extractIncidentFromUrls

Auto-fill an incident draft from up to 3 advisory/event URLs. Returns an editable draft and stores a short-lived server-side attestation for trusted provenance.

Examples

GraphQL

mutation ExtractIncidentFromUrls($urls: [String!]!) {
  extractIncidentFromUrls(urls: $urls) {
    extractionToken
    name
    description
    type
    severity
    publishedDate
    classification {
      attackType
      campaignName
      primaryImpact
      secondaryImpacts
      impactTargets
      capabilities
      executionTriggers
      evidence {
        attackType
        campaignName
        primaryImpact
        secondaryImpacts
        impactTargets
        capabilities
        executionTriggers
      }
      metadataContractVersion
    }
    indicators {
      kind
      value
      versionRange
      fixedVersions
      remediationStatus
      remediations {
        action
        versions
        source
        vendor
        product
        packageName
        collectionUrl
        versionType
        affectedRange
      }
      isCompromised
      isCompromisedBasis
      infectsOnInstall
      ecosystem
      severity
      cvssScore
      cvssVersion
      cveIntelligence {
        exploitationStatus
        exploitationSource
        hasPublicExploit
        publicExploitLink
        firstReportedExploitationAt
        firstObservedExploitationAt
        kev {
          status
          checkedAt
          catalogFetchedAt
          catalogVersion
          dateReleased
          dateAdded
          dueDate
          requiredAction
          knownRansomwareCampaignUse
        }
        euKev {
          status
          checkedAt
          catalogFetchedAt
          source
          sourceDisplayName
          cve
          euvdId
          dateReported
          originSource
          exploitationTypes
          threatActors
          notes
        }
        articleEvidence {
          sourceUrl
          sourcePublishedAt
          analyzedAt
          analysisVersion
          articleTypes
          classificationConfidence
          claims {
            claimType
            reportingRelationship
            attributedSource
            explicitlyObservedAt
            evidenceExcerpt
            confidence
          }
        }
        vulnCheck {
          status
          dateAdded
          sourceUpdatedAt
          sensorObserved
        }
      }
      aiExploitSimulation {
        status
        catalogVersion
        catalogGeneratedAt
        coverage {
          language
          packageName
          logic
          conditions {
            ruleId
            condition
            missingEvidence
            negated
          }
          docs
        }
      }
    }
    confidence
    sourceUrls
    sources {
      url
      via
      ok
      indicatorCount
    }
    unfilledFields
    warnings
    indicatorScopeTruncated
    automaticPreviewComplete
  }
}

Variables

This is an example input showing all available input fields. Only fields marked as required in the schema are mandatory.

{
  "urls": ["example"]
}

cURL

curl -X POST \
https://api.cloud.ox.security/api/apollo-gateway \
-H 'Content-Type: application/json' \
-H 'Authorization: YOUR_API_TOKEN' \
-d '{
 "query": "mutation ExtractIncidentFromUrls($urls: [String!]!) { extractIncidentFromUrls(urls: $urls) { extractionToken name description type severity publishedDate classification { attackType campaignName primaryImpact secondaryImpacts impactTargets capabilities executionTriggers evidence { attackType campaignName primaryImpact secondaryImpacts impactTargets capabilities executionTriggers } metadataContractVersion } indicators { kind value versionRange fixedVersions remediationStatus remediations { action versions source vendor product packageName collectionUrl versionType affectedRange } isCompromised isCompromisedBasis infectsOnInstall ecosystem severity cvssScore cvssVersion cveIntelligence { exploitationStatus exploitationSource hasPublicExploit publicExploitLink firstReportedExploitationAt firstObservedExploitationAt kev { status checkedAt catalogFetchedAt catalogVersion dateReleased dateAdded dueDate requiredAction knownRansomwareCampaignUse } euKev { status checkedAt catalogFetchedAt source sourceDisplayName cve euvdId dateReported originSource exploitationTypes threatActors notes } articleEvidence { sourceUrl sourcePublishedAt analyzedAt analysisVersion articleTypes classificationConfidence claims { claimType reportingRelationship attributedSource explicitlyObservedAt evidenceExcerpt confidence } } vulnCheck { status dateAdded sourceUpdatedAt sensorObserved } } aiExploitSimulation { status catalogVersion catalogGeneratedAt coverage { language packageName logic conditions { ruleId condition missingEvidence negated } docs } } } confidence sourceUrls sources { url via ok indicatorCount } unfilledFields warnings indicatorScopeTruncated automaticPreviewComplete } }",
 "variables": {
    "urls": ["example"]
  }
}'

