xdr_search
Read-only
Search XDR sections for events and objects using field:value queries, with filtering, sorting, and pagination. Empty queries return the entire section.
Instructions
Search for events/objects in an XDR section. Returns matching records; an empty query returns the section unfiltered. Use xdr_get_mapping first to discover available fields.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| query | Yes | Search query string using field:value syntax, e.g. 'resolved : "false" AND severity : "critical"'. Pass an empty string to list the whole section unfiltered — deliberately, since that can be a very large number of records. Fields can be combined with AND, OR, AND NOT, OR NOT and grouped with parentheses. Call xdr_get_mapping for the fields a section accepts, and xdr_get_filters for the values an enumerated field takes — a value outside that set returns zero results rather than an error. Time filtering uses the timestamp field, relative (timestamp >= now-1d, now-6h) or absolute (timestamp >= "2024-01-01T00:00:00.000+03:00"). The calendar-rounding forms now/d, now/w and now/M return nothing, so use now-1d and the like. Note that timestamp is a search field: the ordering parameter takes an entirely different set of names. For the "applications" section, filter by asset, e.g. (asset: "<machine_id>"). A query the API cannot parse is not rejected — it is treated as free text, so verify that the results match what you asked for. | |
| offset | No | Number of results to skip. For the "modules" section the API pages in fixed steps, so offset must be a multiple of page_size there. | |
| section | Yes | Section name, one of: alerts, incidents, emails, files, events, connections, assets, modules, audit, applications | |
| ordering | No | Sort field with optional - prefix for descending, e.g. -created_at (newest first). An unknown field is silently ignored: the API reports no error and the results come back in some other order, so use only the fields listed here. Per section — alerts: created_at, last_event, last_updated, severity; incidents: created_at, updated_at; emails: ts_created, delay; files: ts_created, delay; events: Header.Timestamp; connections: ts_parsed, ts_last_usage_parsed, service_count, duration; assets: last_activity, first_activity; modules: ts_created, name; audit: timestamp; applications: name, ts_created, ts_updated. | |
| page_size | No | Number of results per page (1-200, default 10) |