getIncidents

Get a paginated list of incidents with filters.

Examples

query GetIncidents($input: GetIncidentsInput) {
  getIncidents(input: $input) {
    items {
      id
      caseId
      name
      description
      type
      severity
      status
      blockedReason
      owner
      creator
      slaTargetAt
      settings {
        allowManualClosure
        autoCloseWhenResolved
        cleanDaysBeforeClose
        autoReopenOnNewHit
        watchWindowDays
      }
      isOxDeclared
      autoExpandFromSource
      externalReferences
      sourcePublishedAt
      counts {
        affectedApps
        affectedRepos
        affectedImages
        openFindings
        resolvedFindings
        sbomMatches
        pipelineHits
        clearedMatches
        blockedItems
        cloudAccounts
        cloudRunningImages
        cloudRunningThisVersionImages
        openFindingsBySeverity {
          appoxalypse
          critical
          high
          medium
          low
        }
      }
      exposureState
      currentSeverity
      isMonitoring
      affectedResourceCount
      summary {
        title
        bullets
        lines {
          segments {
            text
            emphasis
          }
        }
      }
      aiSummary {
        bullets
        generatedAt
        model
      }
      indicatorCounts {
        cve
        package
        packageRange
        image
        issue
        advisorySource
      }
      countsAsOf
      lastMatchedAt
      lastExposureChange
      resolvedAt
      createdAt
      updatedAt
      indicators {
        id
        incidentId
        kind
        value
        versionRange
        fixedVersions
        severity
        cvssScore
        addedAt
        source
        addedBy
        status
        url
        lastFetchedAt
        autoExpand
      }
    }
    totalCount
    hasMore
  }
}

Variables

This is an example input showing all available input fields. Only fields marked as required in the schema are mandatory.

{
  "input": {
    "search": "example",
    "statuses": ["Open"],
    "severities": ["Low"],
    "types": ["MaliciousLibrary"],
    "owners": ["example"],
    "isOxDeclared": true,
    "createdFrom": "example",
    "createdTo": "example",
    "conditionalFilters": [
      {
        "fieldName": "example",
        "values": ["example"],
        "condition": "OR"
      }
    ],
    "sortBy": "updatedAt",
    "sortOrder": "asc",
    "limit": 100,
    "offset": 0
  }
}

curl -X POST \
https://api.cloud.ox.security/api/apollo-gateway \
-H 'Content-Type: application/json' \
-H 'Authorization: YOUR_API_TOKEN' \
-d '{
 "query": "query GetIncidents($input: GetIncidentsInput) { getIncidents(input: $input) { items { id caseId name description type severity status blockedReason owner creator slaTargetAt settings { allowManualClosure autoCloseWhenResolved cleanDaysBeforeClose autoReopenOnNewHit watchWindowDays } isOxDeclared autoExpandFromSource externalReferences sourcePublishedAt counts { affectedApps affectedRepos affectedImages openFindings resolvedFindings sbomMatches pipelineHits clearedMatches blockedItems cloudAccounts cloudRunningImages cloudRunningThisVersionImages openFindingsBySeverity { appoxalypse critical high medium low } } exposureState currentSeverity isMonitoring affectedResourceCount summary { title bullets lines { segments { text emphasis } } } aiSummary { bullets generatedAt model } indicatorCounts { cve package packageRange image issue advisorySource } countsAsOf lastMatchedAt lastExposureChange resolvedAt createdAt updatedAt indicators { id incidentId kind value versionRange fixedVersions severity cvssScore addedAt source addedBy status url lastFetchedAt autoExpand } } totalCount hasMore } }",
 "variables": {
    "input": {
      "search": "example",
      "statuses": ["Open"],
      "severities": ["Low"],
      "types": ["MaliciousLibrary"],
      "owners": ["example"],
      "isOxDeclared": true,
      "createdFrom": "example",
      "createdTo": "example",
      "conditionalFilters": [
        {
          "fieldName": "example",
          "values": ["example"],
          "condition": "OR"
        }
      ],
      "sortBy": "updatedAt",
      "sortOrder": "asc",
      "limit": 100,
      "offset": 0
    }
  }
}'

