{"openapi":"3.0.0","info":{"title":"ThreatDown APIs","description":"# Introduction\nThreatDown OneView APIs provide you resources to remotely manage the security of your devices from code. It integrates ThreatDown protection into your workflows and pipelines. The following are some of the actions you can do with OneView APIs:\n\n- Manage the security of your endpoints.\n- Analyze endpoint assets.\n- Perform advance analysis on detections of malware, ransomware, exploits, and other threats by ThreatDown Endpoint Agent.\n- Scan, isolate, remediate, and reboot endpoints.\n- Create new sites.\n- Provision OneView users.\n- Create subscriptions for your customers.\n- Subscribe to security Webhook events to get notified of detections.\n\n## Authentication\n\nThreatDown API uses OAuth2 to allow secure authorization in a simple and standard method from web, mobile, and desktop applications.\n\nRefer to the [Authentication](#operation/api.oneview.oauth2.token) endpoint to retrieve an `access_token` using your `client_id` and `client_secret`.\n\n## Access' scopes\n\nAccess scopes are the permissions that applications require for authorization and use. \n\nWhen creating a new application, you can decide the access level the application has to your account's data. This utility allows you to restrict the scope of access to your account's data depending on the application's needs. For example, if you only need to analyze detections found on your endpoint, the read scope will be enough to prevent that application from modifying data or issuing jobs.\n\nSpecifying access scopes gives you control over the access of your data. You can set different scopes to provide the appropriate credentials to your team. For example, you may want your company's IT department to be able to isolate infected endpoints, while you may want your analysts to only read data for generating reports. To do so, you can create two applications using different scopes, and provide the right people with the right pair of credentials for programmatic access.\n\nSee [Authentication](#operation/api.oneview.oauth2.token) for available scopes.\n\n## User permissions\n\nThe user associated with the client (i.e. the user that created the OAuth2 application) must have the required permissions to perform the requested operation. If the user does not have sufficient permissions, the API will respond with a `403 Forbidden` status code.\nFor each API, you can find the required permissions in the AUTHORIZATIONS dropdown, under `user_permissions`.\n\nSome API requires additional permissions based on the data in the body:\n- **jobs** issue API requires `.performActions` depending on the `command` (\\ can be `endpoints`, `softwareInventory`, or `detections`)\n- **notifications** create/update API requires `.view` depending on the `category`\n- **reports** create/update API requires `.view` depending on the `type`\n\n## Getting Started\n\nAfter having obtained an `access_token`, you will be able to create [Sites](#tag/Sites) which you will be able to manage through apis.\n\nOnce you have created a customer, the next step is to use the [Subscription](#tag/Subscriptions) APIs to assign a valid subscription for your customer. This will attach an `account_id` property to your [Sites](#tag/Sites) resources that you can use for [Endpoints](#tag/Endpoints), [Detections](#tag/Detections), [Jobs](#tag/Jobs), [Webhooks](#tag/Webhooks) and other APIs for security management.\n\n## Rate Limiting\n\nThreatDown API implements a rate-limiting mechanism to prevent abuse. The rate-limiting mechanism is implemented using a leaky bucket algorithm. Once you exceed the available limit, our server will respond with a `429` status code. You can throttle your requests and retry them later.\n\nThe current limit, which you can see in the table below, has shown to be enough for most use cases. If you encounter `429` error codes, consider taking the following actions to minimize your APIs usage:\n\n- Subscribe to webhooks events instead of polling the API for reacting to changes.\n- Throttle the requests you send to the ThreatDown API for not exceeding the limit.\n- Batch requests when possible.\n- Contact us and request to increase the API quota for your application.\n\nCurrently, the default available quota is `360` requests per minute.\n\n## Available catalog codes\n\nProtection:\n\n- `BUS-CLOUD-IR-01` - ThreatDown Incident Response\n- `BUS-CLOUD-EPP-01` - ThreatDown Endpoint Protection\n- `BUS-CLOUD-EPP-SER-01` - ThreatDown Endpoint Protection for Servers\n- `BUS-CLOUD-EPR-01` - ThreatDown Endpoint Detection and Response\n- `BUS-CLOUD-EDR-SER-01` - ThreatDown Endpoint Detection and Response for Servers\n- `BUS-MBCM-01` - ThreatDown Mobile Security for Business\n\nModules:\n\n- `BUS-MBVM-01` - ThreatDown Vulnerability Assessment\n- `BUS-MBVPM-01` - ThreatDown Vulnerability & Patch Management\n- `BUS-MBDNS-01` - ThreatDown DNS Filtering\n- `BUS-MBAB-01` - ThreatDown Application Block\n- `BUS-CLOUD-MDR-01` - ThreatDown Managed Detection and Response\n- `BUS-TDEMS-01` - Email Security\n","version":"1.0.0","x-logo":{"altText":"ThreatDown logo","url":"https://assets.threatdown.com/hermes/ThreatDown_Horizontal_Navy.png","backgroundColor":"#FFFFFF"}},"tags":[{"name":"AI Detection & Response","description":"Manage governance rules and settings for AI Detection & Response (AIDR).\n\nUse these APIs to create per-tool authorization rules that determine whether specific AI tools are authorized, unauthorized, or pending review. Configure account-level defaults as a fallback when no matching rule exists.\n"},{"name":"App Block"},{"name":"Assets"},{"name":"Authentication","description":"Retrieve an access token to send authenticated requests to all the API endpoints."},{"name":"Case Management"},{"name":"Content Filtering"},{"name":"DNS"},{"name":"DNS Logs","description":"The DNS Filtering module limits the number of domain-based threats in your environment by allowing and blocking access across the network. Each time this occurs, a record is generated.\n\nUse these APIs to export the DNS activity and search through the logs."},{"name":"Detections","description":"Detections contain information on threats such as malware, ransomware, and malicious URLs found across your sites. \n\nUse the detection APIs to export detection data, retrieve details about a specific detection, and check if a detection exists across multiple sites."},{"name":"Device Control","description":"The Device Control feature manages access to USB storage drives. Activity is logged every time a USB device is blocked or restricted to read-only.\n\nUse the Device Control APIs to export device control activity, obtain information about a specific device control event, search for device control events across sites, and view device control activity grouped by a selected parameter.\n\nIf your endpoints are running Endpoint Agent version 2.0.0.81 or newer, you can utilize the APIs that manage the Allowlist, or exclusions, for Device Control. The Allowlist provides the ability to override policy controls and prevent certain USB devices from being blocked by Device Control."},{"name":"Email Protection"},{"name":"Endpoints","description":"## Endpoints Introduction\n\nAn Endpoint is a device which has the ThreatDown Endpoint Agent installed. Refer to the installation guide for more information on how to register a new endpoint. There are available Endpoint Agents for Windows, macOS, and Linux.\n\nUsing the Endpoint API, you can search your registered endpoints and retrieve their last known status. The API allows you to perform advanced queries and offers grouping capabilities so you can perform a deep analysis of your company's devices and threats found, such as Detections or Suspicious Activities.\n\nUsing the Job APIs, you can remotely perform tasks such as scanning, isolating, remediating, and rebooting the endpoints. \n\n## How to register an endpoint\n\nWhen you have purchased a valid license, you can register as many Endpoints as seats you have purchased to your account or one of your managed accounts by installing the ThreatDown Endpoint Agent.\n\nYou can install the Endpoint software with the following options:\n\n- Active Directory (AD) Group Policy\n- System Center Configuration Manager (SCCM)\n- Third-party deployment tools\n- Manually on the endpoints\n- Discovery & Deployment Tool\n\nRefer to the `Installers` API to retrieve the installers of your managed accounts.\n"},{"name":"Events"},{"name":"Exclusions","description":"Exculsions allow you to prevent trusted applications, websites, and services from being detected by our security engine. This means they won't be scanned or blocked.\n\nUse these APIs to manage the exclusions across the sites on your account."},{"name":"Firewall Management"},{"name":"Flight-recorder","description":"EDR customers can use Flight Recorder to search event data captured on endpoints that have suspicious activity monitoring enabled. \n\nUse these APIs to search through files, registry, processes, networking activity, and suspicious activities. This information can be used to investigate or identify indicators of compromise. "},{"name":"Grid","description":"# Grid Introduction\n\nUsing the following API, you can search endpoints, detections, software inventory, vulnerabilities, rid rules, os-patches, device control events and dns logs. This API allows to perform filtering, sorting, grouping and aggregating of data by specifying constraints based on the field type.\n\nAvailable constraints for searching based on value type\n\n| Value Type | Constraints |\n| --- |----|\n| Simple String | equals, not_equals, contains, not_contains |\n| String (with enum) | equals, not_equals |\n| String/UUID (entity reference) | equals, not_equals |\n| Version | equals, not_equals |\n| Number | gt, lt, gte, lte |\n| Timestamp | start, end |\n| IP | ip |\n| Boolean | equals, not_equals |\n\nGrid API also supports compound constraints that can be constructed with the keywords **allOf**, **anyOf**, **noneOf**\n\nExample of compound constraint:\n\n```json\n{\n\"constraints\": [\n {\n \"allOf\": [\n {\n \"field\": \"agent.host_name\",\n \"operator\": \"contains\",\n \"value\": \"a\"\n },\n {\n \"field\": \"machine.is_deleted\",\n \"operator\": \"equals\",\n \"value\": false\n },\n {\n \"anyOf\": [\n {\n \"field\": \"agent.os_info.os_platform\",\n \"operator\": \"equals\",\n \"value\": \"Linux\"\n },\n {\n \"field\": \"agent.os_info.os_platform\",\n \"operator\": \"equals\",\n \"value\": \"MacOS\"\n }\n ]\n }\n ]\n }\n]\n}\n```\nIn this example all the records that contain **a** in the ***agent.host_name***, have ***machine.is_deleted*** set to false and whose ***os_platform*** is equal to **either** ***Linux*** or ***MacOS*** will be returned.\n"},{"name":"Groups","description":"Groups in OneView are used to contain and organize endpoints. Policies, which determine the software settings, and endpoints, are assigned to groups. Endpoints use the policies in the groups they are assigned to determine which software settings are enabled.\n\nUse these APIs to create, manage, and move endpoints into groups."},{"name":"Ignore Rules"},{"name":"Info"},{"name":"Installation Tokens","description":"Use these APIs to generate, send, and revoke installation tokens used to activate Mobile Security for Business."},{"name":"Installers","description":"The Installers APIs allow you to deploy the endpoint agent to Windows and macOS devices."},{"name":"Jobs","description":"Jobs are tasks that are issued to endpoints. Use these APIs to manage, search, and export jobs."},{"name":"MDR","description":"Managed Detection and Response configuration through APIs. Using the MDR APIs you can easily configure MDR settings for your sites.\n\n## Important Notes:\n* Contacts must be an existing OneView user\n* Contact IDs are acquired from: https://oneview.malwarebytes.com/oauth/documentation/msp#tag/Users/operation/api.oneview.get-all.contact\n"},{"name":"Notifications","description":"This API offers a powerful tool to create notification subscriptions. There are different categories of notifications,\nfor each category different constraints and output fields can be specified. Please see the documentation below for the\ncategory descriptions.\n\nNotifications can be delivered by email or webhooks. In both cases, it's possible to choose the output fields, but the\nvalue could be different for the two methods. In the email, some values are mapped to friendly names, as in the OneView\nConsole. For webhooks the values are the raw level ones. Here's a list of the mapped values.\n\n| Output field | Email values | Webhook values |\n|--------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|\n| role | Global Administrator
Site Administrator
Customer Administrator
Viewer | GlobalAdministrator
SiteAdministrator
CustomerAdministrator
Viewer |\n| os_platform | Windows
MacOS
Linux | 1
2
3 |\n| category | Malware
PUP
PUM
Exploit
Ransomware
Remote
Website
Vulnerable Driver | MALWARE
PUP
PUM
AE
ARW
RID
MWAC
VULNERABLE_DRIVER |\n| status | Blocked
Found
Quarantined
Deleted
Restored | blocked
found
quarantined
deleted
restored |\n| threat_name | Malicious Website | web |\n| command | Scan
Restart
Restart
Remediate
Isolate
Remove isolation
Refresh Endpoint & Software Info
Check for protection updates
Check for software updates
Install software updates
Generate diagnostic logs
Delete active block rule
Upload file for analysis
Remove endpoint isolation
Isolate
Remediated endpoint
Endpoint logging level changed
Delete from quarantine
Restore from quarantine
Refresh policy
Apply OS Patch
Update Installed Software
Uninstall Software | command.threat.scan
command.service.restart
command.asset.reboot
command.threat.scan.remediate
command.edr.isolation
command.edr.unlock
command.asset.refresh
command.protection.update.now
command.machine.update.now
command.machine.plugin.updateparts
command.service.diag
command.bfp.rules.delete
command.edr.fileupload
command.edr.unlock.force
command.edr.lock
command.sequence.remediate
command.logging.level.set
command.threat.quarantine.remove
command.threat.quarantine.restore
command.policy.refresh
command.asset.patch
command.asset.updatesoftware
command.asset.uninstallsoftware |\n"},{"name":"OS Patches"},{"name":"Policies","description":"A policy is a set of configurations that determine how the endpoint agent monitors your endpoints, such as protection and scan settings. Once a policy has been created, it needs to be assigned to a group in order to take affect. Endpoints will use the policy assigned to the group they belong to."},{"name":"PoliciesV2","description":"Policies define the endpoint configuration. API clients must construct policy contents using the package identifiers and shapes documented below.\n\nThe `contents` object has two parts:\n\n- Root settings in `policy`, shared by the endpoint agent. The default policy includes `endpoint_interface_options`, `monitoring_options`, `protect_service`, `release_channel`, `sirius_update_schedule`, `startup_options`, and `updates`.\n- A `packages` array. Each entry identifies an agent package and its package-specific configuration. Use `enabled`, `product_name`, `schema_version`, `sirius_os_packages`, and `policy`. Each `sirius_os_packages` entry contains `operating_system` and `sirius_package_name`; Windows RID also includes `min_os_version`.\n\nStart from a policy returned by the API when updating it, preserve package entries that are not being changed, and only use package identifiers that apply to the target operating system. The following examples are unmodified excerpts from the default policy; they contain every field from their corresponding default package.\n\n
