Create InstaQuery

Update

CylanceOPTICS

InstaQuery resources for a specific tenant.

Service endpoint	/instaqueries/v2
Optional query string parameters	—
Example	https://protectapi.cylance.com/instaqueries/v2
Method	HTTP/1.1 POST
Request headers	Accept: application/json Authorization: Bearer `JWT Token returned by Auth API` with the opticssurvey:create scope encoded

Request

{
    "name": "InstaQuery Name",
    "description": "Test InstaQuery",
    "artifact": "File",
    "match_value_type": "Path",
    "match_values": [
        "exe"
    ],
    "case_sensitive": true,
    "match_type": "Fuzzy",
    "zones": [
        "D27FF5C45C0D4F56A00DA1FB297E440F"
    ],
    "filters": [
        {
            "aspect": "OS",
            "value": "Windows"
        }
    ],
    "relations": [
        {
            "object": "/focus/focus_id",
            "relationship": "originated-from"
        }
    ]
}

Response

Please see the Response status codes for more information.

Request JSON schema

Field Name	Description
name	This is the name of the InstaQuery.
description	This is the description of the InstaQuery.
artifact	This is the type of artifact to search. Possible values are "File", "Process", "NetworkConnection", and "RegistryKey".
match_value_type	This is the type of value (also known as a facet) to search. Possible values are dependent on the selected artifact type. Valid selections for each are as follows: File Path Md5 Sha2 Owner CreationDateTime Process Name Commandline PrimaryImagePath PrimaryImageMd5 StartDateTime NetworkConnection DestAddr DestPort RegistryKey ProcessName ProcessPrimaryImagePath ValueName FilePath FileMd5 IsPersistencePoint
match_values	This is a list of strings to be matched against for the InstaQuery.
case_sensitive	This determines whether to consider case sensitivity when matching values.
match_type	This determines whether or not to use an exact or "fuzzy" match. The default behavior of InstaQuery is to use a "fuzzy" match. Possible values are: Fuzzy Exact
zones	This is a list of zone IDs to perform the InstaQuery against.
filters	This is a list of filters when performing the InstaQuery.
aspect	This is the aspect (or type) of filters (for example, "OS").
value	This is the value to filter for (for example,. "Windows").
relations	This is a list of objects (for example, Focus View URLs) that are related to the InstaQuery. This is similar to the "Pivot Query" functionality in the Console.
object	This is the URL of the focus view that the InstaQuery relates to.
relationship	This is how the InstaQuery relates to the URL. This should almost always be "originated-from".

Response JSON schema

Field Name	Description
name	This is the name of the InstaQuery.
description	This is the description of the InstaQuery.
artifact	This is the type of artifact to search. Possible values are "File", "Process", "NetworkConnection", and "RegistryKey".
match_value_type	This is the type of value (also known as a facet) to search. Possible values are dependent on the selected artifact type. Valid selections for each are as follows: File Path Md5 Sha2 Owner CreationDateTime Process Name Commandline PrimaryImagePath PrimaryImageMd5 StartDateTime NetworkConnection DestAddr DestPort RegistryKey ProcessName ProcessPrimaryImagePath ValueName FilePath FileMd5 IsPersistencePoint
match_values	This is a list of strings to be matched against for the InstaQuery.
case_sensitive	This determines whether to consider case sensitivity when matching values.
match_type	This determines whether or not to use an exact or "fuzzy" match. The default behavior of InstaQuery is to use a "fuzzy" match. Possible values are: Fuzzy Exact
zones	This is a list of zone IDs to perform the InstaQuery against.
filters	This is a list of filters when performing the InstaQuery.
aspect	This is the aspect (or type) of filters (for example, "OS").
value	This is the value to filter for (for example, "Windows").
relations	This is a list of objects (for example, Focus View URLs) that are related to the InstaQuery. This is similar to the "Pivot Query" functionality in the Console.
object	This is the URL of the focus view that the InstaQuery relates to.
relationship	This is how the InstaQuery relates to the URL. This should almost always be "originated-from".
id	This is the unique identifier of the created InstaQuery.
created_at	This is the date and time that the InstaQuery was created.
progress	This is the progress of the InstaQuery.

Section:

InstaQuery API