const query = 'query GetIncidents($input: GetIncidentsInput) { getIncidents(input: $input) { items { id caseId name description type severity status blockedReason owner creator slaTargetAt settings { allowManualClosure autoCloseWhenResolved cleanDaysBeforeClose autoReopenOnNewHit watchWindowDays } isOxDeclared autoExpandFromSource externalReferences sourcePublishedAt counts { affectedApps affectedRepos affectedImages openFindings resolvedFindings sbomMatches pipelineHits clearedMatches blockedItems cloudAccounts cloudRunningImages cloudRunningThisVersionImages openFindingsBySeverity { appoxalypse critical high medium low } } exposureState currentSeverity isMonitoring affectedResourceCount summary { title bullets lines { segments { text emphasis } } } aiSummary { bullets generatedAt model } indicatorCounts { cve package packageRange image issue advisorySource } countsAsOf lastMatchedAt lastExposureChange resolvedAt createdAt updatedAt indicators { id incidentId kind value versionRange fixedVersions severity cvssScore addedAt source addedBy status url lastFetchedAt autoExpand } } totalCount hasMore } }';

fetch("https://api.cloud.ox.security/api/apollo-gateway", {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
    "Authorization": "YOUR_API_TOKEN"
  },
  body: JSON.stringify({
    query: query,
    // This is an example input showing all available input fields. Only fields marked as required in the schema are mandatory.
    variables: {
      input: {
        search: "example",
        statuses: ["Open"],
        severities: ["Low"],
        types: ["MaliciousLibrary"],
        owners: ["example"],
        isOxDeclared: true,
        createdFrom: "example",
        createdTo: "example",
        conditionalFilters: [
          {
            fieldName: "example",
            values: ["example"],
            condition: "OR"
          }
        ],
        sortBy: "updatedAt",
        sortOrder: "asc",
        limit: 100,
        offset: 0
      }
    }
  })
})
.then(response => response.json())
.then(result => console.log(JSON.stringify(result, null, 2)))
.catch(error => console.error('Error:', error));

import requests

query = 'query GetIncidents($input: GetIncidentsInput) { getIncidents(input: $input) { items { id caseId name description type severity status blockedReason owner creator slaTargetAt settings { allowManualClosure autoCloseWhenResolved cleanDaysBeforeClose autoReopenOnNewHit watchWindowDays } isOxDeclared autoExpandFromSource externalReferences sourcePublishedAt counts { affectedApps affectedRepos affectedImages openFindings resolvedFindings sbomMatches pipelineHits clearedMatches blockedItems cloudAccounts cloudRunningImages cloudRunningThisVersionImages openFindingsBySeverity { appoxalypse critical high medium low } } exposureState currentSeverity isMonitoring affectedResourceCount summary { title bullets lines { segments { text emphasis } } } aiSummary { bullets generatedAt model } indicatorCounts { cve package packageRange image issue advisorySource } countsAsOf lastMatchedAt lastExposureChange resolvedAt createdAt updatedAt indicators { id incidentId kind value versionRange fixedVersions severity cvssScore addedAt source addedBy status url lastFetchedAt autoExpand } } totalCount hasMore } }'

response = requests.post(
  "https://api.cloud.ox.security/api/apollo-gateway",
  headers={
    "Content-Type": "application/json",
    "Authorization": "YOUR_API_TOKEN"
  },
  json={
    "query": query,
    # This is an example input showing all available input fields. Only fields marked as required in the schema are mandatory.
    "variables": {
      "input": {
        "search": "example",
        "statuses": ["Open"],
        "severities": ["Low"],
        "types": ["MaliciousLibrary"],
        "owners": ["example"],
        "isOxDeclared": true,
        "createdFrom": "example",
        "createdTo": "example",
        "conditionalFilters": [
          {
            "fieldName": "example",
            "values": ["example"],
            "condition": "OR"
          }
        ],
        "sortBy": "updatedAt",
        "sortOrder": "asc",
        "limit": 100,
        "offset": 0
      }
    }
  }
)

if response.status_code == 200:
    result = response.json()
    print(result)
else:
    print(f"Error: {response.status_code}")
    print(response.text)

Arguments

You can use the following argument(s) to customize your getIncidents query.

Argument

Description

Supported fields

input GetIncidentsInput

search String statuses [IncidentStatus!] severities [IncidentSeverity!] types [IncidentType!] owners [String!] isOxDeclared Boolean createdFrom DateTime createdTo DateTime conditionalFilters [IncidentConditionalFilterInput!] sortBy IncidentSortField sortOrder SortOrder limit Int offset Int

Fields

Return type: IncidentsConnection!

You can use the following field(s) to specify what information your getIncidents query will return. Please note that some fields may have their own subfields.

