App names, GUI action groups, and page IDs
App names, GUI action groups, and page IDs are identifiers that IBM® QRadar® uses for QRadar products, GUI actions, and UI pages.
The following manifest blocks use these identifiers.
The groups field of the gui_actions block uses GUI action group identifiers to
specify the toolbar or right-click menu where the GUI action is added:
...
"gui_actions": [
{
"id":"sampleToolbarButton",
"text":"Sample Toolbar Button",
"description":"Sample toolbar button that
calls a REST method, passing an offense ID along",
"icon":null,
"rest_method":"sampleToolbarMethod",
"javascript":"alert(result)",
"groups":[ "OffenseListToolbar" ],
"required_capabilities":[ "ADMIN" ]
}
],
..
The app_name and page_id fields of the
page_scripts block use the app name and page ID identifiers to specify the QRadar application tab and sub
page into which the page script is added.
...
"page_scripts": [
{
"app_name":"SEM",
" page_id":"OffenseList",
"scripts":["/static/sampleScriptInclude.js"]
}
],
...
Supported app names
The following table shows a list of supported app names with descriptions.| App Name | Description |
|---|---|
| assetprofile | Asset Profile (for example, Vulnerabilities: Manage Vulnerabilities, search) |
| Assets | Assets Manager |
| EventViewer | Event Viewer (for example, syslogdestination) |
| Forensics | Incident Forensics |
| QRadar | QRadar (for example, Reference Data) |
| QVM | QRadar Vulnerability Manager |
| Reports | Reports |
| Sem | Offense Management |
| SRM | QRadar Risk Manager |
| Surveillance | Network Surveillance (Flows) |
Supported GUI Actions and corresponding page IDs
The following table describes the supported GUI Actions and corresponding page IDs.
| GUI Action group | App name | Page ID | Location |
|---|---|---|---|
| AssetDetailsToolbar | Assets | AssetDetailsVulnList | Assets - click on IP Address/ Vulnerabilities - Manage Vulnerabilities - By Asset - click on IP Address |
| AssetListToolbar | Assets | AssetList | Asset tab list |
| AssetOwnerToolbar | assetprofile | AssetOwner | Vulnerabilities tab - left panel - Vulnerability Assignment |
| AttackerList | SEM | OffenseSummary | Offense Tab - All Offenses - double-click offense row - right-click row in Top 5 Source IPs section |
| AttackerListSmallToolbar | SEM | OffenseAttackerList | Offenses tab - All Offenses - double-click offense row - click Sources button on Top 5 Source IPs toolbar |
| NetworkAttackerList | Offenses tab - By Network - select row - click Sources button on toolbar to view List of Sources | ||
| TargetAttackerList | Offenses tab - By Destination IP - select row, click Sources button on toolbar to view List of Sources | ||
| AttackerListToolbar | SEM | AttackerList | Offenses tab - By Source IP |
| ByAssetListFormToolbar | assetprofile | ByAssetListForm | Vulnerabilities tab - Manage vulnerabilities - by Asset |
| ByNetworkListToolbar | assetprofile | ByNetworkList | Vulnerabilities tab - Manage vulnerabilities - by Network |
| ByOpenServiceListToolbar | assetprofile | ByOpenServiceList | Vulnerabilities tab - Manage vulnerabilities - by Open Service |
| ByVulnerabilityInstanceListToolbar | assetprofile | ByVulnerabilityInstanceList | Vulnerabilities tab - Manage vulnerabilities - By vulnerability instance - main screen |
| ByVulnerabilityListToolbar | assetprofile | ByVulnerabilityList | Vulnerabilities tab - Manage vulnerabilities - By vulnerability |
| CategoryList | SEM | OffenseSummary | Offenses tab - All Offenses, - double-click row -Top 5 Categories table - right-click a row |
| CategoryListToolbar | SEM | OffenseCategoryList | Offenses Tab - All offenses - double-click row - click Display > Categories in toolbar - List of Event Categories table toolbar |
| DomainListToolbar | QRadar | DomainList | Admin tab - Domain Management |
| EventDetailsToolbar | Event Viewer | EventDetails | Log Activity tab - pause - click row - Events detail toolbar |
| ExceptionRulesListToolbar | assetprofile | ExceptionRulesList | Vulnerabilities tab - Vulnerability exception |
| FlowDetailsToolbar | Surveillance | FlowDetails | Network Activity - double-click on a flow. |
| FlowsourceListToolbar | Surveillance | FlowsourceList | Admin tab - Flow Sources |
| MyAssignedVulnerabilitiesListToolbar | assetprofile | MyAssignedVulnerabilitiesList | Vulnerability tab - My assigned vulnerabilities |
| NetworkHierarchyListToolbar | QRadar | NetworkHierarchyList | Admin tab - Network Hierarchy |
| NetworkListSmallToolbar | SEM | OffenseNetworkList | Offenses tab - All Offenses - double-click row - click Display in toolbar, Networks, Destination Networks table, toolbar, and right click |
| NetworkListToolbar | SEM | NetworkList | Offenses -By Network |
| NetworkSummaryToolbar | SEM | NetworkOffenseList | Offenses Tab - By Network - double-click an offense. |
