Get Query Run Results
POST {{cb_url}}/livequery/v1/orgs/{{cb_org_key}}/runs/{{cb_query_id}}/results/_search?format=csv&download=true
Gets results from a Live Query run. The Live Query results can also be exported as a CSV compressed in a ZIP, or exported asynchronously (see below for details).
RBAC Permissions Required
| Permission (.notation name) | Operation(s) |
|---|---|
| livequery.manage | READ |
Request
POST <psc-hostname>/livequery/v1/orgs/{org_key}/runs/{id}/results/_search
POST <psc-hostname>/livequery/v1/orgs/{org_key}/runs/{id}/results/_search?format=csv
POST <psc-hostname>/livequery/v1/orgs/{org_key}/runs/{id}/results/_search?format=csv&download=true
Note: The last two routes will stream or download results to a CSV. See Additional Query Parameter Values below for additional information about using the stream or download CSV functionality.
Export Large Jobs Asynchronously
(See Examples in the upper right of Qodex)
You can use the Job Service API (Platform APIs) to download large sets of query results without experiencing timeout errors or receiving corrupt files.
This route can take an optional URL query parameter that tells the server to process the request asynchronously.
When downloading very large sets of query results as CSV, make sure you pass “?format=csv&async=true” as a query parameter to the existing /results/_search route or you may receive errors and corrupt files.
You can only request format=csv when using async=true. - ?format=zip&async=true is not supported
Request Params
| Key | Datatype | Required | Description |
|---|---|---|---|
format | string | CSV or ZIP | |
download | boolean | Cannot pass async AND download | |
async | boolean | Cannot pass download AND async |
HEADERS
| Key | Datatype | Required | Description |
|---|---|---|---|
Content-Type | string |
RESPONSES
status: OK
{"org_key":"ABCD1234","num_found":45,"results":[{"id":"bxnrsex8dkzq7fw28rmdzhng6mzhczei","device":{"id":11412673,"name":"test-machine","policy_id":7113786,"policy_name":"Standard","os":"WINDOWS"},"status":"matched","time_received":"2022-11-28T13:45:51.379Z","device_message":"","fields":{"name":"Privacy Badger","path":"C:\\Users\\Administrator\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\6jmaljui.default-release\\extensions\\jid1-MnnxcxisBPnSXQ@jetpack.xpi","version":"2021.11.23.1"}}]}