getIncidentRelatedIssues

Issues on the incident's monitored libraries that belong to a different policy than its own exposure, returned as code and container evidence groups (Findings-tab Related Issues section).

Examples

GraphQL

query GetIncidentRelatedIssues($incidentId: String!, $includeFactorEvidence: Boolean) {
  getIncidentRelatedIssues(incidentId: $incidentId, includeFactorEvidence: $includeFactorEvidence) {
    groups {
      category
      totalCount
      stateCounts {
        state
        count
      }
      stateBreakdown {
        label
        count
      }
      latestAsOf
      severityCounts {
        severity
        count
      }
      breakdownCounts {
        label
        count
      }
      items {
        id
        incidentId
        category
        state
        severity
        title
        resourceName
        resourceDetail
        pipelineOutcome
        targetBranch
        appName
        appType
        hitIndicatorValues
        foundVersion
        libraryName
        libraryVersion
        isRunning
        runtimeStatus
        cloudRunState
        isUsed
        aiSimulation
        exploitabilityVerdict
        cveExploitability {
          cve
          library
          verdict
          aiSimulation
          runtimeStatus
        }
        cveExploitabilityOverflow
        linkedIssueId
        factorEvidence {
          signal
          factorId
          factorName
          cve
          library
          items {
            key
            value
            link
            snippet {
              fileName
              snippetLineNumber
              text
            }
          }
        }
        isInternetExposed
        dependencyType
        pinState
        stateReason
        externalUrl
        asOf
        developerEmail
        commandRanAt
        devEnvironmentOutcome
        resourceOwner
        issueId
        joinableIssueId
        jiraTicketKeys
        sbomAppId
        sbomLibrary
        isFixAvailable
        hasTicket
        commentCount
        latestCommentText
        latestCommentAuthorName
        latestCommentAt
        isGptAvailable
        isExcluded
        hasJiraTicket
        hasNonJiraTicket
        hasSeverityOverride
        originalIssueSeverity
        hasOwnerOverride
        originalOwnerName
        originalOwnerEmail
        currentOwnerName
        currentOwnerEmail
        hasMessages
        isFixApplied
        isExcludedByAlert
        isFalsePositive
        isCanceledFalsePositive
        appTags
        businessUnits {
          id
          name
        }
        hasPullRequest
        hasFalsePositiveDetails
        falsePositiveComment
        cancelFalsePositiveComment
      }
      columnPresence {
        aiSimulation
        isUsed
        runtimeStatus
      }
    }
  }
}

Variables

This is an example input showing all available input fields. Only fields marked as required in the schema are mandatory.

{
  "incidentId": "example",
  "includeFactorEvidence": true
}

cURL

curl -X POST \
https://api.cloud.ox.security/api/apollo-gateway \
-H 'Content-Type: application/json' \
-H 'Authorization: YOUR_API_TOKEN' \
-d '{
 "query": "query GetIncidentRelatedIssues($incidentId: String!, $includeFactorEvidence: Boolean) { getIncidentRelatedIssues(incidentId: $incidentId, includeFactorEvidence: $includeFactorEvidence) { groups { category totalCount stateCounts { state count } stateBreakdown { label count } latestAsOf severityCounts { severity count } breakdownCounts { label count } items { id incidentId category state severity title resourceName resourceDetail pipelineOutcome targetBranch appName appType hitIndicatorValues foundVersion libraryName libraryVersion isRunning runtimeStatus cloudRunState isUsed aiSimulation exploitabilityVerdict cveExploitability { cve library verdict aiSimulation runtimeStatus } cveExploitabilityOverflow linkedIssueId factorEvidence { signal factorId factorName cve library items { key value link snippet { fileName snippetLineNumber text } } } isInternetExposed dependencyType pinState stateReason externalUrl asOf developerEmail commandRanAt devEnvironmentOutcome resourceOwner issueId joinableIssueId jiraTicketKeys sbomAppId sbomLibrary isFixAvailable hasTicket commentCount latestCommentText latestCommentAuthorName latestCommentAt isGptAvailable isExcluded hasJiraTicket hasNonJiraTicket hasSeverityOverride originalIssueSeverity hasOwnerOverride originalOwnerName originalOwnerEmail currentOwnerName currentOwnerEmail hasMessages isFixApplied isExcludedByAlert isFalsePositive isCanceledFalsePositive appTags businessUnits { id name } hasPullRequest hasFalsePositiveDetails falsePositiveComment cancelFalsePositiveComment } columnPresence { aiSimulation isUsed runtimeStatus } } } }",
 "variables": {
    "incidentId": "example",
    "includeFactorEvidence": true
  }
}'

