alertsServiceRetrieveAlertsByGroupKey¶
QUERYalertsServiceRetrieveAlertsByGroupKey
Detections GraphQL API · Queries
Provide a list of entities to retrieve alert details about each alert that contains the group_key. This is used by the service to aid in alert deduplication. This would not commonly be used by a tenant of XDR.
Request samples¶
curl -X POST "https://api.taegis.sophos.com/graphql" -H "Authorization: Bearer <access-token>" -H "X-Tenant-ID: <tenant-id>" -H "Content-Type: application/json" -d "{
\"query\": \"query AlertsServiceRetrieveAlertsByGroupKey(\$in: GetByIDRequestInput) { alertsServiceRetrieveAlertsByGroupKey(in: \$in) { status reason alerts { total_results next_offset previous_offset last_offset first_offset total_parts } search_id queryId } }\",
\"variables\": {
\"in\": {
\"iDs\": [
\"<iDs>\"
]
}
}
}"
import requests
response = requests.post(
"https://api.taegis.sophos.com/graphql",
headers={
"Authorization": "Bearer <access-token>",
"X-Tenant-ID": "<tenant-id>",
"Content-Type": "application/json",
},
json={ 'query': 'query AlertsServiceRetrieveAlertsByGroupKey($in: '
'GetByIDRequestInput) { alertsServiceRetrieveAlertsByGroupKey(in: '
'$in) { status reason alerts { total_results next_offset '
'previous_offset last_offset first_offset total_parts } search_id '
'queryId } }',
'variables': {'in': {'iDs': ['<iDs>']}}},
)
print(response.json())
$headers = @{
"Authorization" = "Bearer <access-token>"
"X-Tenant-ID" = "<tenant-id>"
"Content-Type" = "application/json"
}
$body = '{
"query": "query AlertsServiceRetrieveAlertsByGroupKey($in: GetByIDRequestInput) { alertsServiceRetrieveAlertsByGroupKey(in: $in) { status reason alerts { total_results next_offset previous_offset last_offset first_offset total_parts } search_id queryId } }",
"variables": {
"in": {
"iDs": [
"<iDs>"
]
}
}
}'
Invoke-RestMethod -Method POST -Uri "https://api.taegis.sophos.com/graphql" -Headers $headers -Body $body -ContentType "application/json"
package main
import (
"fmt"
"io"
"net/http"
"strings"
)
func main() {
req, err := http.NewRequest("POST", "https://api.taegis.sophos.com/graphql", strings.NewReader(`{
"query": "query AlertsServiceRetrieveAlertsByGroupKey($in: GetByIDRequestInput) { alertsServiceRetrieveAlertsByGroupKey(in: $in) { status reason alerts { total_results next_offset previous_offset last_offset first_offset total_parts } search_id queryId } }",
"variables": {
"in": {
"iDs": [
"<iDs>"
]
}
}
}`))
if err != nil {
panic(err)
}
req.Header.Set("Authorization", "Bearer <access-token>")
req.Header.Set("X-Tenant-ID", "<tenant-id>")
req.Header.Set("Content-Type", "application/json")
resp, err := http.DefaultClient.Do(req)
if err != nil {
panic(err)
}
defer resp.Body.Close()
body, _ := io.ReadAll(resp.Body)
fmt.Println(string(body))
}
const response = await fetch("https://api.taegis.sophos.com/graphql", {
method: "POST",
headers: {
"Authorization": "Bearer <access-token>",
"X-Tenant-ID": "<tenant-id>",
"Content-Type": "application/json",
},
body: JSON.stringify({
"query": "query AlertsServiceRetrieveAlertsByGroupKey($in: GetByIDRequestInput) { alertsServiceRetrieveAlertsByGroupKey(in: $in) { status reason alerts { total_results next_offset previous_offset last_offset first_offset total_parts } search_id queryId } }",
"variables": {
"in": {
"iDs": [
"<iDs>"
]
}
}
}),
});
const data = await response.json();
console.log(data);