Scheduled Queries
APIs for managing scheduled queries
Return a list of scheduled queries. You can return all scheduled queries or filter results. You can also return extended results with all details included.
You must have Instance Administrator permissions to run this endpoint.
{api_key}
{api_key_id}
OK
Bad Request. Got an invalid JSON.
Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.
Unauthorized access. User does not have the required license type to run this API.
Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.
Internal server error. A unified status for API communication type errors.
POST /public_api/v1/scheduled_queries/list HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 41
{
"request_data": {
"extended_view": "True"
}
}{
"reply": {
"data": [
{
"query_def_id": "text",
"query_definition_name": "text",
"xql": "text",
"timeframe": {
"relativeTime": "text"
},
"schedule": {
"run_date": 1,
"trigger_type": "text"
},
"tenants": {},
"enable": true
}
],
"filter_count": 1,
"total_count": 1
}
}Insert new scheduled queries or update existing scheduled queries.
You must have Instance Administrator permissions to run this endpoint.
{api_key}
{api_key_id}
OK
Bad Request. Got an invalid JSON.
Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.
Unauthorized access. User does not have the required license type to run this API.
Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.
Internal server error. A unified status for API communication type errors.
POST /public_api/v1/scheduled_queries/insert HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 197
{
"request_data": [
{
"query_definition_name": "debug_john_api",
"xql": "dataset = xdr_data | limit 10",
"timeframe": {
"relativeTime": 46400000
},
"schedule": {
"trigger_type": "date",
"run_date": 4677621540000
}
}
]
}{
"reply": {
"qc_0123456789_01": {
"query_definition_name": "test_1",
"xql": "dataset = xdr_data | limit 1",
"timeframe": {
"relativeTime": 86400000
},
"schedule": {
"trigger_type": "date",
"run_date": 1824072062000
}
},
"qc_0123456789_02": {
"query_definition_name": "test_2",
"xql": "dataset = xdr_data | limit 1",
"timeframe": {
"relativeTime": 86400000
},
"schedule": {
"trigger_type": "date",
"run_date": 1824072062000
}
}
}
}Delete scheduled queries.
You must have Instance Administrator permissions to run this endpoint.
{api_key}
{api_key_id}
OK
Bad Request. Got an invalid JSON.
Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.
Unauthorized access. User does not have the required license type to run this API.
Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.
Internal server error. A unified status for API communication type errors.
POST /public_api/v1/scheduled_queries/delete HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 69
{
"request_data": [
"qc_1683461522_18780",
"qc_1677754986_6539",
"avram"
]
}{
"reply": [
{
"scheduled_query_id": "text"
}
]
}Last updated
Was this helpful?