Threat Timeline GraphQL API types¶

Every named type reachable from a query or mutation in this schema, grouped by kind.

Jump to: Objects · Enums · Unions · Input objects · Scalars

Objects¶

`DNSRelatedEvent`¶

DNS query event associated with a process.

Fields¶

Field	Type	Description
`eventType`	`String!`	Event family.
`eventObservedAtUsec`	`Int64!`	Time the event was observed, in Unix microseconds.
`hostId`	`String!`	Host identifier for the event.
`resourceId`	`String!`	Resource identifier for the event.
`hostname`	`String!`	Host name for the event.
`processId`	`String!`	Operating system process ID.
`summary`	`String`	Summary of the event.
`commandLine`	`String`	Command used to start the process.
`sourceAddress`	`String`	Source network address.
`sensorType`	`String`	Sensor type that reported the event.
`queryType`	`String`	DNS query type.
`queryName`	`String`	DNS name queried by the process.
`responses`	`String`	DNS responses returned for the query.

`DataTimeRange`¶

Time range covered by returned records, in Unix microseconds.

Fields¶

Field	Type	Description
`startTimeUsec`	`Int64`	Start of the returned time range, in Unix microseconds.
`endTimeUsec`	`Int64`	End of the returned time range, in Unix microseconds.

`Detection`¶

Detection associated with a process.

Fields¶

Field	Type	Description
`id`	`String!`	`Detection` identifier.
`status`	`String`	`Detection` status.
`title`	`String`	`Detection` title.
`createdAt`	`String`	Time the detection was created, in RFC 3339 format.
`threatScore`	`Int`	Threat score as an integer.
`threatScoreFloat`	`Float`	Threat score with decimal precision.
`detectorName`	`String`	Name of the detector that created the detection.
`usernames`	`[String]`	Usernames associated with the detection.
`numInvestigations`	`Int`	Number of investigations associated with the detection.
`investigations`	`[String]`	Investigation identifiers associated with the detection.
`tenantId`	`String`	Tenant identifier for the detection.
`resourceId`	`String`	Resource identifier for the detection.
`hostId`	`String`	Host identifier for the detection.
`processCorrelationId`	`String`	Process correlation ID associated with the detection.

`EnrichmentJob`¶

Status of one enrichment job.

Fields¶

Field	Type	Description
`jobId`	`UUID!`	Identifier for the enrichment job.
`status`	`EnrichmentJobStatus!`	Current enrichment status.
`expiryTime`	`String`	Time the job expires, in RFC 3339 format.
`queryEntries`	`[EnrichmentQueryEntry!]`	Status for each query in the job. Null when details are unavailable.

`EnrichmentQueryEntry`¶

Status of one enrichment query in an enrichment job.

Fields¶

Field	Type	Description
`queryType`	`String!`	Type of data requested by the enrichment query.
`status`	`EnrichmentJobStatus!`	Current enrichment status.
`queryId`	`UUID!`	Identifier for this enrichment query. Use it with `enrichmentQueries`.
`errorMessage`	`String`	Reason the query failed. Null when it did not fail.

`FieldHighlight`¶

Text-search highlights for one field.

Fields¶

Field	Type	Description
`field`	`String!`	Public field name that contains the highlight.
`snippets`	`[String!]!`	Highlighted text snippets. Matching text is marked with HTML em tags.

`FilemodRelatedEvent`¶

File modification event associated with a process.

Fields¶

Field	Type	Description
`eventType`	`String!`	Event family.
`eventObservedAtUsec`	`Int64!`	Time the event was observed, in Unix microseconds.
`hostId`	`String!`	Host identifier for the event.
`resourceId`	`String!`	Resource identifier for the event.
`hostname`	`String!`	Host name for the event.
`processId`	`String!`	Operating system process ID.
`summary`	`String`	Summary of the event.
`commandLine`	`String`	Command used to start the process.
`action`	`String`	File action recorded by the event.
`processImagePath`	`String`	Path to the process executable.
`processUsername`	`String`	User who ran the process.
`fileName`	`String`	Name of the modified file.

`HTTPRelatedEvent`¶

HTTP event associated with a process.