Field

Description

Supported fields

items [Incident!]!

id String! caseId String! name String! description String type IncidentType! severity IncidentSeverity! status IncidentStatus! blockedReason String owner String creator String! slaTargetAt DateTime settings IncidentSettings! isOxDeclared Boolean! autoExpandFromSource Boolean! externalReferences [String!]! sourcePublishedAt DateTime counts IncidentCounts! exposureState ExposureState currentSeverity IncidentSeverity isMonitoring Boolean! affectedResourceCount Int! summary [IncidentSummarySection!]! aiSummary IncidentAiSummary indicatorCounts IncidentIndicatorCounts countsAsOf DateTime lastMatchedAt DateTime lastExposureChange DateTime resolvedAt DateTime createdAt DateTime updatedAt DateTime indicators [Indicator!]

totalCount Int!

hasMore Boolean!

Last updated 6 days ago

const query = 'query GetIncidents($input: GetIncidentsInput) { getIncidents(input: $input) { items { id caseId name description type severity status blockedReason owner creator slaTargetAt settings { allowManualClosure autoCloseWhenResolved cleanDaysBeforeClose autoReopenOnNewHit watchWindowDays } isOxDeclared autoExpandFromSource externalReferences sourcePublishedAt counts { affectedApps affectedRepos affectedImages openFindings resolvedFindings sbomMatches pipelineHits clearedMatches blockedItems cloudAccounts cloudRunningImages cloudRunningThisVersionImages openFindingsBySeverity { appoxalypse critical high medium low } } exposureState currentSeverity isMonitoring affectedResourceCount summary { title bullets lines { segments { text emphasis } } } aiSummary { bullets generatedAt model } indicatorCounts { cve package packageRange image issue advisorySource } countsAsOf lastMatchedAt lastExposureChange resolvedAt createdAt updatedAt indicators { id incidentId kind value versionRange fixedVersions severity cvssScore addedAt source addedBy status url lastFetchedAt autoExpand } } totalCount hasMore } }'; fetch("https://api.cloud.ox.security/api/apollo-gateway", { method: "POST", headers: { "Content-Type": "application/json", "Authorization": "YOUR_API_TOKEN" }, body: JSON.stringify({ query: query, // This is an example input showing all available input fields. Only fields marked as required in the schema are mandatory. variables: { input: { search: "example", statuses: ["Open"], severities: ["Low"], types: ["MaliciousLibrary"], owners: ["example"], isOxDeclared: true, createdFrom: "example", createdTo: "example", conditionalFilters: [ { fieldName: "example", values: ["example"], condition: "OR" } ], sortBy: "updatedAt", sortOrder: "asc", limit: 100, offset: 0 } } }) }) .then(response => response.json()) .then(result => console.log(JSON.stringify(result, null, 2))) .catch(error => console.error('Error:', error));

import requests query = 'query GetIncidents($input: GetIncidentsInput) { getIncidents(input: $input) { items { id caseId name description type severity status blockedReason owner creator slaTargetAt settings { allowManualClosure autoCloseWhenResolved cleanDaysBeforeClose autoReopenOnNewHit watchWindowDays } isOxDeclared autoExpandFromSource externalReferences sourcePublishedAt counts { affectedApps affectedRepos affectedImages openFindings resolvedFindings sbomMatches pipelineHits clearedMatches blockedItems cloudAccounts cloudRunningImages cloudRunningThisVersionImages openFindingsBySeverity { appoxalypse critical high medium low } } exposureState currentSeverity isMonitoring affectedResourceCount summary { title bullets lines { segments { text emphasis } } } aiSummary { bullets generatedAt model } indicatorCounts { cve package packageRange image issue advisorySource } countsAsOf lastMatchedAt lastExposureChange resolvedAt createdAt updatedAt indicators { id incidentId kind value versionRange fixedVersions severity cvssScore addedAt source addedBy status url lastFetchedAt autoExpand } } totalCount hasMore } }' response = requests.post( "https://api.cloud.ox.security/api/apollo-gateway", headers={ "Content-Type": "application/json", "Authorization": "YOUR_API_TOKEN" }, json={ "query": query, # This is an example input showing all available input fields. Only fields marked as required in the schema are mandatory. "variables": { "input": { "search": "example", "statuses": ["Open"], "severities": ["Low"], "types": ["MaliciousLibrary"], "owners": ["example"], "isOxDeclared": true, "createdFrom": "example", "createdTo": "example", "conditionalFilters": [ { "fieldName": "example", "values": ["example"], "condition": "OR" } ], "sortBy": "updatedAt", "sortOrder": "asc", "limit": 100, "offset": 0 } } } ) if response.status_code == 200: result = response.json() print(result) else: print(f"Error: {response.status_code}") print(response.text)