List Leef Expressions

Get a list of LEEF expressions configured in QRadar.

External Documentation

To learn more, visit the QRadar documentation.

​

Parameters

Parameter	Description
End Index	The index of the last item to return. The default is 999.
Fields	A comma separated list of fields to include in the response. Fields that are not named are excluded. To specify subfields, use brackets. For example: parent_field(subfield1,subfield2),top_level_field
Filter	Specify a filter expression to restrict the returned results. For more information, refer to Qradar documentation.
Start Index	The index of the first item to return. The default is 0.

​

Example Output

[
	{
		"creation_date": 42,
		"enabled": true,
		"expression": "String",
		"id": 42,
		"identifier": "String",
		"log_source_id": 42,
		"log_source_type_id": 42,
		"low_level_category_id": 42,
		"modification_date": 42,
		"payload": "String",
		"qid": 42,
		"regex_property_identifier": "String",
		"username": "String"
	}
]