List Property Expressions

Get a list of property expressions configured in QRadar.

External Documentation

To learn more, visit the QRadar documentation.

Parameters

Parameter	Description
End Index	The index of the last item to return. The default is 999.
Fields	A comma separated list of fields to include in the response. Fields that are not named are excluded. To specify subfields, use brackets. For example: parent_field(subfield1,subfield2),top_level_field
Filter	Specify a filter expression to restrict the returned results. For more information, refer to Qradar documentation.
Start Index	The index of the first item to return. The default is 0.

Example Output

[
	{
		"capture_group": 42,
		"creation_date": 42,
		"enabled": true,
		"id": 42,
		"identifier": "String",
		"log_source_id": 42,
		"log_source_type_id": 42,
		"low_level_category_id": 42,
		"modification_date": 42,
		"payload": "String",
		"qid": 42,
		"regex": "String",
		"regex_property_identifier": "String",
		"username": "String"
	}
]

Workflow Library Example

List Property Expressions with Qradar and Send Results Via Email

Preview this Workflow on desktop