args:
- auto: PREDEFINED
  defaultValue: raw
  description: The type of the templates data.
  name: templates_type
  predefined:
  - list
  - raw
  - base64
  required: true
- description: The name of a template to choose it from 'templates'.
  name: template_name
  required: true
- description: A list of templates to choose from for building an entry.
  name: templates
  required: true
- description: 'The base time for the relative time provided to earliest_time or latest_time (The default is the first available value from the following: alert.occurred, incident.occurred, alert.created, incident.created, now).'
  name: base_time
- defaultValue: '0'
  description: 'The value (in seconds) used to round down the base time (Default = 0). If two parameters are provided in a list, they will be applied to the base time for earliest_time and latest_time, respectively.'
  name: round_time
- defaultValue: 24 hours ago
  description: The earliest time at which the time range of the query starts (Default = 24 hours ago).
  name: earliest_time
- defaultValue: now
  description: The latest time at which the time range of the query ends (Default = now).
  name: latest_time
- defaultValue: ${,}
  description: The pair of default opening and closing markers that enclose a variable name (Default = ${,}).
  name: variable_substitution
- auto: PREDEFINED
  defaultValue: 'true'
  description: 'Set to true to convert a string within triple quotes in the templates to a JSON string if it is of type string. Set to false to use the templates as they are, without any conversion (Default = true).'
  name: triple_quotes_to_string
  predefined:
  - 'true'
  - 'false'
- auto: PREDEFINED
  defaultValue: recordset
  description: The name of the type that defines which data is stored and retrieved from the cache to create the entry (Default = recordset).
  name: cache_type
  predefined:
  - none
  - recordset
  - entry
- defaultValue: '10'
  description: The maximum number of retries to query XQL for recoverable errors (Default = 10).
  name: max_retries
- defaultValue: '10'
  description: The wait time (in seconds) between retries (Default = 10).
  name: retry_interval
- defaultValue: '10'
  description: The polling interval (in seconds) to wait for results (Default = 10).
  name: polling_interval
- defaultValue: '60'
  description: The maximum duration (in seconds) allowed for an XQL query to complete after it has started. (Default = 60).
  name: query_timeout_duration
- description: The custom context data is merged with the current context data for use.
  name: context_data
- name: output_recordset
  auto: PREDEFINED
  predefined:
  - "true"
  - "false"
  description: Set to true to return the recordset in the outputs context; otherwise,
    set to false.
  defaultValue: "false"
- description: The name of the integration instance to execute xdr-xql-generic-query and xdr-xql-get-query-results.
  name: xql_query_instance
commonfields:
  id: XQLDSHelper
  version: -1
contentitemexportablefields:
  contentitemfields:
    fromServerVersion: ''
dockerimage: demisto/python3:3.12.13.10116658
enabled: true
engineinfo: {}
name: XQLDSHelper
outputs:
- contextPath: XQLDSHelper.QueryParams
  description: The query parameters.
  type: unknown
- contextPath: XQLDSHelper.QueryHash
  description: The hash value of the query parameters.
  type: string
- contextPath: XQLDSHelper.RequestURL
  description: The URL path, including query parameters, used to search datasets in
    the XQL builder.
  type: string
- contextPath: XQLDSHelper.ResultURL
  description: 'The URL path used to get the results of an executed query in the XQL
    builder. '
  type: string
- contextPath: XQLDSHelper.ExecutionID
  description: The unique execution ID for the request query.
  type: string
- contextPath: XQLDSHelper.Entry
  description: The entry data for the general dynamic section.
  type: unknown
- contextPath: XQLDSHelper.RecordSet
  description: The record set retrieved by the XQL query.
  type: unknown
runas: DBotWeakRole
runonce: false
script: ''
scripttarget: 0
subtype: python3
tags:
- Utility
type: python
fromversion: 6.0.0
tests:
- No tests (auto formatted)