xql_query
Execute an XQL query and receive results automatically, eliminating manual polling. Use for ad-hoc security data investigation.
Instructions
Run an XQL query end-to-end in a single call: starts the query, polls until results are ready, and returns them. This wraps xql/start_xql_query + xql/get_query_results so you don't have to poll manually. Prefer this for ad-hoc data investigation.
Example: {"query": "dataset = xdr_data | fields event_id, event_type | limit 10", "time_frame": {"relativeTime": 86400000}}
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| query | Yes | The XQL query string to execute. | |
| tenant_ids | No | Optional list of tenant IDs (for multi-tenant / MSSP). Sent as the XSIAM 'tenants' field. | |
| time_frame | No | Optional time frame, e.g. {"relativeTime": 86400000} for the last 24h (ms), or {"from": <epoch_ms>, "to": <epoch_ms>}. | |
| max_wait_seconds | No | Max seconds to poll for results before returning the pending status (default 60). |