IBM® QRadar Incident Forensics endpoints

Use the references for REST API 15.0 QRadar® Incident Forensics endpoints.

GET /forensics/capture/recoveries
Retrieves a list of capture recoveries.
POST /forensics/capture/recoveries
Creates a new capture recovery.
GET /forensics/capture/recoveries/{id}
Retrieves a recovery based on the supplied ID.
GET /forensics/capture/recovery_tasks
Retrieves a list of recovery tasks.
GET /forensics/capture/recovery_tasks/{id}
Retrieves a recovery task based on the supplied ID.
GET /forensics/case_management/case_create_tasks/{id}
Retrieves a case create task based on the supplied id.
GET /forensics/case_management/cases
Retrieves a list of cases.
POST /forensics/case_management/cases
Creates a new case.
GET /forensics/case_management/cases/{id}
Retrieves a case based on the supplied id.