XQL Query
Run XQL queries on your data sources using a series of APIs.
Execute an XQL query.
For more information on how to run XQL queries, see Run XQL Query APIs.
Note
To ensure you don't surpass your quota, Cortex allows you to run up to four API queries in parallel.
Required license: Cortex Cloud Runtime Security or Cortex Cloud Posture Management.
{api_key}
{api_key_id}
Successful response
Bad Request. Invalid JSON.
Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.
Unauthorized access. User does not have the required license type to run this API.
Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.
Internal server error. A unified status for API communication type errors.
POST /public_api/v1/xql/start_xql_query HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 168
{
"request_data": {
"query": "dataset=xdr_data | fields event_id, event_type, event_sub_type | limit 3",
"tenants": [],
"timeframe": {
"from": 1598907600000,
"to": 1599080399000
}
}
}{
"reply": "ad21c1e1492d4c_667_inv"
}Retrieve results of an executed XQL query API.
Note: This endpoint only works on XQL queries initiated by /public_api/v1/xql/start_xql_query/.
Maximum result set size is 1000. The API does not support pagination, therefore, you can set values to determine the result size limitation and how to wait for the results. To view response with greater than 1000 results you must call Get XQL query results Stream.
For more information on how to run XQL queries, see Run XQL Query APIs.
Note
To ensure you don't surpass your quota, Cortex allows you to run up to four API queries in parallel.
Required license: Cortex Cloud Runtime Security or Cortex Cloud Posture Management.
{api_key}
{api_key_id}
Successful response
Bad Request. Got an invalid JSON.
Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.
Unauthorized access. User does not have the required license type to run this API.
Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.
Internal server error. A unified status for API communication type errors.
POST /public_api/v1/xql/get_query_results HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 103
{
"request_data": {
"query_id": "061880b4867446_4356_inv",
"pending_flag": true,
"limit": 100,
"format": "json"
}
}{
"reply": {
"status": "PENDING"
}
}Retrieve the amount of query quota available and used.
Note: This endpoint only works on XQL queries initiated by /public_api/v1/xql/start_xql_query/.
For more information on how to run XQL queries, see Run XQL Query APIs.
Note
To ensure you don't surpass your quota, Cortex allows you to run up to four API queries in parallel.
Required license: Cortex Cloud Runtime Security or Cortex Cloud Posture Management.
{api_key}
{api_key_id}
{"request_data":{}}Successful response
Bad Request. Got an invalid JSON.
Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.
Unauthorized access. User does not have the required license type to run this API.
Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.
Internal server error. A unified status for API communication type errors.
POST /public_api/v1/xql/get_quota HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 19
{
"request_data": {}
}{
"reply": {
"license_quota": 5,
"additional_purchased_quota": 0,
"used_quota": 0,
"eval_quota": 0,
"total_daily_running_queries": 4,
"total_daily_concurrent_rejected_queries": 8,
"current_concurrent_active_queries": {
"debee6b0c41f47_911_inv": {
"xql": "config timeframe = 1mo | dataset=xdr_data | limit 1000000",
"duration": 61
}
},
"current_concurrent_active_queries_count": 1,
"max_daily_concurrent_active_query_count": 4
}
}Retrieve XQL query results with more than 1000 results.
Note: This endpoint only works on XQL queries initiated by /public_api/v1/xql/start_xql_query/.
Response is returned as chunked (Transfer-Encoding: chunked). To retrieve a compressed gzipped response (Content-Encoding: gzip), in your header add Accept-Encoding: gzip.
For more information on how to run XQL queries, see Run XQL Query APIs.
Note
To ensure you don't surpass your quota, Cortex allows you to run up to four API queries in parallel.
Required license: Cortex Cloud Runtime Security or Cortex Cloud Posture Management.
{api_key}
{api_key_id}
For retrieving a compressed gzipped response
gzipSuccessful response
Bad Request. Got an invalid JSON.
Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.
Unauthorized access. User does not have the required license type to run this API.
Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.
Internal server error. A unified status for API communication type errors.
POST /public_api/v1/xql/get_query_results_stream HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 84
{
"request_data": {
"stream_id": "563c5e24-===-9a1f8139d3c5",
"is_gzip_compressed": true
}
}Last updated
Was this helpful?