xql_library_insert
Insert or update XQL queries in XSIAM's query library. Provide query content, unique names, optional tags, and override flag to replace existing queries.
Instructions
Insert or update XQL queries
Insert new XQL queries or update existing XQL queries.
Note: You should use unique xql_query_name for each XQL query on a given tenant.
You must have Instance Administrator permissions to run this endpoint.
[POST /public_api/xql_library/insert] · Query Library
Example request body:
{
"request_data": {
"xql_queries_override": true,
"xql_queries": [
{
"xql_query": "dataset = xdr_data |limit 1",
"xql_query_name": "test_ql1"
},
{
"xql_query": "dataset = xdr_data |limit 2",
"xql_query_name": "test_ql11"
},
{
"xql_query": "dataset = xdr_data |limit 2",
"xql_query_name": "test_ql11"
}
],
"xql_query_tags": [
"tag1",
"tag101"
]
}
}Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| request_data | Yes |