Introducing SOC Insights for BloxOne Threat Defense: Boost your SOC efficiency with AI-driven insights to eliminate manual work and accelerate investigation and response times. Read the blog announcement here.

API & Integration, DevOps,NetOps,SecOps

Reply

How can we know the correct values for extensible attribute?

[ Edited ]
Techie
Posts: 9
1512     0

Hello all,

  i was trying to create an extensible attribute today and i had some issue with it due to object type names.

/extensibleattributedef

payload:

{
    "name""test1",
    "type""STRING",
    "comment" : "Testing",
    "allowed_object_types" :    ["Network""NetworkContainer"]
}
This example is working ok now. It was not working because i was using : "network" , "networkcontainer" instead of "Network" and "NetworkContainer".
Can anyone maybe help me with explaining how to obtain the correct values for those queries ? This one i sorted out by creating an attribute using gui, and then looking it up via api. API return the results with correct capital letters. When i was reading documentation from the wapidoc, those object types are not types with capital letters. Any idea if i have missed something ?
 
One more question,
 how was i supposed to know what was the correct value of that type ? 
first i was using chrome developer tools to inspect possible values, which was bad idea as they were incorrect ("IPv4 Network Container"). It looks like the correct name is NetworkContainer, but for ipv6 its actually IPv6NetworkContainer. If i would have to guess i would have typed IPv4NetworkContainer.
 
When i query schema for extensibleattributedef , all isee about the allowed_object_types is
 
doc : The object types this extensible attribute is allowed to associate with.
is_array : True
name : allowed_object_types
standard_field : False
supports : rwu
type : {string}
 
 
Thank you
Showing results for 
Search instead for 
Did you mean: 

Recommended for You

Businesses are investing heavily into securing company resources from cyber-attacks form cybercrimin