Node.js

const query = 'query GetIncidentRelatedIssues($incidentId: String!, $includeFactorEvidence: Boolean) { getIncidentRelatedIssues(incidentId: $incidentId, includeFactorEvidence: $includeFactorEvidence) { groups { category totalCount stateCounts { state count } stateBreakdown { label count } latestAsOf severityCounts { severity count } breakdownCounts { label count } items { id incidentId category state severity title resourceName resourceDetail pipelineOutcome targetBranch appName appType hitIndicatorValues foundVersion libraryName libraryVersion isRunning runtimeStatus cloudRunState isUsed aiSimulation exploitabilityVerdict cveExploitability { cve library verdict aiSimulation runtimeStatus } cveExploitabilityOverflow linkedIssueId factorEvidence { signal factorId factorName cve library items { key value link snippet { fileName snippetLineNumber text } } } isInternetExposed dependencyType pinState stateReason externalUrl asOf developerEmail commandRanAt devEnvironmentOutcome resourceOwner issueId joinableIssueId jiraTicketKeys sbomAppId sbomLibrary isFixAvailable hasTicket commentCount latestCommentText latestCommentAuthorName latestCommentAt isGptAvailable isExcluded hasJiraTicket hasNonJiraTicket hasSeverityOverride originalIssueSeverity hasOwnerOverride originalOwnerName originalOwnerEmail currentOwnerName currentOwnerEmail hasMessages isFixApplied isExcludedByAlert isFalsePositive isCanceledFalsePositive appTags businessUnits { id name } hasPullRequest hasFalsePositiveDetails falsePositiveComment cancelFalsePositiveComment } columnPresence { aiSimulation isUsed runtimeStatus } } } }';

fetch("https://api.cloud.ox.security/api/apollo-gateway", {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
    "Authorization": "YOUR_API_TOKEN"
  },
  body: JSON.stringify({
    query: query,
    // This is an example input showing all available input fields. Only fields marked as required in the schema are mandatory.
    variables: {
      incidentId: "example",
      includeFactorEvidence: true
    }
  })
})
.then(response => response.json())
.then(result => console.log(JSON.stringify(result, null, 2)))
.catch(error => console.error('Error:', error));

Python

import requests

query = 'query GetIncidentRelatedIssues($incidentId: String!, $includeFactorEvidence: Boolean) { getIncidentRelatedIssues(incidentId: $incidentId, includeFactorEvidence: $includeFactorEvidence) { groups { category totalCount stateCounts { state count } stateBreakdown { label count } latestAsOf severityCounts { severity count } breakdownCounts { label count } items { id incidentId category state severity title resourceName resourceDetail pipelineOutcome targetBranch appName appType hitIndicatorValues foundVersion libraryName libraryVersion isRunning runtimeStatus cloudRunState isUsed aiSimulation exploitabilityVerdict cveExploitability { cve library verdict aiSimulation runtimeStatus } cveExploitabilityOverflow linkedIssueId factorEvidence { signal factorId factorName cve library items { key value link snippet { fileName snippetLineNumber text } } } isInternetExposed dependencyType pinState stateReason externalUrl asOf developerEmail commandRanAt devEnvironmentOutcome resourceOwner issueId joinableIssueId jiraTicketKeys sbomAppId sbomLibrary isFixAvailable hasTicket commentCount latestCommentText latestCommentAuthorName latestCommentAt isGptAvailable isExcluded hasJiraTicket hasNonJiraTicket hasSeverityOverride originalIssueSeverity hasOwnerOverride originalOwnerName originalOwnerEmail currentOwnerName currentOwnerEmail hasMessages isFixApplied isExcludedByAlert isFalsePositive isCanceledFalsePositive appTags businessUnits { id name } hasPullRequest hasFalsePositiveDetails falsePositiveComment cancelFalsePositiveComment } columnPresence { aiSimulation isUsed runtimeStatus } } } }'

response = requests.post(
  "https://api.cloud.ox.security/api/apollo-gateway",
  headers={
    "Content-Type": "application/json",
    "Authorization": "YOUR_API_TOKEN"
  },
  json={
    "query": query,
    # This is an example input showing all available input fields. Only fields marked as required in the schema are mandatory.
    "variables": {
      "incidentId": "example",
      "includeFactorEvidence": true
    }
  }
)

if response.status_code == 200:
    result = response.json()
    print(result)
else:
    print(f"Error: {response.status_code}")
    print(response.text)

Arguments

You can use the following argument(s) to customize your getIncidentRelatedIssues query.

Argument	Description	Supported fields
incidentId String! required
includeFactorEvidence Boolean	When true, each issue row also carries factorEvidence read live from the scanner issue. Off by default because it costs extra scanner reads per page.

Fields

Return type: IncidentEvidenceResult!

You can use the following field(s) to specify what information your getIncidentRelatedIssues query will return. Please note that some fields may have their own subfields.

Field	Description	Supported fields
groups [IncidentEvidenceGroup!]!		category EvidenceCategory! totalCount Int! stateCounts [EvidenceStateCount!]! stateBreakdown [IncidentNamedCount!]! latestAsOf DateTime severityCounts [SeverityHistogramBucket!]! breakdownCounts [IncidentNamedCount!]! items [IncidentEvidenceItem!]! columnPresence IncidentEvidenceColumnPresence!