> For the complete documentation index, see [llms.txt](https://docs.ox.security/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.ox.security/api-documentation/api-reference/api--application/types/enums/filter-types.md). # filterTypes Types of filters that can be applied to narrow down and organize security findings and resources. ### Examples ```graphql enum FilterTypes { digest expiry fakeApp apps criticality policies issueOwners codeOwners categories issueNames appId sourceTools cwe originBranchName businessPriority cvss severityChange severityChangeReasons issueStatus issueStatusVsLastScan issueActions originalSeverity filePaths uniqueLibs languages cve dastUrl oscar oscarTactic complianceControl complianceStandard tags customTags tagIds issuesWithout image resolvedReasons os baseImage registryName artifactSha artifactPath workflows scaFixType oxuser issueIds firstSeen daysPastSLA slaStatus credentialsName credentialsId attackCategory issueUpdatedAt commitDate orgUnit azureResourceGroup applicationSource libraryNames libraryVersions appIds source licenses dependencyTypes packageNames copyrights severities packageInfos packageManagers ruleId licenseIssue malicious cicd repoTypes appApplicationSource orchestrators artifacts artifactsSystem cloudDeployments kubernetes sast sca iac secretSearch securityToolSource oxInPipeline oxInPipelineV2 pkgManagers isMonoRepoChild appClassification appOwners ticketStatus workflowExecutionLogId resolvedReason disappearedReason disappearedType reappearedReason enforcement cicdIssueStatus jobNumber pullRequests eventTypes targetBranches sourceBranches jobTriggeredBy result cicdTypes jobId sourceBranch cicdEventType scanCompletionStatus pipelineScanType pipelineArtifactName pipelineArtifactTag artifactName artifactFullName artifactType environment issueSeverities registryType version user region accountId cloudRegion cloudAccountId cloudResource cloudResourceTag namespace artifactIntegrity artifactTag artifactSignStatus appTags artifactSignatureTag signerProfileVersion imageName reason imageTags imageDigest apiId titles endpoints methods framework appOwnersName appOwnersEmail apiItem irrelevantReasons severityChangeHistory reachability authentication verdict reachabilityResponseCode exposureByApi name detectionType saasBom type service cloudProvider assetName serviceCategory isLegitimatelyDisappeared cbomId cluster isExposed epssPercentile epssScore imageSource imageScanStatus resolvedByName sbomImageTags libForSearch runtimeStatus pinStatus fixedByVibeSecOxMind cspmEnhanced packageVisibility triageStatus severityChangeReasonsV2 secretProvider cspmRelated exposedAsset cloudAlertType applauseCategoryName applauseIssueId runtimeImageTag instanceId customAttribute k8sLabel cloudflareRuntimeStatus cloudflareMatchType cloudflareRequestCount cloudflareLastSeen cloudflareHost cloudflareZone cloudflareWafBlockCount category mitreTactic event process parentProcess container pod imageTag modelVendor modelName trainingDataType trainingStorageType scanId } ``` ### Enum values | Enum value | Description | | ------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | digest | Filter by Signature Time | | expiry | Filter by Expiration Time | | fakeApp | Filter test/demo applications | | apps | Filter by Application | | criticality | Filter by Severity | | policies | Filter by Policy | | issueOwners | Filter by Issue Owner | | codeOwners | Filter by Code Owners | | categories | Filter by Category | | issueNames | Filter by Issue Name | | appId | Filter by application identifier | | sourceTools | Filter by Source Tool | | cwe | Filter by CWE | | originBranchName | Filter by repository branch names | | businessPriority | Filter by Business Priority | | cvss | Filter by CVSS Base Score | | severityChange | Filter by Severity Reprioritized | | severityChangeReasons | Filter by Severity Factor | | issueStatus | Filter by Issue Status Over Time | | issueStatusVsLastScan | Filter by Issue Status vs Last Scan | | issueActions | Filter by Actions | | originalSeverity | Filter by Severity Before Prioritization | | filePaths | Filter by Files With Issues | | uniqueLibs | Filter by Vulnerable Library | | languages | Filter by Languages | | cve | Filter by CVE | | dastUrl | Filter by Target URL | | oscar | Filter by OSC\&R Technique | | oscarTactic | Filter by OSC\&R Tactic | | complianceControl | Filter by Compliance Control | | complianceStandard | Filter by Compliance Standard | | tags | Filter by App Tag | | customTags | Filter by Custom Tag | | tagIds | Filter by tag identifiers | | issuesWithout | Filter by Issues Without | | image | Filter by Artifact Image | | resolvedReasons | Filter by Resolved Reasons | | os | Filter by Artifact OS Image | | baseImage | Filter by Artifact Base Image | | registryName | Filter by Registry Name | | artifactSha | Filter by Artifact SHA | | artifactPath | Filter by Artifact Path | | workflows | Filter by Workflow Name | | scaFixType | Filter by software composition analysis fix types | | oxuser | Filter by Ox user references | | issueIds | Filter by issue identifiers | | firstSeen | Filter by First Seen | | daysPastSLA | Filter by SLA | | slaStatus | Filter by SLA status | | credentialsName | Filter by Connection Name | | credentialsId | Filter by credentials ID | | attackCategory | Filter by Attack Category | | issueUpdatedAt | Filter by Issue Updated At | | commitDate | Filter by Commit Date | | orgUnit | Filter by Business Unit | | azureResourceGroup | Filter by Resource Group | | applicationSource | Filter by Application Source | | libraryNames | Filter by Library Name | | libraryVersions | Filter by Library Version | | appIds | Filter by application identifiers | | source | Filter by Source | | licenses | Filter by License | | dependencyTypes | Filter by Dependency | | packageNames | Filter by Package Name | | copyrights | Filter by Copyright | | severities | Filter by Vulnerability Severity | | packageInfos | Filter by Issues | | packageManagers | Filter by Package Manager | | ruleId | Filter by Rule ID | | licenseIssue | Filter by license compliance issues | | malicious | Filter by Malicious | | cicd | Filter by CI/CD | | repoTypes | Filter by Source Control | | appApplicationSource | Filter by Application Source | | orchestrators | Filter by Orchestrator | | artifacts | Filter by Artifact Type | | artifactsSystem | Filter by Registry | | cloudDeployments | Filter by Cloud Deployment | | kubernetes | Filter by Container as a Service | | sast | Filter by SAST Coverage | | sca | Filter by SCA Coverage | | iac | Filter by IAC Coverage | | secretSearch | Filter by Secret Coverage | | securityToolSource | Filter by Security Tool Source | | oxInPipeline | Filter by OX In Pipeline | | oxInPipelineV2 | Filter by OX In Pipeline | | pkgManagers | Filter by Package Manager | | isMonoRepoChild | Filter by monorepo child status | | appClassification | Filter by App Classification | | appOwners | Filter by application owners | | ticketStatus | Filter by Ticket Status | | workflowExecutionLogId | Filter by the workflow execution log identifier. Returns the issues referenced by the given workflow execution log. | | resolvedReason | Filter by issue resolution reason | | disappearedReason | Filter by Removed Reasons | | disappearedType | Filter by type of disappearance | | reappearedReason | Filter by prior close reason for a reappeared issue | | enforcement | Filter by Result | | cicdIssueStatus | Filter by Pipeline Issue Status | | jobNumber | Filter by Job Number | | pullRequests | Filter by Pull Request | | eventTypes | Filter by Event Type | | targetBranches | Filter by Target Branch | | sourceBranches | Filter by Source Branch | | jobTriggeredBy | Filter by Job Triggered By | | result | Filter by Result | | cicdTypes | Filter by CI/CD Type | | jobId | Filter by Job ID | | sourceBranch | Filter by source branch | | cicdEventType | Filter by CI/CD event type | | scanCompletionStatus | Filter by Scan Completion Status | | pipelineScanType | Filter by Scan Type | | pipelineArtifactName | Filter by pipeline artifact name | | pipelineArtifactTag | Filter by pipeline artifact tag | | artifactName | Filter by Artifact | | artifactFullName | Filter by full artifact name | | artifactType | Filter by Artifact Type | | environment | Filter by Environment | | issueSeverities | Filter by issue severity levels | | registryType | Filter by Registry Type | | version | Filter by Version | | user | Filter by User | | region | Filter by Region | | accountId | Filter by Account | | cloudRegion | Filter by Cloud Region | | cloudAccountId | Filter by Cloud Account | | cloudResource | Filter by Cloud Resource | | cloudResourceTag | Filter by Cloud Resource Tag | | namespace | Filter by Kubernetes Namespace | | artifactIntegrity | Filter by Artifact Integrity | | artifactTag | Filter by Artifact Tag | | artifactSignStatus | Filter by artifact signature status | | appTags | Filter by application tags | | artifactSignatureTag | Filter by Signature Tag | | signerProfileVersion | Filter by Signing Profile | | imageName | Filter by Image Name | | reason | Filter by Reason | | imageTags | Filter by Image Tags | | imageDigest | Filter by image digest | | apiId | Filter by API identifier | | titles | Filter by Title | | endpoints | Filter by Endpoint | | methods | Filter by Method | | framework | Filter by Framework | | appOwnersName | Filter by application owner name | | appOwnersEmail | Filter by application owner email | | apiItem | Filter by API item | | irrelevantReasons | Filter by irrelevant reasons | | severityChangeHistory | Filter by Severity Change Log | | reachability | Filter by Code-to-Cloud Exposure (Available values: Code) | | authentication | Internal computed authentication verdict for the Attack Surface simulation (Required, NotRequired, N/A). Enables filtering cloud items by whether the asset requires authentication. | | verdict | Internal computed verdict for the Attack Surface simulation (Breachable, Contained, N/A). Enables sorting cloud items by simulation verdict. | | reachabilityResponseCode | Computed HTTP response code observed during the reachability probe. Enables filtering cloud items by the probe