GET /config/event_sources/wincollect/wincollect_agents

Retrieves a list of WinCollect agents.

Table 1. GET /config/event_sources/wincollect/wincollect_agents resource details
MIME Type

application/json

Table 2. GET /config/event_sources/wincollect/wincollect_agents request parameter details
Parameter Type Optionality Data Type MIME Type Description

Range

header

Optional

String

text/plain

Optional - Use this parameter to restrict the number of elements that are returned in the list to a specified range. The list is indexed starting at zero.

filter

query

Optional

String

text/plain

Optional - This parameter is used to restrict the elements in a list base on the contents of various fields.

fields

query

Optional

String

text/plain

Optional - Use this parameter to specify which fields you would like to get back in the response. Fields that are not named are excluded. Specify subfields in brackets and multiple fields in the same object are separated by commas.
Table 3. GET /config/event_sources/wincollect/wincollect_agents response codes
HTTP Response Code Unique Code Description

422

1010

The supplied filter is invalid

500

1020

An internal server error has occurred.

Response Description

A List of WinCollectAgentDTOs
  • id - Integer - ID of the WinCollect agent.
  • name - String - The name of the WinCollect agent.
  • description - String - An optional description of the WinCollect agent.
  • host - String - The IP address or hostname of the WinCollect agent.
  • version - String - The version of the WinCollect agent.
  • os_version - String - The operating system version of the host that the agent is running on.
  • status - Enumeration - The status of the agent in QRadar. Possible values are NO_COMMUNICATION_FROM_AGENT, RUNNING, STOPPED, or UNAVAILABLE (set when the Windows host reboots).
  • enabled - Boolean - Set to 'true' if the agent is enabled or running; otherwise, it is set to 'false' if the agent is deliberately disabled or turned off.
  • autoupdates_enabled - Boolean - Set to 'true' if the agent is allowed to autonomously request configuration and software updates from QRadar; otherwise, set to 'false' if the agent is not allowed to receive updates.
  • autodiscovered - Boolean - Set to 'true' if the agent was created when an agent registered with QRadar. Otherwise, set to 'false' if a user manually created the agent before the agent initiated communication.
  • last_heartbeat_time - Long - The date/time (in milliseconds since epoch) that a heartbeat signal from the agent was last received.
  • last_config_generation_time - Long - The date/time (in milliseconds since epoch) that the agent's configuration file was last generated in QRadar.

Response Sample


[
    {
        "autodiscovered": true,
        "autoupdates_enabled": true,
        "description": "String",
        "enabled": true,
        "host": "String",
        "id": 42,
        "last_config_generation_time": 42,
        "last_heartbeat_time": 42,
        "name": "String",
        "os_version": "String",
        "status": "String <one of: NO_COMMUNICATION_FROM_AGENT, RUNNING, STOPPED, UNAVAILABLE, UNKNOWN>",
        "version": "String"
    }
]