Events GraphQL API types¶
Every named type reachable from a query or mutation in this schema, grouped by kind.
Jump to: Objects · Enums · Input objects · Scalars
Objects¶
Alert2 F Detections GraphQL API¶
Fields¶
| Field | Type | Description |
|---|---|---|
id | ID! |
Event¶
Event represents an atomic piece of recorded telemetry from a sensor. It is a core type of the Fusion ecosystem, and all Observations and Detections are generated with reference to Events.
Fields¶
| Field | Type | Description |
|---|---|---|
rn | ResourceName! | Is the unique resource name for the Event. |
id | ID! | Is an alias for the unique resource name for the Event. Made available for backwards compatibility. Deprecated: use rn instead. |
eventType | EventType! | Defines the schema for the Event. |
summary | String! | Is the standardized, human-readable description of the Event. |
eventTime | Time! | Is the registered timestamp (with microsecond precision) for the Event. |
ingestTime | Time! | Is the time (with microsecond precision) when the Event was received by the platform. |
values | Map! | Contains the data associated with the Event. |
additionalData | EventAdditionalData | Includes additional data for the Event beyond the default, normalized values. |
EventAdditionalData¶
EventAdditionalData holds any additional data for the Event beyond the default, normalized values. This data is only loaded if requested and may affect the time to retrieve the Event.
Fields¶
| Field | Type | Description |
|---|---|---|
originalData | String | Contains the original, pre-normalized data packet that instigated the Event. |
mitreAttackTechniques | [MitreAttackInformation!] | The MITRE ATT&CK techniques (by id) associated with the Event, if any. |
detections | [Alert2!] | The Detections associated with the Event, if any |
MitreAttackInformation F¶
Fields¶
| Field | Type | Description |
|---|---|---|
id | ID! |
Enums¶
EventType¶
Values¶
| Value | Description |
|---|---|
AGENT_DETECTION | |
ANTIVIRUS | |
API_CALL | |
AUTH | |
CLOUD_AUDIT | |
DHCP | |
DNS_QUERY | |
EMAIL | |
ENCRYPT | |
FILE_MOD | |
FORENSIC_INFO | |
GENERIC | |
HTTP | |
INVENTORY_INFO | |
MANAGEMENT_EVENT | |
NETFLOW | |
NIDS | |
PATCH_STATE | |
PERSISTENCE | |
PROCESS | |
PROCESS_MODULE | |
REGISTRY | |
SCRIPT_BLOCK | |
THIRD_PARTY | |
THREAD_INJECTION | |
DETECTION_FINDING | |
TECHNIQUE_FINDING | |
IDENTITY_FINDING | |
SOFTWARE_INFO |
Input objects¶
EventsInput¶
EventsInput identifies the event resources to retrieve by resource name, also known as "event id."
Fields¶
| Field | Type | Description |
|---|---|---|
rns | [ResourceName!]! | Lists rns for Events to retrieve. |
Scalars¶
Map¶
Map holds a string-keyed JSON object.
ResourceName¶
ResourceName is an identifier (ID) that uses a Fusion-wide format for core resources.
Time¶
Federated types and introspection. Types marked with F are federated across one or more APIs in the graph. Other subgraphs may provide more fields than those strictly defined here.
Where introspection is available, query the federated endpoint to inspect its composed API schema and available fields. Learn how GraphQL introspection works.