Skip to content

searchLineage

QUERYsearchLineage

Threat Timeline GraphQL API · Queries

Returns lineage counts and selected process details for multiple processes.

Arguments

Argument Type Description
input SearchLineageInput! Lineage search input.

Returns

[SearchLineageItem!]!

Request samples

curl -X POST "https://api.taegis.sophos.com/graphql" -H "Authorization: Bearer <access-token>" -H "X-Tenant-ID: <tenant-id>" -H "Content-Type: application/json" -d "{
  \"query\": \"query SearchLineage(\$input: SearchLineageInput!) { searchLineage(input: \$input) { processCorrelationId counts { lineageNode lineageNodeDetections lineageNodeKeyActivities lineageNodeChildProcesses } matchingCounts { lineageNode lineageNodeDetections lineageNodeKeyActivities lineageNodeChildProcesses } lineageNode { matched isEnriching } lineageNodeDetections { totalCount page pageSize isEnriching } lineageNodeKeyActivities { totalCount page pageSize isEnriching } lineageNodeChildProcesses { totalCount page pageSize maxResults isEnriching } } }\",
  \"variables\": {
    \"input\": {
      \"processCorrelationIds\": [
        \"<processCorrelationIds>\"
      ],
      \"lineageId\": \"<lineageId>\"
    }
  }
}"


import requests

response = requests.post(
    "https://api.taegis.sophos.com/graphql",
    headers={
        "Authorization": "Bearer <access-token>",
        "X-Tenant-ID": "<tenant-id>",
        "Content-Type": "application/json",
    },
    json={   'query': 'query SearchLineage($input: SearchLineageInput!) { '
             'searchLineage(input: $input) { processCorrelationId counts { '
             'lineageNode lineageNodeDetections lineageNodeKeyActivities '
             'lineageNodeChildProcesses } matchingCounts { lineageNode '
             'lineageNodeDetections lineageNodeKeyActivities '
             'lineageNodeChildProcesses } lineageNode { matched isEnriching } '
             'lineageNodeDetections { totalCount page pageSize isEnriching } '
             'lineageNodeKeyActivities { totalCount page pageSize isEnriching '
             '} lineageNodeChildProcesses { totalCount page pageSize '
             'maxResults isEnriching } } }',
    'variables': {   'input': {   'processCorrelationIds': [   '<processCorrelationIds>'],
                                  'lineageId': '<lineageId>'}}},
)
print(response.json())


$headers = @{
    "Authorization" = "Bearer <access-token>"
    "X-Tenant-ID" = "<tenant-id>"
    "Content-Type" = "application/json"
}
$body = '{
  "query": "query SearchLineage($input: SearchLineageInput!) { searchLineage(input: $input) { processCorrelationId counts { lineageNode lineageNodeDetections lineageNodeKeyActivities lineageNodeChildProcesses } matchingCounts { lineageNode lineageNodeDetections lineageNodeKeyActivities lineageNodeChildProcesses } lineageNode { matched isEnriching } lineageNodeDetections { totalCount page pageSize isEnriching } lineageNodeKeyActivities { totalCount page pageSize isEnriching } lineageNodeChildProcesses { totalCount page pageSize maxResults isEnriching } } }",
  "variables": {
    "input": {
      "processCorrelationIds": [
        "<processCorrelationIds>"
      ],
      "lineageId": "<lineageId>"
    }
  }
}'
Invoke-RestMethod -Method POST -Uri "https://api.taegis.sophos.com/graphql" -Headers $headers -Body $body -ContentType "application/json"


package main

import (
    "fmt"
    "io"
    "net/http"
    "strings"
)

func main() {
    req, err := http.NewRequest("POST", "https://api.taegis.sophos.com/graphql", strings.NewReader(`{
  "query": "query SearchLineage($input: SearchLineageInput!) { searchLineage(input: $input) { processCorrelationId counts { lineageNode lineageNodeDetections lineageNodeKeyActivities lineageNodeChildProcesses } matchingCounts { lineageNode lineageNodeDetections lineageNodeKeyActivities lineageNodeChildProcesses } lineageNode { matched isEnriching } lineageNodeDetections { totalCount page pageSize isEnriching } lineageNodeKeyActivities { totalCount page pageSize isEnriching } lineageNodeChildProcesses { totalCount page pageSize maxResults isEnriching } } }",
  "variables": {
    "input": {
      "processCorrelationIds": [
        "<processCorrelationIds>"
      ],
      "lineageId": "<lineageId>"
    }
  }
}`))
    if err != nil {
        panic(err)
    }
    req.Header.Set("Authorization", "Bearer <access-token>")
    req.Header.Set("X-Tenant-ID", "<tenant-id>")
    req.Header.Set("Content-Type", "application/json")

    resp, err := http.DefaultClient.Do(req)
    if err != nil {
        panic(err)
    }
    defer resp.Body.Close()

    body, _ := io.ReadAll(resp.Body)
    fmt.Println(string(body))
}


const response = await fetch("https://api.taegis.sophos.com/graphql", {
  method: "POST",
  headers: {
    "Authorization": "Bearer <access-token>",
    "X-Tenant-ID": "<tenant-id>",
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
  "query": "query SearchLineage($input: SearchLineageInput!) { searchLineage(input: $input) { processCorrelationId counts { lineageNode lineageNodeDetections lineageNodeKeyActivities lineageNodeChildProcesses } matchingCounts { lineageNode lineageNodeDetections lineageNodeKeyActivities lineageNodeChildProcesses } lineageNode { matched isEnriching } lineageNodeDetections { totalCount page pageSize isEnriching } lineageNodeKeyActivities { totalCount page pageSize isEnriching } lineageNodeChildProcesses { totalCount page pageSize maxResults isEnriching } } }",
  "variables": {
    "input": {
      "processCorrelationIds": [
        "<processCorrelationIds>"
      ],
      "lineageId": "<lineageId>"
    }
  }
}),
});
const data = await response.json();
console.log(data);