XQL User Datasets

APIs for managing XQL user datasets.

Define an XQL user dataset

post

Define an XQL user dataset based on an existing BigQuery table created by the user.

Note: BigQuery table must be an existing table under public_access_user.

Required license: Cortex Cloud Runtime Security or Cortex Cloud Posture Management.

These APIs are only applicable from within the XSIAM Notebook environment.

Header parameters

AuthorizationstringRequired

{api_key}

x-xdr-auth-idstringRequired

{api_key_id}

Body

Responses

200

OK

No content

post/public_api/v1/dataset/define_dataset

POST /public_api/v1/dataset/define_dataset HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 38

{
  "request_data": {
    "table_name": "text"
  }
}

200

OK

No content

Get created XQL user datasets

post

Retrieve a list of all XQL user datasets created using the Cortex SDK.

Required license: Cortex Cloud Runtime Security or Cortex Cloud Posture Management.

These APIs are only applicable from within the XSIAM Notebook environment.

Header parameters

AuthorizationstringRequired

{api_key}

x-xdr-auth-idstringRequired

{api_key_id}

Body

objectOptional

Responses

200

OK

application/json

datasetsstring[]Optional

A list of created datasets.

post/public_api/v1/dataset/get_created_datasets

POST /public_api/v1/dataset/get_created_datasets HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 2

{}

200

OK

{
  "datasets": [
    "text"
  ]
}

Delete an XQL user dataset

post

Delete an XQL user dataset that was created by the Cortex SDK.

Required license: Cortex Cloud Runtime Security or Cortex Cloud Posture Management.

These APIs are only applicable from within the XSIAM Notebook environment.

Header parameters

AuthorizationstringRequired

{api_key}

x-xdr-auth-idstringRequired

{api_key_id}

Body

Responses

200

OK

application/json

objectOptional

post/public_api/v1/dataset/delete_dataset

POST /public_api/v1/dataset/delete_dataset HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 75

{
  "request_data": {
    "dataset_name": "text",
    "delete_underlying_bq_table": false
  }
}

200

OK

{}