Endpoint
Send a JSON object or an array of objects with an ingest key:
curl -X POST https://console.xdr.example.com/api/ingest/v1/events \
-H "Authorization: Bearer xk_YOUR_KEY" \
-H "Content-Type: application/json" \
--data @events.json
The deployment also exposes a direct HTTP listener that accepts the shared ingest key with basic authentication; it lands in the default organization and is intended for single-company deployments.
Shape of an event
Use the canonical field names where you can; XenXDR keeps everything else under fields.
{
"@timestamp": "2026-09-15T09:31:02Z",
"event": { "module": "custom", "type": "logon_failed", "severity": "medium" },
"host": { "name": "NL-SRV-02" },
"user": { "name": "j.kowalski" },
"source": { "ip": "192.0.2.44" },
"message": "Failed logon from 192.0.2.44"
}
@timestamp is optional; if absent the receive time is used. event.module should name the source so that detections and dashboards can select it. The closed vocabulary of event.type values is listed in the field dictionary.
Limits
Requests are limited in size and rate per key; the limits are shown in Settings › Integrations › Ingest keys. Batch events into arrays rather than sending one request per event.
Errors
A malformed body returns 400 with the reason. An event that is valid JSON but cannot be normalised is accepted and lands in the unparsed queue, where you can see the parse error and fix the sender.