Retrieves a list of deployed remote networks.
GET /config/remote_networks/{network_id}
Retrieves a deployed remote network by ID.
GET /config/remote_services
Retrieves a list of deployed remote services.
GET /config/remote_services/{service_id}
Retrieves a deployed remote service by ID.
GET /config/resource_restrictions
Retrieves a list of all resource restrictions.
POST /config/resource_restrictions
Creates a new resource restriction.
DELETE /config/resource_restrictions/{resource_restriction_id}
Deletes a resource restriction consumer by ID.
GET /config/resource_restrictions/{resource_restriction_id}
Retrieves a resource restriction consumer by ID.
PUT /config/resource_restrictions/{resource_restriction_id}
Updates a resource restriction consumer by ID.
GET /config/store_and_forward/policies
Retrieves a list of store and forward policies.
DELETE /config/store_and_forward/policies/{id}
Deletes a store and forward policy.
GET /config/store_and_forward/policies/{id}
Retrieves a store and forward policy.
POST /config/store_and_forward/policies/{id}
Updates the store and forward policy owner only.