updateIncidentIndicator

Edit an indicator (version range / fixed versions; re-runs the matcher).

Examples

GraphQL

mutation UpdateIncidentIndicator($incidentId: String!, $indicatorId: String!, $input: UpdateIndicatorInput!) {
  updateIncidentIndicator(incidentId: $incidentId, indicatorId: $indicatorId, input: $input) {
    id
    incidentId
    kind
    value
    versionRange
    fixedVersions
    remediationStatus
    remediations {
      action
      versions
      source
      vendor
      product
      packageName
      collectionUrl
      versionType
      affectedRange
    }
    isCompromised
    isCompromisedBasis
    infectsOnInstall
    ecosystem
    severity
    cvssScore
    cvssVersion
    epssScore
    epssPercentile
    epssDate
    epssCheckedAt
    cveIntelligence {
      exploitationStatus
      exploitationSource
      hasPublicExploit
      publicExploitLink
      firstReportedExploitationAt
      firstObservedExploitationAt
      kev {
        status
        checkedAt
        catalogFetchedAt
        catalogVersion
        dateReleased
        dateAdded
        dueDate
        requiredAction
        knownRansomwareCampaignUse
      }
      euKev {
        status
        checkedAt
        catalogFetchedAt
        source
        sourceDisplayName
        cve
        euvdId
        dateReported
        originSource
        exploitationTypes
        threatActors
        notes
      }
      articleEvidence {
        sourceUrl
        sourcePublishedAt
        analyzedAt
        analysisVersion
        articleTypes
        classificationConfidence
        claims {
          claimType
          reportingRelationship
          attributedSource
          explicitlyObservedAt
          evidenceExcerpt
          confidence
        }
      }
      vulnCheck {
        status
        dateAdded
        sourceUpdatedAt
        sensorObserved
      }
    }
    cweMetadata {
      status
      cwes
      provenance {
        source
        cwes
      }
      vulnerabilityClass
      vulnerabilityClassSource
      mappingVersion
      resolvedAt
    }
    addedAt
    source
    addedBy
    status
    url
    lastFetchedAt
    autoExpand
    matchState
    activeMatchCount
    isUnpinned
    aiExploitSimulation {
      status
      catalogVersion
      catalogGeneratedAt
      coverage {
        language
        packageName
        logic
        conditions {
          ruleId
          condition
          missingEvidence
          negated
        }
        docs
      }
    }
  }
}

Variables

This is an example input showing all available input fields. Only fields marked as required in the schema are mandatory.

{
  "incidentId": "example",
  "indicatorId": "example",
  "input": {
    "versionRange": "example",
    "fixedVersions": ["example"],
    "remediationStatus": "known",
    "remediations": [
      {
        "action": "upgrade",
        "versions": ["example"],
        "vendor": "example",
        "product": "example",
        "packageName": "example",
        "collectionUrl": "example",
        "versionType": "example",
        "affectedRange": "example"
      }
    ]
  }
}

cURL

curl -X POST \
https://api.cloud.ox.security/api/apollo-gateway \
-H 'Content-Type: application/json' \
-H 'Authorization: YOUR_API_TOKEN' \
-d '{
 "query": "mutation UpdateIncidentIndicator($incidentId: String!, $indicatorId: String!, $input: UpdateIndicatorInput!) { updateIncidentIndicator(incidentId: $incidentId, indicatorId: $indicatorId, input: $input) { id incidentId kind value versionRange fixedVersions remediationStatus remediations { action versions source vendor product packageName collectionUrl versionType affectedRange } isCompromised isCompromisedBasis infectsOnInstall ecosystem severity cvssScore cvssVersion epssScore epssPercentile epssDate epssCheckedAt cveIntelligence { exploitationStatus exploitationSource hasPublicExploit publicExploitLink firstReportedExploitationAt firstObservedExploitationAt kev { status checkedAt catalogFetchedAt catalogVersion dateReleased dateAdded dueDate requiredAction knownRansomwareCampaignUse } euKev { status checkedAt catalogFetchedAt source sourceDisplayName cve euvdId dateReported originSource exploitationTypes threatActors notes } articleEvidence { sourceUrl sourcePublishedAt analyzedAt analysisVersion articleTypes classificationConfidence claims { claimType reportingRelationship attributedSource explicitlyObservedAt evidenceExcerpt confidence } } vulnCheck { status dateAdded sourceUpdatedAt sensorObserved } } cweMetadata { status cwes provenance { source cwes } vulnerabilityClass vulnerabilityClassSource mappingVersion resolvedAt } addedAt source addedBy status url lastFetchedAt autoExpand matchState activeMatchCount isUnpinned aiExploitSimulation { status catalogVersion catalogGeneratedAt coverage { language packageName logic conditions { ruleId condition missingEvidence negated } docs } } } }",
 "variables": {
    "incidentId": "example",
    "indicatorId": "example",
    "input": {
      "versionRange": "example",
      "fixedVersions": ["example"],
      "remediationStatus": "known",
      "remediations": [
        {
          "action": "upgrade",
          "versions": ["example"],
          "vendor": "example",
          "product": "example",
          "packageName": "example",
          "collectionUrl": "example",
          "versionType": "example",
          "affectedRange": "example"
        }
      ]
    }
  }
}'