\nShow policy examples\n\n```json\n{\n \"policy\": {\n \"endpoint_interface_options\": {\n \"allow_run_threat_scan\": true,\n \"display_rtp_events\": true,\n \"limit_endpoint_agent_control\": false,\n \"show_threat_scan_shortcuts\": false,\n \"show_tray_icon\": true,\n \"show_windows_contextmenu\": true\n },\n \"monitoring_options\": {\n \"enabled\": true\n },\n \"protect_service\": true,\n \"release_channel\": {\n \"android\": \"release\",\n \"chromeos\": \"release\",\n \"linux\": \"release\",\n \"mac\": \"release\",\n \"windows\": \"release6\",\n \"ios\": \"release\"\n },\n \"sirius_update_schedule\": \"FREQ=DAILY\",\n \"startup_options\": {\n \"timeout\": 300000,\n \"toggle_on\": true\n },\n \"updates\": {\n \"pause_until\": null\n }\n },\n \"packages\": []\n}\n```\n\n### Package examples\n\n```json\n{\n \"enabled\": true,\n \"product_name\": \"Android Endpoint Protection\",\n \"schema_version\": \"1.0\",\n \"sirius_os_packages\": [\n {\n \"operating_system\": \"android\",\n \"sirius_package_name\": \"epa.android.plugin.epp\"\n }\n ],\n \"policy\": {\n \"default_scan_settings\": {\n \"deep_scanner\": true,\n \"power_saver\": true,\n \"scan_after_reboot\": true,\n \"scan_after_update\": true,\n \"scan_during_charge\": false\n },\n \"memory_caching\": true,\n \"policy_version\": 1,\n \"protection_update_over_expensive_networks\": false,\n \"rtp_settings\": {\n \"malware\": {\n \"enabled\": true\n },\n \"ransomware\": {\n \"enabled\": true\n },\n \"web\": {\n \"enabled\": true\n }\n }\n }\n}\n```\n\n```json\n{\n \"product_name\": \"Chrome OS Asset Manager\",\n \"enabled\": true,\n \"schema_version\": \"1.0\",\n \"sirius_os_packages\": [\n {\n \"operating_system\": \"chromeos\",\n \"sirius_package_name\": \"epa.chromeos.plugin.assetmanager\"\n }\n ],\n \"policy\": {\n \"default_scan_settings\": {\n \"include_drives\": false,\n \"include_installs\": true,\n \"include_memory\": false,\n \"include_nics\": true,\n \"include_startups\": true\n },\n \"policy_version\": 1\n }\n}\n```\n\n```json\n{\n \"product_name\": \"Chrome OS Endpoint Protection\",\n \"enabled\": true,\n \"schema_version\": \"1.0\",\n \"sirius_os_packages\": [\n {\n \"operating_system\": \"chromeos\",\n \"sirius_package_name\": \"epa.chromeos.plugin.epp\"\n }\n ],\n \"policy\": {\n \"default_scan_settings\": {\n \"deep_scanner\": true,\n \"scan_after_reboot\": true,\n \"scan_after_update\": true,\n \"scan_during_charge\": false\n },\n \"memory_caching\": true,\n \"policy_version\": 1,\n \"protection_update_over_expensive_networks\": false,\n \"rtp_settings\": {\n \"ransomware\": {\n \"enabled\": true\n }\n }\n }\n}\n```\n\n```json\n{\n \"product_name\": \"iOS Endpoint Protection\",\n \"enabled\": true,\n \"schema_version\": \"1.0\",\n \"sirius_os_packages\": [\n {\n \"operating_system\": \"ios\",\n \"sirius_package_name\": \"epa.ios.plugin.epp\"\n }\n ],\n \"policy\": {\n \"policy_version\": 1,\n \"protection_update_over_expensive_networks\": false,\n \"rtp_settings\": {\n \"ad_block\": {\n \"enabled\": true\n },\n \"web\": {\n \"enabled\": true\n }\n }\n }\n}\n```\n\n```json\n{\n \"product_name\": \"Linux Asset Manager\",\n \"enabled\": true,\n \"schema_version\": \"1.0\",\n \"sirius_os_packages\": [\n {\n \"operating_system\": \"linux\",\n \"sirius_package_name\": \"epa.linux.plugin.assetmanager\"\n }\n ],\n \"policy\": {\n \"default_scan_settings\": {\n \"include_drives\": true,\n \"include_installs\": true,\n \"include_memory\": true,\n \"include_nics\": true,\n \"include_startups\": true,\n \"include_updates\": true\n },\n \"policy_version\": 1\n }\n}\n```\n\n```json\n{\n \"product_name\": \"Linux Endpoint Detection and Response\",\n \"enabled\": true,\n \"schema_version\": \"1.0\",\n \"sirius_os_packages\": [\n {\n \"operating_system\": \"linux\",\n \"sirius_package_name\": \"epa.linux.plugin.edr\"\n }\n ],\n \"policy\": {\n \"flight_recorder\": {\n \"data_retention_enabled\": false,\n \"eagle_url\": \"\",\n \"enabled\": true,\n \"enabled_server\": true,\n \"learning_duration\": 20,\n \"network_collection_enabled\": true\n },\n \"isolation\": {\n \"enabled\": true\n },\n \"log_file_retention_rules\": {\n \"max_file_size\": \"125MB\",\n \"max_num_roll_backups\": 5\n },\n \"policy_version\": 1\n }\n}\n```\n\n```json\n{\n \"product_name\": \"Linux Endpoint Protection\",\n \"enabled\": true,\n \"schema_version\": \"1.0\",\n \"sirius_os_packages\": [\n {\n \"operating_system\": \"linux\",\n \"sirius_package_name\": \"epa.linux.plugin.epp\"\n }\n ],\n \"policy\": {\n \"policy_version\": 1,\n \"rtp_settings\": {\n \"malware\": {\n \"enabled\": true\n }\n }\n }\n}\n```\n\n```json\n{\n \"product_name\": \"Mac Asset Manager\",\n \"enabled\": true,\n \"schema_version\": \"1.0\",\n \"sirius_os_packages\": [\n {\n \"operating_system\": \"mac\",\n \"sirius_package_name\": \"epa.mac.plugin.assetmanager\"\n }\n ],\n \"policy\": {\n \"default_scan_settings\": {\n \"include_drives\": true,\n \"include_installs\": true,\n \"include_memory\": true,\n \"include_modules\": false,\n \"include_nics\": true,\n \"include_processes\": false,\n \"include_startups\": true,\n \"include_updates\": true,\n \"software_management\": {\n \"enabled\": true,\n \"force_close\": {\n \"delay_rrule\": \"FREQ=HOURLY;INTERVAL=24;COUNT=1\",\n \"enabled\": true,\n \"message\": \"Your company has identified application(s) that need to be closed to perform and complete their update.\",\n \"reminder_message\": \"Your company has identified application(s) that need to be closed to perform and complete their update.\",\n \"reminder_rrule\": \"FREQ=HOURLY;INTERVAL=6;COUNT=1\"\n },\n \"patch_management\": false,\n \"show_deployment_progress\": true,\n \"vuln_management\": true\n }\n },\n \"policy_version\": 1\n }\n}\n```\n\n```json\n{\n \"product_name\": \"Mac Endpoint Detection and Response\",\n \"enabled\": true,\n \"schema_version\": \"1.0\",\n \"sirius_os_packages\": [\n {\n \"operating_system\": \"mac\",\n \"sirius_package_name\": \"epa.mac.plugin.edr\"\n }\n ],\n \"policy\": {\n \"flight_recorder\": {\n \"data_retention_enabled\": false,\n \"eagle_url\": \"\",\n \"enabled\": true,\n \"learning_duration\": 20,\n \"network_collection_enabled\": true\n },\n \"isolation\": {\n \"enabled\": true\n },\n \"log_file_retention_rules\": {\n \"max_file_size\": \"125MB\",\n \"max_num_roll_backups\": 5\n },\n \"policy_version\": 1\n }\n}\n```\n\n```json\n{\n \"product_name\": \"Mac Endpoint Protection\",\n \"enabled\": true,\n \"schema_version\": \"1.0\",\n \"sirius_os_packages\": [\n {\n \"operating_system\": \"mac\",\n \"sirius_package_name\": \"epa.mac.plugin.epp\"\n }\n ],\n \"policy\": {\n \"auto_service_updates\": true,\n \"default_scan_settings\": {\n \"allow_postpone_reboot\": true,\n \"pup_detection\": \"Detect\",\n \"no_reboot\": false,\n \"reboot_delay_rrule\": \"FREQ=HOURLY;INTERVAL=1;COUNT=1\",\n \"reboot_message\": \"Restart your computer to complete pending security updates.\",\n \"malware_ai_mode\": null,\n \"scan_priority\": \"low\"\n },\n \"device_control\": {\n \"enabled\": true,\n \"action\": \"allow\",\n \"message\": \"\"\n },\n \"policy_version\": 1,\n \"protection_update_enabled\": true,\n \"protection_update_schedule\": \"FREQ=HOURLY;INTERVAL=1\",\n \"rtp_settings\": {\n \"app_block\": {\n \"enabled\": true\n },\n \"malware\": {\n \"enabled\": true\n },\n \"web\": {\n \"enabled\": true\n }\n }\n }\n}\n```\n\n```json\n{\n \"product_name\": \"Active Response Shell\",\n \"enabled\": true,\n \"schema_version\": \"1.0\",\n \"sirius_os_packages\": [\n {\n \"operating_system\": \"windows\",\n \"sirius_package_name\": \"epa.win.plugin.ars\"\n }\n ],\n \"policy\": {\n \"only_authorized_certificate\": true,\n \"policy_version\": 1,\n \"verbose\": false\n }\n}\n```\n\n```json\n{\n \"product_name\": \"Mac Active Response Shell\",\n \"enabled\": false,\n \"schema_version\": \"1.0\",\n \"sirius_os_packages\": [\n {\n \"operating_system\": \"mac\",\n \"sirius_package_name\": \"epa.mac.plugin.ars\"\n }\n ],\n \"policy\": {\n \"only_authorized_certificate\": true,\n \"policy_version\": 1,\n \"verbose\": false\n }\n}\n```\n\n```json\n{\n \"product_name\": \"Linux Active Response Shell\",\n \"enabled\": true,\n \"schema_version\": \"1.0\",\n \"sirius_os_packages\": [\n {\n \"operating_system\": \"linux\",\n \"sirius_package_name\": \"epa.linux.plugin.ars\"\n }\n ],\n \"policy\": {\n \"only_authorized_certificate\": true,\n \"policy_version\": 1,\n \"verbose\": false\n }\n}\n```\n\n```json\n{\n \"product_name\": \"Asset Manager\",\n \"enabled\": true,\n \"schema_version\": \"1.0\",\n \"sirius_os_packages\": [\n {\n \"operating_system\": \"windows\",\n \"sirius_package_name\": \"epa.win.plugin.assetmanager\"\n }\n ],\n \"policy\": {\n \"default_scan_settings\": {\n \"include_drives\": true,\n \"include_installs\": true,\n \"include_memory\": true,\n \"include_modules\": false,\n \"include_nics\": true,\n \"include_processes\": false,\n \"include_startups\": true,\n \"include_updates\": true,\n \"software_management\": {\n \"application_block\": true,\n \"enabled\": true,\n \"disable_windows_auto_updates\": false,\n \"force_close\": {\n \"delay_rrule\": \"FREQ=HOURLY;INTERVAL=24;COUNT=1\",\n \"enabled\": true,\n \"message\": \"Your company has identified application(s) that need to be closed to perform and complete their update.\",\n \"reminder_message\": \"Your company has identified application(s) that need to be closed to perform and complete their update.\",\n \"reminder_rrule\": \"FREQ=HOURLY;INTERVAL=6;COUNT=1\"\n },\n \"patch_management\": true,\n \"show_deployment_progress\": true,\n \"skip_signature_check\": true,\n \"vuln_management\": true\n }\n },\n \"drive_encryption\": {\n \"enabled\": true,\n \"method\": \"XtsAes256\",\n \"rotate_key\": false,\n \"scope\": \"full_disk\",\n \"silent_encryption\": false,\n \"target_drives\": [\n \"os\",\n \"fixed\"\n ]\n },\n \"policy_version\": 1\n }\n}\n```\n\n```json\n{\n \"product_name\": \"Endpoint Detection and Response\",\n \"enabled\": true,\n \"schema_version\": \"1.0\",\n \"sirius_os_packages\": [\n {\n \"operating_system\": \"windows\",\n \"sirius_package_name\": \"epa.win.plugin.edr\"\n }\n ],\n \"policy\": {\n \"flight_recorder\": {\n \"data_retention_enabled\": false,\n \"eagle_url\": \"\",\n \"enabled\": true,\n \"enabled_server\": true,\n \"experimental_collection_enabled\": false,\n \"learning_duration\": 20,\n \"network_collection_enabled\": true,\n \"remote_fs_events_enabled\": true,\n \"rollback\": {\n \"backup_folder_server\": null,\n \"backup_quota\": \"30\",\n \"enabled\": true,\n \"file_size\": \"20MB\",\n \"file_size_server\": \"100MB\",\n \"window\": 72\n },\n \"very_aggressive\": false,\n \"win_etw_enabled\": false,\n \"winlog_collection_enabled\": false\n },\n \"isolation\": {\n \"enabled\": true,\n \"text\": \"Your system has been locked by the IT Department. Please contact the Helpdesk for further information.\",\n \"title\": \"Malware or suspicious application behavior has been detected on this computer.\",\n \"title_image_path\": null\n },\n \"log_file_retention_rules\": {\n \"max_file_size\": \"125MB\",\n \"max_num_roll_backups\": 5\n },\n \"policy_version\": 1\n }\n}\n```\n\n```json\n{\n \"product_name\": \"Endpoint Protection\",\n \"enabled\": true,\n \"schema_version\": \"1.0\",\n \"sirius_os_packages\": [\n {\n \"operating_system\": \"windows\",\n \"sirius_package_name\": \"epa.win.plugin.mbam\"\n }\n ],\n \"policy\": {\n \"anomaly_detection\": false,\n \"application_updates\": true,\n \"arw_silent_mode\": false,\n \"auto_service_updates\": true,\n \"dds_aggressive_mode\": true,\n \"default_scan_settings\": {\n \"allow_postpone_reboot\": true,\n \"ark\": false,\n \"enable_shuriken\": true,\n \"no_archive\": false,\n \"no_reboot\": false,\n \"pup_detection\": \"Detect\",\n \"pum_detection\": \"Detect\",\n \"reboot_delay\": 60,\n \"reboot_delay_rrule\": \"FREQ=HOURLY;INTERVAL=1;COUNT=1\",\n \"reboot_message\": \"Restart your computer to complete pending security updates.\",\n \"scan_priority\": \"low\",\n \"malware_ai_mode\": null\n },\n \"device_control\": {\n \"action\": \"allow\",\n \"auto_scan\": true,\n \"block_while_scanning\": false,\n \"block_while_scanning_message\": \"\",\n \"enabled\": true,\n \"message\": \"\"\n },\n \"disable_ae_macro\": false,\n \"disable_dds_bettername_scan\": false,\n \"disable_dds_whitelist\": false,\n \"force_dds_entitlement\": false,\n \"hacktools_detection\": false,\n \"hacktools_detection_enhanced\": true,\n \"install_settings\": {\n \"program_folder\": null,\n \"start_menu\": true,\n \"desktop_shortcut\": true\n },\n \"new_sdk\": false,\n \"policy_version\": 1,\n \"protection_aging\": \"\",\n \"protection_update_enabled\": true,\n \"protection_update_schedule\": \"FREQ=HOURLY;INTERVAL=1\",\n \"relax_ig_filters\": true,\n \"rtp_settings\": {\n \"application_block\": {\n \"enabled\": true\n },\n \"delay_rtp\": false,\n \"delay_seconds\": 15,\n \"display_rtp_notifications\": true,\n \"exploit\": {\n \"enabled\": true,\n \"l3block_malicious_emailattachment\": false,\n \"options\": {\n \"ah_dep_browser\": true,\n \"ah_dep_chrome\": true,\n \"ah_dep_pdf\": true,\n \"ah_dep_ms\": true,\n \"ah_dep_media\": false,\n \"ah_dep_other\": false,\n \"ah_ahs_browser\": true,\n \"ah_ahs_chrome\": false,\n \"ah_ahs_pdf\": false,\n \"ah_ahs_ms\": false,\n \"ah_ahs_media\": false,\n \"ah_ahs_other\": false,\n \"ah_dahs_browser\": true,\n \"ah_bua_browser\": false,\n \"ah_bua_chrome\": false,\n \"ah_bua_pdf\": false,\n \"ah_bua_ms\": true,\n \"ah_bua_media\": false,\n \"ah_bua_other\": false,\n \"ah_diev_browser\": true,\n \"ah_daef_browser\": true,\n \"amp_mrad_browser\": true,\n \"amp_mrad_chrome\": true,\n \"amp_mrad_pdf\": true,\n \"amp_mrad_ms\": true,\n \"amp_mrad_media\": true,\n \"amp_mrad_other\": true,\n \"amp_depb_browser\": true,\n \"amp_depb_chrome\": true,\n \"amp_depb_pdf\": true,\n \"amp_depb_ms\": true,\n \"amp_depb_media\": true,\n \"amp_depb_other\": false,\n \"amp_mph_browser\": true,\n \"amp_mph_chrome\": true,\n \"amp_mph_pdf\": true,\n \"amp_mph_ms\": true,\n \"amp_mph_media\": true,\n \"amp_mph_other\": false,\n \"amp_sp_browser\": true,\n \"amp_sp_chrome\": true,\n \"amp_sp_pdf\": true,\n \"amp_sp_ms\": true,\n \"amp_sp_media\": true,\n \"amp_sp_other\": true,\n \"amp_crg32_browser\": true,\n \"amp_crg32_chrome\": true,\n \"amp_crg32_pdf\": true,\n \"amp_crg32_ms\": true,\n \"amp_crg32_media\": true,\n \"amp_crg32_other\": true,\n \"amp_rrg32_browser\": false,\n \"amp_rrg32_chrome\": false,\n \"amp_rrg32_pdf\": false,\n \"amp_rrg32_ms\": false,\n \"amp_rrg32_media\": false,\n \"amp_rrg32_other\": false,\n \"amp_crg64_browser\": true,\n \"amp_crg64_chrome\": true,\n \"amp_crg64_pdf\": true,\n \"amp_crg64_ms\": true,\n \"amp_crg64_media\": true,\n \"amp_crg64_other\": true,\n \"amp_rrg64_browser\": false,\n \"amp_rrg64_chrome\": false,\n \"amp_rrg64_pdf\": false,\n \"amp_rrg64_ms\": false,\n \"amp_rrg64_media\": false,\n \"amp_rrg64_other\": false,\n \"abp_mll_browser\": false,\n \"abp_mll_chrome\": false,\n \"abp_mll_pdf\": false,\n \"abp_mll_ms\": false,\n \"abp_mll_media\": false,\n \"abp_mll_other\": false,\n \"abp_piev_browser\": true,\n \"abp_pmbp_browser\": false,\n \"abp_pmbp_chrome\": false,\n \"abp_pmbp_pdf\": false,\n \"abp_pmbp_ms\": false,\n \"abp_pmbp_media\": false,\n \"abp_pmbp_other\": false,\n \"abp_powmi_ms\": true,\n \"abp_povba_ms\": true,\n \"java_wmcl\": true,\n \"java_misp\": false,\n \"java_mosp\": false,\n \"java_mmgp\": true,\n \"java_mmcep\": true,\n \"java_aijoip\": true,\n \"abp_povbe7_ms\": true,\n \"abp_posaa_ms\": true,\n \"abp_polpa_ms\": true,\n \"abp_posba_ms\": true,\n \"abp_pem4a_ms\": true,\n \"abp_pecsa_ms\": true\n },\n \"pen_test_enabled\": false,\n \"protected\": [\n {\n \"application\": \"Adobe Acrobat\",\n \"file\": \"acrobat.exe\",\n \"default\": true,\n \"enabled\": true,\n \"type\": \"FamilyPdfReader\"\n },\n {\n \"application\": \"Adobe Reader\",\n \"file\": \"acrord32.exe\",\n \"default\": true,\n \"enabled\": true,\n \"type\": \"FamilyPdfReader\"\n },\n {\n \"application\": \"Comodo Dragon\",\n \"file\": \"dragon.exe\",\n \"default\": true,\n \"enabled\": false,\n \"type\": \"FamilyWebBrowser\"\n },\n {\n \"application\": \"Cyberfox\",\n \"file\": \"cyberfox.exe\",\n \"default\": true,\n \"enabled\": false,\n \"type\": \"FamilyWebBrowser\"\n },\n {\n \"application\": \"Foxit Phantom\",\n \"file\": \"Foxit PhantomPDF.exe\",\n \"default\": true,\n \"enabled\": false,\n \"type\": \"FamilyPdfReader\"\n },\n {\n \"application\": \"Foxit Phantom\",\n \"file\": \"FoxitPhantomPDF.exe\",\n \"default\": true,\n \"enabled\": false,\n \"type\": \"FamilyPdfReader\"\n },\n {\n \"application\": \"Foxit Reader\",\n \"file\": \"foxit reader.exe\",\n \"default\": true,\n \"enabled\": false,\n \"type\": \"FamilyPdfReader\"\n },\n {\n \"application\": \"Google Chrome (and plug-ins)\",\n \"file\": \"chrome.exe\",\n \"default\": true,\n \"enabled\": false,\n \"type\": \"FamilyWebBrowser\"\n },\n {\n \"application\": \"IceDragon\",\n \"file\": \"icedragon.exe\",\n \"default\": true,\n \"enabled\": false,\n \"type\": \"FamilyWebBrowser\"\n },\n {\n \"application\": \"Internet Explorer (and add-ons)\",\n \"file\": \"iexplore.exe\",\n \"default\": true,\n \"enabled\": true,\n \"type\": \"FamilyWebBrowser\"\n },\n {\n \"application\": \"Java\",\n \"file\": \"java.exe\",\n \"default\": true,\n \"enabled\": false,\n \"type\": \"FamilyJava\"\n },\n {\n \"application\": \"Java\",\n \"file\": \"javaw.exe\",\n \"default\": true,\n \"enabled\": false,\n \"type\": \"FamilyJava\"\n },\n {\n \"application\": \"Java\",\n \"file\": \"javaws.exe\",\n \"default\": true,\n \"enabled\": false,\n \"type\": \"FamilyJava\"\n },\n {\n \"application\": \"LibreOffice\",\n \"file\": \"soffice.bin\",\n \"default\": true,\n \"enabled\": true,\n \"type\": \"FamilyOffice\"\n },\n {\n \"application\": \"Maxthon\",\n \"file\": \"maxthon.exe\",\n \"default\": true,\n \"enabled\": false,\n \"type\": \"FamilyWebBrowser\"\n },\n {\n \"application\": \"Microsoft Edge (and add-ons)\",\n \"file\": \"MicrosoftEdge.exe\",\n \"default\": true,\n \"enabled\": true,\n \"type\": \"FamilyWebBrowser\"\n },\n {\n \"application\": \"Microsoft Office Excel\",\n \"file\": \"excel.exe\",\n \"default\": true,\n \"enabled\": true,\n \"type\": \"FamilyOffice\"\n },\n {\n \"application\": \"Microsoft Office PowerPoint\",\n \"file\": \"powerpnt.exe\",\n \"default\": true,\n \"enabled\": true,\n \"type\": \"FamilyOffice\"\n },\n {\n \"application\": \"Microsoft Office Publisher\",\n \"file\": \"mspub.exe\",\n \"default\": true,\n \"enabled\": false,\n \"type\": \"FamilyOffice\"\n },\n {\n \"application\": \"Microsoft Office Word\",\n \"file\": \"winword.exe\",\n \"default\": true,\n \"enabled\": true,\n \"type\": \"FamilyOffice\"\n },\n {\n \"application\": \"Mozilla Firefox (and add-ons)\",\n \"file\": \"firefox.exe\",\n \"default\": true,\n \"enabled\": true,\n \"type\": \"FamilyWebBrowser\"\n },\n {\n \"application\": \"Opera (and plug-ins)\",\n \"file\": \"opera.exe\",\n \"default\": true,\n \"enabled\": true,\n \"type\": \"FamilyWebBrowser\"\n },\n {\n \"application\": \"Palemoon\",\n \"file\": \"palemoon.exe\",\n \"default\": true,\n \"enabled\": false,\n \"type\": \"FamilyWebBrowser\"\n },\n {\n \"application\": \"QuickTime Player\",\n \"file\": \"quicktimeplayer.exe\",\n \"default\": true,\n \"enabled\": false,\n \"type\": \"FamilyMultimedia\"\n },\n {\n \"application\": \"Seamonkey\",\n \"file\": \"seamonkey.exe\",\n \"default\": true,\n \"enabled\": false,\n \"type\": \"FamilyWebBrowser\"\n },\n {\n \"application\": \"Tor Browser\",\n \"file\": \"tor.exe\",\n \"default\": true,\n \"enabled\": true,\n \"type\": \"FamilyWebBrowser\"\n },\n {\n \"application\": \"VLC Player\",\n \"file\": \"vlc.exe\",\n \"default\": true,\n \"enabled\": false,\n \"type\": \"FamilyMultimedia\"\n },\n {\n \"application\": \"Waterfox\",\n \"file\": \"waterfox.exe\",\n \"default\": true,\n \"enabled\": false,\n \"type\": \"FamilyWebBrowser\"\n },\n {\n \"application\": \"Winamp Player\",\n \"file\": \"winamp.exe\",\n \"default\": true,\n \"enabled\": false,\n \"type\": \"FamilyMultimedia\"\n },\n {\n \"application\": \"Windows Media Player (mplayer2)\",\n \"file\": \"mplayer2.exe\",\n \"default\": true,\n \"enabled\": false,\n \"type\": \"FamilyMultimedia\"\n },\n {\n \"application\": \"Windows Media Player (wmplayer)\",\n \"file\": \"wmplayer.exe\",\n \"default\": true,\n \"enabled\": false,\n \"type\": \"FamilyMultimedia\"\n },\n {\n \"application\": \"Java Process Launcher\",\n \"file\": \"jp2launcher.exe\",\n \"default\": true,\n \"enabled\": false,\n \"type\": \"FamilyJava\"\n },\n {\n \"application\": \"Microsoft Edge (Chromium based)\",\n \"file\": \"msedge.exe\",\n \"default\": true,\n \"enabled\": true,\n \"type\": \"FamilyWebBrowser\"\n },\n {\n \"application\": \"Microsoft Access\",\n \"file\": \"msaccess.exe\",\n \"default\": true,\n \"enabled\": false,\n \"type\": \"FamilyOffice\"\n },\n {\n \"file\": \"outlook.exe\",\n \"type\": \"FamilyEmailClient\",\n \"default\": true,\n \"enabled\": false,\n \"application\": \"Microsoft Outlook\"\n },\n {\n \"application\": \"Microsoft OneNote\",\n \"default\": true,\n \"enabled\": true,\n \"file\": \"onenote.exe\",\n \"type\": \"FamilyOffice\"\n },\n {\n \"application\": \"Microsoft OneNote\",\n \"default\": true,\n \"enabled\": true,\n \"file\": \"onenoteim.exe\",\n \"type\": \"FamilyOffice\"\n },\n {\n \"application\": \"Microsoft OneNote\",\n \"default\": true,\n \"enabled\": true,\n \"file\": \"onenotem.exe\",\n \"type\": \"FamilyOffice\"\n }\n ]\n },\n \"malware\": {\n \"enabled\": true\n },\n \"ransomware\": {\n \"enabled\": true,\n \"network_protection\": true,\n \"employ_sensors\": true\n },\n \"web\": {\n \"enabled\": true,\n \"inbound_tcp\": true,\n \"outbound_tcp\": true,\n \"outbound_udp\": true,\n \"inbound_icmp\": true,\n \"outbound_icmp\": true\n },\n \"amsi\": {\n \"enabled\": true\n }\n },\n \"self_protect_early_start\": false,\n \"self_protection\": true,\n \"smart_priority_idle\": {\n \"max_cpu_percentage\": 25,\n \"max_disk_io_percentage\": 25,\n \"seconds\": 300\n },\n \"smart_scan\": false,\n \"usage_stat\": true,\n \"win_ac\": \"default\",\n \"windows_context_menus\": false\n }\n}\n```\n\n```json\n{\n \"product_name\": \"Browser Phishing Protection\",\n \"enabled\": true,\n \"schema_version\": \"1.0\",\n \"sirius_os_packages\": [\n {\n \"operating_system\": \"windows\",\n \"sirius_package_name\": \"epa.win.plugin.bg\"\n }\n ],\n \"policy\": {\n \"deployment\": {\n \"enabled\": true,\n \"chrome\": true,\n \"edge\": true,\n \"brave\": true,\n \"firefox\": true,\n \"check_conflict\": true\n },\n \"protection\": {\n \"ad\": true,\n \"ad_continue\": false,\n \"malware\": true,\n \"scam\": true,\n \"gtld\": true\n },\n \"extension\": {\n \"org_name\": \"\",\n \"logo_url\": \"\",\n \"header_message\": \"Website Blocked\",\n \"footer_message\": \"This Browser Phishing Protection extension is managed by your company's administrator. If you have any questions or need support, please reach out to your IT administrator for assistance.\",\n \"block_message\": \"You may be putting your online safety and system at risk by visiting this site. To continue to the suspicious website, contact your system administrator to add an exclusion to ThreatDown.\"\n }\n }\n}\n```\n\n```json\n{\n \"product_name\": \"Mac Browser Phishing Protection\",\n \"enabled\": false,\n \"schema_version\": \"1.0\",\n \"sirius_os_packages\": [\n {\n \"operating_system\": \"mac\",\n \"sirius_package_name\": \"epa.mac.plugin.bpp\"\n }\n ],\n \"policy\": {\n \"deployment\": {\n \"enabled\": true,\n \"chrome\": true,\n \"edge\": true,\n \"brave\": true,\n \"firefox\": true,\n \"check_conflict\": true\n },\n \"protection\": {\n \"ad\": true,\n \"ad_continue\": false,\n \"malware\": true,\n \"scam\": true,\n \"gtld\": false\n },\n \"extension\": {\n \"org_name\": \"\",\n \"logo_url\": \"\",\n \"header_message\": \"Website Blocked\",\n \"footer_message\": \"This Browser Phishing Protection extension is managed by your company's administrator. If you have any questions or need support, please reach out to your IT administrator for assistance.\",\n \"block_message\": \"You may be putting your online safety and system at risk by visiting this site. To continue to the suspicious website, contact your system administrator to add an exclusion to ThreatDown.\"\n }\n }\n}\n```\n\n```json\n{\n \"product_name\": \"Chrome OS Browser Phishing Protection\",\n \"enabled\": true,\n \"schema_version\": \"1.0\",\n \"sirius_os_packages\": [\n {\n \"operating_system\": \"chromeos\",\n \"sirius_package_name\": \"epa.chromeos.plugin.bg\"\n }\n ],\n \"policy\": {\n \"deployment\": {\n \"enabled\": true,\n \"chrome\": true,\n \"edge\": true,\n \"brave\": true,\n \"firefox\": true\n },\n \"protection\": {\n \"ad\": true,\n \"ad_continue\": false,\n \"malware\": true,\n \"scam\": true,\n \"gtld\": true\n },\n \"extension\": {\n \"org_name\": \"\",\n \"logo_url\": \"\",\n \"header_message\": \"Website Blocked\",\n \"footer_message\": \"This Browser Phishing Protection extension is managed by your company's administrator. If you have any questions or need support, please reach out to your IT administrator for assistance.\",\n \"block_message\": \"You may be putting your online safety and system at risk by visiting this site. To continue to the suspicious website, contact your system administrator to add an exclusion to ThreatDown.\"\n }\n }\n}\n```\n\n```json\n{\n \"product_name\": \"Windows Remote Intrusion Detection and Prevention\",\n \"enabled\": true,\n \"schema_version\": \"1.0\",\n \"sirius_os_packages\": [\n {\n \"min_os_version\": \"6.1\",\n \"operating_system\": \"windows\",\n \"sirius_package_name\": \"epa.win.plugin.bfp\"\n }\n ],\n \"policy\": {\n \"action\": \"NOTIFY\",\n \"detection_mode\": \"EVENTLOG\",\n \"allowed_failed_attempts\": 5,\n \"exclude_private_networks\": false,\n \"minutes_between_failed_attempts\": 5,\n \"minutes_to_block\": 5,\n \"policy_version\": 1,\n \"protected_protocols\": [\n {\n \"enabled\": true,\n \"name\": \"RDP\",\n \"ports\": []\n },\n {\n \"enabled\": true,\n \"name\": \"FTP\",\n \"ports\": [\n 21\n ]\n },\n {\n \"enabled\": true,\n \"name\": \"IMAP\",\n \"ports\": [\n 143,\n 993\n ]\n },\n {\n \"enabled\": true,\n \"name\": \"MSSQL\",\n \"ports\": [\n 1433\n ]\n },\n {\n \"enabled\": true,\n \"name\": \"POP3\",\n \"ports\": [\n 110,\n 995\n ]\n },\n {\n \"enabled\": true,\n \"name\": \"SMTP\",\n \"ports\": [\n 25,\n 465,\n 587,\n 2525\n ]\n },\n {\n \"enabled\": true,\n \"name\": \"SSH\",\n \"ports\": [\n 22\n ]\n }\n ]\n }\n}\n```\n\n
\n"},{"name":"Preferences","description":"The Preferences APIs allow you to enable or disable all notifications of a specific type (email, webhook, slack, teams), without needing to modify or delete multiple notifications. "},{"name":"Quarantine","description":"When a harmful file is found on a device, it can be neutralized and placed in quarantine, preventing it from posing a threat. You can utilize the Quarantine APIs to export or check data for the existence of quarantined threats across your environments."},{"name":"Remote Intrusion Detection","description":"A remote intrusion detection (RID) occurs when a brute force protection rule is triggered according to policy settings.\n\nUse these APIs to export and search for RID rules by specific parameters."},{"name":"Reports"},{"name":"Schedules","description":"Scheduled scans allow you to automate scans to run based on a certain schedule, rather than manually triggering a scan. \n\nUse these APIs to create and manage your scan schedules."},{"name":"Sites","description":"Create and manage sites through APIs. Using sites APIs you can easily segment the usage and the subscriptions for your customers.\n\nIn order to obtain an `account_id` for one of your sites to use for security APIs, for example [Endpoints](#tag/Endpoints) and [Installers](#tag/Installers), you need to create first a valid [Subscription](#tag/Subscriptions) for your customer."},{"name":"Subscriptions","description":"Subscriptions allow you to enable and manage ThreatDown security services for your customers by setting terms, volume and duration."},{"name":"Suspicious Activity","description":"Suspicious Activities are found using Endpoint Detection and Response (EDR). When Suspicious Activity Monitoring is enabled via the policy, EDR watches for potentially malicious behavior on your endpoints by monitoring the processes, registry, file system, and network activity. \n\nUse these APIs to retrieve the suspicious activity records and details."},{"name":"Syslog"},{"name":"Usage"},{"name":"Users","description":"Provision and manage OneView users through APIs."},{"name":"Vulnerability Assessment"},{"name":"Vulnerability Management","description":"Use the Vulnerability Management APIs to get more info about Common Vulnerabilities and Exposures (CVEs) within your environment. This requires the Vulnerability Assessment or Vulnerability & Patch Management add-ons."},{"name":"Webhooks","description":"## Using Webhooks\n\nThreatDown can send webhook events that notify your application any time an event happens on your account.\nThis is useful for transactions which are not reported synchronously to your code when performing an API call, or for security events happening in your endpoints.