Get XQL Query Results Stream

post /public_api/v1/xql/get_query_results_stream

Retrieve XQL query results with more than 1000 results.

Note: This endpoint only works on XQL queries initiated by /public_api/v1/xql/start_xql_query/.

Response is returned as chunked (Transfer-Encoding: chunked). To retrieve a compressed gzipped response (Content-Encoding: gzip), in your header add Accept-Encoding: gzip.

For more information on how to run XQL queries, see Running XQL Query APIs.

Required license: Cortex XDR Pro per Endpoint or Cortex XDR Pro per GB

CURL

  curl -X POST \

-H "Accept: application/json" \
 -H "Content-Type: application/json" -H "'Accept-Encoding: gzip' : " ": QuoteAcceptEncoding gzipQuote  Double_Quote Double_Quote_example" \
"https://api-yourfqdn/public_api/v1/xql/get_query_results_stream" \
 -d '{
  "request_data" : {
    "stream_id" : "563c5e24-===-9a1f8139d3c5",
    "is_gzip_compressed" : true
  }
}'
  

Request headers

'Accept-Encoding: gzip' : " "

optional

String

For retrieving a compressed gzipped response

Example: QuoteAcceptEncoding gzipQuote Double_Quote Double_Quote_example

Request

Body

optional

request_data

required

stream_id

required

String

String representing the unique ID generate by the response to Get XQL Query Results API.

is_gzip_compressed

optional

Boolean

A boolean flag indicating whether the response should be compressed and gzipped.

Responses

Successful response

Bad Request. Got an invalid JSON.

Body

The query result upon error.

err_code

optional

String

HTTP response code.

err_msg

optional

String

Error message.

Example: {"line": 1, "column": 19, "message": "no viable alternative at input '|alter2'"}

err_extra

optional

String

Additional information describing the error.

Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.

Body

The query result upon error.

err_code

optional

String

HTTP response code.

err_msg

optional

String

Error message.

Example: {"line": 1, "column": 19, "message": "no viable alternative at input '|alter2'"}

err_extra

optional

String

Additional information describing the error.

Unauthorized access. User does not have the required license type to run this API.

Body

The query result upon error.

err_code

optional

String

HTTP response code.

err_msg

optional

String

Error message.

Example: {"line": 1, "column": 19, "message": "no viable alternative at input '|alter2'"}

err_extra

optional

String

Additional information describing the error.

Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.

Body

The query result upon error.

err_code

optional

String

HTTP response code.

err_msg

optional

String

Error message.

Example: {"line": 1, "column": 19, "message": "no viable alternative at input '|alter2'"}

err_extra

optional

String

Additional information describing the error.

Internal server error. A unified status for API communication type errors.

Body

The query result upon error.

err_code

optional

String

HTTP response code.

err_msg

optional

String

Error message.

Example: {"line": 1, "column": 19, "message": "no viable alternative at input '|alter2'"}

err_extra

optional

String

Additional information describing the error.