| ObfuscationProfileContextMenu | QRadar | ObfuscationProfiles | Admin - Data Obfuscation Management |
| ObfuscationRightClick | QRadar | Deprecated | |
| OffenseListSmallToolbar | SEM | AttackerOffenseList | Offenses - double-click a row in Offenses - double-click row in Top 5 SourceIPs - select a row and right click |
| SEM | TargetOffenseList | Offenses - double-click a row in Offenses - double-click row in Top 5 SourceIPs - double-click a row - select a row and right click | |
| OffenseListToolbar | SEM | OffenseList | Offenses tab main page |
| OffenseSummaryToolbar | SEM | OffenseSummary | Offenses tab, double-click Offense - toolbar |
| OffenseDeviceList | Click Display > Log Sources | ||
| OffenseUserList | Click Display > Users | ||
| OffenseRuleList | Click Display > Rules | ||
| OffenseSummaryToolbar | OffenseAttackerList Added in QRadar V.7.3.0 |
Offenses tab, double-click Offense - on toolbar, Click Display > Sources | |
| OffenseCategoryList Added in QRadar V.7.3.0 |
Offenses tab, double-click Offense - on toolbar, Click Display > Categories | ||
| OffenseNetworkList Added in QRadar V.7.3.0 |
Offenses tab, double-click Offense - on toolbar, Click Display > Networks | ||
| OffenseSummaryToolbar | SEM | OffenseAnnotationList Added in QRadar V.7.3.2 |
Click Display > Annotations |
| OffenseSummaryToolbar | SEM | OffenseTargetList Added in QRadar V.7.3.2 |
Click Display > Destinations |
| OffenseSummaryToolbar | SEM | NotesList Added in QRadar V.7.3.2 |
Click Display > Notes |
| ReferenceSetElemsContextMenu | QRadar | ReferenceSetElems | Admin tab- Reference Set Management - View a reference set - Content tab, right-click row |
| ReferenceSetElemsToolbar | QRadar | ReferenceSetElems | Admin tab- Reference Set Management - View a reference set - Content tab |
| ReferenceSetRulesContextMenu | QRadar | ReferenceSetRules | Admin tab - Reference Set Management - View a reference set - References tab, right-click row |
| ReferenceSetRulesToolbar | QRadar | ReferenceSetRules | Admin tab - Reference Set Management - View a reference set - References tab, click row, click toolbar button |
| ReferenceSetsContextMenu | QRadar | ReferenceSets | Admin tab - Reference Set Management - right-click a reference set. |
| ReferenceSetsToolbar | QRadar | ReferenceSets | Admin tab -Reference Set Management |
| ReportTemplateListToolbar | Reports | ReportTemplateListAll | Reports tab toolbar |
| SensorDeviceListToolbar | EventViewer | SensorDeviceList | Admin tab - Log Sources |
| TargetList | SEM | OffenseSummary | Offenses tab - double-click offense, Top 5 Destination IPs table, right-click row. |
| TargetListToolbar | SEM | TargetList | Offenses tab - By Destination IP. |
| TargetSummaryToolbar |
SEM |
TargetOffenseList |
Offenses tab - By Destination IP - double-click offense
|
| TargetNotesList | Offenses tab - By Destination IP - double click offense - click Notes on toolbar | ||
| TargetAttackerList | Offenses tab - By Destination IP - double click offense - click Sources on toolbar | ||
| TenantListToolbar | QRadar | TenantList | Admin tab - Tenant Management |
| VaScannerSchedulesListToolbar | Assets | VaScannerSchedulesList | Admin tab - Schedule VA Scanners |
| VaScannersListToolbar | Assets | VaScannersList | Admin tab - VA Scanners |
| ViewNotesToolbar | SEM | OffenseSummary | Offenses tab - double-click Offense, Last 5 Notes table toolbar |
| ViewOffenseDevicesToolbar | SEM | OffenseSummary | Offenses tab - double-click Offense - Top 5 Log Sources table toolbar |
| ViewoffenseusersToolbar | SEM | OffenseSummary | Offenses tab - double-click Offense, Top 5 Users table toolbar |
| VulnerabilityManagementListPopup | assetprofile | ByAssetListForm, ByNetworkList, ByOpenServiceList, ByVulnerabilityList, MyAssignedVulnerabilitiesList, ByVulnerabilityInstanceList | Vulnerabilities tab - Manage Vulnerabilities - By Network - By Asset - By Vulnerability - By Open Service - My Assigned Vulnerabilities |
| arielListToolbar | Surveillance | FlowList | Network Activity tab |
| customEventListToolbar | EventViewer | EventList | Log Activity tab |
| ipPopup |
Assets assetprofile assetprofile assetprofile assetprofile |
AssetList MyAssignedVulnerabilitiesList ByVulnerabilityInstanceList ByAssetListForm ExceptionRulesList |
Right-click IP address on Assets tab, Vulnerability tab - Manage Vulnerabilities - Vulnerability Exception |
| userNamePopup | Assets | AssetDetailsVulnList |
For example, Assets Tab, click IP Address to View Asset Details, select a row in Vulnerabilities table, right-click Technical User, see right-click View Assets /View Events Also used in Offenses, Log Activity. |
Deprecated GUI actions
- OffenseList
- NetworkList
- HistoricalCorrelationToolbar
- OffenseRuleList
- OffenseDeviceList
- OffenseUserList
- NotesList
- ByAssetListForm