\n\nYou can register multiple webhook handlers for any event. Any time an event occurs, we will send a `POST` request to any endpoint URLs you have registered for that event.\n\n## When to use Webhooks\n\nFor most requests, you don't need Webhooks. However, for all requests that involve asynchronous transactions, such as getting the report after a machine scan, you will need to register webhooks to get real-time notifications.\nThe alternative to registering webhooks is performing polling, but this is deeply discouraged: besides involving more complicated code on your side, you may exceed your quota and consequently your API plan.\n\n## How to configure Webhooks\n\nThreatDown provides you with REST APIs for creating, retrieving, and deleting subscriptions. Currently, subscriptions can be registered only through APIs.\n\n## Handling Webhook notifications and responding\n\nCreating a webhook handler on your server is no different from creating an API endpoint. Webhook data is sent as `JSON` data in the `POST` requests body. You can handle these requests and process data to fit your needs.\nTo acknowledge receipt of a webhook notification, your server must return a `2xx` `HTTP` status code. All response codes outside this range, including `3xx`, will be threatened as failures and we will try sending these notifications again using exponential backoff for calculating the delay between requests. The default maximum number of retries is `5`. You can configure the `max_retries` parameter when registering a new subscription to customize this behavior.\n\nIf your endpoint keeps responding with a status code outside the `2xx` range, after the default number of `maxAttempts`, we will stop sending the webhook notification. You will be responsible for reconciling your data by querying our API endpoints for potentially missed events.\n\nWe recommend you design idempotent event processing because you might receive the same event more than once.\n\n## How to verify Webhooks origin\n\nThreatDown will sign the webhook events it sends to your server. We do so by including a signature in each event’s `X-MWB-Signature` header. This allows you to validate that the events were sent by ThreatDown and not by a third party.\n\nTo protect your server from bad senders:\n\n- When you create a webhook subscription, you can supply an additional `secret_token` parameter. We will use that parameter as the signing key to generate an `HMAC` of the payload.\n- When you receive a webhook event, extract the request's body and compute:\n\n```\nHMAC_SHA256(secret_token, webhookPayload)\n```\n\n`secret_token` is the shared secret you configured when creating a subscription.\n\n- compare your result with the value of `X-MWB-Signature`. If those match, you can assume the notification was sent by ThreatDown.\n\n## Supported events\nThe supported events are:\n- job_status_change\n- detection\n- machine_events\n- threat_events\n- agent_events\n- quarantine_events\n- edr_events\n- syslog_events\n- exclusion_events\n- scheduled_events\n- policy_events\n- user_events\n- drive_events\n- cve_events\n- dns_events\n- license_events\n- appblock_events\n- endpoint_events\n\n## Events model\nWhen ThreatDown sends a webhook notification, it wraps the notification in an envelope in order to supply additional metadata. When you receive a webhook notification, expect the following data posted in the request body:\n\n| Name | Description | Type |\n|------|-------------|-------|\n| event| The event type. | string, one of supported events type listed above |\n| subscription_id | Unique identifier of the subscription that matched this event | string |\n| account_id | Nebula account id (site) generating this event | string |\n| payload | An object containing the event-specific data | object |\n\n**When you receive a webhook notification, you usually switch your processing logic depending on the value of the `event` property, which represents the event type. Depending on the value, the `payload` sent will have a different model. Refer to specific models below:**\n\n\n### job_status_change\nThe `job_status_change` event is sent when a job you issue through the `Jobs` APIs, change its status.\nThis allow you to track, for example, completed or failed scans.\nThe payload includes the following parameters:\n\n| Name | Description | Type |\n|------|-------------|-------|\n| id | Unique identifier of the job | string |\n| machine_id | Unique identifier of the endpoint | string |\n| command | Type of command. See the `Job` API for more info | string |\n| issued_by | User issuing the job. This is of your interest only if you use Nebula through cloud console UI as well | string |\n| status | Status of the job. It can be one of `PENDING`, `STARTED`, `TIMED_OUT`, `COMPLETED`, `EXPIRED`, `FAILED`. | string |\n| relay_state | The relay state if you supplied one when issuing the job | string |\n| data | Job's settings. See the `Job` API for more info | object |\n| created_at | Timestamp indicating when the job was created | string |\n| updated_at | Timestamp indicating when the job was last updated | string |\n| expires_at | Timestamp indicating when the job expires | string |\n\nExample:\n\n```json\n{\n \"event\":\"job_status_change\",\n \"id\":\"cdf5f8e6-a3d0-4c33-a506-3c6cbce7bf0b\",\n \"payload\":{\n \"machine_id\":\"cf1ed661-812c-4342-9dc7-c806b90072c3\",\n \"issued_by\":\"86d6c44f-2d0d-4225-b1f7-23f47b5d1a7b\",\n \"expires_at\":\"2020-08-31T11:22:31.624139429Z\",\n \"command\":\"command.asset.refresh\",\n \"data\":\"{}\",\n \"status\":\"CREATED\",\n \"id\":\"2c74da91-6e73-4867-8736-ca4b1f8effda\",\n \"updated_at\":\"2020-08-28T11:22:31.625274922Z\",\n \"created_at\":\"2020-08-28T11:22:31.624138004Z\"\n },\n \"account_id\":\"550a20b8-6d36-4222-afbc-54d100f2e894\",\n \"subscription_id\":\"f43dc73b-2709-4d6f-9c79-08abc815114b\"\n}\n```\n\n\n### Detection\n\nThe `detection` event is sent when ThreatDown finds one or more threats in your endpoints.\nThe payload includes the following parameters:\n\n| Name | Description | Type |\n|------|-------------|-------|\n| id | Unique identifier of the detection | string |\n| machine_id | Unique identifier of the endpoint where the detection happened | string |\n| machine_name | Name of the endpoint where the detection happened | string |\n| scan_id | Unique identifier of the scan triggering the detection | string |\n| group_id | Unique identifier of the group to which the endpoint belongs | string |\n| group_name | Name of the group to which the endpoint belongs | string |\n| policy_id | Unique identifier of the policy assigned to the endpoint | string |\n| policy_name | Name of the policy assigned to the endpoint | string |\n| detection_id | Unique identifier of the detection as reported by the endpoint agent | string |\n| scanned_at | Timestamp of the scan (as received by the server) | string |\n| scanned_at_local | Timestamp of the scan (as reported by the endpoint agent) | string |\n| reported_at | Timestamp of when the detection was reported | string |\n| status | The status of the detection (i.e. `blocked`, `quarantined`) | string |\n| threat_name | Name of the threat | string |\n| type | Type of the threat | string |\n| path | Path where the threat was found | string |\n| category | Category of the threat | string |\n| ip_address | IP address of the detection, when applicable | string |\n| url | URL of the detection, when applicable | string |\n| port | Port of the detection, when applicable | string |\n| affected_application | Affected application, when applicable | string |\n| md5 | Hash of the file, when applicable | string |\n| process_name | Name of the process, when applicable | string |\n\n### Policy Events\n\n#### Policy Updated\n```json\n{\n \"event\":\"policy_events\",\n \"id\":\"a8accc52-9f8c-4319-a2fd-975641f0ba7d\",\n \"payload\":{\n \"severity\":\"AUDIT\",\n \"type\":\"POLICY_UPDATED\",\n \"account_id\":\"550a20b8-6d36-4222-afbc-54d100f2e894\",\n \"details\":{\n \"message\":\"Policy Updated\",\n \"user_id\":\"86d6c44f-2d0d-4225-b1f7-23f47b5d1a7b\",\n \"user_email\":\"example@example.com\",\n \"user_name\":\"Mister User\",\n \"user_role\":\"Super Admin\",\n \"policy_id\":\"870de3fa-073e-468f-8d3a-a7edddeae594\",\n \"policy_name\":\"Aggressive Policy\",\n \"ip_address\":\"37.157.101.160\"\n },\n \"user_id\":\"86d6c44f-2d0d-4225-b1f7-23f47b5d1a7b\",\n \"id\":\"579b0361-3e3f-4ab0-8453-84fc0f36f4e6\",\n \"created_at\":\"2020-08-28T10:35:32.637936426Z\"\n },\n \"account_id\":\"550a20b8-6d36-4222-afbc-54d100f2e894\",\n \"subscription_id\":\"f43dc73b-2709-4d6f-9c79-08abc815114b\"\n}\n```\n\n#### Policy Created\n\n```json\n{\n \"event\":\"policy_events\",\n \"id\":\"40662e4a-60c7-4920-b788-59af13c2c23d\",\n \"payload\":{\n \"severity\":\"AUDIT\",\n \"type\":\"POLICY_CREATED\",\n \"account_id\":\"550a20b8-6d36-4222-afbc-54d100f2e894\",\n \"details\":{\n \"message\":\"Policy Created\",\n \"user_id\":\"86d6c44f-2d0d-4225-b1f7-23f47b5d1a7b\",\n \"user_email\":\"example@example.com\",\n \"user_name\":\"Mister User\",\n \"user_role\":\"Super Admin\",\n \"policy_id\":\"b3bdce6e-a055-4246-b3a3-08237db82c9d\",\n \"policy_name\":\"My new Policy\",\n \"ip_address\":\"37.157.101.160\"\n },\n \"user_id\":\"86d6c44f-2d0d-4225-b1f7-23f47b5d1a7b\",\n \"id\":\"c8e4d487-8167-4a46-8bf2-c6ee331abd1b\",\n \"created_at\":\"2020-08-28T11:01:49.015472172Z\"\n },\n \"account_id\":\"550a20b8-6d36-4222-afbc-54d100f2e894\",\n \"subscription_id\":\"f43dc73b-2709-4d6f-9c79-08abc815114b\"\n}\n```\n\n#### Policy Deleted\n```json\n{\n \"event\":\"policy_events\",\n \"id\":\"4a88d17d-3f48-452e-a871-32584d9b26cf\",\n \"payload\":{\n \"severity\":\"AUDIT\",\n \"type\":\"POLICY_DELETED\",\n \"account_id\":\"550a20b8-6d36-4222-afbc-54d100f2e894\",\n \"details\":{\n \"message\":\"Policy Deleted\",\n \"user_id\":\"86d6c44f-2d0d-4225-b1f7-23f47b5d1a7b\",\n \"user_email\":\"example@example.com\",\n \"user_name\":\"Mister User\",\n \"user_role\":\"Super Admin\",\n \"policy_id\":\"b3bdce6e-a055-4246-b3a3-08237db82c9d\",\n \"policy_name\":\"My new Policy\",\n \"ip_address\":\"37.157.101.160\"\n },\n \"user_id\":\"86d6c44f-2d0d-4225-b1f7-23f47b5d1a7b\",\n \"id\":\"ef09a4a9-5c9f-481c-beb6-4757ede35dc3\",\n \"created_at\":\"2020-08-28T11:03:15.655679621Z\"\n },\n \"account_id\":\"550a20b8-6d36-4222-afbc-54d100f2e894\",\n \"subscription_id\":\"f43dc73b-2709-4d6f-9c79-08abc815114b\"\n}\n```\n\n### Machine Events\n\n#### Machine registered\n```json\n\n{\n \"event\":\"machine_events\",\n \"id\":\"43c1fbfd-788a-4839-86b6-b765dfdc59d5\",\n \"payload\":{\n \"severity\":\"AUDIT\",\n \"type\":\"MACHINE_REGISTERED\",\n \"machine_id\":\"0eed4a65-81a9-4cae-91e6-d8cd8dbd775a\",\n \"account_id\":\"47632e8c-f125-4875-8d5b-ab24275c90a8\",\n \"machine_name\":\"My PC\",\n \"details\":{\n \"message\":\"New machine registered\"\n },\n \"id\":\"ccb84b33-2d8e-4dcb-94a0-922fc669ce4a\",\n \"created_at\":\"2020-08-28T11:28:05.083699037Z\"\n },\n \"account_id\":\"47632e8c-f125-4875-8d5b-ab24275c90a8\",\n \"subscription_id\":\"5032842b-0dd1-44f4-a59e-feadc22c142d\"\n}\n```\n\n#### Machine unregistered\n```json\n{\n \"event\": \"machine_events\",\n \"id\": \"3883b459-b3c8-40d5-999a-18514f1a3db0\",\n \"account_id\": \"550a20b8-6d36-4222-afbc-54d100f2e894\",\n \"payload\": {\n \"severity\": \"AUDIT\",\n \"account_id\": \"550a20b8-6d36-4222-afbc-54d100f2e894\",\n \"machine_id\": \"d5536936-941a-4e12-9e62-b11cda0f39a6\",\n \"id\": \"d7653c62-eb23-4163-8cfc-43ef69aea9ad\",\n \"created_at\": \"2022-03-30T13:11:52.925005454Z\",\n \"machine_name\": \"LeBlanc\",\n \"details\": {\n \"message\": \"machine unregistered\",\n \"timeout\": false\n },\n \"type\": \"MACHINE_UNREGISTERED\"\n },\n \"subscription_id\": \"3dc2a8d9-eb83-4127-afff-8fefa04f58e1\"\n}\n```\n\n#### Machine asset info\n```json\n{\n \"event\":\"machine_events\",\n \"id\":\"9ecdd1c2-eb50-4baa-be81-823897ebd55e\",\n \"payload\":{\n \"severity\":\"INFO\",\n \"type\":\"MACHINE_ASSET_INFO\",\n \"machine_id\":\"cf406788-edea-4938-b0db-757379d21e11\",\n \"account_id\":\"47632e8c-f125-4875-8d5b-ab24275c90a8\",\n \"machine_name\":\"NewEndpoint\",\n \"details\":{\n \"message\":\"Asset information received\"\n },\n \"id\":\"93ba7d7c-fcf4-43fd-9df8-8d857d6d3cd0\",\n \"created_at\":\"2020-08-28T11:29:08.290089258Z\"\n }\n}\n```\n\n#### Machine group changed\n```json\n{\n \"event\":\"machine_events\",\n \"id\":\"7541515f-95f7-49d3-8913-9cb31c0aa927\",\n \"payload\":{\n \"severity\":\"AUDIT\",\n \"type\":\"MACHINE_GROUP_CHANGED\",\n \"machine_id\":\"36b53eb8-45f0-46c7-a395-1aa361f09021\",\n \"account_id\":\"47632e8c-f125-4875-8d5b-ab24275c90a8\",\n \"machine_name\":\"NewEndpoint\",\n \"details\":{\n \"message\":\"NewEndpoint moved from Default Group to New Test Group ihg21jhkee5mhmr\",\n \"user_id\":\"d10235ef-e177-4c31-a2b7-ea40a80e6824\",\n \"user_email\":\"tagalileogalilei+ihg21jbkee5i0f0@gmail.com\",\n \"user_name\":\"Webhooks Tests\",\n \"machine_id\":\"36b53eb8-45f0-46c7-a395-1aa361f09021\",\n \"machine_name\":\"NewEndpoint\"\n },\n \"user_id\":\"d10235ef-e177-4c31-a2b7-ea40a80e6824\",\n \"id\":\"d9613bf2-e5c5-4bce-9bf8-e138c792bc6b\",\n \"created_at\":\"2020-08-28T11:30:09.249131849Z\"\n },\n \"account_id\":\"47632e8c-f125-4875-8d5b-ab24275c90a8\",\n \"subscription_id\":\"5032842b-0dd1-44f4-a59e-feadc22c142d\"\n}\n```\n\n#### Machine alias created\n```json\n{\n \"event\": \"machine_events\",\n \"id\": \"50be8bed-d2e9-4a85-9bfa-6ccecd98137e\",\n \"payload\": {\n \"severity\": \"INFO\",\n \"type\": \"MACHINE_ALIAS_CREATED\",\n \"account_id\": \"08496dca-fc09-4757-9573-c033ce078985\",\n \"user_id\": \"ea1b004e-5fd2-4fbc-bf09-5a00023704d0\",\n \"id\": \"659dc314-a9a0-41c5-bde4-26f293947ede\",\n \"created_at\": \"2021-03-01T10:19:31.732122237Z\",\n \"details\": {\n \"machine_id\": \"dc190e62-5424-4975-9913-1d84aec39300\",\n \"new_alias\": \"Endpoint name\"\n }\n },\n \"account_id\": \"08496dca-fc09-4757-9573-c033ce078985\",\n \"subscription_id\": \"95dbb4e0-3cf2-4d81-a312-2ea6b6e7202c\"\n}\n```\n\n#### Machine alias changed\n```json\n{\n \"event\": \"machine_events\",\n \"id\": \"5563e7f9-3d04-48f0-b276-531fdff0b637\",\n \"payload\": {\n \"severity\": \"INFO\",\n \"type\": \"MACHINE_ALIAS_CHANGED\",\n \"account_id\": \"08496dca-fc09-4757-9573-c033ce078985\",\n \"user_id\": \"ea1b004e-5fd2-4fbc-bf09-5a00023704d0\",\n \"id\": \"e38e8b75-a0e5-4794-bb05-f3ee4d5deed8\",\n \"created_at\": \"2021-03-01T10:19:32.14157065Z\",\n \"details\": {\n \"machine_id\": \"dc190e62-5424-4975-9913-1d84aec39300\",\n \"old_alias\": \"Endpoint name\",\n \"new_alias\": \"Changed endpoint name\"\n }\n },\n \"account_id\": \"08496dca-fc09-4757-9573-c033ce078985\",\n \"subscription_id\": \"95dbb4e0-3cf2-4d81-a312-2ea6b6e7202c\"\n}\n```\n\n#### Machine alias deleted\n```json\n{\n \"event\": \"machine_events\",\n \"id\": \"6b30f551-2f7a-4170-bf7b-0a1175ad10df\",\n \"payload\": {\n \"severity\": \"INFO\",\n \"type\": \"MACHINE_ALIAS_DELETED\",\n \"account_id\": \"08496dca-fc09-4757-9573-c033ce078985\",\n \"user_id\": \"ea1b004e-5fd2-4fbc-bf09-5a00023704d0\",\n \"id\": \"6b84564f-503d-4c60-bae7-c54f8092911b\",\n \"created_at\": \"2021-03-01T10:19:59.212023675Z\",\n \"details\": {\n \"machine_id\": \"8b18023a-d108-420d-b435-c4b0132c1a6e\",\n \"old_alias\": \"New endpoint name\"\n }\n },\n \"account_id\": \"08496dca-fc09-4757-9573-c033ce078985\",\n \"subscription_id\": \"95dbb4e0-3cf2-4d81-a312-2ea6b6e7202c\"\n}\n```\n\n### Exclusion events\n\n#### Exclusion created\n```json\n{\n \"event\":\"exclusion_events\",\n \"id\":\"3a1ff38c-0246-42e6-a859-06cfa4a3d4db\",\n \"payload\":{\n \"severity\":\"AUDIT\",\n \"type\":\"EXCLUSION_CREATED\",\n \"account_id\":\"47632e8c-f125-4875-8d5b-ab24275c90a8\",\n \"details\":{\n \"message\":\"An Exclusion was Added\",\n \"user_id\":\"d10235ef-e177-4c31-a2b7-ea40a80e6824\",\n \"user_email\":\"tagalileogalilei+ihg21jbkee5i0f0@gmail.com\",\n \"user_name\":\"Webhooks Tests\",\n \"user_role\":\"Super Admin\",\n \"exclusion_type\":1,\n \"exclusion_value\":\"C:/testCreateExclusion/happypathihg21jhkee5l5na.txt\",\n \"global_exclusion\":true\n },\n \"user_id\":\"d10235ef-e177-4c31-a2b7-ea40a80e6824\",\n \"id\":\"cfe2c8ae-6803-4c24-9f35-dfea16e902d9\",\n \"created_at\":\"2020-08-28T11:29:06.745315507Z\"\n },\n \"account_id\":\"47632e8c-f125-4875-8d5b-ab24275c90a8\",\n \"subscription_id\":\"cf65f446-e88f-409e-accf-de7f371013a2\"\n}\n```\n\n#### Exclusion updated\n```json\n{\n \"event\":\"exclusion_events\",\n \"id\":\"f6080c78-4d52-4593-935d-c33a85c7cd44\",\n \"payload\":{\n \"severity\":\"AUDIT\",\n \"type\":\"EXCLUSION_UPDATED\",\n \"account_id\":\"47632e8c-f125-4875-8d5b-ab24275c90a8\",\n \"details\":{\n \"message\":\"An Exclusion was Edited\",\n \"user_id\":\"d10235ef-e177-4c31-a2b7-ea40a80e6824\",\n \"user_email\":\"tagalileogalilei+ihg21jbkee5i0f0@gmail.com\",\n \"user_name\":\"Webhooks Tests\",\n \"user_role\":\"Super Admin\",\n \"exclusion_type\":6,\n \"exclusion_value\":\"https://www.malwarebytesihg21jhkee5lbib.com/\",\n \"global_exclusion\":true\n },\n \"user_id\":\"d10235ef-e177-4c31-a2b7-ea40a80e6824\",\n \"id\":\"31243b63-9b24-4dc9-b7f3-d5e2eb210496\",\n \"created_at\":\"2020-08-28T11:29:14.236333504Z\"\n },\n \"account_id\":\"47632e8c-f125-4875-8d5b-ab24275c90a8\",\n \"subscription_id\":\"cf65f446-e88f-409e-accf-de7f371013a2\"\n}\n```\n\n#### Exclusion enabled\n```json\n{\n \"event\":\"exclusion_events\",\n \"id\":\"f1277c42-8fb6-4615-ba3d-b4cdb00b1e78\",\n \"payload\":{\n \"severity\":\"AUDIT\",\n \"type\":\"EXCLUSION_ENABLED\",\n \"account_id\":\"47632e8c-f125-4875-8d5b-ab24275c90a8\",\n \"details\":{\n \"message\":\"An Exclusion was Enabled\",\n \"user_id\":\"d10235ef-e177-4c31-a2b7-ea40a80e6824\",\n \"user_email\":\"tagalileogalilei+ihg21jbkee5i0f0@gmail.com\",\n \"user_name\":\"Webhooks Tests\",\n \"user_role\":\"Super Admin\",\n \"exclusion_type\":6,\n \"exclusion_value\":\"https://www.malwarebytesihg21jhkee5lh9c.com/\",\n \"global_exclusion\":true\n },\n \"user_id\":\"d10235ef-e177-4c31-a2b7-ea40a80e6824\",\n \"id\":\"2833e903-955a-48a3-8a5d-8e05c1e8f75f\",\n \"created_at\":\"2020-08-28T11:29:21.690971637Z\"\n },\n \"account_id\":\"47632e8c-f125-4875-8d5b-ab24275c90a8\",\n \"subscription_id\":\"cf65f446-e88f-409e-accf-de7f371013a2\"\n}\n```\n\n#### Exclusion deleted\n```json\n{\n \"event\":\"exclusion_events\",\n \"id\":\"7ba0355e-44d9-4f5c-a5a0-2884b783c465\",\n \"payload\":{\n \"severity\":\"AUDIT\",\n \"type\":\"EXCLUSION_DELETED\",\n \"account_id\":\"47632e8c-f125-4875-8d5b-ab24275c90a8\",\n \"details\":{\n \"message\":\"An Exclusion was Deleted\",\n \"user_id\":\"d10235ef-e177-4c31-a2b7-ea40a80e6824\",\n \"user_email\":\"tagalileogalilei+ihg21jbkee5i0f0@gmail.com\",\n \"user_name\":\"Webhooks Tests\",\n \"user_role\":\"Super Admin\",\n \"exclusion_type\":1,\n \"exclusion_value\":\"C:/testCreateExclusion/happypathihg21jhkee5ls7x.txt\",\n \"global_exclusion\":true\n },\n \"user_id\":\"d10235ef-e177-4c31-a2b7-ea40a80e6824\",\n \"id\":\"03fc92e0-4e17-4ab8-9b85-cd74fa521660\",\n \"created_at\":\"2020-08-28T11:29:36.655423399Z\"\n },\n \"account_id\":\"47632e8c-f125-4875-8d5b-ab24275c90a8\",\n \"subscription_id\":\"cf65f446-e88f-409e-accf-de7f371013a2\"\n}\n```\n\n#### Exclusion disabled\n```json\n{\n \"event\":\"exclusion_events\",\n \"id\":\"f54f8b33-95ba-4591-96f8-d3dbfce7264d\",\n \"payload\":{\n \"severity\":\"AUDIT\",\n \"type\":\"EXCLUSION_DISABLED\",\n \"account_id\":\"47632e8c-f125-4875-8d5b-ab24275c90a8\",\n \"details\":{\n \"message\":\"An Exclusion was Disabled\",\n \"user_id\":\"d10235ef-e177-4c31-a2b7-ea40a80e6824\",\n \"user_email\":\"tagalileogalilei+ihg21jbkee5i0f0@gmail.com\",\n \"user_name\":\"Webhooks Tests\",\n \"user_role\":\"Super Admin\",\n \"exclusion_type\":6,\n \"exclusion_value\":\"https://www.malwarebytesihg21jhkee5ln0w.com/\",\n \"global_exclusion\":true\n },\n \"user_id\":\"d10235ef-e177-4c31-a2b7-ea40a80e6824\",\n \"id\":\"126430b1-8d09-4356-8533-524231a7aee9\",\n \"created_at\":\"2020-08-28T11:29:29.158586114Z\"\n },\n \"account_id\":\"47632e8c-f125-4875-8d5b-ab24275c90a8\",\n \"subscription_id\":\"cf65f446-e88f-409e-accf-de7f371013a2\"\n}\n```\n\n#### Exclusion bulk delete\n```json\n{\n \"event\":\"exclusion_events\",\n \"id\":\"1bf018a2-d93e-48a5-be17-579f1f4c8bac\",\n \"payload\":{\n \"severity\":\"AUDIT\",\n \"type\":\"EXCLUSION_BULK_DELETED\",\n \"account_id\":\"47632e8c-f125-4875-8d5b-ab24275c90a8\",\n \"details\":{\n \"message\":\"Bulk Exclusions were Deleted\",\n \"user_id\":\"d10235ef-e177-4c31-a2b7-ea40a80e6824\",\n \"user_email\":\"tagalileogalilei+ihg21jbkee5i0f0@gmail.com\",\n \"user_name\":\"Webhooks Tests\",\n \"user_role\":\"Super Admin\",\n \"exclusion_count\":2\n },\n \"user_id\":\"d10235ef-e177-4c31-a2b7-ea40a80e6824\",\n \"id\":\"a0d18178-f772-48bd-bc12-8c421b4dacc1\",\n \"created_at\":\"2020-08-28T11:29:45.054762536Z\"\n },\n \"account_id\":\"47632e8c-f125-4875-8d5b-ab24275c90a8\",\n \"subscription_id\":\"cf65f446-e88f-409e-accf-de7f371013a2\"\n}\n```\n\n### Threat events\n\n#### Threat found\n```json\n{\n \"event\":\"threat_events\",\n \"id\":\"ebaef39a-40fd-4575-9fe7-2e07fd04d76f\",\n \"payload\":{\n \"severity\":\"SEVERE\",\n \"type\":\"THREAT_FOUND\",\n \"machine_id\":\"b11220d5-60f5-4f25-adf1-03bebd14f2f2\",\n \"account_id\":\"47632e8c-f125-4875-8d5b-ab24275c90a8\",\n \"machine_name\":\"Webhook validator\",\n \"details\":{\n \"message\":\"Scan event notification\"\n },\n \"id\":\"5984e884-8f7b-407a-892e-51bea5fa86e2\",\n \"created_at\":\"2020-08-28T11:29:08.496072781Z\"\n },\n \"account_id\":\"47632e8c-f125-4875-8d5b-ab24275c90a8\",\n \"subscription_id\":\"820e96cd-0fd4-4ed7-af74-8d1896322a3a\"\n}\n```\n\n#### Threat scan success\n```json\n{\n \"event\":\"threat_events\",\n \"id\":\"8eb6aabb-9a70-44d8-b767-5ceedf80893b\",\n \"payload\":{\n \"severity\":\"INFO\",\n \"type\":\"THREAT_SCAN_SUCCESS\",\n \"machine_id\":\"b11220d5-60f5-4f25-adf1-03bebd14f2f2\",\n \"account_id\":\"47632e8c-f125-4875-8d5b-ab24275c90a8\",\n \"machine_name\":\"Webhook validator\",\n \"details\":{\n \"message\":\"Threat scan result received\"\n },\n \"id\":\"10032184-9bfb-42b0-aab1-678b5cef859f\",\n \"created_at\":\"2020-08-28T11:29:08.46647437Z\"\n },\n \"account_id\":\"47632e8c-f125-4875-8d5b-ab24275c90a8\",\n \"subscription_id\":\"820e96cd-0fd4-4ed7-af74-8d1896322a3a\"\n}\n```\n\n#### Threat cleaned\n```json\n{\n \"event\":\"threat_events\",\n \"id\":\"a01f1de7-a072-4a98-b728-425706318cf8\",\n \"payload\":{\n \"severity\":\"WARNING\",\n \"type\":\"THREAT_CLEANED\",\n \"machine_id\":\"06667ced-ed77-4cb5-bf17-ab45a6457ec6\",\n \"account_id\":\"47632e8c-f125-4875-8d5b-ab24275c90a8\",\n \"machine_name\":\"NewEndpoint\",\n \"details\":{\n \"message\":\"Scan event notification\",\n \"scan_id\":\"4169c48d-2c03-40fd-8965-240e6d6b94f9\",\n \"scan_type\":\"ThreatScan\",\n \"group_name\":\"Default Group\",\n \"group_id\":\"513cf384-d53d-44b9-9813-db69a0e12d16\",\n \"policy_id\":\"138d00b0-05d0-4370-bd0e-d8b9db66dd0f\",\n \"policy_name\":\"Default Policy\",\n \"detections_found\":0,\n \"detections_cleaned\":1,\n \"scan_date\":\"2020-08-28T11:29:25Z\",\n \"scan_date_offset_seconds\":0,\n \"domain\":\"corp.mb-test.com\",\n \"ip_addresses\":[\n \"10.100.136.53\"\n ],\n \"detections\":[\n {\n \"id\":\"544064a5-b1bb-439b-b4df-2536d5949cfe\",\n \"trace_id\":\"4169c48d-2c03-40fd-8965-240e6d6b94f9_7fccf164-95bd-4035-a9bc-48a6dcf510c8\",\n \"scan_id\":\"4169c48d-2c03-40fd-8965-240e6d6b94f9\",\n \"machine_id\":\"06667ced-ed77-4cb5-bf17-ab45a6457ec6\",\n \"machine_name\":\"NewEndpoint\",\n \"group_id\":\"513cf384-d53d-44b9-9813-db69a0e12d16\",\n \"account_id\":\"47632e8c-f125-4875-8d5b-ab24275c90a8\",\n \"detection_id\":\"7fccf164-95bd-4035-a9bc-48a6dcf510c8\",\n \"parent_detection_id\":\"\",\n \"correlation_hash\":\"\",\n \"scanned_at\":\"2020-08-28T11:29:25Z\",\n \"scanned_at_offset_seconds\":0,\n \"reported_at\":\"2020-08-28T11:29:26.138544Z\",\n \"cleaned_at\":\"0001-01-01T00:00:00Z\",\n \"status\":\"quarantined\",\n \"threat_name\":\"PUP.Optional.FooBar\",\n \"type\":\"WyJmaWxlIl0=\",\n \"path\":\"C:\\\\\\\\USERS\\\\\\\\ADMIN\\\\\\\\DESKTOP\\\\\\\\c8e09e6a-6619-44f3-9b5c-f7a15d258aeb.EXE\",\n \"category\":\"PUP\",\n \"is_rtp_stream_event\":false,\n \"affected_application\":\"\",\n \"md5\":\"\",\n \"process_name\":\"\",\n \"GroupName\":\"\",\n \"PolicyID\":\"\",\n \"PolicyName\":\"\",\n \"CurrentGroupID\":\"00000000-0000-0000-0000-000000000000\"\n }\n ]\n },\n \"id\":\"26c47666-02a2-452c-b382-07942372d0df\",\n \"created_at\":\"2020-08-28T11:29:26.191675412Z\"\n },\n \"account_id\":\"47632e8c-f125-4875-8d5b-ab24275c90a8\",\n \"subscription_id\":\"820e96cd-0fd4-4ed7-af74-8d1896322a3a\"\n}\n```\n\n#### Threat remediate success\n```json\n{\n \"event\":\"threat_events\",\n \"id\":\"2cc1807e-9b33-4de0-9d50-c240839bc79a\",\n \"payload\":{\n \"severity\":\"INFO\",\n \"type\":\"THREAT_REMEDIATE_SUCCESS\",\n \"machine_id\":\"a0f29eef-257a-4101-a814-074ee462c949\",\n \"account_id\":\"47632e8c-f125-4875-8d5b-ab24275c90a8\",\n \"machine_name\":\"NewEndpoint\",\n \"details\":{\n \"message\":\"\"\n },\n \"id\":\"155f60f3-8128-446c-b409-580fad9b247f\",\n \"created_at\":\"2020-08-28T11:30:31.264848509Z\"\n },\n \"account_id\":\"47632e8c-f125-4875-8d5b-ab24275c90a8\",\n \"subscription_id\":\"820e96cd-0fd4-4ed7-af74-8d1896322a3a\"\n}\n```\n\n#### Threat remediate failure\n```json\n{\n \"event\":\"threat_events\",\n \"id\":\"99def8df-e1c7-4558-9287-009d3d87949e\",\n \"payload\":{\n \"severity\":\"INFO\",\n \"type\":\"THREAT_REMEDIATE_FAILURE\",\n \"machine_id\":\"40919ac8-a2cd-458d-ba49-8af92c19ca54\",\n \"account_id\":\"47632e8c-f125-4875-8d5b-ab24275c90a8\",\n \"machine_name\":\"NewEndpoint\",\n \"details\":{\n \"message\":\"\"\n },\n \"id\":\"22f8269a-8e1f-4b22-a29a-b7d16b6bc376\",\n \"created_at\":\"2020-08-28T11:30:57.669921894Z\"\n },\n \"account_id\":\"47632e8c-f125-4875-8d5b-ab24275c90a8\",\n \"subscription_id\":\"820e96cd-0fd4-4ed7-af74-8d1896322a3a\"\n}\n```\n\n#### Threat found\n```json\n{\n \"event\":\"threat_events\",\n \"id\":\"d9cd9bc7-b5c2-49b3-88ca-9682ffe015ca\",\n \"payload\":{\n \"severity\":\"SEVERE\",\n \"type\":\"THREAT_FOUND\",\n \"machine_id\":\"58e326bc-de1f-49a6-926f-def0065275b3\",\n \"account_id\":\"47632e8c-f125-4875-8d5b-ab24275c90a8\",\n \"machine_name\":\"NewEndpoint\",\n \"details\":{\n \"message\":\"Scan event notification\",\n \"scan_id\":\"1dad28d1-7a34-40df-96dc-4ee9781e9363\",\n \"scan_type\":\"ThreatScan\",\n \"group_name\":\"Default Group\",\n \"group_id\":\"513cf384-d53d-44b9-9813-db69a0e12d16\",\n \"policy_id\":\"138d00b0-05d0-4370-bd0e-d8b9db66dd0f\",\n \"policy_name\":\"Default Policy\",\n \"detections_found\":1,\n \"detections_cleaned\":0,\n \"scan_date\":\"2020-08-28T11:29:25Z\",\n \"scan_date_offset_seconds\":0,\n \"domain\":\"corp.mb-test.com\",\n \"ip_addresses\":[\n \"10.100.136.53\"\n ],\n \"detections\":[\n {\n \"id\":\"e659d7d7-7bc3-49e2-b3e7-7a44bf37753e\",\n \"trace_id\":\"1dad28d1-7a34-40df-96dc-4ee9781e9363_f596c2bf-f55c-4fa9-8dfa-17861ca8e84b\",\n \"scan_id\":\"1dad28d1-7a34-40df-96dc-4ee9781e9363\",\n \"machine_id\":\"58e326bc-de1f-49a6-926f-def0065275b3\",\n \"machine_name\":\"NewEndpoint\",\n \"group_id\":\"513cf384-d53d-44b9-9813-db69a0e12d16\",\n \"account_id\":\"47632e8c-f125-4875-8d5b-ab24275c90a8\",\n \"detection_id\":\"f596c2bf-f55c-4fa9-8dfa-17861ca8e84b\",\n \"parent_detection_id\":\"\",\n \"correlation_hash\":\"\",\n \"scanned_at\":\"2020-08-28T11:29:25Z\",\n \"scanned_at_offset_seconds\":0,\n \"reported_at\":\"2020-08-28T11:29:25.763388Z\",\n \"cleaned_at\":\"0001-01-01T00:00:00Z\",\n \"status\":\"found\",\n \"threat_name\":\"PUP.Optional.FooBar\",\n \"type\":\"WyJmaWxlIl0=\",\n \"path\":\"C:\\\\\\\\USERS\\\\\\\\ADMIN\\\\\\\\DESKTOP\\\\\\\\80febe47-44fe-4b5e-9549-4677b5d8dc8d.EXE\",\n \"category\":\"PUP\",\n \"is_rtp_stream_event\":false,\n \"affected_application\":\"\",\n \"md5\":\"\",\n \"process_name\":\"\",\n \"GroupName\":\"\",\n \"PolicyID\":\"\",\n \"PolicyName\":\"\",\n \"CurrentGroupID\":\"00000000-0000-0000-0000-000000000000\"\n }\n ]\n },\n \"id\":\"41668db4-af52-4547-84eb-f68a4ed55cb2\",\n \"created_at\":\"2020-08-28T11:29:25.818909871Z\"\n },\n \"account_id\":\"47632e8c-f125-4875-8d5b-ab24275c90a8\",\n \"subscription_id\":\"820e96cd-0fd4-4ed7-af74-8d1896322a3a\"\n}\n```\n\n### EDR events\n\n#### Suspicious activity detection\n\n```json\n{\n \"event\": \"edr_events\",\n \"id\": \"48d1658e-87d8-4df4-87a8-27cecded2174\",\n \"payload\": {\n \"severity\": \"WARNING\",\n \"type\": \"EDR_SUSPICIOUS_ACTIVITY\",\n \"account_id\": \"683645cb-edf4-4a81-aa1f-efd87c53851d\",\n \"machine_id\": \"3a89e0b2-47db-4fe2-b6ba-8cd520bc5833\",\n \"id\": \"31cc7f69-4def-4291-89b8-6f7defb5b702\",\n \"created_at\": \"2021-03-10T15:09:45.055891846Z\",\n \"details\": {\n \"message\": \"C:\\\\REG-DISABLE-CMD359B71O4LKM3KQO3G.EXE\"\n },\n \"machine_name\": \"NewEndpoint\"\n },\n \"account_id\": \"683645cb-edf4-4a81-aa1f-efd87c53851d\",\n \"subscription_id\": \"c817dbda-95f5-4956-a6db-cc070ff0bd6d\"\n}\n```\n\n#### Restore success\n\n```json\n{\n \"event\":\"edr_events\",\n \"id\":\"ae69d649-bd12-4948-9c98-342ba890f9a3\",\n \"payload\":\n {\n \"severity\":\"INFO\",\n \"type\":\"EDR_RESTORE_SUCCESS\",\n \"machine_id\":\"7f0d7483-92a8-4da5-9754-f7c16e4c3105\",\n \"account_id\":\"caef93d6-92bc-4731-a51f-f61685cca765\",\n \"details\":{\"message\":\"\"},\n \"id\":\"64a6fdef-31f1-4ec8-8c2a-a3d2c2f1f290\",\n \"machine_name\":\"NewEndpoint\",\n \"created_at\":\"2020-08-31T10:51:50.396082575Z\"\n },\n \"account_id\":\"caef93d6-92bc-4731-a51f-f61685cca765\",\n \"subscription_id\":\"ea725d97-11c2-4a34-9022-221b347c731d\"\n}\n```\n\n#### Restore failure\n\n```json\n{\n \"event\":\"edr_events\",\n \"id\":\"9abec3e1-99ec-4af6-9ef1-e56453b402e8\",\n \"payload\":\n {\n \"severity\":\"INFO\",\n \"type\":\"EDR_RESTORE_FAILURE\",\n \"machine_id\":\"a207f475-7e6d-4c0d-8664-f8ddb6c1bb8a\",\n \"account_id\":\"caef93d6-92bc-4731-a51f-f61685cca765\",\n \"details\":{\"message\":\"\"},\n \"id\":\"1ae86c7a-9b45-4f8d-800b-cc5885964737\",\n \"machine_name\":\"NewEndpoint\",\n \"created_at\":\"2020-08-31T10:52:16.910215996Z\"\n },\n \"account_id\":\"caef93d6-92bc-4731-a51f-f61685cca765\",\n \"subscription_id\":\"ea725d97-11c2-4a34-9022-221b347c731d\"\n}\n```\n\n#### Isolation