POST /config/event_sources/disconnected_log_collectors/{id}

Updates a disconnected log collector by ID. A disconnected log collector contains the following fields:

id - ID - The ID of the disconnected log collector.
uuid - UUID - The UUID of the disconnected log collector.
name - String - The name of the Disconnected Log Collector.
description - String - The description of the Disconnected Log Collector.
version - String - The version of the Disconnected Log Collector.
protocol - Enumeration - The transport protocol used by the Disconnected Log Collector to send events to QRadar. Possible Values are TLS and UDP.
status - Enumeration - The status of the Disconnected Log Collector. Possible Values are: CONNECTION_BUNDLE_PENDING, CONNECTION_BUNDLE_READY, SUCCESS, WARN, ERROR.
status_detail - List - The list of the status details of the Disconnected Log Collector, each item contains:
- component_name - Enumeration - The component name of the status. Possible Values are: connection_bundle, event_collection, performance, management, connector_config
- status - String - The status info defined in the status detail.
- severity - Enumeration - The severity of the status. Possible Values are: INFO, WARN, ERROR.
- message - String - The message define in status detail.
- timestamp - Number - The timestamp in milliseconds since Epoch.
- data - List - The list of component statuses, each item contains:
- key - String - The key of the component status data object.
- value - String - The value of the component status data object.
updates_enabled - Enumeration - The updates enabled value of the Disconnected Log Collector. Possible Values are NONE, CONFIG_ONLY, CONFIG_AND_SOFTWARE.
last_event_time - Number - The last event time in milliseconds since Epoch.
event_timeout_threshold - Number - The event timeout threshold of the Disconnected Log Collector.
supported_protocol_types - List - The List of supported protocol types in the Disconnected Log Collector, each item contains:
- protocol_type_id - String - The protocol type id.
- protocol_type_version - String - The version of the protocol type
- install_failed - Boolean - This boolean indicates if the installation failed.
certificate_signing_request - String - The certificate signing request, supplied when the QRadar is used as a CA.
client_certificate - String - The client certificate, if other CA is used for certificates.
public_encryption_keys - String - The public encryption keys. It will be used to encrypt secrets in configurations.
public_authentication_keys - String - The public authentication keys.
host - String - The host field for storing IP address or hostname of system agent is installed on.

Table 1. POST /config/event_sources/disconnected_log_collectors/{id} resource details
MIME Type
application/json

Table 2. POST /config/event_sources/disconnected_log_collectors/{id} request parameter details
Parameter	Type	Optionality	Data Type	MIME Type	Description
id	path	Required	Number (Integer)	text/plain	The ID of the disconnected log collector to update.
fields	header	Optional	String	text/plain	Optional - Use this parameter to specify which fields you would like to get back in the response. Fields that are not named are excluded. Specify subfields in brackets and multiple fields in the same object are separated by commas.

Table 3. POST /config/event_sources/disconnected_log_collectors/{id} request body details
Parameter	Data Type	MIME Type	Description	Sample
log_source_data	Object	application/json	The updated disconnected log collector data. Any field not provided will be ignored.	{ "client_certificate": "String", "creation_time": 42, "description": "String", "event_timeout_threshold": 42, "host": "String", "last_event_time": 42, "managed": true, "modified_time": 42, "name": "String", "protocol": "String", "public_authentication_keys": "String", "public_encryption_keys": "String", "status": "String", "status_detail": [ { "component_name": "String", "data": [ { "key": "String", "value": "String" } ], "message": "String", "severity": "String", "status": "String", "timestamp": 42 } ], "supported_protocol_types": [ { "install_failed": true, "protocol_type_id": 42, "protocol_type_version": "String" } ], "updates_enabled": "String", "uuid": "String", "version": "String" }