Fields¶

Field	Type	Description
`eventType`	`String!`	Event family.
`eventObservedAtUsec`	`Int64!`	Time the event was observed, in Unix microseconds.
`hostId`	`String!`	Host identifier for the event.
`resourceId`	`String!`	Resource identifier for the event.
`hostname`	`String!`	Host name for the event.
`processId`	`String!`	Operating system process ID.
`summary`	`String`	Summary of the event.
`commandLine`	`String`	Command used to start the process.
`sourceAddress`	`String`	Source network address.
`destinationAddress`	`String`	Destination network address.
`processImagePath`	`String`	Path to the process executable.
`blocked`	`Boolean`	Whether the HTTP request was blocked.
`httpMethod`	`String`	HTTP request method.
`requestDirection`	`String`	Direction of the HTTP request.
`responseCode`	`String`	HTTP response status code.
`responseText`	`String`	HTTP response text.
`originalUri`	`String`	Original URI requested.
`userAgent`	`String`	HTTP user agent.
`referer`	`String`	HTTP referer.

`KeyActivity`¶

Key activity associated with a process.

Fields¶

Field	Type	Description
`type`	`String`	Key activity type.
`activityValue`	`String`	Value recorded for the activity.
`action`	`String`	Action recorded for the activity.
`raw`	`String`	Raw event data.
`occurredAtUsec`	`String`	Time the activity occurred, in Unix microseconds as a string.
`ingestedAt`	`String`	Time the record was ingested, in RFC 3339 format.
`detectionId`	`String`	Identifier of the related detection.
`tenantId`	`String`	Tenant identifier for the activity.
`hostId`	`String`	Host identifier for the activity.
`processId`	`String`	Operating system process ID.
`resourceId`	`String`	Resource identifier for the activity.
`lineageId`	`String`	Identifier of the process lineage.

`LineageNodeTopRelatedEventsResult`¶

Most recent related events across all event families.

Fields¶

Field	Type	Description
`events`	`[RelatedEventSummary!]!`	Most recent related events.
`errors`	`[String!]`	Messages for event families that could not be returned.
`asyncToken`	`String`	Enrichment job token when enrichment is still running.

`LineageProcessNode`¶

One process in a lineage or child-process result.

Fields¶

Field	Type	Description
`processCorrelationId`	`String`	Correlation ID for this process.
`id`	`String`	Deprecated alias for processCorrelationId. Deprecated: Use processCorrelationId..
`processName`	`String`	File name portion of imagePath.
`imagePath`	`String`	Path to the process executable.
`commandLine`	`String`	Command used to start the process.
`processStartedAtUsec`	`Int64`	Time the process started, in Unix microseconds.
`eventObservedAtUsec`	`Int64`	Time the process event was observed, in Unix microseconds.
`processId`	`String`	Operating system process ID.
`userIsAdmin`	`Boolean`	Whether the user has administrator privileges.
`processIsAdmin`	`Boolean`	Whether the process has administrator privileges.
`wasBlocked`	`Boolean`	Whether the process was blocked.
`programHash`	`ProcessHashes`	Hash values for the process executable.
`username`	`String`	User who ran the process.
`parentProcessCorrelationId`	`String`	Correlation ID for the parent process.
`parentProcessId`	`String`	Operating system process ID for the parent process.
`resourceId`	`String`	Resource identifier for the process.
`tenantId`	`String`	Tenant identifier for the process.
`hostId`	`String`	Host identifier for the process.
`processTimeWindow`	`Int64`	Process time window value.
`realPid`	`String`	Operating system process ID reported by the event source.
`normalizer`	`String`	Event normalizer name.
`sensorType`	`String`	Sensor type that reported the process.
`childrenCount`	`Int`	Number of child processes.

`LineageProcessResult`¶

Process lineage returned as a flat list. Use parentProcessCorrelationId to build a tree.

Fields¶

Field	Type	Description
`lineageId`	`String`	Identifier of the process lineage.
`depth`	`Int`	Number of process levels in the lineage.
`lineage`	`[LineageProcessNode]`	Processes in the lineage.

`NetflowRelatedEvent`¶

Network flow event associated with a process.

