xql_lookups_add_data
Add or update entries in a lookup dataset using key fields to identify existing records, creating new rows when no match is found. Maintain reference data for security investigations.
Instructions
Add or update data in a lookup dataset
Add or update data in a lookup dataset.
When updating data, any field not specified in the data field, but specified on at least one of the rows, will be set to None.
The /public_api/xql/lookups/add_data/ endpoint does not support concurrent edits. Sending concurrent calls to this endpoint can cause data to be unintentionally overwritten or deleted. To allow sufficient time for each API call to complete its operation before initiating another one, assume that 1000 entries can be added per API every 10 seconds.
**Note: **
The maximum size of a lookup dataset is 50 MB. Attemping to exceed this limit will fail.
Requests time out after three minutes.
Required license: Cortex XSIAM Premium or Cortex XSIAM Enterprise or Cortex XSIAM Enterprise Plus
[POST /public_api/v1/xql/lookups/add_data] · Lookup Datasets
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| request_data | No |