Table 4. POST /config/event_sources/disconnected_log_collectors/{id} response codes
HTTP Response Code	Unique Code	Description
200		The disconnected log collector was updated successfully.
404	1001	The requested disconnected log collector cannot be found.
409	1002	The 'uuid' parameter must be unique.
409	1005	The 'name' parameter must be unique.
422	1003	The 'uuid' parameter format is invalid.
422	1004	The 'uuid' parameter is required.
422	1006	The 'name' parameter is required.
422	1007	The 'name' parameter must not exceed 255 characters.
422	1008	The 'description' parameter must not exceed 255 characters.
422	1009	The 'version' parameter is required.
422	1010	The 'version' parameter must not exceed 255 characters.
422	1011	The 'protocol' parameter must be TLS or UDP.
422	1012	The 'status' parameter must be one of: CONNECTION_BUNDLE_PENDING, CONNECTION_BUNDLE_READY, SUCCESS, WARN, ERROR.
422	1013	The 'component_name' parameter must be one of: connection_bundle, event_collection, performance, management, connector_config.
422	1014	The 'status' in status_detail cannot be null.
422	1015	The 'status' in status_detail must not exceed be 128 characters.
422	1016	The 'severity' parameter must be one of: INFO, WARN or ERROR.
422	1017	The 'message' in status_detail cannot be null.
422	1018	The 'message' in 'status_detail' must not exceed be 255 characters.
422	1019	The 'timestamp' in status_detail cannot be null.
422	1020	The timestamp in status_detail must be non-negative.
422	1021	The 'key' in 'data' of status_detail cannot be null.
422	1022	The 'key' in 'data' of status_detail must not exceed be 255 characters.
422	1023	The 'value' in 'data' of status_detail cannot be null.
422	1024	The 'value' in 'data' of status_detail must not exceed be 255 characters.
422	1025	The 'updatesEnabled' must be NONE, CONFIG_ONLY, CONFIG_AND_SOFTWARE.
422	1026	The 'last_event_time' must be non-negative.
422	1027	The 'event_timeout_threshold' must be non-negative.
422	1028	The 'protocol_type_id' in 'supported_protocol_type' cannot be null.
422	1029	The 'protocol_type_id' in 'supported_protocol_type' must be non-negative.
422	1030	The 'protocol_type_version' in 'supported_protocol_type' cannot be null.
422	1031	The 'protocol_type_version' in 'supported_protocol_type' must not exceed be 255 characters.
422	1032	The 'install_failed' in 'supported_protocol_type' cannot be null.
422	1033	The 'version' can only be set by SYSTEM.AGENTPROTOCOL capability when the DLC is managed.
422	1034	The 'status' can only be set by SYSTEM.AGENTPROTOCOL capability.
422	1035	The 'status_detail' can only be set by SYSTEM.AGENTPROTOCOL capability.
422	1036	The 'supported_protocol_type' can only be set by SYSTEM.AGENTPROTOCOL capability.
422	1037	The 'last_event_time' can only be set by SYSTEM.AGENTPROTOCOL capability.
422	1038	The 'public_encryption_keys' is not a valid JWKS.
422	1039	The 'public_authentication_keys' can only be set by SYSTEM.AGENTPROTOCOL capability.
422	1040	The 'public_authentication_keys' is not a valid JWKS.
422	1041	The 'name' is only editable by ADMIN\|SAASADMIN\|SYSTEM.LOGSOURCE
422	1042	The 'description' is only editable by ADMIN\|SAASADMIN\|SYSTEM.LOGSOURCE
422	1043	The 'host' is only editable by ADMIN\|SAASADMIN\|SYSTEM.LOGSOURCE
422	1044	The 'protocol' is only editable by ADMIN\|SAASADMIN\|SYSTEM.LOGSOURCE
422	1045	The 'updates_enabled' is only editable by ADMIN\|SAASADMIN\|SYSTEM.LOGSOURCE
422	1046	The 'event_timeout_threshold' is only editable by ADMIN\|SAASADMIN\|SYSTEM.LOGSOURCE
422	1047	The 'client_certificate' is only editable by ADMIN\|SAASADMIN\|SYSTEM.LOGSOURCE
422	1048	The requested 'uuid' does not match the existing 'uuid' which is required for SYSTEM.AGENTPROTOCOL
422	1049	The 'uuid' parameter is required for SYSTEM.AGENTPROTOCOL.
422	1050	The 'data' field is mandatory but may contain an empty list.
500	1100	An error occurred during the attempt to create the disconnected log collector.

Response Description

The updated disconnected log collector identified by the id specified in the request.

Response Sample


{
    "client_certificate": "String",
    "creation_time": 42,
    "description": "String",
    "event_timeout_threshold": 42,
    "host": "String",
    "id": 42,
    "last_event_time": 42,
    "managed": true,
    "modified_time": 42,
    "name": "String",
    "protocol": "String",
    "public_authentication_keys": "String",
    "public_encryption_keys": "String",
    "status": "String",
    "status_detail": [
        {
            "component_name": "String",
            "data": [
                {
                    "key": "String",
                    "value": "String"
                }
            ],
            "message": "String",
            "severity": "String",
            "status": "String",
            "timestamp": 42
        }
    ],
    "supported_protocol_types": [
        {
            "install_failed": true,
            "protocol_type_id": 42,
            "protocol_type_version": "String"
        }
    ],
    "updates_enabled": "String",
    "uuid": "String",
    "version": "String"
}