Update a scheduled search by name: Request

To update a specific scheduled search, send the following request:

PUT https://<IA_IP_address>:<port_number>/scheduledsearch/v1/watch/<user_name>/<scheduled_search_name>

Required header:

Cookie: px=<token>

Request body (must be in JSON):

{
  "name": <scheduled_search_name>,
  "state": <scheduled_seach_state>,
  "trigger": 
  {
    ["interval": <trigger_interval>|"schedule": <trigger_schedule>]
  }
  "input": {
    "search": {
      "request": {
        "body": {
          "query": <query_string_or_saved_query
        },
        "lookback_period": {
          "type": <lookback_period_type>
        }
      }
    }
  },
  "condition": {
    "hitCount": <hit_count>,
    "operator": <operator>
  }
}

Options

IA_IP_address—The IP address of the NDR appliance running the NDR API.
port_number—The port number of the NDR appliance running the NDR API.
user_name—The name of the user. The user_name must be for a user who is logged in.
scheduled_search_name—The name of the scheduled search. It must be already created.
token—This token authenticates the session. By default, the session times out after 24 hours.
scheduled_search_state—The state of the scheduled search. The state can be ACTIVE if the query runs at scheduled intervals or INACTIVE if no queries are run.

Important
Use trigger_interval or trigger_schedule but not both. If you use more than one kind of trigger, the result is unpredictable.

trigger_interval—The interval between scheduled searches. Valid values are 1m–59m or 1h–23h. For example, a value of 5h means to run the query every 5 hours from now, and a value of 20m means to run the query every 20 minutes from now.
trigger_schedule—When the query will run. Valid values are hourly, daily, or weekly:
- hourly—Valid values are 1–59; for example, 10 means to run the query every 10th minute of every hour.
- daily—The valid value is the time of day in hour:minute format. For example, 13:40 means to run the query every 14th hour at 40 minutes, and 01:01 means to run the query every second hours at 1 second.
- weekly—Valid values are MONDAY, TUESDAY, WEDNESDAY, THURSDAY, FRIDAY, SATURDAY, and SUNDAY and the time of day in hour:minute format; for example, "items": {"MONDAY","WEDNESDAY","FRIDAY"} "at": 01:01.
query_string_or_saved_query—The Elasticsearch query to run or the name of a saved query to run.
lookback_period_type—The start time of the period examined by the query. The start time is AUTO if the start time is the last invocation of the query or CUSTOM if the start time is provided with the period field. Valid values for the period field are 1h–23h or 1d–31d, indicating the number of hours or days before now to start searching. For example, {"type": "CUSTOM", "period": "4h"} indicates that the query examines the four hours before now.
hit_count—The number of search results returned before the query results are saved.
operator—The operator to be evaluated with hit_count value. Valid vales are EQUAL, NOTEQUAL, LESSTHAN, LESSTHANOREQUAL, and GREATERTHANOREQUAL.

Example

PUT https://xxx.xxx.xxx.xxx:443/scheduledsearch/v1/watch/npadmin/test

Required header:

Cookie: px=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Request body:

{
  "name": "SavedQueryExample",
  "state": "INACTIVE",
  "trigger": {
    "schedule": {
      "weekly": {
        "at": "14:10",
        "daysOfWeek": [
          "MONDAY",
          "TUESDAY"
        ]
      }
    }
  },
  "input": {
    "search": {
      "request": {
        "body": {
          "query": {
            "ef_saved_query_id": "querybody::npadmin::test"
          }
        },
        "lookback_period": {
          "type": "AUTO"
        }
      }
    }
  },
  "condition": {
    "hitCount": 100,
    "operator": "GREATERTHAN"
  }
}

Update a scheduled search by name: Response

HTTP/1.1 [Response Code] [Response Message]				
Server: [Server]
Date: [Date]				
Content-Type: [Content Type]

Response fields

Response Code—A standard HTTP response code.
- 204—Request successful; the scheduled search was updated.
- 4xx—Request unsuccessful.
Response Message—A standard HTTP response message.
- No Content—Request successful; the scheduled search was updated.
- Error message—Request unsuccessful.
Server—The server being used.
Date—Standard HTML date format.
Content Type—The response format.

Example

HTTP/1.1 204 No Content
Server: nginx
Date: Thu, 28 Apr 2016 17:30:04 GMT
Content-Type: application/json; charset=utf-8

cURL code sample: Update a scheduled search by name

curl -k -X PUT -H "Content-Type: application/json" --cookie "px=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" https://xxx.xxx.xxx.xxx:443/scheduledsearch/v1/watch/npadmin/test -d '{"name":"test","state":"INACTIVE","trigger":{"schedule":{"daily":{"at":"10:00"}}},"input":{"search":{"request":{"body":{"query":{"query_string":{"analyze_wildcard":true,"lowercase_expanded_terms":false,"query":"doc_values_type:fileinfo"}}},"lookback_period": {"type":"CUSTOM","period":"5h"}}}},"condition":{"hitCount":10,"operator":"GREATERTHAN"}}'

This cURL sample includes the following options:

-k—This option explicitly allows cURL to perform insecure SSL connections and transfers, which allows you to test your SSL connection without installing a CA certificate.
-X PUT—This option specifies using the PUT method.
-H "Content-Type: application/json"—This header specifies that the request body is in JSON format.
--cookie "px=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"—This option specifies the authentication token for this session.
https://xxx.xxx.xxx.xxx:443/scheduledsearch/v1/watch/npadmin/test—The saved query request URL. Replace xxx.xxx.xxx.xxx with the IP address of your NDR appliance. Replace npadmin with the name of the user who created the scheduled search. Replace test with the scheduled search of interest.
-d '{"name":"test","state":"INACTIVE","trigger":{"schedule":{"daily":{"at":"10:00"}}},"input":{"search":{"request":{"body":{"query":{"query_string":{"analyze_wildcard":true,"lowercase_expanded_terms":false,"query":"doc_values_type:fileinfo"}}},"lookback_period": {"type":"CUSTOM","period":"5h"}}}},"condition":{"hitCount":10,"operator":"GREATERTHAN"}}'—This option specifies what will be searched for and when the search will be run.

Results

This example updates the specified scheduled search.