success\n\n```json\n{\n \"event\":\"edr_events\",\n \"id\":\"7866c914-b4f9-4e99-8002-501079b2ca86\",\n \"payload\":\n {\n \"severity\":\"INFO\",\n \"type\":\"EDR_ISOLATION_SUCCESS\",\n \"machine_id\":\"f468073b-8715-49e4-a51f-903b86d8a57e\",\n \"account_id\":\"caef93d6-92bc-4731-a51f-f61685cca765\",\n \"details\":{\n \"message\":\"Endpoint isolation succeeded\"\n },\n \"id\":\"1c2b8b90-56d5-4bfd-97c1-073b0a4ea184\",\n \"machine_name\":\"NewEndpoint\",\n \"created_at\":\"2020-08-31T10:52:43.345700926Z\"\n },\n \"account_id\":\"caef93d6-92bc-4731-a51f-f61685cca765\",\n \"subscription_id\":\"ea725d97-11c2-4a34-9022-221b347c731d\"\n}\n```\n\n#### Isolation failure\n\n```json\n{\n \"event\":\"edr_events\",\n \"id\":\"b7265e89-c05f-4c9f-bc1b-d5ef1cbf2439\",\n \"payload\":{\n \"severity\":\"INFO\",\n \"type\":\"EDR_ISOLATION_FAILURE\",\n \"machine_id\":\"0361f318-4f01-4cef-8c5b-580f721eae8f\",\n \"account_id\":\"caef93d6-92bc-4731-a51f-f61685cca765\",\n \"details\":{\n \"message\":\"Endpoint isolation failed\"\n },\n \"id\":\"c64d1c74-8cf5-4afa-91ec-23e87c735b05\",\n \"machine_name\":\"NewEndpoint\",\n \"created_at\":\"2020-08-31T10:53:09.878218526Z\"\n },\n \"account_id\":\"caef93d6-92bc-4731-a51f-f61685cca765\",\n \"subscription_id\":\"ea725d97-11c2-4a34-9022-221b347c731d\"\n}\n```\n\n#### Unisolation success\n\n```json\n{\n \"event\": \"edr_events\",\n \"id\": \"002e4f0a-2911-4ccb-aeb6-08d4ee5696de\",\n \"payload\": {\n \"severity\": \"INFO\",\n \"type\": \"EDR_UNISOLATION_SUCCESS\",\n \"machine_id\": \"f1e3a297-0039-4fb6-b736-e14e10a7b3c7\",\n \"account_id\": \"caef93d6-92bc-4731-a51f-f61685cca765\",\n \"details\": {\n \"message\": \"Endpoint un-isolation succeeded\"\n },\n \"id\": \"5d8f7034-1d4c-4551-a4f7-d54d85de4dcd\",\n \"machine_name\": \"NewEndpoint\",\n \"created_at\": \"2020-08-31T10:53:36.517826109Z\"\n },\n \"account_id\": \"caef93d6-92bc-4731-a51f-f61685cca765\",\n \"subscription_id\": \"ea725d97-11c2-4a34-9022-221b347c731d\"\n}\n```\n\n#### Unisolation failure\n\n```json\n{\n \"event\": \"edr_events\",\n \"id\": \"0c3b07b2-4a3f-4b88-9d60-314d0fdf8314\",\n \"payload\": {\n \"severity\": \"INFO\",\n \"type\": \"EDR_UNISOLATION_FAILURE\",\n \"machine_id\": \"0f92d8e2-c9a1-4666-9e05-deb63a139ca7\",\n \"account_id\": \"caef93d6-92bc-4731-a51f-f61685cca765\",\n \"details\": {\n \"message\": \"Endpoint un-isolation failed\"\n },\n \"id\": \"60ed3071-19d3-4d56-8818-842666d356e6\",\n \"machine_name\": \"NewEndpoint\",\n \"created_at\": \"2020-08-31T10:54:03.055317564Z\"\n },\n \"account_id\": \"caef93d6-92bc-4731-a51f-f61685cca765\",\n \"subscription_id\": \"ea725d97-11c2-4a34-9022-221b347c731d\"\n}\n```\n\n### Syslog events\n\n#### Communication endpoint added\n\n```json\n{\n \"event\":\"syslog_events\",\n \"id\":\"59936c65-d1ad-4fb9-8e6f-191a7dc94d4c\",\n \"payload\":{\n \"severity\":\"AUDIT\",\n \"type\":\"SYSLOG_COMMUNICATION_ENDPOINT_ADDED\",\n \"account_id\":\"47632e8c-f125-4875-8d5b-ab24275c90a8\",\n \"details\":{\n \"message\":\"tagalileogalilei+ihg21jbkee5i0f0@gmail.com Added Syslog Communication Endpoint\",\n \"user_id\":\"d10235ef-e177-4c31-a2b7-ea40a80e6824\",\n \"user_email\":\"tagalileogalilei+ihg21jbkee5i0f0@gmail.com\",\n \"user_name\":\"Webhooks Tests\",\n \"machine_id\":\"e21c1572-cbf5-4f41-a8f2-f520b752b244\",\n \"machine_name\":\"NewEndpoint\"\n },\n \"user_id\":\"d10235ef-e177-4c31-a2b7-ea40a80e6824\",\n \"id\":\"4663c1b1-86ba-4ae8-aab9-bbb33892bdc0\",\n \"created_at\":\"2020-08-28T11:29:26.553694088Z\"\n },\n \"account_id\":\"47632e8c-f125-4875-8d5b-ab24275c90a8\",\n \"subscription_id\":\"d5d7d7aa-43f0-483a-913a-49f3e282b964\"\n}\n```\n\n#### Communication endpoint removed\n```json\n{\n \"event\":\"syslog_events\",\n \"id\":\"5e3a440b-b6b3-4c17-a6af-1593419ceecc\",\n \"payload\":{\n \"severity\":\"AUDIT\",\n \"type\":\"SYSLOG_COMMUNICATION_ENDPOINT_REMOVED\",\n \"account_id\":\"47632e8c-f125-4875-8d5b-ab24275c90a8\",\n \"details\":{\n \"message\":\"tagalileogalilei+ihg21jbkee5i0f0@gmail.com Removed Syslog Communication Endpoint\",\n \"user_id\":\"d10235ef-e177-4c31-a2b7-ea40a80e6824\",\n \"user_email\":\"tagalileogalilei+ihg21jbkee5i0f0@gmail.com\",\n \"user_name\":\"Webhooks Tests\",\n \"machine_id\":\"e21c1572-cbf5-4f41-a8f2-f520b752b244\",\n \"machine_name\":\"NewEndpoint\"\n },\n \"user_id\":\"d10235ef-e177-4c31-a2b7-ea40a80e6824\",\n \"id\":\"dd6ccb44-0cfb-4c92-8080-2b77637e809a\",\n \"created_at\":\"2020-08-28T11:29:33.371490102Z\"\n },\n \"account_id\":\"47632e8c-f125-4875-8d5b-ab24275c90a8\",\n \"subscription_id\":\"d5d7d7aa-43f0-483a-913a-49f3e282b964\"\n}\n```\n\n#### Communication endpoint disabled\n```json\n{\n \"event\":\"syslog_events\",\n \"id\":\"22c64b19-2a10-429f-b785-4db3ea0876bb\",\n \"payload\":{\n \"severity\":\"AUDIT\",\n \"type\":\"SYSLOG_COMMUNICATION_ENDPOINT_DISABLED\",\n \"account_id\":\"47632e8c-f125-4875-8d5b-ab24275c90a8\",\n \"details\":{\n \"message\":\"tagalileogalilei+ihg21jbkee5i0f0@gmail.com Disabled Syslog Communication Endpoint\",\n \"user_id\":\"d10235ef-e177-4c31-a2b7-ea40a80e6824\",\n \"user_email\":\"tagalileogalilei+ihg21jbkee5i0f0@gmail.com\",\n \"user_name\":\"Webhooks Tests\",\n \"machine_id\":\"e21c1572-cbf5-4f41-a8f2-f520b752b244\",\n \"machine_name\":\"NewEndpoint\"\n },\n \"user_id\":\"d10235ef-e177-4c31-a2b7-ea40a80e6824\",\n \"id\":\"e4856d8e-c00f-4e96-a1e2-58d89bed0813\",\n \"created_at\":\"2020-08-28T11:29:40.182107484Z\"\n },\n \"account_id\":\"47632e8c-f125-4875-8d5b-ab24275c90a8\",\n \"subscription_id\":\"d5d7d7aa-43f0-483a-913a-49f3e282b964\"\n}\n```\n\n#### Communication endpoint enabled\n```json\n{\n \"event\":\"syslog_events\",\n \"id\":\"552c6be3-fdf2-4350-9a2e-1f90fa5feb39\",\n \"payload\":{\n \"severity\":\"AUDIT\",\n \"type\":\"SYSLOG_COMMUNICATION_ENDPOINT_ENABLED\",\n \"account_id\":\"47632e8c-f125-4875-8d5b-ab24275c90a8\",\n \"details\":{\n \"message\":\"tagalileogalilei+ihg21jbkee5i0f0@gmail.com Enabled Syslog Communication Endpoint\",\n \"user_id\":\"d10235ef-e177-4c31-a2b7-ea40a80e6824\",\n \"user_email\":\"tagalileogalilei+ihg21jbkee5i0f0@gmail.com\",\n \"user_name\":\"Webhooks Tests\",\n \"machine_id\":\"e21c1572-cbf5-4f41-a8f2-f520b752b244\",\n \"machine_name\":\"NewEndpoint\"\n },\n \"user_id\":\"d10235ef-e177-4c31-a2b7-ea40a80e6824\",\n \"id\":\"08bc431c-0e68-47e7-848d-56ed5ae54952\",\n \"created_at\":\"2020-08-28T11:29:46.987196405Z\"\n },\n \"account_id\":\"47632e8c-f125-4875-8d5b-ab24275c90a8\",\n \"subscription_id\":\"d5d7d7aa-43f0-483a-913a-49f3e282b964\"\n}\n```\n\n### Scheduled events\n\n#### Scheduled threat scan success\n```json\n{\n \"event\":\"scheduled_events\",\n \"id\":\"2bfccc7d-0706-4fda-a32f-24016d19dc94\",\n \"payload\":{\n \"severity\":\"INFO\",\n \"type\":\"SCHEDULED_THREAT_SCAN_SUCCESS\",\n \"machine_id\":\"cf406788-edea-4938-b0db-757379d21e11\",\n \"account_id\":\"47632e8c-f125-4875-8d5b-ab24275c90a8\",\n \"machine_name\":\"NewEndpoint\",\n \"details\":{\n \"scan_id\":\"86412100-2b43-4c44-af9e-fb1697b2f019\",\n \"schedule_id\":\"047cb2f2-2bb9-43e7-974e-625c451bf21e\",\n \"schedule_name\":\"Daily Scan\",\n \"schedule_command_data\":\"{\\\"schedule_for_chromeos\\\":true,\\\"schedule_for_mac\\\":true,\\\"schedule_for_windows\\\":true,\\\"scan_settings\\\":{\\\"type\\\":\\\"ThreatScan\\\",\\\"remove\\\":true},\\\"mac_scan_settings\\\":{\\\"remove\\\":true,\\\"pup_detection\\\":\\\"Detect\\\"},\\\"chromeos_scan_settings\\\":{}}\"\n },\n \"id\":\"f2816da1-5244-4338-a85e-0809da72d77c\",\n \"created_at\":\"2020-08-28T11:29:26.403277042Z\"\n },\n \"account_id\":\"47632e8c-f125-4875-8d5b-ab24275c90a8\",\n \"subscription_id\":\"cf5031f5-e0cb-4bf9-a581-fdf5c6289906\"\n}\n```\n\n#### Scheduled threat scan failure\n```json\n{\n \"event\":\"scheduled_events\",\n \"id\":\"fac11237-7602-427f-ad6f-c230c138d774\",\n \"payload\":{\n \"severity\":\"WARNING\",\n \"type\":\"SCHEDULED_THREAT_SCAN_FAILURE\",\n \"machine_id\":\"fc2b39dc-d49a-4a62-b1db-f1c9239e4f13\",\n \"account_id\":\"47632e8c-f125-4875-8d5b-ab24275c90a8\",\n \"machine_name\":\"NewEndpoint\",\n \"details\":{\n \"scan_id\":\"00000000-0000-0000-0000-000000000000\",\n \"schedule_id\":\"047cb2f2-2bb9-43e7-974e-625c451bf21e\",\n \"schedule_name\":\"Daily Scan\",\n \"schedule_command_data\":\"{\\\"schedule_for_chromeos\\\":true,\\\"schedule_for_mac\\\":true,\\\"schedule_for_windows\\\":true,\\\"scan_settings\\\":{\\\"type\\\":\\\"ThreatScan\\\",\\\"remove\\\":true},\\\"mac_scan_settings\\\":{\\\"remove\\\":true,\\\"pup_detection\\\":\\\"Detect\\\"},\\\"chromeos_scan_settings\\\":{}}\"\n },\n \"id\":\"6f8b5e95-382e-44ef-9621-1921cad7b952\",\n \"created_at\":\"2020-08-28T11:29:52.346309401Z\"\n },\n \"account_id\":\"47632e8c-f125-4875-8d5b-ab24275c90a8\",\n \"subscription_id\":\"cf5031f5-e0cb-4bf9-a581-fdf5c6289906\"\n}\n```\n\n### Quarantine events\n\n#### Quarantine deleted\n```json\n{\n \"event\":\"quarantine_events\",\n \"id\":\"38fadc7a-c7e6-4562-a29e-c411cdc2d85e\",\n \"payload\":{\n \"severity\":\"INFO\",\n \"type\":\"QUARANTINE_DELETED\",\n \"machine_id\":\"06667ced-ed77-4cb5-bf17-ab45a6457ec6\",\n \"account_id\":\"47632e8c-f125-4875-8d5b-ab24275c90a8\",\n \"machine_name\":\"NewEndpoint\",\n \"details\":{\n \"message\":\"C:\\\\\\\\USERS\\\\\\\\ADMIN\\\\\\\\DESKTOP\\\\\\\\c8e09e6a-6619-44f3-9b5c-f7a15d258aeb.EXE\",\n \"detection_id\": \"b271af4a-8967-4916-9045-c27cbe1c8f36\"\n },\n \"id\":\"1534989f-f720-40d3-b4a8-d2640c8127c4\",\n \"created_at\":\"2020-08-28T11:29:26.992510864Z\"\n },\n \"account_id\":\"47632e8c-f125-4875-8d5b-ab24275c90a8\",\n \"subscription_id\":\"3471740f-aaa8-4e2c-8695-2bfb3e378d61\"\n}\n```\n\n#### Quarantine restored\n```json\n{\n \"event\":\"quarantine_events\",\n \"id\":\"56098088-35ce-44e2-ad1e-1d394580d7b2\",\n \"payload\":{\n \"severity\":\"INFO\",\n \"type\":\"QUARANTINE_RESTORED\",\n \"machine_id\":\"23f22e64-d7d0-4134-9e0a-df2d4372d42f\",\n \"account_id\":\"47632e8c-f125-4875-8d5b-ab24275c90a8\",\n \"machine_name\":\"NewEndpoint\",\n \"details\":{\n \"message\":\"C:\\\\\\\\USERS\\\\\\\\ADMIN\\\\\\\\DESKTOP\\\\\\\\895705b2-4924-4a58-9f57-38bf17190f0e.EXE\",\n \"detection_id\": \"b271af4a-8967-4916-9045-c27cbe1c8f36\"\n },\n \"id\":\"851d94de-38f9-4f13-983c-1240e5847bac\",\n \"created_at\":\"2020-08-28T11:30:22.246451515Z\"\n },\n \"account_id\":\"47632e8c-f125-4875-8d5b-ab24275c90a8\",\n \"subscription_id\":\"3471740f-aaa8-4e2c-8695-2bfb3e378d61\"\n}\n```\n\n#### Restore quarantine fail\n```json\n{\n \"event\":\"quarantine_events\",\n \"id\":\"23e86e5f-41ba-4227-9b99-d4d0f6aaf0bb\",\n \"payload\":{\n \"severity\":\"WARNING\",\n \"type\":\"QUARANTINE_RESTORE_FAIL\",\n \"machine_id\":\"f5271fe1-1d4b-462f-97a3-c1c610e6ba80\",\n \"account_id\":\"47632e8c-f125-4875-8d5b-ab24275c90a8\",\n \"machine_name\":\"NewEndpoint\",\n \"details\":{\n \"message\":\"C:\\\\\\\\USERS\\\\\\\\ADMIN\\\\\\\\DESKTOP\\\\\\\\5d2c45f2-a076-4bdb-8cf0-060fa6bb486f.EXE\",\n \"detection_id\": \"b271af4a-8967-4916-9045-c27cbe1c8f36\"\n },\n \"id\":\"844d1e23-0e34-4237-bc2d-972758d67a90\",\n \"created_at\":\"2020-08-28T11:30:48.946977118Z\"\n },\n \"account_id\":\"47632e8c-f125-4875-8d5b-ab24275c90a8\",\n \"subscription_id\":\"3471740f-aaa8-4e2c-8695-2bfb3e378d61\"\n}\n```\n\n#### Delete quarantine fail\n\n```json\n{\n \"event\":\"quarantine_events\",\n \"id\":\"308c0fcf-90e9-4036-a572-82de8aeb5075\",\n \"payload\":{\n \"severity\":\"WARNING\",\n \"type\":\"QUARANTINE_DELETE_FAIL\",\n \"machine_id\":\"4d59b887-34ad-49a2-a103-1ba24dd790f1\",\n \"account_id\":\"47632e8c-f125-4875-8d5b-ab24275c90a8\",\n \"machine_name\":\"NewEndpoint\",\n \"details\":{\n \"message\":\"C:\\\\\\\\USERS\\\\\\\\ADMIN\\\\\\\\DESKTOP\\\\\\\\3e7e7a17-969a-4d07-8126-fe62f3b26e82.EXE\",\n \"detection_id\": \"b271af4a-8967-4916-9045-c27cbe1c8f36\"\n },\n \"id\":\"eabbd68e-ca6e-4ec9-aa9a-2e448e9983d5\",\n \"created_at\":\"2020-08-28T11:29:55.416828312Z\"\n },\n \"account_id\":\"47632e8c-f125-4875-8d5b-ab24275c90a8\",\n \"subscription_id\":\"3471740f-aaa8-4e2c-8695-2bfb3e378d61\"\n}\n```\n\n### Users Events\n\n#### User invited\n```json\n{\n \"event\": \"user_events\",\n \"id\": \"d3f25ec6-e943-495a-b251-f73dca979c1e\",\n \"payload\": {\n \"severity\": \"AUDIT\",\n \"type\": \"USER_INVITED\",\n \"account_id\": \"550a20b8-6d36-4222-afbc-54d100f2e894\",\n \"user_id\": \"c79a9d0b-7fc5-413c-8161-182873f7870f\",\n \"id\": \"d38df30e-5601-40fb-92d1-c6cc55086fce\",\n \"created_at\": \"2021-03-10T12:56:26.316135667Z\",\n \"details\": {\n \"message\": \"Email: tifiy10802@566dh.com, Role: Super Admin\",\n \"ip_address\": \"90.191.127.234\",\n \"invited_by\": \"avitella@malwarebytes.com\",\n \"invitee_role\": \"SuperAdmin\",\n \"invitee_groupIDs\": null,\n \"invitee_email\": \"tifiy10802@566dh.com\",\n \"invitee_allGroupsAccess\": true\n }\n },\n \"account_id\": \"550a20b8-6d36-4222-afbc-54d100f2e894\",\n \"subscription_id\": \"f43dc73b-2709-4d6f-9c79-08abc815114b\"\n}\n```\n\n#### User verified\n```json\n{\n \"event\": \"user_events\",\n \"id\": \"81ca10e2-73fa-4008-b391-f0efe63e3ca5\",\n \"payload\": {\n \"severity\": \"AUDIT\",\n \"type\": \"USER_VERIFIED\",\n \"account_id\": \"550a20b8-6d36-4222-afbc-54d100f2e894\",\n \"user_id\": \"a1b739d8-ad84-4730-bb92-252d372ebee4\",\n \"id\": \"878c484f-73d0-4482-8e38-7a8953059074\",\n \"created_at\": \"2021-03-10T12:57:46.961165627Z\",\n \"details\": {\n \"message\": \"tifiy10802@566dh.com\"\n }\n },\n \"account_id\": \"550a20b8-6d36-4222-afbc-54d100f2e894\",\n \"subscription_id\": \"f43dc73b-2709-4d6f-9c79-08abc815114b\"\n}\n```\n\n#### User role updated\n```json\n{\n \"event\": \"user_events\",\n \"id\": \"a5696568-490b-44cb-83d3-b97c27b5c272\",\n \"payload\": {\n \"severity\": \"AUDIT\",\n \"type\": \"USER_ROLE_UPDATED\",\n \"account_id\": \"550a20b8-6d36-4222-afbc-54d100f2e894\",\n \"user_id\": \"c79a9d0b-7fc5-413c-8161-182873f7870f\",\n \"id\": \"b6eaceeb-b66a-4f3c-b2d3-1928f959a04d\",\n \"created_at\": \"2021-03-10T12:59:19.612242246Z\",\n \"details\": {\n \"message\": \"Changed the role for user test (tifiy10802@566dh.com) from Super Admin to Admin\",\n \"user_id\": \"c79a9d0b-7fc5-413c-8161-182873f7870f\",\n \"user_email\": \"avitella@malwarebytes.com\",\n \"user_name\": \"Alessio Vitella\"\n }\n },\n \"account_id\": \"550a20b8-6d36-4222-afbc-54d100f2e894\",\n \"subscription_id\": \"f43dc73b-2709-4d6f-9c79-08abc815114b\"\n}\n```\n\n#### User group role updated\n```json\n{\n \"event\": \"user_events\",\n \"id\": \"700e2e19-7dd5-4dc9-aa75-436bc4ce4449\",\n \"payload\": {\n \"severity\": \"AUDIT\",\n \"type\": \"USER_GROUP_ACCESS_UPDATED\",\n \"account_id\": \"550a20b8-6d36-4222-afbc-54d100f2e894\",\n \"user_id\": \"c79a9d0b-7fc5-413c-8161-182873f7870f\",\n \"id\": \"9e3b48c9-3fee-46dd-807a-3f567205feeb\",\n \"created_at\": \"2021-03-10T12:59:34.6325247Z\",\n \"details\": {\n \"message\": \"Group access updated for user test (tifiy10802@566dh.com)\",\n \"user_id\": \"c79a9d0b-7fc5-413c-8161-182873f7870f\",\n \"user_email\": \"avitella@malwarebytes.com\",\n \"user_name\": \"Alessio Vitella\"\n }\n },\n \"account_id\": \"550a20b8-6d36-4222-afbc-54d100f2e894\",\n \"subscription_id\": \"f43dc73b-2709-4d6f-9c79-08abc815114b\"\n}\n```\n\n#### User deleted\n```json\n{\n \"event\": \"user_events\",\n \"id\": \"acd4187a-df1e-45bf-8ef7-ef8e666c8ad1\",\n \"payload\": {\n \"severity\": \"AUDIT\",\n \"type\": \"USER_DELETED\",\n \"account_id\": \"550a20b8-6d36-4222-afbc-54d100f2e894\",\n \"user_id\": \"c79a9d0b-7fc5-413c-8161-182873f7870f\",\n \"id\": \"f60d1cb0-ed06-4de9-bedd-ea3081df9c0d\",\n \"created_at\": \"2021-03-10T13:01:08.21154784Z\",\n \"details\": {\n \"message\": \"tifiy10802@566dh.com was deleted by user avitella@malwarebytes.com\",\n \"deleted_by\": \"avitella@malwarebytes.com\",\n \"ip_address\": \"90.191.127.234\"\n }\n },\n \"account_id\": \"550a20b8-6d36-4222-afbc-54d100f2e894\",\n \"subscription_id\": \"f43dc73b-2709-4d6f-9c79-08abc815114b\"\n}\n```\n\n### Device control events\n\n#### Drive blocked\n```json\n{\n \"event\": \"drive_events\",\n \"id\": \"60de6386-56d9-4b18-b0dd-8cf75e53665e\",\n \"account_id\": \"f29c5663-100a-4cd5-a5c3-b9a45e67ad21\",\n \"payload\": {\n \"severity\": \"INFO\",\n \"account_id\": \"f29c5663-100a-4cd5-a5c3-b9a45e67ad21\",\n \"machine_id\": \"9278ff33-9989-47d1-ac1f-fc40381f3b39\",\n \"id\": \"83418205-78d2-453b-b15e-b8ac3e6efc21\",\n \"created_at\": \"2022-02-09T15:36:57.7484112Z\",\n \"action\": \"blocked\",\n \"type\": \"DRIVE_BLOCKED\",\n \"details\": {\n \"group_id\": \"39a36fde-49ae-416b-9e68-112d9bfa1945\",\n \"group_name\": \"PMP DNS Lite\",\n \"policy_id\": \"833bd822-e2a6-44e8-a7b6-92ca1edae4c0\",\n \"policy_name\": \"DNS Lite\",\n \"metadata\": {\n \"timestamp\": \"2022-02-09T15:36:57.7484112Z\",\n \"physical_disk_name\": \"Walgreen Infinitive USB Device\",\n \"pnp_device_id\": \"USBSTOR\\\\DISK&VEN_WALGREEN&PROD_INFINITIVE&REV_1.00\\\\4C530001030323105095&0\",\n \"device_id\": \"\\\\\\\\.