xdr_count
Read-only
Count records in an XDR section, with an optional query filter to tally only matching entries. Use it to gauge dataset size or scope a search.
Instructions
Get the total count of records in an XDR section. Optionally filter by query to count matching records only.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| query | No | Search query string using field:value syntax, e.g. 'resolved : "false" AND severity : "critical"'. Pass an empty string to list the whole section unfiltered — deliberately, since that can be a very large number of records. Fields can be combined with AND, OR, AND NOT, OR NOT and grouped with parentheses. Call xdr_get_mapping for the fields a section accepts, and xdr_get_filters for the values an enumerated field takes — a value outside that set returns zero results rather than an error. Time filtering uses the timestamp field, relative (timestamp >= now-1d, now-6h) or absolute (timestamp >= "2024-01-01T00:00:00.000+03:00"). The calendar-rounding forms now/d, now/w and now/M return nothing, so use now-1d and the like. Note that timestamp is a search field: the ordering parameter takes an entirely different set of names. For the "applications" section, filter by asset, e.g. (asset: "<machine_id>"). A query the API cannot parse is not rejected — it is treated as free text, so verify that the results match what you asked for. (optional) | |
| section | Yes | Section name, one of: alerts, incidents, emails, files, events, connections, assets, modules, audit, applications |