Node.js

const query = 'mutation UpdateIncidentIndicator($incidentId: String!, $indicatorId: String!, $input: UpdateIndicatorInput!) { updateIncidentIndicator(incidentId: $incidentId, indicatorId: $indicatorId, input: $input) { id incidentId kind value versionRange fixedVersions remediationStatus remediations { action versions source vendor product packageName collectionUrl versionType affectedRange } isCompromised isCompromisedBasis infectsOnInstall ecosystem severity cvssScore cvssVersion epssScore epssPercentile epssDate epssCheckedAt cveIntelligence { exploitationStatus exploitationSource hasPublicExploit publicExploitLink firstReportedExploitationAt firstObservedExploitationAt kev { status checkedAt catalogFetchedAt catalogVersion dateReleased dateAdded dueDate requiredAction knownRansomwareCampaignUse } euKev { status checkedAt catalogFetchedAt source sourceDisplayName cve euvdId dateReported originSource exploitationTypes threatActors notes } articleEvidence { sourceUrl sourcePublishedAt analyzedAt analysisVersion articleTypes classificationConfidence claims { claimType reportingRelationship attributedSource explicitlyObservedAt evidenceExcerpt confidence } } vulnCheck { status dateAdded sourceUpdatedAt sensorObserved } } cweMetadata { status cwes provenance { source cwes } vulnerabilityClass vulnerabilityClassSource mappingVersion resolvedAt } addedAt source addedBy status url lastFetchedAt autoExpand matchState activeMatchCount isUnpinned aiExploitSimulation { status catalogVersion catalogGeneratedAt coverage { language packageName logic conditions { ruleId condition missingEvidence negated } docs } } } }';

fetch("https://api.cloud.ox.security/api/apollo-gateway", {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
    "Authorization": "YOUR_API_TOKEN"
  },
  body: JSON.stringify({
    query: query,
    // This is an example input showing all available input fields. Only fields marked as required in the schema are mandatory.
    variables: {
      incidentId: "example",
      indicatorId: "example",
      input: {
        versionRange: "example",
        fixedVersions: ["example"],
        remediationStatus: "known",
        remediations: [
          {
            action: "upgrade",
            versions: ["example"],
            vendor: "example",
            product: "example",
            packageName: "example",
            collectionUrl: "example",
            versionType: "example",
            affectedRange: "example"
          }
        ]
      }
    }
  })
})
.then(response => response.json())
.then(result => console.log(JSON.stringify(result, null, 2)))
.catch(error => console.error('Error:', error));

Python

import requests

query = 'mutation UpdateIncidentIndicator($incidentId: String!, $indicatorId: String!, $input: UpdateIndicatorInput!) { updateIncidentIndicator(incidentId: $incidentId, indicatorId: $indicatorId, input: $input) { id incidentId kind value versionRange fixedVersions remediationStatus remediations { action versions source vendor product packageName collectionUrl versionType affectedRange } isCompromised isCompromisedBasis infectsOnInstall ecosystem severity cvssScore cvssVersion epssScore epssPercentile epssDate epssCheckedAt cveIntelligence { exploitationStatus exploitationSource hasPublicExploit publicExploitLink firstReportedExploitationAt firstObservedExploitationAt kev { status checkedAt catalogFetchedAt catalogVersion dateReleased dateAdded dueDate requiredAction knownRansomwareCampaignUse } euKev { status checkedAt catalogFetchedAt source sourceDisplayName cve euvdId dateReported originSource exploitationTypes threatActors notes } articleEvidence { sourceUrl sourcePublishedAt analyzedAt analysisVersion articleTypes classificationConfidence claims { claimType reportingRelationship attributedSource explicitlyObservedAt evidenceExcerpt confidence } } vulnCheck { status dateAdded sourceUpdatedAt sensorObserved } } cweMetadata { status cwes provenance { source cwes } vulnerabilityClass vulnerabilityClassSource mappingVersion resolvedAt } addedAt source addedBy status url lastFetchedAt autoExpand matchState activeMatchCount isUnpinned aiExploitSimulation { status catalogVersion catalogGeneratedAt coverage { language packageName logic conditions { ruleId condition missingEvidence negated } docs } } } }'

