Which of the following will show all artifacts that have the term results in a filePath CEF value?

The correct answer is A. .../rest/artifact?_filter_cef_filePath_icontain=''results''. The _filter parameter is used to filter the results based on a field value, and the icontain operator is used to perform a case-insensitive substring match. The filePath field is part of the Common Event Format (CEF) standard, and the cef_ prefix is used to access CEF fields in…

Working with the API

Question

Options

A.../rest/artifact?_filter_cef_filePath_icontain=''results''
B...rest/artifacts/filePath=''%results%''
C.../result/artifacts/cef/filePath= '%results%''
D.../result/artifact?_query_cef_filepath_icontains=''results

How the community answered

(27 responses)

A
78% (21)
B
4% (1)
C
15% (4)
D
4% (1)

Explanation

The filter parameter is used to filter the results based on a field value, and the icontain operator is used to perform a case-insensitive substring match. The filePath field is part of the Common Event Format (CEF) standard, and the cef prefix is used to access CEF fields in the REST API. To query and display all artifacts that contain the term "results" in a filePath CEF (Common Event Format) value, using the REST API endpoint with a filter parameter is effective. The filter _filter_cef_filePath_icontain="results" is applied to search within the artifact data for filePath fields that contain the term "results", disregarding case sensitivity. This method allows users to precisely locate and work with artifacts that meet specific criteria, aiding in the investigation and analysis processes within Splunk SOAR.

Topics

#REST API#artifact query#CEF filePath#icontain filter

Community Discussion

No community discussion yet for this question.

Full SPLK-2003 Practice