QRadarFullSearch Deprecated

Deprecated.Use the following command instead `qradar-search-retrieve-results`. This playbook runs a QRadar query and return its results to the context.

IBM QRadar · 10 tasks · 5 inputs · 1 output

Inputs

  • timeout — How much time to wait before a timeout occurs (minutes)
  • interval — Polling frequency - how often the polling command should run (minutes)
  • query_expression — The query expressions in AQL
  • range — Range of results to return (e.g. 0-20)
  • headers — Table headers

Outputs

  • QRadar.Search.Result — The result of the search

Commands used

qradar-get-search qradar-get-search-results qradar-searches

Flowchart

yes yes yes Start Start Run QRadar search - qradar-searches Run QRadar search qradar-searches Get QRadar search - qradar-get-search Get QRadar search qradar-get-search GenericPolling - GenericPolling GenericPolling GenericPolling Get QRadar search results - qradar-get-search-results Get QRadar search results qradar-get-search-results Done Done Is search completed? Is search completed? Is QRadar enabled? Is QRadar enabled? Is search canceled? Is search canceled? ERROR - PrintErrorEntry ERROR PrintErrorEntry