Fields¶

Field	Type	Description
`eventType`	`String!`	Event family.
`eventObservedAtUsec`	`Int64!`	Time the event was observed, in Unix microseconds.
`hostId`	`String!`	Host identifier for the event.
`resourceId`	`String!`	Resource identifier for the event.
`hostname`	`String!`	Host name for the event.
`processId`	`String!`	Operating system process ID.
`summary`	`String`	Summary of the event.
`commandLine`	`String`	Command used to start the process.
`sourceAddress`	`String`	Source network address.
`destinationAddress`	`String`	Destination network address.
`processImagePath`	`String`	Path to the process executable.
`sourcePort`	`Int`	Source network port.
`destinationPort`	`Int`	Destination network port.
`protocol`	`String`	Network protocol.
`direction`	`String`	Network flow direction.
`rxByteCount`	`Int`	Bytes received.
`txByteCount`	`Int`	Bytes sent.
`dnsName`	`String`	DNS name associated with the flow.

`OtherRelatedEvent`¶

Related event that does not have a named event type.

Fields¶

Field	Type	Description
`eventType`	`String!`	Event family.
`eventObservedAtUsec`	`Int64!`	Time the event was observed, in Unix microseconds.
`hostId`	`String!`	Host identifier for the event.
`resourceId`	`String!`	Resource identifier for the event.
`hostname`	`String!`	Host name for the event.
`processId`	`String!`	Operating system process ID.
`summary`	`String`	Summary of the event.
`username`	`String`	User associated with the event.
`detectionCountTotal`	`Int`	Total number of related detections.

`ProcessHashes`¶

Hash values for a process executable.

Fields¶

Field	Type	Description
`md5`	`String`	MD5 hash.
`sha1`	`String`	SHA-1 hash.
`sha256`	`String`	SHA-256 hash.
`sha512`	`String`	SHA-512 hash.

`ProcessInfoMitreAttackInfo`¶

MITRE ATT&CK information associated with a process.

Fields¶

Field	Type	Description
`tactics`	`String`	MITRE ATT&CK tactic.
`technique`	`String`	MITRE ATT&CK technique name.
`techniqueId`	`String`	MITRE ATT&CK technique identifier.
`type`	`String`	MITRE ATT&CK entry type.
`url`	`String`	Link to the MITRE ATT&CK entry.

`RegistryRelatedEvent`¶

Registry event associated with a process.

Fields¶

Field	Type	Description
`eventType`	`String!`	Event family.
`eventObservedAtUsec`	`Int64!`	Time the event was observed, in Unix microseconds.
`hostId`	`String!`	Host identifier for the event.
`resourceId`	`String!`	Resource identifier for the event.
`hostname`	`String!`	Host name for the event.
`processId`	`String!`	Operating system process ID.
`summary`	`String`	Summary of the event.
`commandLine`	`String`	Command used to start the process.
`processUsername`	`String`	User who ran the process.
`registryEventType`	`String`	Registry event type.
`registryName`	`String`	Registry key name.
`registryPath`	`String`	Registry key path.
`registryValueName`	`String`	Registry value name.

`RelatedEventSummary`¶

Summary of a related event returned across event families.

Fields¶

Field	Type	Description
`eventType`	`String!`	Event family.
`eventObservedAtUsec`	`Int64!`	Time the event was observed, in Unix microseconds.
`resourceId`	`String`	Resource identifier for the event.
`processId`	`String`	Operating system process ID.
`hostId`	`String`	Host identifier for the event.
`hostname`	`String`	Host name for the event.
`endpointId`	`String`	Endpoint identifier for the event.
`summary`	`String`	Summary of the event.

`ScriptblockRelatedEvent`¶

Script block event associated with a process.

Fields¶

Field	Type	Description
`eventType`	`String!`	Event family.
`eventObservedAtUsec`	`Int64!`	Time the event was observed, in Unix microseconds.
`hostId`	`String!`	Host identifier for the event.
`resourceId`	`String!`	Resource identifier for the event.
`hostname`	`String!`	Host name for the event.
`processId`	`String!`	Operating system process ID.
`summary`	`String`	Summary of the event.
`processStartedAtUsec`	`Int64`	Time the process started, in Unix microseconds.
`interpreterName`	`String`	Name of the script interpreter.

`SearchLineageCounts`¶

Record counts for each lineage data type.

Fields¶

Field	Type	Description
`lineageNode`	`Int!`	Number of process information records.
`lineageNodeDetections`	`Int!`	Number of detection records.
`lineageNodeKeyActivities`	`Int!`	Number of key activity records.
`lineageNodeChildProcesses`	`Int!`	Number of child process records.
`lineageNodeRelatedEvents`	`SearchLineageRelatedEventCounts!`	Related event counts by event family.

