Ctrlk
Book a demoOX Security
For the complete documentation index, see llms.txt. This page is also available as Markdown.

incidentEvidenceItem

Examples

type IncidentEvidenceItem {
  id: String!
  incidentId: String!
  category: EvidenceCategory!
  state: EvidenceState!
  severity: IncidentSeverity
  title: String!
  resourceName: String!
  resourceDetail: String
  pipelineOutcome: PipelineOutcome
  targetBranch: String
  appName: String
  appType: String
  hitIndicatorValues: [String!]!
  foundVersion: String
  libraryName: String
  libraryVersion: String
  isRunning: Boolean
  runtimeStatus: String
  cloudRunState: CloudRunState
  isUsed: Boolean
  aiSimulation: AiSimulationVerdict
  exploitabilityVerdict: ExploitabilityVerdict
  cveExploitability: [CveExploitability!]
  cveExploitabilityOverflow: Int
  linkedIssueId: String
  factorEvidence: [IncidentEvidenceFactorEvidence!]
  isInternetExposed: Boolean
  dependencyType: EvidenceDependencyType
  pinState: String
  stateReason: String
  externalUrl: String
  asOf: DateTime!
  developerEmail: String
  commandRanAt: DateTime
  devEnvironmentOutcome: DevEnvironmentOutcome
  resourceOwner: String
  issueId: String
  joinableIssueId: String
  jiraTicketKeys: [String!]
  sbomAppId: String
  sbomLibrary: String
  isFixAvailable: Boolean
  hasTicket: Boolean
  commentCount: Int
  latestCommentText: String
  latestCommentAuthorName: String
  latestCommentAt: DateTime
  isGptAvailable: Boolean
  isExcluded: Boolean
  hasJiraTicket: Boolean
  hasNonJiraTicket: Boolean
  hasSeverityOverride: Boolean
  originalIssueSeverity: IncidentSeverity
  hasOwnerOverride: Boolean
  originalOwnerName: String
  originalOwnerEmail: String
  currentOwnerName: String
  currentOwnerEmail: String
  hasMessages: Boolean
  isFixApplied: Boolean
  isExcludedByAlert: Boolean
  isFalsePositive: Boolean
  isCanceledFalsePositive: Boolean
  appTags: [String!]!
  businessUnits: [IncidentBusinessUnitRef!]!
  hasPullRequest: Boolean
  hasFalsePositiveDetails: Boolean
  falsePositiveComment: String
  cancelFalsePositiveComment: String
}

Fields

Field
Description
Supported fields

id String!

incidentId String!

category EvidenceCategory!

state EvidenceState!

severity IncidentSeverity

title String!

resourceName String!

resourceDetail String

pipelineOutcome PipelineOutcome

targetBranch String

appName String

appType String

hitIndicatorValues [String!]!

foundVersion String

The version of the matched package found in this row. Absent for issue rows and when the match did not evaluate a version.

libraryName String

The name of the package this row represents. Absent when no package identity is available for the row.

libraryVersion String

The version of the package this row represents. Absent when no package identity is available for the row.

isRunning Boolean

runtimeStatus String

cloudRunState CloudRunState

isUsed Boolean

Code SBOM, Code Issue and Container Issue rows only. Whether application code imports the dependency. Absent when the scanner has not evaluated usage.

aiSimulation AiSimulationVerdict

Code Issue and Container Issue rows only. Whether the AI simulator judged the matched CVE exploit path reachable. Absent when no matched CVE carries an AI Simulation verdict.

exploitabilityVerdict ExploitabilityVerdict

Primary Code Issue and Container Issue rows only. The Exploitability Verdict rolled up over the monitored CVEs of the row. Absent when the row carries no verdict or it has not been computed yet.

cveExploitability [CveExploitability!]

Primary Code Issue and Container Issue rows only. The Exploitability Verdict of each monitored CVE of the row, capped. Empty for malicious-dependency rows, which have no CVE list.

cve String! library String verdict ExploitabilityVerdict! aiSimulation AiSimulationVerdict runtimeStatus String

cveExploitabilityOverflow Int

The number of monitored CVEs of the row beyond the capped per-CVE list. The rollup counts them.

linkedIssueId String

Code Issue and Container Issue rows only. The scanner issue id of the linked issue: the code issue of a container issue, or the container issue of a code issue. Absent when the scanner links no issue.

factorEvidence [IncidentEvidenceFactorEvidence!]

Severity-factor evidence backing the Findings verdict columns, scoped to the CVEs and library this row matched. Only populated when includeFactorEvidence is requested; absent for non-issue rows or when no matched factor carries evidence.

signal FactorEvidenceSignal! factorId String! factorName String! cve String library String items [IncidentEvidenceFactorEvidenceItem!]!

isInternetExposed Boolean

dependencyType EvidenceDependencyType

pinState String

stateReason String

externalUrl String

asOf DateTime!

developerEmail String

commandRanAt DateTime

DevEnvironment rows — when the install command actually ran.

devEnvironmentOutcome DevEnvironmentOutcome

DevEnvironment rows — the ox-ai-agent governance verdict for the install: Blocked, Flagged, or Allowed.

resourceOwner String

issueId String

joinableIssueId String

The scanner issue id that is safe to join on for issue mutations. Absent when the row carries no real issue id.

jiraTicketKeys [String!]

Keys of the Jira tickets already attached to the source issue.

sbomAppId String

sbomLibrary String

isFixAvailable Boolean

hasTicket Boolean

commentCount Int

latestCommentText String

Newest comment body, truncated — drives the Actions-column comment tooltip preview.

latestCommentAuthorName String

latestCommentAt DateTime

isGptAvailable Boolean

isExcluded Boolean

hasJiraTicket Boolean

hasNonJiraTicket Boolean

hasSeverityOverride Boolean

originalIssueSeverity IncidentSeverity

hasOwnerOverride Boolean

originalOwnerName String

originalOwnerEmail String

currentOwnerName String

currentOwnerEmail String

hasMessages Boolean

isFixApplied Boolean

isExcludedByAlert Boolean

isFalsePositive Boolean

isCanceledFalsePositive Boolean

appTags [String!]!

Application tags of the application this evidence row belongs to, resolved per request from the current tag assignments of that application. Empty when the application carries no tags or could not be resolved.

businessUnits [IncidentBusinessUnitRef!]!

Business units of the application this evidence row belongs to, resolved per request from the org-unit hierarchy. Empty when the application belongs to no business unit or could not be resolved.

id String! name String!

hasPullRequest Boolean

Whether an OX-opened pull request is attached to the source issue of this evidence row.

hasFalsePositiveDetails Boolean

falsePositiveComment String

cancelFalsePositiveComment String

References

Fields with this object:

Last updated