response code. | | exposureByApi | Filter by Exposure by API (Available values: "Exposed + internet exposure", "Exposed", "Not exposed") | | name | Filter by name | | detectionType | Filter by Detection Type | | saasBom | Filter by SaaS Bill of Materials | | type | Filter by Type | | service | Filter by Cloud Service | | cloudProvider | Filter by Cloud Provider | | assetName | Filter by Asset Name | | serviceCategory | Filter by Service Category | | isLegitimatelyDisappeared | Filter by Is Legitimately Removed | | cbomId | Filter by Cloud Bill of Materials identifier | | cluster | Filter by Kubernetes Cluster | | isExposed | Filter by Is Internet Exposed | | epssPercentile | Filter by EPSS percentile | | epssScore | Filter by EPSS score | | imageSource | Filter by Image Source | | imageScanStatus | Filter by Image Scan Status | | resolvedByName | Filter by Resolved By | | sbomImageTags | Filter by Artifact Image Tag | | libForSearch | Filter by Library | | runtimeStatus | Filter by Runtime Status | | pinStatus | Filter by Pin Status | | fixedByVibeSecOxMind | Filter by Fixed by VibeSec OxMind | | cspmEnhanced | Filter by CSPM Enhanced Issues | | packageVisibility | Filter by Visibility | | triageStatus | Filter by Triage Status | | severityChangeReasonsV2 | | | secretProvider | Filter by Secret Provider | | cspmRelated | Filter by CSPM Related Issues | | exposedAsset | Filter by Internet Exposed Asset | | cloudAlertType | Filter issues by cloud alert type. | | applauseCategoryName | Filter by Applause Category Name | | applauseIssueId | Filter by Applause Issue ID | | runtimeImageTag | Filter by Runtime Image Tag | | instanceId | Filter by Instance ID | | customAttribute | Filter by Custom Attribute | | k8sLabel | Filter by Kubernetes Label | | cloudflareRuntimeStatus | Filter by Cloudflare Runtime Status | | cloudflareMatchType | Filter by Cloudflare Match Type | | cloudflareRequestCount | Filter by Cloudflare Request Count | | cloudflareLastSeen | Filter by Cloudflare Last Traffic | | cloudflareHost | Filter by Cloudflare Host | | cloudflareZone | Filter by Cloudflare Zone | | cloudflareWafBlockCount | Filter by Cloudflare WAF Block Count | | category | Filter by Category | | mitreTactic | Filter by MITRE Tactic | | event | Filter by Event | | process | Filter by Process | | parentProcess | Filter by Parent Process | | container | Filter by Container | | pod | Filter by Pod | | imageTag | Filter by Image Tag | | modelVendor | Filter by the AI model vendor of the asset. | | modelName | Filter by the AI model name of the asset. | | trainingDataType | Filter by the training data type of the asset. | | trainingStorageType | Filter by the training data storage type of the asset. | | scanId | Filter by Scan ID | ### References #### Fields with this object: * [{} GetApplicationsInput.openItems](/api-documentation/api-reference/api--application/types/inputs/get-applications-input.md) * [{} ConditionalFilters.fieldName](/api-documentation/api-reference/api--application/types/inputs/conditional-filters.md) * [{} FilterLazy.type](/api-documentation/api-reference/api--application/types/objects/filter-lazy.md) * [{} IssuesInput.openItems](/api-documentation/api-reference/api--issue/types/inputs/issues-input.md) * [{} GetIssuesConditionalFiltersInput.openItems](/api-documentation/api-reference/api--issue/types/inputs/get-issues-conditional-filters-input.md) * [{} GetApplicationsSbom.openItems](/api-documentation/api-reference/api--sbom/types/inputs/get-applications-sbom.md) * [{} GetSbomConditionalFiltersInput.openItems](/api-documentation/api-reference/api--sbom/types/inputs/get-sbom-conditional-filters-input.md) * [{} ResolvedIssuesInput.openItems](/api-documentation/api-reference/api--issue/types/inputs/resolved-issues-input.md) * [{} ResolvedIssuesV2Input.openItems](/api-documentation/api-reference/api--issue/types/inputs/resolved-issues-v2input.md) * [{} DisappearedIssuesInput.openItems](/api-documentation/api-reference/api--issue/types/inputs/disappeared-issues-input.md) * [{} CICDIssuesInput.openItems](/api-documentation/api-reference/api--cicd-issue/types/inputs/cicd-issues-input.md) * [{} GetArtifactsInput.openItems](/api-documentation/api-reference/api--artifact/types/inputs/get-artifacts-input.md) * [{} GetUnscannedArtifactsInput.openItems](/api-documentation/api-reference/api--artifact/types/inputs/get-unscanned-artifacts-input.md) * [{} GetPipelineSummaryInput.openItems](/api-documentation/api-reference/api--pipeline/types/inputs/get-pipeline-summary-input.md) * [{} GetApiSecurityInput.openItems](/api-documentation/api-reference/api--api-security/types/inputs/get-api-security-input.md) * [{} GetSaasBomItemsInput.openItems](/api-documentation/api-reference/api--saas-sbom/types/inputs/get-saas-bom-items-input.md) * [{} CloudItemsInput.openItems](/api-documentation/api-reference/api--cloud-security/types/inputs/cloud-items-input.md) --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.ox.security/api-documentation/api-reference/api--application/types/enums/filter-types.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.