Configuring webhook NQL conditions
Last updated
Last updated
Write a query for the NQL conditions field of a webhook using:
NQL tables and NQL properties supported by Webhooks.
NQL operators supported by Webhooks.
Find below the NQL tables supported by Webhooks in the format of <namespace>.<table>.
The system displays an error message when saving a webhook configuration with unsupported NQL objects in the NQL conditions field, even for valid syntaxes.
Jump to the end of the page for examples of NQL conditions for Webhooks.
| NQL objects supported by Webhooks |
|---|
When writing the query in the NQL conditions field from the webhook configuration page, the system displays the supported NQL properties from the NQL objects listed above. See the image below.
Using unsupported NQL table properties results in system errors, even for valid syntaxes.
Jump to the end of the page for examples of NQL conditions for Webhooks.
Not all NQL operators are available to the customer. When working with punctual events, use the following subset of NQL operators.
You must add every NQL field you use as a placeholder in the webhook Resource or Payload to the list clause.
Even if you do not use any placeholders, still you must add one NQL field to the list clause.
Some of the following valid NQL query examples assume you previously defined the associated alerts. Refer to the Getting started with Alerts documentation for more information.
Valid NQL example.1 - Trigger a webhook when a monitor named “(…)” triggers an alert, and when the condition on a specific web application is met.
Valid NQL example.2 - Trigger a webhook when a monitor named “MS Teams crashes in the last 24 hours" triggers an alert.
Valid NQL example.3 - Trigger a webhook when a monitor with high priority triggers an alert.
Valid NQL example.4 - Trigger a Webhook when a monitor named “MS Teams crashes in the last 24 hours" or “Poor video quality for computers" triggers an alert.
Valid NQL example.5 - Trigger a Webhook when a monitor with high priority or monitor named “MS Teams crashes for SD", and a tag that contains “servicenow" triggers an alert.
Valid NQL example.6 - Filter the device boots that are equal to fast_startup and when the duration is greater than 200 seconds.
Valid NQL example.7 - Filter the device crashes by error code 335 or 49 that refer to a timeout situation.
Valid NQL example.8 - Filter all the execution crashes for the binary zoom.exe that have crashed on start more than 5 times.
Valid NQL example.9 - Filter remote actions by nql_id and completed without a status [expired , failure , cancelled ].
Valid NQL example.10 - List answers, state, and details of a specific campaign.
Some of the following invalid NQL query examples assume you previously defined the associated alerts. Refer to the Getting started with Alerts documentation for more information.
Invalid NQL example.1 - Unsupported NQL tables, missing the list operator and wrong usage of the in operator.
Invalid NQL example.2 - Unavailable properties and the wrong usage of the in operator.
Invalid NQL example.3 - Unavailable operators.
Invalid NQL example.4 - Unsupported NQL tables.
Invalid NQL example.5 - Unsupported NQL operators.
Invalid NQL example.6 - Wrong value when comparing enums.
RELATED TOPICS
| NQL Operator | Type | Available in Webhook | Mandatory |
|---|---|---|---|
alert.alerts
campaign.responses
execution.crashes
device_performance.boots
device_performance.system_crashes
device_performance.hard_resets
remote_action.executions
sessions
where
selection
Yes
No
list
projection
Yes
Yes, at least once.
and
filtering
Yes
No
or
filtering
Yes
No
contains
filtering
Yes
No
in
filtering
Yes
No
