scheduled_queries_insert
Insert or update scheduled queries in Cortex XSIAM to automate recurring XQL searches. Define query name, XQL, timeframe, and schedule for proactive security monitoring.
Instructions
Insert or update scheduled queries
Insert new scheduled queries or update existing scheduled queries.
You must have Instance Administrator permissions to run this endpoint.
[POST /public_api/v1/scheduled_queries/insert] · Scheduled Queries
Example request body:
{
"request_data": [
{
"query_definition_name": "test_debug_avram_api",
"xql": "dataset = xdr_data | limit 10",
"timeframe": {
"relativeTime": 46400000
},
"schedule": {
"trigger_type": "date",
"run_date": 4677621540000
}
}
]
}Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| request_data | Yes |