Initializes a search for events matching the search query across agents.

Use the “queryId” field in the response to fetch matched events.

​
Parameters

ParameterDescription
From DateFilter results after the given date.
QueryThe query to be created. Should be formatted in SentinelOne Query Language (S1QL). For more information, see S1QL Cheatsheet.
To DateFilter results before the given date.

​
Example Output

{
	"data": {
		"queryId": "q4015ce6017fb176bc5b215dade314778",
		"queryModeInfo": {
			"lastActivatedAt": "2022-07-22T19:53:09+00:00",
			"mode": "scalyr"
		}
	}
}

​
Workflow Library Example

Create Deep Visibility Query with Sentinelone and Send Results Via Email

Preview this Workflow on desktop