xql_start_xql_query
Initiate an XQL query to run security data searches and investigations. Specify query string, tenants, and timeframe to retrieve results.
Instructions
Start an XQL query
Execute an XQL query.
For more information on how to run XQL queries, see Running XQL query APIs.
Note
To ensure you don't surpass your quota, Cortex XSIAM allows you to run up to four API queries in parallel.
Required license: Cortex XSIAM Premium or Cortex XSIAM Enterprise or Cortex XSIAM Enterprise Plus
[POST /public_api/v1/xql/start_xql_query] · XQL query
Example request body:
{
"request_data": {
"query": "dataset=xdr_data | fields event_id, event_type, event_sub_type | limit 3",
"tenants": [],
"timeframe": {
"from": 1598907600000,
"to": 1599080399000
}
}
}Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| request_data | Yes |