!qradar-offenses-list enrichment=IPs filter="status=OPEN" range=0-2
!qradar-offense-update offense_id=14 assigned_to=admin enrichment="IPs And Assets" follow_up=true status=OPEN protected=false
!qradar-closing-reasons include_deleted=true include_reserved=true
!qradar-offense-notes-list offense_id=14 filter="username='API_user: admin'" range=0-1
!qradar-offense-note-create note_text="Note Regarding The Offense" offense_id=14
!qradar-rules-list rule_type=COMMON range=0-2
!qradar-rule-groups-list range=0-2
!qradar-assets-list filter="id<1100" range=0-2
!qradar-saved-searches-list range=0-1
!qradar-searches-list
!qradar-search-create query_expression="""SELECT "destinationPort" AS 'Destination Port', UniqueCount("sourceIP") AS 'Source IP (Unique Count)', UniqueCount("destinationIP") AS 'Destination IP (Unique Count)', UniqueCount(qid) AS 'Event Name (Unique Count)', UniqueCount(logSourceId) AS 'Log Source (Unique Count)', UniqueCount(category) AS 'Low Level Category (Unique Count)', UniqueCount("protocolId") AS 'Protocol (Unique Count)', UniqueCount("userName") AS 'Username (Unique Count)', MAX("magnitude") AS 'Magnitude (Maximum)', SUM("eventCount") AS 'Event Count (Sum)', COUNT(*) AS 'Count' from events where ( ("creEventList"='100120') or ("creEventList"='100122') or ("creEventList"='100135') AND "eventDirection"='R2L' ) GROUP BY "destinationPort" order by "Event Count (Sum)" desc last 6 hours"""
!qradar-search-status-get search_id=36227863-bc6a-488f-9aa4-0f9c6f767655
!qradar-search-results-get search_id=36227863-bc6a-488f-9aa4-0f9c6f767655 range=0-3
!qradar-search-delete search_id=36227863-bc6a-488f-9aa4-0f9c6f767655
!qradar-reference-sets-list filter="timeout_type=FIRST_SEEN" range=0-2
!qradar-reference-set-create element_type=IP ref_name="Malicious IPs" time_to_live="1 year" timeout_type=FIRST_SEEN
!qradar-reference-set-value-upsert ref_name="Malicious IPs" value="1.2.3.4,1.2.3.5,192.168.1.3"
!qradar-reference-set-value-delete ref_name="Malicious IPs" value="1.2.3.4"
!qradar-reference-set-delete ref_name="Malicious IPs"
!qradar-domains-list
!qradar-indicators-upload ref_name="Mail Servers" limit=2 query="type:IP"
!qradar-geolocations-for-ip ip="1.2.3.4,1.2.3.5" range=0-1
!qradar-log-sources-list qrd_encryption_algorithm=AES128 range=0-2
!qradar-get-custom-properties filter="id between 90 and 100" range=1-1231
!qradar-reset-last-run
!qradar-ips-source-get filter=`source_ip="192.168.0.15"` range=0-2
!qradar-ips-local-destination-get filter=`local_destination_ip="1.1.1.1"`
!qradar-search-retrieve-events offense_id=14
!qradar-event-collectors-list id=7
!qradar-wincollect-destinations-list
!qradar-disconnected-log-collectors-list
!qradar-log-source-types-list
!qradar-log-source-protocol-types-list id=0
!qradar-log-source-extensions-list
!qradar-log-source-languages-list
!qradar-log-source-groups-list
!qradar-log-source-delete name=example
!qradar-log-source-create type_id=11 name=example protocol_type_id=0 protocol_parameters="identifier=id,incomingPayloadEncoding=UTF-8" target_event_collector_id=7
!qradar-log-source-update id=1900 description="A demo log source"
!qradar-reference-maps-list
!qradar-reference-maps-list ref_name="Monitoring Identifier Gaps"
!qradar-reference-map-value-upsert ref_name="Monitoring Identifier Gaps" value="12345" key="demoKey"