Skip to main content
POST
/
v1
/
ocsf
/
advanced
Search OCSF events
curl --request POST \
  --url https://api.wirespeed.co/v1/ocsf/advanced \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "query": "<string>",
  "queryId": "<string>",
  "startTime": "<string>",
  "endTime": "<string>"
}
'
{
  "data": [
    {}
  ],
  "totalCount": 123,
  "queryId": "<string>",
  "rowsRead": 123,
  "bytesRead": 123
}

Authorizations

​
Authorization
string
header
required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Body

application/json
​
query
string

Query to search

​
queryId
string

ID of an existing query to reuse

​
startTime
string

Start time of the query

​
endTime
string

End time of the query

Response

​
data
object[]
required

Array of OCSF search result objects

​
totalCount
number | null
required

Total number of results matching the search query, or null if the count query timed out

​
queryId
string
required

Unique identifier for this query execution

​
rowsRead
number
required

Number of rows read during query execution

​
bytesRead
number
required

Number of bytes read during query execution