Node.js

const query = 'mutation ExtractIncidentFromUrls($urls: [String!]!) { extractIncidentFromUrls(urls: $urls) { extractionToken name description type severity publishedDate classification { attackType campaignName primaryImpact secondaryImpacts impactTargets capabilities executionTriggers evidence { attackType campaignName primaryImpact secondaryImpacts impactTargets capabilities executionTriggers } metadataContractVersion } indicators { kind value versionRange fixedVersions remediationStatus remediations { action versions source vendor product packageName collectionUrl versionType affectedRange } isCompromised isCompromisedBasis infectsOnInstall ecosystem severity cvssScore cvssVersion cveIntelligence { exploitationStatus exploitationSource hasPublicExploit publicExploitLink firstReportedExploitationAt firstObservedExploitationAt kev { status checkedAt catalogFetchedAt catalogVersion dateReleased dateAdded dueDate requiredAction knownRansomwareCampaignUse } euKev { status checkedAt catalogFetchedAt source sourceDisplayName cve euvdId dateReported originSource exploitationTypes threatActors notes } articleEvidence { sourceUrl sourcePublishedAt analyzedAt analysisVersion articleTypes classificationConfidence claims { claimType reportingRelationship attributedSource explicitlyObservedAt evidenceExcerpt confidence } } vulnCheck { status dateAdded sourceUpdatedAt sensorObserved } } aiExploitSimulation { status catalogVersion catalogGeneratedAt coverage { language packageName logic conditions { ruleId condition missingEvidence negated } docs } } } confidence sourceUrls sources { url via ok indicatorCount } unfilledFields warnings indicatorScopeTruncated automaticPreviewComplete } }';

fetch("https://api.cloud.ox.security/api/apollo-gateway", {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
    "Authorization": "YOUR_API_TOKEN"
  },
  body: JSON.stringify({
    query: query,
    // This is an example input showing all available input fields. Only fields marked as required in the schema are mandatory.
    variables: {
      urls: ["example"]
    }
  })
})
.then(response => response.json())
.then(result => console.log(JSON.stringify(result, null, 2)))
.catch(error => console.error('Error:', error));

Python

import requests

query = 'mutation ExtractIncidentFromUrls($urls: [String!]!) { extractIncidentFromUrls(urls: $urls) { extractionToken name description type severity publishedDate classification { attackType campaignName primaryImpact secondaryImpacts impactTargets capabilities executionTriggers evidence { attackType campaignName primaryImpact secondaryImpacts impactTargets capabilities executionTriggers } metadataContractVersion } indicators { kind value versionRange fixedVersions remediationStatus remediations { action versions source vendor product packageName collectionUrl versionType affectedRange } isCompromised isCompromisedBasis infectsOnInstall ecosystem severity cvssScore cvssVersion cveIntelligence { exploitationStatus exploitationSource hasPublicExploit publicExploitLink firstReportedExploitationAt firstObservedExploitationAt kev { status checkedAt catalogFetchedAt catalogVersion dateReleased dateAdded dueDate requiredAction knownRansomwareCampaignUse } euKev { status checkedAt catalogFetchedAt source sourceDisplayName cve euvdId dateReported originSource exploitationTypes threatActors notes } articleEvidence { sourceUrl sourcePublishedAt analyzedAt analysisVersion articleTypes classificationConfidence claims { claimType reportingRelationship attributedSource explicitlyObservedAt evidenceExcerpt confidence } } vulnCheck { status dateAdded sourceUpdatedAt sensorObserved } } aiExploitSimulation { status catalogVersion catalogGeneratedAt coverage { language packageName logic conditions { ruleId condition missingEvidence negated } docs } } } confidence sourceUrls sources { url via ok indicatorCount } unfilledFields warnings indicatorScopeTruncated automaticPreviewComplete } }'

response = requests.post(
  "https://api.cloud.ox.security/api/apollo-gateway",
  headers={
    "Content-Type": "application/json",
    "Authorization": "YOUR_API_TOKEN"
  },
  json={
    "query": query,
    # This is an example input showing all available input fields. Only fields marked as required in the schema are mandatory.
    "variables": {
      "urls": ["example"]
    }
  }
)

if response.status_code == 200:
    result = response.json()
    print(result)
else:
    print(f"Error: {response.status_code}")
    print(response.text)

Arguments

You can use the following argument(s) to customize your extractIncidentFromUrls mutation.

Argument	Description	Supported fields
urls [String!]! required

Fields

Return type: ExtractedIncidentDraft!

You can use the following field(s) to specify what information your extractIncidentFromUrls mutation will return. Please note that some fields may have their own subfields.

Field	Description	Supported fields
extractionToken String
name String
description String
type IncidentType
severity IncidentSeverity
publishedDate String
classification IncidentClassification	Structured threat classification derived from the sources. Absent when no source establishes one.	attackType IncidentAttackType campaignName String primaryImpact IncidentImpact secondaryImpacts [IncidentImpact!] impactTargets [IncidentImpactTarget!] capabilities [IncidentCapability!] executionTriggers [IncidentExecutionTrigger!] evidence IncidentClassificationEvidence metadataContractVersion String
indicators [ExtractedIndicator!]!		kind IndicatorKind! value String! versionRange String fixedVersions [String!]! remediationStatus IndicatorRemediationStatus! remediations [ExtractedRemediation!]! isCompromised Boolean isCompromisedBasis String infectsOnInstall Boolean ecosystem String severity IncidentSeverity cvssScore Float cvssVersion String cveIntelligence CveIntelligence aiExploitSimulation AiExploitSimulation
confidence String!
sourceUrls [String!]!
sources [ExtractionSourceResolution!]!		url String! via String! ok Boolean! indicatorCount Float
unfilledFields [String!]!
warnings [String!]!
indicatorScopeTruncated Boolean	Whether extraction discarded indicators because the monitored scope exceeded its limit.
automaticPreviewComplete Boolean	Whether all sources and required enrichment completed for automatic publication.