run_sql
Execute SQL queries on log and alert data to analyze and retrieve security events. Target specific server indices for flexible data exploration.
Instructions
Run a SQL query against the log/alert data (UTMStack SQL editor). Index names are used UNQUOTED as table names. Example: SELECT dataType, COUNT() FROM v11-log- WHERE @timestamp BETWEEN DATE_SUB(NOW(), INTERVAL 1 DAY) AND NOW() GROUP BY dataType; server: which configured server to target (default active/default).
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| page | No | ||
| size | No | ||
| query | Yes | ||
| server | No |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |