POST /config/event_sources/disconnected_log_collectors

Creates a new disconnected log collector. A disconnected log collector contains the following fields:

id - ID - The ID of the disconnected log collector.
uuid - UUID - The UUID of the disconnected log collector.
name - String - The name of the Disconnected Log Collector.
description - String - The description of the Disconnected Log Collector.
version - String - The version of the Disconnected Log Collector.
protocol - Enumeration - The transport protocol used by the Disconnected Log Collector to send events to QRadar. Possible Values are TLS and UDP.
updates_enabled - Enumeration - The updates enabled value of the Disconnected Log Collector. Possible Values are NONE, CONFIG_ONLY, CONFIG_AND_SOFTWARE.
certificate_signing_request - String - The certificate signing request, supplied when the QRadar is used as a CA.
client_certificate - String - The client certificate, if other CA is used for certificates.
public_encryption_keys - String - The public encryption keys. It will be used to encrypt secrets in configurations.
public_authentication_keys - String - The public authentication keys.
host - String - The host field for storing IP address or hostname of system agent is installed on.

Table 1. POST /config/event_sources/disconnected_log_collectors resource details
MIME Type
application/json

Table 2. POST /config/event_sources/disconnected_log_collectors request parameter details
Parameter	Type	Optionality	Data Type	MIME Type	Description
fields	header	Optional	String	text/plain	Optional - Use this parameter to specify which fields you would like to get back in the response. Fields that are not named are excluded. Specify subfields in brackets and multiple fields in the same object are separated by commas.

Table 3. POST /config/event_sources/disconnected_log_collectors request body details
Parameter	Data Type	MIME Type	Description	Sample
disconnected_log_collector	Object	application/json	The disconnected log collector to create.	{ "client_certificate": "String", "creation_time": 42, "description": "String", "event_timeout_threshold": 42, "host": "String", "last_event_time": 42, "managed": true, "modified_time": 42, "name": "String", "protocol": "String", "public_authentication_keys": "String", "public_encryption_keys": "String", "status": "String", "status_detail": [ { "component_name": "String", "data": [ { "key": "String", "value": "String" } ], "message": "String", "severity": "String", "status": "String", "timestamp": 42 } ], "supported_protocol_types": [ { "install_failed": true, "protocol_type_id": 42, "protocol_type_version": "String" } ], "updates_enabled": "String", "uuid": "String", "version": "String" }

Table 4. POST /config/event_sources/disconnected_log_collectors response codes
HTTP Response Code	Unique Code	Description
201		The disconnected log collector was created successfully.
409	1001	The 'uuid' parameter must be unique.
409	1004	The 'name' parameter must be unique.
422	1002	The 'uuid' parameter format is invalid.
422	1003	The 'uuid' parameter is required.
422	1005	The 'name' parameter is required.
422	1006	The 'name' parameter must not exceed 255 characters.
422	1007	The 'description' parameter must not exceed 255 characters.
422	1008	The 'version' parameter is required.
422	1009	The 'version' parameter must not exceed 255 characters.
422	1010	The 'protocol' parameter must be TLS or UDP.
422	1011	The 'updatesEnabled' must be NONE, CONFIG_ONLY, CONFIG_AND_SOFTWARE.
422	1012	The 'version' can only be set by SYSTEM.AGENTPROTOCOL capability when the DLC is managed.
422	1013	The 'public_encryption_keys' is not a valid JWKS.
422	1014	The 'public_encryption_keys' is required if called by SYSTEM.AGENTPROTOCOL.
422	1015	The 'public_authentication_keys' can only be set by SYSTEM.AGENTPROTOCOL capability.
422	1016	The 'public_authentication_keys' is not a valid JWKS.
422	1017	The 'public_authentication_keys' is required if called by SYSTEM.AGENTPROTOCOL.
422	1018	The 'host' field is required if called by SYSTEM.AGENTPROTOCOL
422	1019	The 'event_timeout_threshold' must be non-negative.
500	1100	An error occurred during the attempt to create the disconnected log collector.

Response Description

The newly created disconnected log collector.

Response Sample


{
    "client_certificate": "String",
    "creation_time": 42,
    "description": "String",
    "event_timeout_threshold": 42,
    "host": "String",
    "id": 42,
    "last_event_time": 42,
    "managed": true,
    "modified_time": 42,
    "name": "String",
    "protocol": "String",
    "public_authentication_keys": "String",
    "public_encryption_keys": "String",
    "status": "String",
    "status_detail": [
        {
            "component_name": "String",
            "data": [
                {
                    "key": "String",
                    "value": "String"
                }
            ],
            "message": "String",
            "severity": "String",
            "status": "String",
            "timestamp": 42
        }
    ],
    "supported_protocol_types": [
        {
            "install_failed": true,
            "protocol_type_id": 42,
            "protocol_type_version": "String"
        }
    ],
    "updates_enabled": "String",
    "uuid": "String",
    "version": "String"
}