addIncidentIndicators

Add indicators to the monitored scope (re-runs the matcher).

Examples

mutation AddIncidentIndicators($incidentId: String!, $indicators: [IndicatorInput!]!) {
  addIncidentIndicators(incidentId: $incidentId, indicators: $indicators) {
    id
    incidentId
    kind
    value
    versionRange
    fixedVersions
    severity
    cvssScore
    addedAt
    source
    addedBy
    status
    url
    lastFetchedAt
    autoExpand
  }
}

Variables

This is an example input showing all available input fields. Only fields marked as required in the schema are mandatory.

{
  "incidentId": "example",
  "indicators": [
    {
      "kind": "CVE",
      "value": "example",
      "versionRange": "example",
      "fixedVersions": ["example"],
      "severity": "Low",
      "cvssScore": 13.37,
      "url": "example",
      "autoExpand": true
    }
  ]
}

curl -X POST \
https://api.cloud.ox.security/api/apollo-gateway \
-H 'Content-Type: application/json' \
-H 'Authorization: YOUR_API_TOKEN' \
-d '{
 "query": "mutation AddIncidentIndicators($incidentId: String!, $indicators: [IndicatorInput!]!) { addIncidentIndicators(incidentId: $incidentId, indicators: $indicators) { id incidentId kind value versionRange fixedVersions severity cvssScore addedAt source addedBy status url lastFetchedAt autoExpand } }",
 "variables": {
    "incidentId": "example",
    "indicators": [
      {
        "kind": "CVE",
        "value": "example",
        "versionRange": "example",
        "fixedVersions": ["example"],
        "severity": "Low",
        "cvssScore": 13.37,
        "url": "example",
        "autoExpand": true
      }
    ]
  }
}'

const query = 'mutation AddIncidentIndicators($incidentId: String!, $indicators: [IndicatorInput!]!) { addIncidentIndicators(incidentId: $incidentId, indicators: $indicators) { id incidentId kind value versionRange fixedVersions severity cvssScore addedAt source addedBy status url lastFetchedAt autoExpand } }';

fetch("https://api.cloud.ox.security/api/apollo-gateway", {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
    "Authorization": "YOUR_API_TOKEN"
  },
  body: JSON.stringify({
    query: query,
    // This is an example input showing all available input fields. Only fields marked as required in the schema are mandatory.
    variables: {
      incidentId: "example",
      indicators: [
        {
          kind: "CVE",
          value: "example",
          versionRange: "example",
          fixedVersions: ["example"],
          severity: "Low",
          cvssScore: 13.37,
          url: "example",
          autoExpand: true
        }
      ]
    }
  })
})
.then(response => response.json())
.then(result => console.log(JSON.stringify(result, null, 2)))
.catch(error => console.error('Error:', error));

import requests

query = 'mutation AddIncidentIndicators($incidentId: String!, $indicators: [IndicatorInput!]!) { addIncidentIndicators(incidentId: $incidentId, indicators: $indicators) { id incidentId kind value versionRange fixedVersions severity cvssScore addedAt source addedBy status url lastFetchedAt autoExpand } }'

response = requests.post(
  "https://api.cloud.ox.security/api/apollo-gateway",
  headers={
    "Content-Type": "application/json",
    "Authorization": "YOUR_API_TOKEN"
  },
  json={
    "query": query,
    # This is an example input showing all available input fields. Only fields marked as required in the schema are mandatory.
    "variables": {
      "incidentId": "example",
      "indicators": [
        {
          "kind": "CVE",
          "value": "example",
          "versionRange": "example",
          "fixedVersions": ["example"],
          "severity": "Low",
          "cvssScore": 13.37,
          "url": "example",
          "autoExpand": true
        }
      ]
    }
  }
)

if response.status_code == 200:
    result = response.json()
    print(result)
else:
    print(f"Error: {response.status_code}")
    print(response.text)

Arguments

You can use the following argument(s) to customize your addIncidentIndicators mutation.

Argument

Description

Supported fields

incidentId String! required

indicators [IndicatorInput!]! required

kind IndicatorKind! value String! versionRange String fixedVersions [String!] severity IncidentSeverity cvssScore Float url String autoExpand Boolean

Fields

Return type: [Indicator!]!

You can use the following field(s) to specify what information your addIncidentIndicators mutation will return. Please note that some fields may have their own subfields.

Field

Description

Supported fields

id String!

incidentId String!

kind IndicatorKind!

value String!

versionRange String

fixedVersions [String!]!

severity IncidentSeverity

cvssScore Float

addedAt DateTime!

source String!

addedBy String

status String!

url String

lastFetchedAt DateTime

autoExpand Boolean

Last updated 6 days ago