`SearchLineageItem`¶

One result for each requested process correlation ID, in input order. IDs with no matching data return zero counts. Select only needed detail fields; selecting several detail fields for many processes can increase request cost.

Fields¶

Field	Type	Description
`processCorrelationId`	`String!`	Correlation ID for this process.
`counts`	`SearchLineageCounts!`	Total record counts, without applying searchTerm.
`matchingCounts`	`SearchLineageCounts!`	Record counts that match searchTerm.
`lineageNode`	`SearchLineageNodeResult`	Detailed process information for this process. Arguments: `fieldFilters`: `[FieldFilter!]` (optional) — Optional filters that use public field names..
`lineageNodeDetections`	`SearchLineageNodeDetectionsResult`	Detailed detections for this process. Arguments: `page`: `Int` (optional) — Optional page number.; `pageSize`: `Int` (optional) — Optional number of records per page.; `searchMode`: `SearchMode` (optional) — How searchTerm affects returned records.; `fieldFilters`: `[FieldFilter!]` (optional) — Optional filters that use public field names.; `sortCriteria`: `[SortCriterion!]` (optional) — Optional sort order.; `startTimeUsec`: `Int64` (optional) — Optional start of the time range, in Unix microseconds.; `endTimeUsec`: `Int64` (optional) — Optional end of the time range, in Unix microseconds..
`lineageNodeKeyActivities`	`SearchLineageNodeKeyActivitiesResult`	Detailed key activities for this process. Arguments: `page`: `Int` (optional) — Optional page number.; `pageSize`: `Int` (optional) — Optional number of records per page.; `searchMode`: `SearchMode` (optional) — How searchTerm affects returned records.; `fieldFilters`: `[FieldFilter!]` (optional) — Optional filters that use public field names.; `sortCriteria`: `[SortCriterion!]` (optional) — Optional sort order.; `startTimeUsec`: `Int64` (optional) — Optional start of the time range, in Unix microseconds.; `endTimeUsec`: `Int64` (optional) — Optional end of the time range, in Unix microseconds..
`lineageNodeChildProcesses`	`SearchLineageNodeChildProcessesResult`	Detailed child processes for this process. Arguments: `page`: `Int` (optional) — Optional page number.; `pageSize`: `Int` (optional) — Optional number of records per page.; `searchMode`: `SearchMode` (optional) — How searchTerm affects returned records.; `fieldFilters`: `[FieldFilter!]` (optional) — Optional filters that use public field names.; `sortCriteria`: `[SortCriterion!]` (optional) — Optional sort order.; `startTimeUsec`: `Int64` (optional) — Optional start of the time range, in Unix microseconds.; `endTimeUsec`: `Int64` (optional) — Optional end of the time range, in Unix microseconds..
`lineageNodeRelatedEvents`	`SearchLineageNodeRelatedEventsResult`	Detailed related events for this process. Arguments: `eventType`: `RelatedEventIndexType!` — Related event family to return.; `page`: `Int` (optional) — Optional page number.; `pageSize`: `Int` (optional) — Optional number of records per page.; `searchMode`: `SearchMode` (optional) — How searchTerm affects returned records.; `fieldFilters`: `[FieldFilter!]` (optional) — Optional filters that use public field names.; `sortCriteria`: `[SortCriterion!]` (optional) — Optional sort order.; `startTimeUsec`: `Int64` (optional) — Optional start of the time range, in Unix microseconds.; `endTimeUsec`: `Int64` (optional) — Optional end of the time range, in Unix microseconds..

`SearchLineageNode`¶

Process information returned by searchLineage.

Fields¶

Field	Type	Description
`processCorrelationId`	`String!`	Correlation ID for this process.
`processName`	`String`	File name portion of imagePath.
`imagePath`	`String!`	Path to the process executable.
`parentImagePath`	`String!`	Path to the parent process executable.
`commandLine`	`String!`	Command used to start the process.
`eventObservedAtUsec`	`Int64!`	Time the process event was observed, in Unix microseconds.
`processId`	`String!`	Operating system process ID.
`userIsAdmin`	`Boolean`	Whether the user has administrator privileges.
`processIsAdmin`	`Boolean`	Whether the process has administrator privileges.
`wasBlocked`	`Boolean`	Whether the process was blocked.
`programHash`	`ProcessHashes!`	Hash values for the process executable.
`username`	`String!`	User who ran the process.
`parentProcessId`	`String!`	Operating system process ID for the parent process.
`processTimeWindow`	`Int64`	Process time window value.
`hostId`	`String!`	Host identifier for the process.
`resourceId`	`String!`	Resource identifier for the process.
`lineageId`	`String!`	Identifier of the process lineage.
`mitreAttackInfo`	`[ProcessInfoMitreAttackInfo!]`	MITRE ATT&CK information associated with the process.

