Metadata providers type

Describes metadata providers that are used to show context-sensitive information in IBM® QRadar®.

Metadata is shown when the user's mouse pointer hovers over an item in QRadar. The contents of the metadata comes from the response of the REST method. The following code example shows the expected format of the response:

{
    key:"Unique key for this metadata item",
    label:"Description of what this metadata is",
    value:"Plain-text context-sensitive data to be provided",
    html:"HTML context-sensitive data to be provided"
}

The following table describes the metadata_providers block fields in the manifest.json file.

Table 1. Metadata_providers block fields
Field Required Type Description
rest_method Yes String Name of the REST method that is used to fetch the metadata. Must be declared in the rest_methods block of the manifest. Requires a context argument that specifies the item to fetch metadata for.
metadata_type Yes String Type of metadata that can be fetched for. The following list provides the valid values for this field:
  • ip
  • userName -
  • ariel:<FIELD_NAME>, where <FIELD_NAME> is the name of a field in the QRadar Event or Flow viewer

The following code is a sample metadata_providers block from the manifest.json file:

...

"metadata_providers": [
		{
			"rest_method":"sampleIPInformation",
			"metadata_type":"ip"
		},
		{
			"rest_method":"sampleUserInformation",
			"metadata_type":"userName"
		},
		{
			"rest_method":"sampleURLInformation",
			"metadata_type":"ariel:URL"
		}
	],

...