Detections GraphQL API¶
Query alerts — the detections raised from endpoints, network sensors, and other data sources — over GraphQL.
See the guide for a narrative walkthrough of this API.
This is a GraphQL API: every request is a POST carrying a query (or mutation) document, rather than one endpoint per operation. See the guide above for the request shape and authentication.
Queries¶
- alertsCountByTenant
Returns the count of alerts per tenant. Allows a CQL query, but any aggregation or pipe will be ignored. - alertsServiceAggregateAlertsBySeverity
Pull alert severity aggregates based ongroup_byparameters: domain, watchlist, hostname, detector, user. - alertsServicePoll
Poll for results for a specificsearch_id. - alertsServiceRetrieveAlertsByEntity
Provide a list of entities to retrieve alert details about each alert that contains those entities. - alertsServiceRetrieveAlertsByGroupKey
Provide a list of entities to retrieve alert details about each alert that contains the group_key. This is used by the service to aid in alert deduplication. This would not commonly be used by a tenant of XDR. - alertsServiceRetrieveAlertsByHost
Provide a list of Host IDs to retrieve alert details about each alert that contains those hosts. - alertsServiceRetrieveAlertsById
Provide a list of Alert IDs to retrieve each alert’s detail. - alertsServiceSearch
Search alerts using Query Language. This is the same query language provided in Advanced Search page in Taegis XDR. - detectionAggregatesBySeverity
Pull alert severity aggregates based ongroup_byparameters: domain, watchlist, hostname, detector, user. - detectionCountByTenant
Returns the count of alerts per tenant. Allows a CQL query, but any aggregation or pipe will be ignored. - detectionPoll
Poll for results for a specificsearch_id. - detectionRetrieveByEntity
Provide a list of entities to retrieve alert details about each alert that contains those entities. - detectionRetrieveByGroupKey
Provide a list of entities to retrieve alert details about each alert that contains the group_key. This is used by the service to aid in alert deduplication. This would not commonly be used by a tenant of XDR. - detectionRetrieveByHost
Provide a list of Host IDs to retrieve alert details about each alert that contains those hosts. - detectionRetrieveById
Provide a list of Alert IDs to retrieve each alert's detail. - detectionSearch
Search alerts using Query Language. This is the same query language provided in Advanced Search page in Taegis XDR. - node
Mutations¶
- alertsServiceBulkInvestigationsProcessor
Bulk add alerts to an existing investigation by providing either a query or list of alert IDs. If a query is provided, then all alerts matching the query will be added to the investigation. - alertsServiceEvict — deprecated
DEPRECATED: Does not do anything other than to return OK. No replacement necessary. - alertsServiceUpdateInvestigationInfo
- alertsServiceUpdateResolutionInfo
Add a resolution or modify an existing resolution for a give list of alert IDs. - alertsServiceUpdateThreatScore
Update threat score for a given list of alert IDs. - alertsServiceUpdateThreatScoreV2
Update threat score v2 for a given list of alert IDs. - detectionBulkInvestigationsProcessor
Bulk add alerts to an existing investigation by providing either a query or list of alert IDs. If a query is provided, then all alerts matching the query will be added to the investigation. - detectionUpdateInvestigationInfo
- detectionUpdateResolutionInfo
Add a resolution or modify an existing resolution for a give list of alert IDs. - detectionUpdateThreatScore
Update threat score for a given list of alert IDs. - detectionUpdateThreatScoreV2
Update threat score v2 for a given list of alert IDs.
Types¶
AccountCompromiseDetectorDetailAggregateAlertsBySeverityInputInputAggregateAlertsBySeverityInput_GroupByAggregationKeysAggregationResponseAlert2AlertEventMetadataAlertPriorityAlertRuleReferenceAlertsAggregateResponseAlertsAggregateResponse_AlertsAggregationAlertsAggregateResponse_AlertsAggregation_SeverityAlertsCountByTenantInputAlertsCountByTenantResponseAlertsCountByTenantResponseItemAlertsInvestigationInfoAlertsListAlertsMetadataAlertsResponseAlertsSeverityAuthScanDetailAuthScanLogonAttemptAuxiliaryEventBruteForceAuthBruteForceDetailsBulkInvestigationsRequestInputBulkInvestigationsResponseBusinessEmailCompromiseDetailCallerInformationCollectionCreationRuleCreatorDDosIpAddressOccurrenceCountDDosIpCountDDosSourceIpCountDetailDescriptionDetectorDnsExfilEnrichmentEngineEnrichmentDetailEntityApplicationEntityAuthDomainEntityCertificateEntityCloudObjectEntityCloudResourceEntityCloudUserEntityDnsServerEntityDomainNameEntityEmailEntityEmailAddressEntityFileEntityFileHashEntityFunctionEntityHostEntityIpAddressEntityMetadataEntityPerspectiveEntityProcessEntityRegistryKeyEntityRelationshipsEntityScheduledTaskEntityScriptEntityServiceEntityTaskActionEntityUrlEntityUserEvictRequestInputEvictResponseFileAnalysisDetailFloat32GenericDetailGeoSummaryGeoSummary_ASNGeoSummary_CityGeoSummary_ContinentGeoSummary_CountryGeoSummary_LocationGeographicIpGetByIDRequestInputHandsOnKeyboardDetailsHandsOnKeyboardDetails_CommandlineHandsOnKeyboardDetails_ImageHandsOnKeyboardDetails_MatchedProcessImprobableLogonDetailImprobableLogonDetail_FeatureNameInitialAccessVectorInfoInt64InvestigationInvestigationOperationKerberoastingKeyAndValuesKeyValuePairsIndexedKeyValueRecordIndexedLocaleLoginFailureDetailLogonAnomalyMapMatchDetailsMatchedYaraRuleMitreAttackDetailsNetworkConnectionNodeObservationOriginPasswordSprayAffectedUserPasswordSprayDetailPollRequestInputPropertiesRPCResponseStatusRareProgramRareIpDetailReferenceReferenceDetailRelationshipResolutionMetadataResolutionStatusResponseStatusSearchRequestInputSeverityUpdateStolenCredsTravelFeaturesStolenCredsTrustFeaturesStructuredEntityTacticGraphDetailTenantV4ThirdPartyDetailTimestampTimestampInputTuningUpdateUpdateInvestigationRequestInputUpdateInvestigationResponseUpdateResolutionRequestInputUpdateResolutionResponseUpdateThreatScoreEntryUpdateThreatScoreRequestInputUpdateThreatScoreResponseUpdateThreatScoreV2EntryUpdateThreatScoreV2RequestInputUserLogonBaselineVisibilityWatchlistMatchesWhoisSimple