response = requests.post(
  "https://api.cloud.ox.security/api/apollo-gateway",
  headers={
    "Content-Type": "application/json",
    "Authorization": "YOUR_API_TOKEN"
  },
  json={
    "query": query,
    # This is an example input showing all available input fields. Only fields marked as required in the schema are mandatory.
    "variables": {
      "incidentId": "example",
      "indicatorId": "example",
      "input": {
        "versionRange": "example",
        "fixedVersions": ["example"],
        "remediationStatus": "known",
        "remediations": [
          {
            "action": "upgrade",
            "versions": ["example"],
            "vendor": "example",
            "product": "example",
            "packageName": "example",
            "collectionUrl": "example",
            "versionType": "example",
            "affectedRange": "example"
          }
        ]
      }
    }
  }
)

if response.status_code == 200:
    result = response.json()
    print(result)
else:
    print(f"Error: {response.status_code}")
    print(response.text)

Arguments

You can use the following argument(s) to customize your updateIncidentIndicator mutation.

Argument	Description	Supported fields
incidentId String! required
indicatorId String! required
input UpdateIndicatorInput! required		versionRange String fixedVersions [String!] remediationStatus IndicatorRemediationStatus remediations [IndicatorRemediationInput!]

Fields

Return type: Indicator!

You can use the following field(s) to specify what information your updateIncidentIndicator mutation will return. Please note that some fields may have their own subfields.

Field	Description	Supported fields
id String!
incidentId String!
kind IndicatorKind!
value String!
versionRange String
fixedVersions [String!]!
remediationStatus IndicatorRemediationStatus
remediations [IndicatorRemediation!]!		action IndicatorRemediationAction! versions [String!]! source String vendor String product String packageName String collectionUrl String versionType String affectedRange String
isCompromised Boolean
isCompromisedBasis String
infectsOnInstall Boolean
ecosystem String
severity IncidentSeverity
cvssScore Float
cvssVersion String	CVSS specification version that produced the indicator's CVSS score.
epssScore Float	FIRST EPSS probability of exploitation in the next 30 days, from zero to one.
epssPercentile Float	FIRST EPSS percentile among scored CVEs, from zero to one.
epssDate String	FIRST score date in YYYY-MM-DD format.
epssCheckedAt DateTime	Last Response Center attempt to check FIRST EPSS for this CVE.
cveIntelligence CveIntelligence	Response Center-owned exploitation and official KEV intelligence for a CVE indicator.	exploitationStatus CveExploitationStatus! exploitationSource CveExploitationSource hasPublicExploit Boolean publicExploitLink String firstReportedExploitationAt DateTime firstObservedExploitationAt DateTime kev CisaKevObservation! euKev EuKevObservation articleEvidence [CveArticleEvidence!]! vulnCheck VulnCheckKevObservation!
cweMetadata CweMetadata	Response Center-owned CWE resolution and derived vulnerability class for a CVE indicator.	status CweMetadataStatus! cwes [String!]! provenance [CweProvenanceEntry!]! vulnerabilityClass CveVulnerabilityClass vulnerabilityClassSource CweSource mappingVersion String! resolvedAt DateTime!
addedAt DateTime!
source String!
addedBy String
status String!
url String
lastFetchedAt DateTime
autoExpand Boolean
matchState IndicatorMatchState
activeMatchCount Int
isUnpinned Boolean
aiExploitSimulation AiExploitSimulation	Whether the CVE has an OX AI exploit simulation available, and what it checks.	status AiExploitSimulationStatus! catalogVersion String catalogGeneratedAt DateTime coverage [AiExploitSimulationCoverage!]!