> For the complete documentation index, see [llms.txt](https://docs.ox.security/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.ox.security/api-documentation/api-reference/api--response-center/types/objects/indicator.md).

# indicator

### Examples

```graphql
type Indicator {
  id: String!
  incidentId: String!
  kind: IndicatorKind!
  value: String!
  versionRange: String
  fixedVersions: [String!]!
  remediationStatus: IndicatorRemediationStatus
  remediations: [IndicatorRemediation!]!
  isCompromised: Boolean
  isCompromisedBasis: String
  infectsOnInstall: Boolean
  ecosystem: String
  severity: IncidentSeverity
  cvssScore: Float
  cveIntelligence: CveIntelligence
  cweMetadata: CweMetadata
  addedAt: DateTime!
  source: String!
  addedBy: String
  status: String!
  url: String
  lastFetchedAt: DateTime
  autoExpand: Boolean
  matchState: IndicatorMatchState
  activeMatchCount: Int
  isUnpinned: Boolean
}
```

### Fields

| Field                                                                                                                                               | Description                                                                               | Supported fields                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
| --------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| id `String!`                                                                                                                                        |                                                                                           |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
| incidentId `String!`                                                                                                                                |                                                                                           |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
| kind [`IndicatorKind!`](/api-documentation/api-reference/api--response-center/types/enums/indicator-kind.md)                                        |                                                                                           |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
| value `String!`                                                                                                                                     |                                                                                           |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
| versionRange `String`                                                                                                                               |                                                                                           |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
| fixedVersions `[String!]!`                                                                                                                          |                                                                                           |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
| remediationStatus [`IndicatorRemediationStatus`](/api-documentation/api-reference/api--response-center/types/enums/indicator-remediation-status.md) |                                                                                           |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
| remediations [`[IndicatorRemediation!]!`](/api-documentation/api-reference/api--response-center/types/objects/indicator-remediation.md)             |                                                                                           | <p>action <a href="/api-documentation/api-reference/api--response-center/types/enums/indicator-remediation-action.md"><code>IndicatorRemediationAction!</code></a><br>versions <code>\[String!]!</code><br>source <code>String</code><br>vendor <code>String</code><br>product <code>String</code><br>packageName <code>String</code><br>collectionUrl <code>String</code><br>versionType <code>String</code><br>affectedRange <code>String</code></p>                                                                                                                                                                                                                                                                                                |
| isCompromised `Boolean`                                                                                                                             |                                                                                           |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
| isCompromisedBasis `String`                                                                                                                         |                                                                                           |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
| infectsOnInstall `Boolean`                                                                                                                          |                                                                                           |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
| ecosystem `String`                                                                                                                                  |                                                                                           |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
| severity [`IncidentSeverity`](/api-documentation/api-reference/api--response-center/types/enums/incident-severity.md)                               |                                                                                           |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
| cvssScore `Float`                                                                                                                                   |                                                                                           |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
| cveIntelligence [`CveIntelligence`](/api-documentation/api-reference/api--response-center/types/objects/cve-intelligence.md)                        | Response Center-owned exploitation and official KEV intelligence for a CVE indicator.     | <p>exploitationStatus <a href="/api-documentation/api-reference/api--response-center/types/enums/cve-exploitation-status.md"><code>CveExploitationStatus!</code></a><br>firstReportedExploitationAt <code>DateTime</code><br>firstObservedExploitationAt <code>DateTime</code><br>kev <a href="/api-documentation/api-reference/api--response-center/types/objects/cisa-kev-observation.md"><code>CisaKevObservation!</code></a><br>euKev <a href="/api-documentation/api-reference/api--response-center/types/objects/eu-kev-observation.md"><code>EuKevObservation</code></a><br>articleEvidence <a href="/api-documentation/api-reference/api--response-center/types/objects/cve-article-evidence.md"><code>\[CveArticleEvidence!]!</code></a></p> |
| cweMetadata [`CweMetadata`](/api-documentation/api-reference/api--response-center/types/objects/cwe-metadata.md)                                    | Response Center-owned CWE resolution and derived vulnerability class for a CVE indicator. | <p>status <a href="/api-documentation/api-reference/api--response-center/types/enums/cwe-metadata-status.md"><code>CweMetadataStatus!</code></a><br>cwes <code>\[String!]!</code><br>provenance <a href="/api-documentation/api-reference/api--response-center/types/objects/cwe-provenance-entry.md"><code>\[CweProvenanceEntry!]!</code></a><br>vulnerabilityClass <a href="/api-documentation/api-reference/api--response-center/types/enums/cve-vulnerability-class.md"><code>CveVulnerabilityClass</code></a><br>vulnerabilityClassSource <a href="/api-documentation/api-reference/api--response-center/types/enums/cwe-source.md"><code>CweSource</code></a><br>mappingVersion <code>String!</code><br>resolvedAt <code>DateTime!</code></p>   |
| addedAt `DateTime!`                                                                                                                                 |                                                                                           |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
| source `String!`                                                                                                                                    |                                                                                           |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
| addedBy `String`                                                                                                                                    |                                                                                           |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
| status `String!`                                                                                                                                    |                                                                                           |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
| url `String`                                                                                                                                        |                                                                                           |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
| lastFetchedAt `DateTime`                                                                                                                            |                                                                                           |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
| autoExpand `Boolean`                                                                                                                                |                                                                                           |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
| matchState [`IndicatorMatchState`](/api-documentation/api-reference/api--response-center/types/enums/indicator-match-state.md)                      |                                                                                           |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
| activeMatchCount `Int`                                                                                                                              |                                                                                           |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
| isUnpinned `Boolean`                                                                                                                                |                                                                                           |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |

### References

#### Mutations using this object:

* [<\~> addIncidentIndicators](/api-documentation/api-reference/api--response-center/mutations/add-incident-indicators.md)
* [<\~> updateIncidentIndicator](/api-documentation/api-reference/api--response-center/mutations/update-incident-indicator.md)

#### Fields with this object:

* [{} Incident.indicators](/api-documentation/api-reference/api--response-center/types/objects/incident.md)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.ox.security/api-documentation/api-reference/api--response-center/types/objects/indicator.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.