alert_summary

Queries

Alert summary with filtering, having, and ordering support. Returns alert details including threat key, event type, duration, and transaction counts.

Response

Returns AlertSummaryPageResponse

Arguments

Name	Description
`start_time` - Long!	The time frame start time in epoch milliseconds. Minimum start time is 14 days before current time
`end_time` - Long!	The time frame end time in epoch milliseconds.
`filter_by` - [AlertSummaryPageFilterBy]	Optional filter for the query. Recommended to at least add alert_status filter
`having_filter` - [AlertSummaryPageHavingFilter]	having filter for aggregated metrics.
`order_by` - [AlertSummaryPageOrderBy]	A list of fields to sort the results by.
`limit` - Int	The maximum number of records to return per page. Defaults to 100
`offset` - Int	The row number to start from (for pagination). Defaults to 0 for beginning of results

QUERY

query ALERTS {
ALERTS {
  alert_summary(start_time: "123456789", end_time: "123456789", filter_by: [{ client_ip: { eq: 10 }, proxy_ip: { eq: 10 }, alert_status: { eq: ONGOING } }], having_filter: [{ alert_id: { eq: 10 }, event_type: { eq: 10 }, alert_rule: { eq: 10 } }], order_by: [{ impacted_systems: ASC, duration: ASC, last_known_attempt: ASC }], limit: 10, offset: 10) {
    entries {
      threat_key
      alert_id
      event_type
      event_type_name
      impacted_systems
      status
      duration
      last_known_attempt
    }
  }
}
}

RESPONSE

{
"data": {
  "ALERTS": {
    "alert_summary": {
  "entries": [{
    "threat_key": "example_value",
    "alert_id": 123,
    "event_type": 123,
    "event_type_name": "example_value",
    "impacted_systems": 123
  }]
}
  }
}
}

Response

Arguments​

Arguments