Administrators, users, or business partners working to develop applications that integrate with QRadar should be aware of an important API change coming in QRadar 7.3.1. QRadar applications can be affected by this future API update, so we are alerting developers to the change.

In existing QRadar releases (7.2.8 and 7.3.0), data returned in the JSON response for /ariel/searches/{search_id]/results always displayed as “string” values disregarding the actual JSON data type. For example in the QRadar API v7.1 or v8.0, JSON results for numeric values and booleans were always returned in double quotes, such as “starttime”: “1502316123888”, “sourceport”: “80”, “qid”: “38750003”, or Booleans (“true” / “false”). After an administrator updates the QRadar deployment to version 7.3.1 the API will return proper JSON types in the search results, such as, “starttime”: 1467049610019, “qid”: 20034, “sourceport”: 80, “value”: true.

If you have questions about this change, ask us in the QRadar app development forums.

Join The Discussion

Your email address will not be published. Required fields are marked *