Forum Discussion
Cortex XDR Query API into power BI
You can't call "Get XQL Query Results Stream API" directly.
Pay attention to this part of the document.
Run the following APIs to call an XQL query:
- Start an XQL Query—Run an XQL query. Response returns a unique execution ID used to retrieve the results by the Get XQL Query Results API.
- Get XQL Query Results—Retrieve XQL query results. API displays up to 1,000 results. If query generated more than 1,000 results, the response returns a unique stream ID used to retrieve additional results by the Get XQL Query Results Stream API.
- Get XQL Query Results Stream—Retrieve XQL query with more than 1,000 results.
Thank you for your help ZhangKun. Can I get some help from you as to how I go about this adjustment? not sure I understand how I can achieve this.
ZhangKunSuper User
Since I haven't used this product, I can only give you some hints from the content of the documentation:
Start an XQL query. There is nothing wrong with your code at this step.
Provide the query ID (query_id) obtained in the previous step to get_query_results. Pay attention to the parameter named pending_flag, because it determines whether to block (the server returns the result after successful execution. But if the blocking time is too long, the request will time out) or asynchronous (if this method is used, it is necessary to loop to determine whether the XQL query has been completed).
If the number of results is less than 1000, you don't need to do anything extra. But if it is more than 1000, you need to get the stream_id returned by get_query_results, and then you need to pass the stream_id to get_query_results_stream.
I don't see in the documentation how get_query_results returns the stream_id, you'll need to test this yourself.
Call get_query_results_stream normally and get the remaining results.