xql_lookups_get_data
Retrieve data from a Cortex XSIAM lookup dataset using optional field filters. Returns matching entries, or all entries when no filters are specified.
Instructions
Get data from a lookup dataset
Get data from a lookup dataset according to the specified filter fields. All lookup entries matching any of the filter blocks are returned. To match a filter block, a lookup entry must match all the specified fields as if there were an AND operator between them. If no filters are specified, return all lookup entries.
Note:
The maximum number of entries returned is 10,000.
Requests time out after three minutes.
Required license: Cortex XSIAM Premium or Cortex XSIAM Enterprise or Cortex XSIAM Enterprise Plus
[POST /public_api/v1/xql/lookups/get_data] · Lookup Datasets
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| request_data | No |