getIncidentEvidence

Evidence rows for one incident, grouped per category section (detail Evidence tab).

Examples

query GetIncidentEvidence($incidentId: String!, $input: IncidentEvidenceFilterInput) {
  getIncidentEvidence(incidentId: $incidentId, input: $input) {
    groups {
      category
      totalCount
      stateCounts {
        state
        count
      }
      stateBreakdown {
        label
        count
      }
      latestAsOf
      severityCounts {
        severity
        count
      }
      breakdownCounts {
        label
        count
      }
      items {
        id
        incidentId
        category
        state
        severity
        title
        resourceName
        resourceDetail
        pipelineOutcome
        targetBranch
        appName
        appType
        hitIndicatorValues
        isRunning
        isInternetExposed
        dependencyType
        stateReason
        externalUrl
        asOf
        developerEmail
        resourceOwner
        issueId
        sbomAppId
        sbomLibrary
        isFixAvailable
        hasTicket
        commentCount
        isGptAvailable
        isExcluded
      }
    }
  }
}

Variables

This is an example input showing all available input fields. Only fields marked as required in the schema are mandatory.

{
  "incidentId": "example",
  "input": {
    "conditionalFilters": [
      {
        "fieldName": "example",
        "values": ["example"],
        "condition": "OR"
      }
    ],
    "search": "example",
    "category": "CodeIssue",
    "itemLimit": 42,
    "itemOffset": 42
  }
}

curl -X POST \
https://api.cloud.ox.security/api/apollo-gateway \
-H 'Content-Type: application/json' \
-H 'Authorization: YOUR_API_TOKEN' \
-d '{
 "query": "query GetIncidentEvidence($incidentId: String!, $input: IncidentEvidenceFilterInput) { getIncidentEvidence(incidentId: $incidentId, input: $input) { groups { category totalCount stateCounts { state count } stateBreakdown { label count } latestAsOf severityCounts { severity count } breakdownCounts { label count } items { id incidentId category state severity title resourceName resourceDetail pipelineOutcome targetBranch appName appType hitIndicatorValues isRunning isInternetExposed dependencyType stateReason externalUrl asOf developerEmail resourceOwner issueId sbomAppId sbomLibrary isFixAvailable hasTicket commentCount isGptAvailable isExcluded } } } }",
 "variables": {
    "incidentId": "example",
    "input": {
      "conditionalFilters": [
        {
          "fieldName": "example",
          "values": ["example"],
          "condition": "OR"
        }
      ],
      "search": "example",
      "category": "CodeIssue",
      "itemLimit": 42,
      "itemOffset": 42
    }
  }
}'

const query = 'query GetIncidentEvidence($incidentId: String!, $input: IncidentEvidenceFilterInput) { getIncidentEvidence(incidentId: $incidentId, input: $input) { groups { category totalCount stateCounts { state count } stateBreakdown { label count } latestAsOf severityCounts { severity count } breakdownCounts { label count } items { id incidentId category state severity title resourceName resourceDetail pipelineOutcome targetBranch appName appType hitIndicatorValues isRunning isInternetExposed dependencyType stateReason externalUrl asOf developerEmail resourceOwner issueId sbomAppId sbomLibrary isFixAvailable hasTicket commentCount isGptAvailable isExcluded } } } }';

fetch("https://api.cloud.ox.security/api/apollo-gateway", {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
    "Authorization": "YOUR_API_TOKEN"
  },
  body: JSON.stringify({
    query: query,
    // This is an example input showing all available input fields. Only fields marked as required in the schema are mandatory.
    variables: {
      incidentId: "example",
      input: {
        conditionalFilters: [
          {
            fieldName: "example",
            values: ["example"],
            condition: "OR"
          }
        ],
        search: "example",
        category: "CodeIssue",
        itemLimit: 42,
        itemOffset: 42
      }
    }
  })
})
.then(response => response.json())
.then(result => console.log(JSON.stringify(result, null, 2)))
.catch(error => console.error('Error:', error));

import requests

query = 'query GetIncidentEvidence($incidentId: String!, $input: IncidentEvidenceFilterInput) { getIncidentEvidence(incidentId: $incidentId, input: $input) { groups { category totalCount stateCounts { state count } stateBreakdown { label count } latestAsOf severityCounts { severity count } breakdownCounts { label count } items { id incidentId category state severity title resourceName resourceDetail pipelineOutcome targetBranch appName appType hitIndicatorValues isRunning isInternetExposed dependencyType stateReason externalUrl asOf developerEmail resourceOwner issueId sbomAppId sbomLibrary isFixAvailable hasTicket commentCount isGptAvailable isExcluded } } } }'

response = requests.post(
  "https://api.cloud.ox.security/api/apollo-gateway",
  headers={
    "Content-Type": "application/json",
    "Authorization": "YOUR_API_TOKEN"
  },
  json={
    "query": query,
    # This is an example input showing all available input fields. Only fields marked as required in the schema are mandatory.
    "variables": {
      "incidentId": "example",
      "input": {
        "conditionalFilters": [
          {
            "fieldName": "example",
            "values": ["example"],
            "condition": "OR"
          }
        ],
        "search": "example",
        "category": "CodeIssue",
        "itemLimit": 42,
        "itemOffset": 42
      }
    }
  }
)

if response.status_code == 200:
    result = response.json()
    print(result)
else:
    print(f"Error: {response.status_code}")
    print(response.text)

Arguments

You can use the following argument(s) to customize your getIncidentEvidence query.

Argument

Description

Supported fields

incidentId String! required

input IncidentEvidenceFilterInput

conditionalFilters [IncidentConditionalFilterInput!] search String category EvidenceCategory itemLimit Int itemOffset Int

Fields

Return type: IncidentEvidenceResult!

You can use the following field(s) to specify what information your getIncidentEvidence query will return. Please note that some fields may have their own subfields.

Field

Description

Supported fields

groups [IncidentEvidenceGroup!]!

category EvidenceCategory! totalCount Int! stateCounts [EvidenceStateCount!]! stateBreakdown [IncidentNamedCount!]! latestAsOf DateTime severityCounts [SeverityHistogramBucket!]! breakdownCounts [IncidentNamedCount!]! items [IncidentEvidenceItem!]!

Last updated 6 days ago