`SearchLineageNodeChildProcessItem`¶

One child process and its search details.

Fields¶

Field	Type	Description
`node`	`LineageProcessNode!`	Child process record.
`matched`	`Boolean!`	Whether the child process matches searchTerm.
`highlights`	`[FieldHighlight!]!`	Text-search highlights for the child process.

`SearchLineageNodeChildProcessesResult`¶

Child processes, search highlights, and enrichment status.

Fields¶

Field	Type	Description
`totalCount`	`Int`	Total number of matching child processes.
`page`	`Int`	Returned page number.
`pageSize`	`Int`	Number of records in each page.
`children`	`[SearchLineageNodeChildProcessItem]`	Child process records in this page.
`maxResults`	`Int`	Maximum records available from enrichment.
`timeRange`	`DataTimeRange`	Time range covered by the returned records.
`isEnriching`	`Boolean!`	Whether child process enrichment is running.

`SearchLineageNodeDetectionItem`¶

One detection and its search details.

Fields¶

Field	Type	Description
`detection`	`Detection!`	`Detection` record.
`matched`	`Boolean!`	Whether the detection matches searchTerm.
`highlights`	`[FieldHighlight!]!`	Text-search highlights for the detection.

`SearchLineageNodeDetectionsResult`¶

Detections, search highlights, and enrichment status.

Fields¶

Field	Type	Description
`totalCount`	`Int!`	Total number of matching detections.
`page`	`Int!`	Returned page number.
`pageSize`	`Int!`	Number of records in each page.
`detections`	`[SearchLineageNodeDetectionItem!]!`	`Detection` records in this page.
`isEnriching`	`Boolean!`	Whether detection enrichment is running.

`SearchLineageNodeKeyActivitiesResult`¶

Key activities, search highlights, and enrichment status.

Fields¶

Field	Type	Description
`totalCount`	`Int!`	Total number of matching key activities.
`page`	`Int!`	Returned page number.
`pageSize`	`Int!`	Number of records in each page.
`keyActivities`	`[SearchLineageNodeKeyActivityItem!]!`	Key activity records in this page.
`isEnriching`	`Boolean!`	Whether key activity enrichment is running.

`SearchLineageNodeKeyActivityItem`¶

One key activity and its search details.

Fields¶

Field	Type	Description
`keyActivity`	`KeyActivity!`	Key activity record.
`matched`	`Boolean!`	Whether the key activity matches searchTerm.
`highlights`	`[FieldHighlight!]!`	Text-search highlights for the key activity.

`SearchLineageNodeRelatedEventItem`¶

One related event and its search details.

Fields¶

Field	Type	Description
`event`	`LineageNodeRelatedEvent!`	Related event record.
`matched`	`Boolean!`	Whether the related event matches searchTerm.
`highlights`	`[FieldHighlight!]!`	Text-search highlights for the related event.

`SearchLineageNodeRelatedEventsResult`¶

Related events, search highlights, and enrichment status.

Fields¶

Field	Type	Description
`totalCount`	`Int!`	Total number of matching related events.
`page`	`Int!`	Returned page number.
`pageSize`	`Int!`	Number of records in each page.
`events`	`[SearchLineageNodeRelatedEventItem!]!`	Related event records in this page.
`maxResults`	`Int`	Maximum records available from enrichment.
`timeRange`	`DataTimeRange`	Time range covered by the returned records.
`isEnriching`	`Boolean!`	Whether related event enrichment is running.

`SearchLineageNodeResult`¶

Process information, search highlights, and enrichment status.

Fields¶

Field	Type	Description
`node`	`SearchLineageNode`	Process information. Null when no process record is found.
`matched`	`Boolean!`	Whether the process record matches searchTerm.
`highlights`	`[FieldHighlight!]!`	Text-search highlights for the process record.
`isEnriching`	`Boolean!`	Whether process information enrichment is running.

`SearchLineageRelatedEventCounts`¶

Related event counts by event family.

