Dataset Management

APIs for managing datasets

Add Dataset

post

Add a dataset of type lookup with the specified name and schema.

Note: Requests time out after three minutes.

Required license: Cortex Cloud Runtime Security or Cortex Cloud Posture Management.

Header parameters

AuthorizationstringRequired

{api_key}

x-xdr-auth-idstringRequired

{api_key_id}

Body

Responses

200

OK

application/json

dataset_namestringOptional

Name of the dataset added.

post/public_api/v1/xql/add_dataset

POST /public_api/v1/xql/add_dataset HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 192

{
  "request_data": {
    "dataset_name": "users",
    "dataset_schema": {
      "uid": "text",
      "username": "text",
      "zipcode": "number",
      "salary": "number",
      "is_admin": "bool",
      "birthday": "datetime"
    },
    "dataset_type": "lookup"
  }
}

200

OK

{
  "dataset_name": "text"
}

Delete a dataset

post

Delete a dataset with the specified name. The following dataset types can be deleted: Lookup, Raw, User, Snapshot, and Correlation. You can only delete a dataset with dependencies by setting force to true.

Note: The System dataset and other protected datasets cannot be deleted.

• Requests time out after three minutes.

Required license: Cortex Cloud Runtime Security or Cortex Cloud Posture Management.

Header parameters

AuthorizationstringRequired

{api_key}

x-xdr-auth-idstringRequired

{api_key_id}

Body

Responses

200

OK

No content

post/public_api/v2/xql/delete_dataset

POST /public_api/v2/xql/delete_dataset HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 54

{
  "request_data": {
    "dataset_name": "users",
    "force": true
  }
}

200

OK

No content

Get all datasets

post

Retrieve a list of all the datasets and their properties.

Note: Requests time out after three minutes.

Required license: Cortex Cloud Runtime Security or Cortex Cloud Posture Management.

Header parameters

AuthorizationstringRequired

{api_key}

x-xdr-auth-idstringRequired

{api_key_id}

Body

request_dataobjectOptional

Responses

200

OK

application/json

post/public_api/v1/xql/get_datasets

POST /public_api/v1/xql/get_datasets HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 19

{
  "request_data": {}
}

200

OK

{
  "reply": [
    {
      "Dataset Name": "xdr_data",
      "Type": "SYSTEM",
      "Log Update Type": "LOGS",
      "Last Updated": null,
      "Total Days Stored": null,
      "Hot Range": {
        "from": 1715299200000,
        "to": 1716595200000
      },
      "Cold Range": {},
      "Total Size Stored": null,
      "Average Daily Size": null,
      "Total Events": null,
      "Average Event Size": null,
      "TTL": null,
      "Default Query Target": "FALSE"
    },
    {
      "Dataset Name": "host_inventory",
      "Type": "SYSTEM",
      "Log Update Type": "LOGS",
      "Last Updated": null,
      "Total Days Stored": null,
      "Hot Range": {},
      "Cold Range": {},
      "Total Size Stored": null,
      "Average Daily Size": null,
      "Total Events": null,
      "Average Event Size": null,
      "TTL": null,
      "Default Query Target": "FALSE"
    },
    {
      "Dataset Name": "host_users_to_groups",
      "Type": "SYSTEM",
      "Log Update Type": "LOGS",
      "Last Updated": null,
      "Total Days Stored": null,
      "Hot Range": {},
      "Cold Range": {},
      "Total Size Stored": null,
      "Average Daily Size": null,
      "Total Events": null,
      "Average Event Size": null,
      "TTL": null,
      "Default Query Target": "FALSE"
    }
  ]
}