Query Library
APIs for managing XQL query libraries
Retrieve a detailed list of XQL query libraries. You can filter by list of query names or by list of query tags.
Requires the granular RBAC permission for this feature.
{api_key}
{api_key_id}
OK
Bad Request. Got an invalid JSON.
Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.
Unauthorized access. User does not have the required license type to run this API.
Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.
Internal server error. A unified status for API communication type errors.
POST /public_api/xql_library/get HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 41
{
"request_data": {
"extended_view": "True"
}
}{
"reply": {
"queries_count": 1,
"xql_queries": [
{
"id": 1,
"name": "text",
"description": "text",
"query_text": "text",
"created_at": 1,
"created_by": "text",
"created_by_pretty": "text",
"query_metadata": {
"is_valid": true,
"query_calls": [
{}
],
"is_datamodel": true,
"query_tables": [
"text"
],
"query_presets": [
{}
]
},
"is_private": true,
"labels": [
"text"
]
}
]
}
}Insert new XQL queries or update existing XQL queries.
Note: You should use unique xql_query_name for each XQL query on a given tenant.
Requires the granular RBAC permission for this feature.
{api_key}
{api_key_id}
OK
Bad Request. Got an invalid JSON.
Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.
Unauthorized access. User does not have the required license type to run this API.
Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.
Internal server error. A unified status for API communication type errors.
POST /public_api/xql_library/insert HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 315
{
"request_data": {
"xql_queries_override": true,
"xql_queries": [
{
"xql_query": "dataset = xdr_data |limit 1",
"xql_query_name": "test_ql1"
},
{
"xql_query": "dataset = xdr_data |limit 2",
"xql_query_name": "test_ql11"
},
{
"xql_query": "dataset = xdr_data |limit 2",
"xql_query_name": "test_ql11"
}
],
"xql_query_tags": [
"tag2",
"tag202"
]
}
}{
"reply": {
"xql_queries_added": [
"text"
],
"xql_queries_updated": [
"text"
],
"errors": [
"text"
]
}
}Delete XQL queries. You can filter by list of query names or by list of query tags.
Requires the granular RBAC permission for this feature.
{api_key}
{api_key_id}
OK
Bad Request. Got an invalid JSON.
Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.
Unauthorized access. User does not have the required license type to run this API.
Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.
Internal server error. A unified status for API communication type errors.
POST /public_api/xql_library/delete HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 108
{
"request_data": {
"xql_query_names": [
"KILLER",
"Rare Executions of PSEXEC",
"Top 10 Users failing to log in"
]
}
}{
"reply": {
"queries_count": 1,
"xql_query_names": [
"text"
],
"errors": [
{}
]
}
}Last updated
Was this helpful?