REST API - registerQuery

POST <baseurl>/audit/query/register/<tag>

• target= string (optional, default=AUDIT): For a list of the valid targets, including information about which Event Collector database tables each target value queries, see Using Attributes in Query Filters .
• requireallattributes=boolean (optional, default=false): Whether all attributes should be returned. Can be obtained from getAllAttributes or getAttributes
• requiredattribute=string (0-n, default=none): Specific attributes that should be returned for each event found by the query. Can be obtained from getAllAttributes or getAttributes
• sortorder=string (0-n, optional): What attribute or attributes the results should be sorted on, and in what direction the sort should run. Specify this in the following format:

  attribute 1:ASCENDING|DESCENDING;attribute 2:ASCENDING|DESCENDING; … attribute n:ASCENDING|DESCENDING

• correlate=boolean (optional, default=false): Whether the query should be correlated.

POST <baseurl>/audit/query/register/Q32

<Query>
  <filter>severity='AUDIT'</filter>
</Query>

{
  "xml-fragment": {
    "guid": "1",
    "tag": "Q32"
  }
}