Dataset Management

APIs for managing datasets

Add Dataset

post

Add a dataset of type lookup with the specified name and schema.

Required license: Cortex XDR Pro per Endpoint or Cortex XDR Pro per GB

Header parameters

AuthorizationstringRequired

{api_key}

x-xdr-auth-idstringRequired

{api_key_id}

Accept-EncodingstringOptional

For retrieving a compressed gzipped response

Default: gzip

Body

Responses

200

OK

application/json

dataset_namestringOptional

Name of the dataset added.

400

Bad Request. Got an invalid JSON.

application/json

401

Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, ID, or other invalid authentication parameters.

application/json

402

Unauthorized access. User does not have the required license type to run this API.

application/json

403

Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.

application/json

500

Internal server error. A unified status for API communication type errors.

application/json

post/public_api/v1/xql/add_dataset

POST /public_api/v1/xql/add_dataset HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 187

{
  "request": {
    "dataset_name": "users",
    "dataset_schema": {
      "uid": "text",
      "username": "text",
      "zipcode": "number",
      "salary": "number",
      "is_admin": "bool",
      "birthday": "datetime"
    },
    "dataset_type": "lookup"
  }
}

{
  "dataset_name": "text"
}

Delete a dataset

post

Delete a dataset with the specified name. The following dataset types can be deleted: Lookup, Raw, User, Snapshot, and Correlation. You can only delete a dataset with dependencies by setting force to true.

Note: The System dataset and other protected datasets cannot be deleted.

Required license: Cortex XDR Pro per Endpoint or Cortex XDR Pro per GB

Header parameters

AuthorizationstringRequired

{api_key}

x-xdr-auth-idstringRequired

{api_key_id}

Accept-EncodingstringOptional

For retrieving a compressed gzipped response

Default: gzip

Body

Responses

200

OK

No content

400

ad Request. Got an invalid JSON.

application/json

401

Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, ID, or other invalid authentication parameters.

application/json

402

Unauthorized access. User does not have the required license type to run this API.

application/json

403

Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.

application/json

500

Internal server error. A unified status for API communication type errors.

application/json

post/public_api/v2/xql/delete_dataset

POST /public_api/v2/xql/delete_dataset HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 49

{
  "request": {
    "dataset_name": "users",
    "force": true
  }
}

No content

Get all datasets

post

Retrieve a list of all the datasets and their properties.

Required license: Cortex XDR Pro per Endpoint or Cortex XDR Pro per GB

Header parameters

AuthorizationstringRequired

{api_key}

x-xdr-auth-idstringRequired

{api_key_id}

Accept-EncodingstringOptional

For retrieving a compressed gzipped response

Default: gzip

Body

requestobjectOptional

Responses

200

OK

application/json

400

ad Request. Got an invalid JSON.

application/json

401

Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, ID, or other invalid authentication parameters.

application/json

402

Unauthorized access. User does not have the required license type to run this API.

application/json

403

Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.

application/json

500

Internal server error. A unified status for API communication type errors.

application/json

post/public_api/v1/xql/get_datasets

POST /public_api/v1/xql/get_datasets HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 14

{
  "request": {}
}

{
  "reply": [
    {
      "Dataset Name": "xdr_data",
      "Type": "SYSTEM",
      "Log Update Type": "LOGS",
      "Last Updated": null,
      "Total Days Stored": null,
      "Hot Range": {
        "from": 1715299200000,
        "to": 1716595200000
      },
      "Cold Range": {},
      "Total Size Stored": null,
      "Average Daily Size": null,
      "Total Events": null,
      "Average Event Size": null,
      "TTL": null,
      "Default Query Target": "FALSE"
    },
    {
      "Dataset Name": "host_inventory",
      "Type": "SYSTEM",
      "Log Update Type": "LOGS",
      "Last Updated": null,
      "Total Days Stored": null,
      "Hot Range": {},
      "Cold Range": {},
      "Total Size Stored": null,
      "Average Daily Size": null,
      "Total Events": null,
      "Average Event Size": null,
      "TTL": null,
      "Default Query Target": "FALSE"
    },
    {
      "Dataset Name": "host_users_to_groups",
      "Type": "SYSTEM",
      "Log Update Type": "LOGS",
      "Last Updated": null,
      "Total Days Stored": null,
      "Hot Range": {},
      "Cold Range": {},
      "Total Size Stored": null,
      "Average Daily Size": null,
      "Total Events": null,
      "Average Event Size": null,
      "TTL": null,
      "Default Query Target": "FALSE"
    }
  ]
}