Fields¶

Field	Type	Description
`dnsquery`	`Int!`	Number of DNS query events.
`filemod`	`Int!`	Number of file modification events.
`http`	`Int!`	Number of HTTP events.
`netflow`	`Int!`	Number of network flow events.
`registry`	`Int!`	Number of registry events.
`scriptblock`	`Int!`	Number of script block events.
`other`	`Int!`	Number of other related events.

Enums¶

`EnrichmentJobStatus`¶

Values¶

Value	Description
`PENDING`	The job is waiting to start.
`IN_PROGRESS`	The job is running.
`COMPLETED`	The job completed successfully.
`FAILED`	The job failed.
`PARTIAL_SUCCESS`	At least one sub-query succeeded and at least one failed.

`EnrichmentQueryType`¶

Values¶

Value	Description
`child_process`	Find child processes.
`related_events`	Find related events.
`detections`	Find detections.
`key_activities`	Find key activities.
`process_info`	Find process information.

`FieldFilterOperator`¶

Values¶

Value	Description
`EQUALS`	Include exact matches.
`NOT_EQUALS`	Exclude exact matches.
`CONTAINS`	Include values that contain the supplied text.
`STARTS_WITH`	Include values that start with the supplied text.
`GREATER_THAN`	Include values greater than the supplied value.
`GREATER_THAN_OR_EQUAL`	Include values greater than or equal to the supplied value.
`LESS_THAN`	Include values less than the supplied value.
`LESS_THAN_OR_EQUAL`	Include values less than or equal to the supplied value.
`EXISTS`	Include records where the field has a value.
`NOT_EXISTS`	Include records where the field has no value.

`RelatedEventIndexType`¶

Values¶

Value	Description
`dnsquery`	DNS query events.
`filemod`	File modification events.
`http`	HTTP events.
`netflow`	Network flow events.
`registry`	Registry events.
`scriptblock`	Script block events.
`other`	Other related events.

`SearchMode`¶

Choose whether text search filters records or marks matching records.

Values¶

Value	Description
`filter`	Return only records that match the search term. This is the default.
`highlight`	Return all records and mark records that match the search term.

`SortOrder`¶

Values¶

Value	Description
`asc`	Sort from lowest to highest.
`desc`	Sort from highest to lowest.

Unions¶

`LineageNodeRelatedEvent`¶

Related event. The returned type depends on eventType.

Input objects¶

`EnrichNodeInput`¶

Input for manually enriching data for one process.

Fields¶

Field	Type	Description
`queryType`	`EnrichmentQueryType!`	Data type to enrich.
`lineageId`	`String!`	Identifier of the process lineage.
`processCorrelationId`	`String!`	Process correlation ID to enrich.
`startTimeUsec`	`Int64`	Optional start of the time range, in Unix microseconds. Required for child_process and related_events. Do not send it for other query types.
`endTimeUsec`	`Int64`	Optional end of the time range, in Unix microseconds. Use it with startTimeUsec.

`FieldFilter`¶

Filter results by one field. Values for one field are combined with OR; filters are combined with AND.

Fields¶

Field	Type	Description
`field`	`String!`	Public field name to filter.
`values`	`[String!]!`	Values to compare with the field.
`operator`	`FieldFilterOperator`	Comparison to use. Defaults to EQUALS.

`LineageNodeTopRelatedEventsInput`¶

Fields¶

Field	Type	Description
`processCorrelationId`	`String!`	Process correlation ID to search.
`lineageId`	`String!`	Identifier of the process lineage to search.
`limit`	`Int`	Maximum events to return. Defaults to 5 and cannot exceed 100.

`LineageProcessInput`¶

Input that identifies a process lineage.

Fields¶

Field	Type	Description
`hostId`	`String!`	Host identifier for the process.
`processCorrelationId`	`String!`	Process correlation ID to search.
`resourceId`	`String`	Optional resource identifier for the process.
`processStartedAtUsec`	`Int64`	Optional process start time, in Unix microseconds.
`forceRefresh`	`Boolean`	When true, refresh lineage data before returning it. Defaults to false.

`SearchLineageInput`¶

Input for searching multiple processes in one lineage.

