Skip to main content
Glama
CoveoSec
by CoveoSec

xql_lookups_add_data

Add or update entries in a lookup dataset using key fields to identify existing records, creating new rows when no match is found. Maintain reference data for security investigations.

Instructions

Add or update data in a lookup dataset

Add or update data in a lookup dataset.

When updating data, any field not specified in the data field, but specified on at least one of the rows, will be set to None.

The /public_api/xql/lookups/add_data/ endpoint does not support concurrent edits. Sending concurrent calls to this endpoint can cause data to be unintentionally overwritten or deleted. To allow sufficient time for each API call to complete its operation before initiating another one, assume that 1000 entries can be added per API every 10 seconds.

**Note: **

  • The maximum size of a lookup dataset is 50 MB. Attemping to exceed this limit will fail.

  • Requests time out after three minutes.

Required license: Cortex XSIAM Premium or Cortex XSIAM Enterprise or Cortex XSIAM Enterprise Plus

[POST /public_api/v1/xql/lookups/add_data] · Lookup Datasets

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
request_dataNo
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It discloses concurrency limitations (no concurrent edits, data may be overwritten/deleted), a rate assumption (1000 entries per 10 seconds), a 50 MB size limit, a three-minute timeout, and the behavior of unspecified fields being set to None. This goes far beyond a basic add/update statement.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with the purpose and structured with paragraphs and bullet points, making it readable. It repeats the first line, and the length is notable but each additional detail (concurrency, rate, size limit, timeout, license) is essential. The minor redundancy prevents a perfect score.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the absence of annotations and output schema, the description covers critical operational constraints: size limit, timeout, concurrency, rate, and license. It does not describe the request payload structure or response, but the schema provides the structure, and the description focuses on behavioral context that is otherwise missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The description elaborates on the `data` field and `key_fields` behavior (e.g., unspecified fields set to None, key_fields trigger updates vs inserts), which adds meaning beyond the schema. However, it does not mention the `dataset_name` parameter or the top-level `request_data` wrapper, leaving gaps for a complete understanding of the request structure.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb and resource: 'Add or update data in a lookup dataset', clearly distinguishing it from sibling tools like xql_lookups_remove_data and xql_lookups_get_data. The action is unambiguous and the scope is defined.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear context on how to use the tool, explaining the behavior of key_fields for updates vs inserts and noting the license requirements. It does not explicitly mention alternative tools, but the guidance on when data is updated vs appended is actionable and context-rich.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Install Server

Other Tools

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/CoveoSec/xsiam-mcp'

If you have feedback or need assistance with the MCP directory API, please join our Discord server