xql_lookups_remove_data
Remove data from a lookup dataset by specifying filter blocks with AND logic. Deletion occurs only when all filter sets are found; otherwise no data is deleted.
Instructions
Remove data from a lookup dataset
Remove data from a dataset based on the specified parameters. If any one of the filter sets are not found, the API does not delete any data.
The /public_api/xql/lookups/remove_data/ endpoint does not support concurrent edits. Sending concurrent calls to this endpoint can cause data to be unintentionally overwritten or deleted. To allow sufficient time for each API call to complete its operation before initiating another one, assume that 1000 entries can be added per API every 10 seconds.
Note:
All lookup entries matching any of the filter blocks are deleted. To match a filter block, a lookup entry must match all the specified fields as if there were an
ANDoperator between them.Requests time out after three minutes.
Required license: Cortex XSIAM Premium or Cortex XSIAM Enterprise or Cortex XSIAM Enterprise Plus
[POST /public_api/v1/xql/lookups/remove_data] · Lookup Datasets
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| request_data | No |