Fields¶

Field	Type	Description
`processCorrelationIds`	`[String!]!`	Process correlation IDs to search. You can send up to 100 IDs.
`lineageId`	`String!`	Identifier of the process lineage to search.
`searchTerm`	`String`	Optional text to match in lineage records.
`startTimeUsec`	`Int64`	Optional start of the time range for counts, in Unix microseconds.
`endTimeUsec`	`Int64`	Optional end of the time range for counts, in Unix microseconds.

`SortCriterion`¶

Sort results by one public field.

Fields¶

Field	Type	Description
`field`	`String!`	Public field name to sort by.
`order`	`SortOrder!`	Sort direction.

Scalars¶

`Int64`¶

64-bit integer.

`UUID`¶

Universally unique identifier.

Threat Timeline GraphQL API types¶

Objects¶

DNSRelatedEvent¶

Fields¶

DataTimeRange¶

Fields¶

Detection¶

Fields¶

EnrichmentJob¶

Fields¶

EnrichmentQueryEntry¶

Fields¶

FieldHighlight¶

Fields¶

FilemodRelatedEvent¶

Fields¶

HTTPRelatedEvent¶

Fields¶

KeyActivity¶

Fields¶

LineageNodeTopRelatedEventsResult¶

Fields¶

LineageProcessNode¶

Fields¶

LineageProcessResult¶

Fields¶

NetflowRelatedEvent¶

Fields¶

OtherRelatedEvent¶

Fields¶

ProcessHashes¶

Fields¶

ProcessInfoMitreAttackInfo¶

Fields¶

RegistryRelatedEvent¶

Fields¶

RelatedEventSummary¶

Fields¶

ScriptblockRelatedEvent¶

Fields¶

SearchLineageCounts¶

Fields¶

SearchLineageItem¶

Fields¶

SearchLineageNode¶

Fields¶

SearchLineageNodeChildProcessItem¶

Fields¶

SearchLineageNodeChildProcessesResult¶

Fields¶

SearchLineageNodeDetectionItem¶

Fields¶

SearchLineageNodeDetectionsResult¶

Fields¶

SearchLineageNodeKeyActivitiesResult¶

Fields¶

SearchLineageNodeKeyActivityItem¶

Fields¶

SearchLineageNodeRelatedEventItem¶

Fields¶

SearchLineageNodeRelatedEventsResult¶

Fields¶

SearchLineageNodeResult¶

Fields¶

SearchLineageRelatedEventCounts¶

Fields¶

Enums¶

EnrichmentJobStatus¶

Values¶

EnrichmentQueryType¶

Values¶

FieldFilterOperator¶

Values¶

RelatedEventIndexType¶

Values¶

SearchMode¶

Values¶

SortOrder¶

Values¶

Unions¶

`DNSRelatedEvent`¶

`DataTimeRange`¶

`Detection`¶

`EnrichmentJob`¶

`EnrichmentQueryEntry`¶

`FieldHighlight`¶

`FilemodRelatedEvent`¶

`HTTPRelatedEvent`¶

`KeyActivity`¶

`LineageNodeTopRelatedEventsResult`¶

`LineageProcessNode`¶

`LineageProcessResult`¶

`NetflowRelatedEvent`¶

`OtherRelatedEvent`¶

`ProcessHashes`¶

`ProcessInfoMitreAttackInfo`¶

`RegistryRelatedEvent`¶

`RelatedEventSummary`¶

`ScriptblockRelatedEvent`¶

`SearchLineageCounts`¶

`SearchLineageItem`¶

`SearchLineageNode`¶

`SearchLineageNodeChildProcessItem`¶

`SearchLineageNodeChildProcessesResult`¶

`SearchLineageNodeDetectionItem`¶

`SearchLineageNodeDetectionsResult`¶

`SearchLineageNodeKeyActivitiesResult`¶

`SearchLineageNodeKeyActivityItem`¶

`SearchLineageNodeRelatedEventItem`¶

`SearchLineageNodeRelatedEventsResult`¶

`SearchLineageNodeResult`¶

`SearchLineageRelatedEventCounts`¶

`EnrichmentJobStatus`¶

`EnrichmentQueryType`¶

`FieldFilterOperator`¶

`RelatedEventIndexType`¶

`SearchMode`¶

`SortOrder`¶

`LineageNodeRelatedEvent`¶

`EnrichNodeInput`¶

`FieldFilter`¶

`LineageNodeTopRelatedEventsInput`¶

`LineageProcessInput`¶

`SearchLineageInput`¶

`SortCriterion`¶

`Int64`¶

`UUID`¶