\\\\PHYSICALDRIVE1\",\n \"disk_interface\": \"USB\",\n \"manufacturer\": \"Zia Caterina\",\n \"serial_number\": \"4C530001030323105095\",\n \"drive_compressed\": false,\n \"file_system\": \"NTFS\",\n \"volume_name\": \"E:\",\n \"volume_serial\": \"44D9870F\",\n \"volume_device_path\": \"\\\\Device\\\\HarddiskVolume8\",\n \"block_status\": \"blocked\",\n \"driver_metadata\": {\n \"DevicePath\": \"\\\\DEVICE\\\\HARDDISKVOLUME8\",\n \"FileSystemFlags\": 65472255,\n \"FileSystemName\": \"NTFS\",\n \"MaximumComponentLength\": 255,\n \"VolumeMountPoints\": [\n \"E:\\\\\"\n ],\n \"VolumeName\": \"USB\",\n \"VolumePath\": \"\\\\\\\\?\\\\Volume{0d619cc3-7d50-11ec-9bca-000c2972f401}\\\\\",\n \"VolumeSerialNumber\": \"1155106575\",\n \"schemaVersion\": 1\n }\n }\n },\n \"machine_name\": \"pmp-win10x64-00\"\n },\n \"subscription_id\": \"f8b2a2f5-1e11-4709-8256-9c17609b05d3\"\n}\n```\n\n### Vulnerability & Patch events\n\n#### Vulnerability found\n```json\n{\n \"event\": \"cve_events\",\n \"id\": \"e2ebad01-faaf-40c7-8b32-00c10ef6dc85\",\n \"account_id\": \"f29c5663-100a-4cd5-a5c3-b9a45e67ad21\",\n \"payload\": {\n \"severity\": \"INFO\",\n \"account_id\": \"f29c5663-100a-4cd5-a5c3-b9a45e67ad21\",\n \"machine_id\": \"9278ff33-9989-47d1-ac1f-fc40381f3b39\",\n \"id\": \"fb839c2e-ae9a-48c0-9233-ed278ee06b30\",\n \"created_at\": \"2022-05-06T13:49:51.227357Z\",\n \"type\": \"CVE_ADDED\",\n \"details\": {\n \"account_id\": \"f29c5663-100a-4cd5-a5c3-b9a45e67ad21\",\n \"account_name\": \"Test Account1\",\n \"parent_account_id\": \"f29c5663-100a-4cd5-a5c3-b9a45e67ad21\",\n \"machine_id\": \"9278ff33-9989-47d1-ac1f-fc40381f3b39\",\n \"group_id\": \"39a36fde-49ae-416b-9e68-112d9bfa1945\",\n \"root_group_id\": \"39a36fde-49ae-416b-9e68-112d9bfa1945\",\n \"host_name\": \"TA-Win81x32-001\",\n \"fully_qualified_host_name\": \"TA-Win81x32-001\",\n \"display_name\": \"TA-Win81x32-001\",\n \"vendor\": \"Adobe Systems Inc.\",\n \"normalized_vendor\": \"adobe\",\n \"product\": \"Adobe Flash Player\",\n \"installed_version\": \"32.0.0.207\",\n \"created_at\": \"2022-05-06T13:49:49.893680453Z\",\n \"os_info\": {\n \"os_type\": \"Workstation\",\n \"os_version\": \"6.3.9600\",\n \"os_platform\": \"Windows\",\n \"os_architecture\": \"x86\",\n \"os_release_name\": \"Microsoft Windows 8.1 Enterprise\"\n },\n \"sort_id\": 1651844991145,\n \"cve_id\": \"CVE-2019-8075\",\n \"cisa_exploitable\": true,\n \"severity\": \"medium\",\n \"severity_score\": 58,\n \"published_at\": \"2019-09-27T16:15:00Z\",\n \"cvss30_score\": 7.5,\n \"cvss20_score\": 5,\n \"description\": \"Adobe Flash Player version 32.0.0.192 and earlier versions have a Same Origin Policy Bypass vulnerability. Successful exploitation could lead to Information Disclosure in the context of the current user.\",\n \"resolution\": {\n \"text\": \"Product is defunct, please uninstall it.\"\n },\n \"document_id\": \"9278ff33-9989-47d1-ac1f-fc40381f3b39c6ba419679d8950eabad5c0385703f78CVE-2019-8075\",\n \"display_vendor\": \"adobe\",\n \"display_product\": \"Adobe Flash Player\",\n \"display_installed_version\": \"32.0.0.207\",\n \"version\": 0\n }\n },\n \"subscription_id\": \"f8b2a2f5-1e11-4709-8256-9c17609b05d3\"\n}\n```\n\n#### Patch available\n```json\n{\n \"event\": \"cve_events\",\n \"id\": \"dea7139e-5589-4d7a-b30c-3b8ed827c4fa\",\n \"account_id\": \"f29c5663-100a-4cd5-a5c3-b9a45e67ad21\",\n \"payload\": {\n \"severity\": \"INFO\",\n \"account_id\": \"f29c5663-100a-4cd5-a5c3-b9a45e67ad21\",\n \"machine_id\": \"9278ff33-9989-47d1-ac1f-fc40381f3b39\",\n \"id\": \"9a608078-7192-4a68-bfce-ec35121a79f1\",\n \"created_at\": \"2022-05-06T13:49:51.22989Z\",\n \"type\": \"CVE_PATCH_AVAILABLE\",\n \"details\": {\n \"account_id\": \"f29c5663-100a-4cd5-a5c3-b9a45e67ad21\",\n \"account_name\": \"Test Account1\",\n \"parent_account_id\": \"f29c5663-100a-4cd5-a5c3-b9a45e67ad21\",\n \"machine_id\": \"9278ff33-9989-47d1-ac1f-fc40381f3b39\",\n \"group_id\": \"39a36fde-49ae-416b-9e68-112d9bfa1945\",\n \"root_group_id\": \"39a36fde-49ae-416b-9e68-112d9bfa1945\",\n \"host_name\": \"TA-Win81x32-001\",\n \"fully_qualified_host_name\": \"TA-Win81x32-001\",\n \"display_name\": \"TA-Win81x32-001\",\n \"created_at\": \"2022-05-06T13:49:49.893680453Z\",\n \"sort_id\": 1651844991166,\n \"os_info\": {\n \"os_type\": \"Workstation\",\n \"os_version\": \"6.3.9600\",\n \"os_platform\": \"Windows\",\n \"os_architecture\": \"x86\",\n \"os_release_name\": \"Microsoft Windows 8.1 Enterprise\"\n },\n \"title\": \"Microsoft .NET Framework 4.8 for Windows 8.1 (KB4486105)\",\n \"description\": \"The Microsoft .NET Framework 4.8 is a highly compatible, in-place update for all the previous versions of .NET Framework 4.X. After you install this update, you may have to restart your computer.\",\n \"product\": \"Windows 8.1\",\n \"severity\": \"important\",\n \"category\": \"feature_pack\",\n \"security_update_id\": \"\",\n \"patch_id\": \"4486105\",\n \"released_at\": \"2020-01-14T05:00:00Z\",\n \"size\": 44044135,\n \"reboot_required\": true,\n \"document_id\": \"9278ff33-9989-47d1-ac1f-fc40381f3b394486105\",\n \"version\": 0\n }\n },\n \"subscription_id\": \"f8b2a2f5-1e11-4709-8256-9c17609b05d3\"\n}\n```\n\n#### Software updated\n```json\n{\n \"event\": \"cve_events\",\n \"id\": \"5168387e-41a7-47cd-b554-f5d49308c464\",\n \"account_id\": \"550a20b8-6d36-4222-afbc-54d100f2e894\",\n \"payload\": {\n \"severity\": \"INFO\",\n \"machine_name\": \"Avarosa\",\n \"account_id\": \"550a20b8-6d36-4222-afbc-54d100f2e894\",\n \"machine_id\": \"07386bfa-d493-41b3-bff1-db6dfe64e17f\",\n \"action\": \"COMPLETED\", // enum: [\"FAILED\",\"COMPLETED\"]\n \"details\": {\n \"application_name\": \"Microsoft Visual C++ Redistributable 2013\",\n \"current_version\": \"12.0.30501.0\",\n \"new_version\": \"12.0.40664.0\",\n \"product\": 3092,\n \"vendor\": \"microsoft\"\n },\n \"created_at\": \"2022-05-09T10:39:59.14429501Z\",\n \"id\": \"1f79149f-d38f-4c20-a09e-75f2debf812a\",\n \"type\": \"CVE_SOFTWARE_UPDATED\"\n },\n \"subscription_id\": \"a469cd25-4c0b-4e35-98cd-b2a01f09945d\"\n}\n```\n\n#### Patch applied\n```json\n{\n \"event\": \"cve_events\",\n \"id\": \"ff0edfda-6cae-4adc-9b4b-1b5f23002d4d\",\n \"account_id\": \"550a20b8-6d36-4222-afbc-54d100f2e894\",\n \"payload\": {\n \"severity\": \"INFO\",\n \"machine_name\": \"Avarosa\",\n \"account_id\": \"550a20b8-6d36-4222-afbc-54d100f2e894\",\n \"machine_id\": \"07386bfa-d493-41b3-bff1-db6dfe64e17f\",\n \"action\": \"COMPLETED\", // enum: [\"FAILED\",\"COMPLETED\",\"REBOOT_REQUIRED\"]\n \"details\": {\n \"category\": \"critical_update\",\n \"product\": \".NET Core 3.1\",\n \"severity\": \"important\",\n \"title\": \"2021-10 .NET Core 3.1.20 Update for Windows 11 for x64 Client (KB5007050)\",\n \"vendor\": \"Armut Corp\",\n \"reboot_required\": false,\n \"description\": \"2021-10 .NET Core 3.1.20 Update for Windows 11 for x64 Client (KB5007050)\",\n \"date\": 1634277600,\n \"size\": 189019608,\n \"kb_id\": \"5007050\",\n \"security_update_id\": \"\"\n },\n \"created_at\": \"2022-05-09T10:40:31.848869068Z\",\n \"type\": \"CVE_PATCH_APPLIED\"\n },\n \"subscription_id\": \"a469cd25-4c0b-4e35-98cd-b2a01f09945d\"\n}\n```\n\n### DNS Content Filtering events\n\n#### DNS blocked\n\n```json\n{\n \"event\": \"dns_events\",\n \"id\": \"4974972d-36f6-4c0f-a687-626d33a98609\",\n \"account_id\": \"f9c1e231-891e-40a2-93a8-7666a527c67d\",\n \"payload\": {\n \"severity\": \"INFO\",\n \"account_id\": \"f9c1e231-891e-40a2-93a8-7666a527c67d\",\n \"machine_id\": \"675c4b7a-335b-47c1-b71f-868f03ccf263\",\n \"created_at\": \"2022-09-01T15:32:12.706971938Z\",\n \"id\": \"0dcdf1c6-16fc-4bb7-b94f-ba1db2d5d4fb\",\n \"details\": {\n \"id\": \"bef4894f-d4e7-4cee-b52e-f15998c6ab49\",\n \"machine_id\": \"675c4b7a-335b-47c1-b71f-868f03ccf263\",\n \"group_id\": \"faafbf27-e166-45ce-bb16-f01f3a5b7ae1\",\n \"group_name\": \"Default Group\",\n \"account_id\": \"f9c1e231-891e-40a2-93a8-7666a527c67d\",\n \"parent_account_id\": \"f9c1e231-891e-40a2-93a8-7666a527c67d\",\n \"policy_id\": \"fa4331e7-989b-47b3-8f40-efff592d573c\",\n \"rule_id\": \"d25c4ec1-bb72-4d5a-8f4b-20cd131634d6\",\n \"rule_name\": \"no msnbc\",\n \"policy_name\": \"Default Policy\",\n \"action\": \"block\",\n \"log\": {\n \"colo_id\": 465,\n \"datetime\": \"2022-09-01T15:31:45Z\",\n \"device_id\": \"5f166267-2a09-11ed-99f4-7a63bd6fb789\",\n \"user_id\": \"721ab000-8a6c-4b54-858c-1b67f6d4a630\",\n \"dst_ip\": \"162.159.36.5\",\n \"src_ip\": \"98.207.10.35\",\n \"email\": \"non_identity@mwb-nebula-7bde22be1cb528441ad14380f02a8411.cloudflareaccess.com\",\n \"location\": \"d25c4ec1-bb72-4d5a-8f4b-20cd131634d6\",\n \"policy\": \"\",\n \"policy_id\": \"ccb7fe0d52fb493dbfdc2cf4de0764ee\",\n \"protocol\": \"https\",\n \"query_name\": \"msnbc.com\",\n \"query_name_reversed\": \"com.msnbc\",\n \"resolver_decision\": \"blockedRule\",\n \"query_category_ids\": [7,122,164],\n \"query_size\": 38,\n \"query_type\": 28,\n \"src_port\": 0,\n \"dst_port\": 0\n },\n \"document_id\": \"bef4894f-d4e7-4cee-b52e-f15998c6ab49\",\n \"version\": 0,\n \"@timestamp\": \"2022-09-01T15:32:12.706971938Z\"\n },\n \"type\": \"DNS_BLOCKED\"\n },\n \"subscription_id\": \"f01dc32c-76a6-4629-8efa-5afe861f32b7\"\n}\n```\n\n### License events\n\n#### License Entitlement Added\n\n```json\n{\n \"event\": \"license_events\",\n \"id\": \"5db19165-9078-408d-be55-38b540fb8527\",\n \"account_id\": \"00017df6-13c5-4cac-8967-40f85b054e4e\",\n \"payload\": {\n \"severity\": \"INFO\",\n \"type\": \"LICENSE_ENTITLEMENT_CHANGED\",\n \"account_id\": \"00017df6-13c5-4cac-8967-40f85b054e4e\",\n \"id\": \"1e659a56-5b03-493a-baf8-bb3ecd628c59\",\n \"details\": {\n \"id\": \"5944a421-9f33-4471-9382-72525fae1427\",\n \"account_id\": \"00017df6-13c5-4cac-8967-40f85b054e4e\",\n \"license_key\": \"CBFCK-XRRG2-67ZDJ-CGHUS\",\n \"licensed_product\": \"MBDNS-B,NCCA-B\",\n \"catalog_code\": \"\",\n \"combo_product\": \"NEBULA-DNS-COMBO\",\n \"licensed_seats\": 10,\n \"license_expires_at\": \"2023-11-17T23:59:59Z\",\n \"license_key_status\": \"active\",\n \"license_term_type\": \"subscription\",\n \"license_status\": \"active\",\n \"licensed_remediations\": 0,\n \"licensed_remediation_factor\": 0,\n \"remediation_count\": 0,\n \"created_at\": \"2022-11-17T14:01:07.426394557Z\",\n \"updated_at\": \"2022-11-17T14:01:07.426394557Z\",\n \"active\": true,\n \"machine_counts\": null,\n \"auto_renew\": \"no\",\n \"can_be_paid\": false,\n \"keystone_id\": 35093303\n },\n \"action\": \"added\",\n \"created_at\": \"2022-11-17T14:01:07.556054636Z\"\n },\n \"subscription_id\": \"1fa8e9ee-7a16-4197-987f-4362ddfbd5ac\"\n}\n```\n\n#### License Entitlement Updated\n\n```json\n{\n \"event\": \"license_events\",\n \"id\": \"599e8be4-ae4b-4066-b31c-ea223e900179\",\n \"account_id\": \"00017df6-13c5-4cac-8967-40f85b054e4e\",\n \"payload\": {\n \"severity\": \"INFO\",\n \"type\": \"LICENSE_ENTITLEMENT_CHANGED\",\n \"account_id\": \"00017df6-13c5-4cac-8967-40f85b054e4e\",\n \"id\": \"a13fdaca-13a1-4e4e-88f8-ac66309ef11b\",\n \"details\": {\n \"old_entitlement\": {\n \"id\": \"5944a421-9f33-4471-9382-72525fae1427\",\n \"account_id\": \"00017df6-13c5-4cac-8967-40f85b054e4e\",\n \"license_key\": \"CBFCK-XRRG2-67ZDJ-CGHUS\",\n \"licensed_product\": \"MBDNS-B,NCCA-B\",\n \"catalog_code\": \"\",\n \"combo_product\": \"NEBULA-DNS-COMBO\",\n \"licensed_seats\": 10,\n \"license_expires_at\": \"2023-11-17T23:59:59Z\",\n \"license_key_status\": \"active\",\n \"license_term_type\": \"subscription\",\n \"license_status\": \"active\",\n \"licensed_remediations\": 0,\n \"licensed_remediation_factor\": 0,\n \"remediation_count\": 0,\n \"created_at\": \"2022-11-17T14:01:07.426395Z\",\n \"updated_at\": \"2022-11-17T14:01:07.426395Z\",\n \"active\": true,\n \"machine_counts\": null,\n \"auto_renew\": \"no\",\n \"can_be_paid\": false,\n \"keystone_id\": 35093303\n },\n \"new_entitlement\": {\n \"id\": \"5944a421-9f33-4471-9382-72525fae1427\",\n \"account_id\": \"00017df6-13c5-4cac-8967-40f85b054e4e\",\n \"license_key\": \"CBFCK-XRRG2-67ZDJ-CGHUS\",\n \"licensed_product\": \"MBDNS-B,NCCA-B\",\n \"catalog_code\": \"\",\n \"combo_product\": \"NEBULA-DNS-COMBO\",\n \"licensed_seats\": 20,\n \"license_expires_at\": \"2023-11-17T23:59:59Z\",\n \"license_key_status\": \"active\",\n \"license_term_type\": \"subscription\",\n \"license_status\": \"active\",\n \"licensed_remediations\": 0,\n \"licensed_remediation_factor\": 0,\n \"remediation_count\": 0,\n \"created_at\": \"0001-01-01T00:00:00Z\",\n \"active\": true,\n \"machine_counts\": null,\n \"auto_renew\": \"no\",\n \"can_be_paid\": false,\n \"keystone_id\": 35093303\n }\n },\n \"action\": \"updated\",\n \"created_at\": \"2022-11-17T14:02:38.006653379Z\"\n },\n \"subscription_id\": \"1fa8e9ee-7a16-4197-987f-4362ddfbd5ac\"\n}\n```\n\n#### License Entitlement Removed\n\n```json\n{\n \"event\": \"license_events\",\n \"id\": \"29d6f063-fd95-4b6a-bcdb-1ecaaa15eb87\",\n \"account_id\": \"00017df6-13c5-4cac-8967-40f85b054e4e\",\n \"payload\": {\n \"severity\": \"INFO\",\n \"type\": \"LICENSE_ENTITLEMENT_CHANGED\",\n \"account_id\": \"00017df6-13c5-4cac-8967-40f85b054e4e\",\n \"id\": \"038304ca-4fa8-4926-a3d6-fca29c6b1e71\",\n \"details\": {\n \"id\": \"5944a421-9f33-4471-9382-72525fae1427\",\n \"account_id\": \"00017df6-13c5-4cac-8967-40f85b054e4e\",\n \"license_key\": \"CBFCK-XRRG2-67ZDJ-CGHUS\",\n \"licensed_product\": \"MBDNS-B,NCCA-B\",\n \"catalog_code\": \"\",\n \"combo_product\": \"NEBULA-DNS-COMBO\",\n \"licensed_seats\": 20,\n \"license_expires_at\": \"2023-11-17T23:59:59Z\",\n \"license_key_status\": \"active\",\n \"license_term_type\": \"subscription\",\n \"license_status\": \"active\",\n \"licensed_remediations\": 0,\n \"licensed_remediation_factor\": 0,\n \"remediation_count\": 0,\n \"created_at\": \"2022-11-17T14:01:07.426395Z\",\n \"updated_at\": \"2022-11-17T14:02:37.95501Z\",\n \"active\": true,\n \"machine_counts\": null,\n \"auto_renew\": \"no\",\n \"can_be_paid\": false,\n \"keystone_id\": 35093303\n },\n \"action\": \"removed\",\n \"created_at\": \"2022-11-17T14:03:06.077892882Z\"\n },\n \"subscription_id\": \"1fa8e9ee-7a16-4197-987f-4362ddfbd5ac\"\n}\n```\n\n#### License Entitlement Usage changed\n\n```json\n{\n \"event\": \"license_events\",\n \"id\": \"a79b4fbb-90f2-408c-a3d5-e4b37cdaa9d1\",\n \"account_id\": \"00017df6-13c5-4cac-8967-40f85b054e4e\",\n \"payload\": {\n \"severity\": \"INFO\",\n \"type\": \"LICENSE_ENTITLEMENT_USAGE_CHANGED\",\n \"created_at\": \"2022-11-17T15:57:59.921931957Z\",\n \"account_id\": \"00017df6-13c5-4cac-8967-40f85b054e4e\",\n \"details\": {\n \"license_key\": \"CBFCK-XRRG2-67ZDJ-CGHUS\",\n \"licensed_product\": \"MBAE-B,MBAM-B,MBBR-B,MBCM-B,MBFT-B,MBRX-B,NCCA-B,NCEP-B,NCRM-B\",\n \"catalog_code\": \"BUS-CLOUD-EPP-01\",\n \"combo_product\": \"NEBULA-EP-COMBO\",\n \"licensed_seats\": 10,\n \"license_expires_at\": \"2023-11-17T23:59:59Z\",\n \"license_key_status\": \"active\",\n \"license_term_type\": \"subscription\",\n \"license_status\": \"active\",\n \"auto_renew\": \"no\",\n \"used_seats\": 5\n }\n },\n \"subscription_id\": \"1fa8e9ee-7a16-4197-987f-4362ddfbd5ac\"\n}\n```\n\n#### License Over deployment\n\n```json\n{\n \"event\": \"license_events\",\n \"id\": \"c39ce0df-ed3d-4f31-bea4-b2926b36f49a\",\n \"account_id\": \"00017df6-13c5-4cac-8967-40f85b054e4e\",\n \"payload\": {\n \"severity\": \"INFO\",\n \"type\": \"LICENSE_OVER_DEPLOYMENT\",\n \"account_id\": \"00017df6-13c5-4cac-8967-40f85b054e4e\",\n \"details\": {\n \"message\": \"Over deployment\",\n \"license_key\": \"CBFCK-XRRG2-67ZDJ-CGHUS\",\n \"licensed_product\": \"MBAE-B,MBAM-B,MBBR-B,MBCM-B,MBFT-B,MBRX-B,NCCA-B,NCEP-B,NCRM-B\",\n \"catalog_code\": \"BUS-CLOUD-EPP-01\",\n \"combo_product\": \"NEBULA-EP-COMBO\",\n \"licensed_seats\": 3,\n \"license_expires_at\": \"2023-11-17T23:59:59Z\",\n \"license_key_status\": \"active\",\n \"license_term_type\": \"subscription\",\n \"license_status\": \"active\",\n \"auto_renew\": \"no\",\n \"used_seats\": 4\n },\n \"created_at\": \"2022-11-17T14:49:59.333193431Z\"\n },\n \"subscription_id\": \"1fa8e9ee-7a16-4197-987f-4362ddfbd5ac\"\n}\n```\n\n#### License Expiring\n\n```json\n{\n \"event\": \"license_events\",\n \"id\": \"533605a0-6cce-4b9a-8292-101f0b9583c2\",\n \"account_id\": \"00017df6-13c5-4cac-8967-40f85b054e4e\",\n \"payload\": {\n \"severity\": \"INFO\",\n \"type\": \"LICENSE_EXPIRING\",\n \"account_id\": \"00017df6-13c5-4cac-8967-40f85b054e4e\",\n \"details\": {\n \"license_key\": \"CBFCK-XRRG2-67ZDJ-CGHUS\",\n \"licensed_product\": \"MBAE-B,MBAM-B,MBBR-B,MBCM-B,MBFT-B,MBRX-B,NCCA-B,NCEP-B,NCRM-B\",\n \"catalog_code\": \"BUS-CLOUD-EPP-01\",\n \"combo_product\": \"NEBULA-EP-COMBO\",\n \"licensed_seats\": 3,\n \"license_expires_at\": \"2022-11-30T23:59:59Z\",\n \"license_key_status\": \"active\",\n \"license_term_type\": \"subscription\",\n \"license_status\": \"active\",\n \"auto_renew\": \"no\",\n \"used_seats\": 4,\n \"message\": \"Expiring license\",\n \"days_left\": 14 // enum: [0, 1, 7, 14 ,30]\n },\n \"created_at\": \"2022-11-17T14:56:26.743834259Z\"\n },\n \"subscription_id\": \"1fa8e9ee-7a16-4197-987f-4362ddfbd5ac\"\n}\n```\n\n### Application Block events\n\n#### Application blocked\n\n```json\n{\n \"event\": \"appblock_events\",\n \"id\": \"b3e1f103-c490-445f-9136-d45450e1a961\",\n \"account_id\": \"550a20b8-6d36-4222-afbc-54d100f2e894\",\n \"payload\": {\n \"type\": \"APPBLOCK_BLOCKED\",\n \"document_id\": \"e8c540c7-fe43-511d-b6df-805656440afd\",\n \"severity\": \"INFO\",\n \"account_id\": \"550a20b8-6d36-4222-afbc-54d100f2e894\",\n \"machine_id\": \"f2750e61-a41c-47ed-8d12-fca857fe8453\",\n \"group_id\": \"f4b15520-3153-4956-be41-185c4a523cfc\",\n \"action\": \"blocked\",\n \"id\": \"e8c540c7-fe43-511d-b6df-805656440afd\",\n \"created_at\": \"2023-03-15T13:34:02.80344Z\",\n \"root_group_id\": \"f4b15520-3153-4956-be41-185c4a523cfc\",\n \"account_name\": \"Test-Account3\",\n \"parent_account_id\": \"550a20b8-6d36-4222-afbc-54d100f2e894\",\n \"group_name\": \"Default Group\",\n \"policy_id\": \"4ab40443-dea1-4c76-8713-ef5141307b98\",\n \"policy_name\": \"!!!!_!_!!!_!!_!_!NEW POLICY12345\",\n \"details\": {\n \"file_path\": \"C:\\\\burla2.exe\",\n \"matching_rule_ids\": [\n \"33741ecc-6775-4f13-b7d9-4f462a59fc2a\"\n ],\n \"app_block_rules\": [\n {\n \"id\": \"33741ecc-6775-4f13-b7d9-4f462a59fc2a\",\n \"account_id\": \"550a20b8-6d36-4222-afbc-54d100f2e894\",\n \"name\": \"Rule test 34\",\n \"rule\": {\n \"action\": \"block\",\n \"files\": [\n \"C:\\\\burla2.exe\"\n ]\n },\n \"type\": \"files\"\n }\n ],\n \"group_id\": \"f4b15520-3153-4956-be41-185c4a523cfc\",\n \"group_name\": \"Default Group\",\n \"policy_id\": \"4ab40443-dea1-4c76-8713-ef5141307b98\",\n \"policy_name\": \"!!!!_!_!!!_!!_!_!NEW POLICY12345\",\n \"last_user\": \"ben-fake-endpoint\\\\Testuser\"\n }\n },\n \"subscription_id\": \"a22a2b59-4897-45de-b055-cfa1eabb9d1e\"\n}\n```\n\n\n### Endpoint status events\n\n#### Endpoint reboot required\n\n```json\n{\n \"event\": \"endpoint_events\",\n \"id\": \"a8f76811-fa21-48b3-8bba-6b6e800ecc6e\",\n \"account_id\": \"f29c5663-100a-4cd5-a5c3-b9a45e67ad21\",\n \"payload\": {\n \"severity\": \"INFO\",\n \"type\": \"ENDPOINT_REBOOT_REQUIRED\",\n \"account_id\": \"f29c5663-100a-4cd5-a5c3-b9a45e67ad21\",\n \"machine_id\": \"350eff78-1061-4357-b992-3121d22288ab\",\n \"created_at\": \"2023-01-17T15:06:02.410951Z\",\n \"id\": \"3e52d13e-ac67-109b-b0a9-9443f785f5d1\",\n \"machine_name\": \"test_machine387\"\n },\n \"subscription_id\": \"289ffcf2-3168-45c4-89fb-378d59031d12\"\n}\n```\n\n#### Endpoint reboot cleared\n\n```json\n{\n \"event\": \"endpoint_events\",\n \"id\": \"a8f76811-fa21-48b3-6bba-1b6e800ecc6e\",\n \"account_id\": \"f29c5663-10a-4cd5-a5c3-b9a45e67ad21\",\n \"payload\": {\n \"severity\": \"INFO\",\n \"type\": \"ENDPOINT_REBOOT_REQUIRED_CLEARED\",\n \"account_id\": \"f29c5663-100a-4cd5-a5c3-b9a45e67ad21\",\n \"machine_id\": \"350eff78-1061-4357-b992-3121d22288ab\",\n \"created_at\": \"2023-01-17T15:06:02.410951Z\",\n \"id\": \"3e52d13e-ac67-409b-b0a9-9443f785f5d1\",\n \"machine_name\": \"test_machine387\"\n },\n \"subscription_id\": \"289ffcf2-1168-55c4-89fb-378d59031d12\"\n}\n```\n\n#### Endpoint remediation required\nThis event is emitted when at least one detection is detected while the endpoint had no detection before\n\n```json\n{\n \"event\": \"endpoint_events\",\n \"id\": \"f98f4ee7-1a32-4840-8d5d-9d4ab0adac93\",\n \"account_id\": \"f29c5663-100a-4cd5-a5c3-b9a45e67ad21\",\n \"payload\": {\n \"severity\": \"INFO\",\n \"type\": \"ENDPOINT_INFECTED\",\n \"account_id\": \"f29c5663-100a-4cd5-a5c3-b9a45e67ad21\",\n \"machine_id\": \"350eff78-1061-4357-b992-3121d22288ab\",\n \"created_at\": \"2023-01-17T15:52:42.6652Z\",\n \"id\": \"d288002d-806e-4b2b-a0d4-f8f80ae801e8\",\n \"machine_name\": \"test_machine387\"\n },\n \"subscription_id\": \"289ffcf2-1168-45c4-89fb-378d59031d12\"\n}\n```\n\n#### Endpoint remediated\nThis event is emitted when all the detections are remediated for an endpoint\n\n```json\n{\n \"event\": \"endpoint_events\",\n \"id\": \"f98f4ee7-1232-4840-8d5d-9ddab0adac93\",\n \"account_id\": \"f29c5663-100a-4cd5-a5c3-b9a45e67ad21\",\n \"payload\": {\n \"severity\": \"INFO\",\n \"type\": \"ENDPOINT_REMEDIATED\",\n \"account_id\": \"f29c5663-100a-4cd5-a5c3-b9a45e67ad21\",\n \"machine_id\": \"350eff78-1061-4357-b992-3121d22288ab\",\n \"created_at\": \"2023-01-17T15:52:42.6652Z\",\n \"id\": \"d288040d-806e-4b2b-a0d4-f8f80ae801e8\",\n \"machine_name\": \"test_machine387\"\n },\n \"subscription_id\": \"289ffcf2-1168-45c4-89fb-378d59031d12\"\n}\n```\n\n#### Endpoint isolated\n\n```json\n{\n \"event\": \"endpoint_events\",\n \"id\": \"f98f4ee7-1a32-4840-8d5d-9ddab0adac95\",\n \"account_id\": \"f29c5663-100a-4cd5-a5c3-b9a45e67ad21\",\n \"payload\": {\n \"severity\": \"INFO\",\n \"type\": \"ENDPOINT_ISOLATED\",\n \"account_id\": \"f29c5663-100a-4cd5-a5c3-b9a45e67ad21\",\n \"machine_id\": \"350eff78-1061-4357-b992-3121d22288ab\",\n \"created_at\": \"2023-01-17T15:52:42.6652Z\",\n \"id\": \"d288000d-806e-4b2b-a0d4-f8f80ae831e8\",\n \"machine_name\": \"test_machine387\"\n },\n \"subscription_id\": \"289ffcf2-1168-45c4-89fb-378d59031d12\"\n}\n```\n\n#### Endpoint un-isolated\n\n```json\n{\n \"event\": \"endpoint_events\",\n \"id\": \"f98f4ee7-1a32-4840-8d5d-9ddab0adac93\",\n \"account_id\": \"f29c5663-100a-4cd5-a5c3-b9a45e67ad21\",\n \"payload\": {\n \"severity\": \"INFO\",\n \"type\": \"ENDPOINT_UNISOLATED\",\n \"account_id\": \"f29c5663-100a-4cd5-a5c3-b9a45e67ad21\",\n \"machine_id\": \"350eff78-1061-4357-b992-3121d22288ab\",\n \"created_at\": \"2023-01-17T15:52:42.6652Z\",\n \"id\": \"d288000d-806e-4b2b-a0d4-f8f80ae801e8\",\n \"machine_name\": \"test_machine387\"\n },\n \"subscription_id\": \"289ffcf2-1168-45c4-89fb-378d59031d12\"\n}\n```\n\n#### Suspicious activity detected\nThis event is emitted when at least one suspicious activity is detected while the endpoint had no suspicious activities before\n\n```json\n{\n \"event\": \"endpoint_events\",\n \"id\": \"f98f4ee7-1a32-4840-8d5d-9ddab0ad3c93\",\n \"account_id\": \"f29c5663-100a-4cd5-a5c3-b9a45e67ad21\",\n \"payload\": {\n \"severity\": \"INFO\",\n \"type\": \"ENDPOINT_SUSPICIOUS_ACTIVITY_FOUND\",\n \"account_id\": \"f29c5663-100a-4cd5-a5c3-b9a45e67ad21\",\n \"machine_id\": \"350eff78-1061-4357-b992-3121d22288ab\",\n \"created_at\": \"2023-01-17T15:52:42.6652Z\",\n \"id\": \"d288000d-806e-2b2b-a0d4-f8f80ae801e8\",\n \"machine_name\": \"test_machine387\"\n },\n \"subscription_id\": \"289ffcf2-1168-45c4-89fb-378d59031d12\"\n}\n```\n\n#### Suspicious activity cleared\nThis event is emitted when all the suspicious activities are cleared for an endpoint\n\n```json\n{\n \"event\": \"endpoint_events\",\n \"id\": \"f98f4ee7-1a32-4840-8d5d-9ddab0ad3c93\",\n \"account_id\": \"f29c5663-180a-4cd5-a5c3-b9a45e67ad21\",\n \"payload\": {\n \"severity\": \"INFO\",\n \"type\": \"ENDPOINT_SUSPICIOUS_ACTIVITY_CLEARED\",\n \"account_id\": \"f29c5663-100a-4cd5-a5c3-b9a45e67ad21\",\n \"machine_id\": \"350eff78-1061-4357-b992-3121d22288ab\",\n \"created_at\": \"2023-01-17T15:52:42.6652Z\",\n \"id\": \"d288200d-806e-2b2b-a0d4-f8f80ae801e8\",\n \"machine_name\": \"test_machine387\"\n },\n \"subscription_id\": \"289ffcf2-1168-45c4-89fb-378d59031d12\"\n}\n```\n\n### Agent Events\n\n#### Endpoint needs attention\nThis event is emitted when the list of alerts form the endpoint is changed\n\n```json\n{\n \"event\": \"agent_events\",\n \"id\": \"3be75bf1-0926-41b5-9c6f-ad4a70123293\",\n \"account_id\": \"f29c5663-100a-4cd5-a5c3-b9a45e67ad21\",\n \"payload\": {\n \"type\": \"AGENT_ALERTS_CHANGED\",\n \"severity\": \"INFO\",\n \"account_id\": \"f29c5663-100a-4cd5-a5c3-b9a45e67ad21\",\n \"machine_id\": \"350eff78-1061-4357-b992-3121d22288ab\",\n \"created_at\": \"2023-01-18T10:59:40.3162Z\",\n \"id\": \"4ec6595c-e8c4-4a85-b1e1-2ceff1086c59\",\n \"details\": {\n \"added_codes\": [\"FULL_DISK_ACCESS_DISABLED\"],\n \"cleared_codes\": [],\n \"current_codes\": [\"FULL_DISK_ACCESS_DISABLED\"]\n },\n \"machine_name\": \"dummy-host.corp.mb-test.com\"\n },\n \"subscription_id\": \"289ffcf2-1168-45c4-89fb-378d59031d12\"\n}\n```\n"}],"servers":[{"url":"https://api.threatdown.com"}],"paths":{"/oneview/oauth2/token":{"post":{"description":"First, you need to get a valid `client_id`, `client_secret` pair to retrieve an authentication token. See notes below for obtaining a credential pair*.\n\nOnce you have obtained the `access_token`, by adhering to the following specification, you must include it for all the requests to the public APIs along with the `Authorization` header:\n\n```\nAuthorization: Bearer \n```\n\n## Request\n\n### Headers\n\nAdd the following headers to your request.\n\n| Name | Description | Type | Required | Default |\n|------|-------------|-------|-----------|----------|\n| Authorization | base64 encoded credential pair* as basic authorization `Basic base64(:)`| string | yes | '' |\n| Content-Type | Set to 'application/x-www-form-urlencoded' | string | yes | '' |\n\n*You need to concatenate `client_id` and `client_secret` and encode in base64.\n\nRefer to the following Javascript example to get the correct header's value:\n\n**In the browser**:\n\n```\n`Basic ${window.btoa(`${clientId}:${clientSecret}`)}`\n```\n\n**NodeJS**:\n\n```\n`Basic ${Buffer.from(`${clientId}:${clientSecret}`).toString('base64')}`\n```\n\n### Body\n\nSend the following body with the request.\n\n| Name | Description | Type | Required | Default |\n|------|-------------|-------|-----------|----------|\n| scope | The scope of the token. Can be ```read write execute create:accounts``` or any subset of those space-separated scopes | string | yes | '' |\n| grant\\_type | The grant\\_type. Set it to `client_credentials` | string | yes | '' |\n\n## Response\n\nIf your request successfully processed, our server will respond with a 200 status code and send a JSON body, which will include:\n\n| Name | Description | Type | Can be blank |\n|------|-------------|-------|-----------|\n| access_token | The access token. You need this token to access all other API endpoints | string | no |\n| expires_in | Expiry time in seconds of the access\\_token | number | no |\n| scope | The scope. Can be `read write execute create:accounts` or a subset of those. Space separate the scope you want to request | string | no |\n| token_type | The type of the token | string | no |\n\nYou can use the `access_token` to send requests to all the other HTTP endpoints.\n\n# Notes\nYou can send a raw HTTP request to retrieve the `access_token` following the specification above, but we strongly recommend to using one of the existing `oauth2` libraries.\nLibraries will usually handle refreshing the `access_token`, and generally implements best practices for that authentication protocol. We provide 2 examples as reference:\n\n## Python example\nThe following Python examples use the `oauthlib`:\n```python\nfrom requests_oauthlib import OAuth2Session\nfrom oauthlib.oauth2 import BackendApplicationClient\n\nCLIENT_ID = \"\"\nCLIENT_SECRET = \"\"\nCLIENT_ACCOUNT = \"\"\n\ndef NEBULA_URL(path):\n return \"{NEBULA_URL}{PATH}\".format(NEBULA_URL=\"https://api.threatdown.com\", PATH=path)\n\ndef get_nebula_client(client_id, client_secret, account_id):\n client_scope = [\"read\", \"write\"]\n headers = {}\n\n client = BackendApplicationClient(client_id, scope=client_scope)\n nebula = OAuth2Session(client=client, scope=client_scope)\n nebula.headers.update(headers)\n token = nebula.fetch_token(\n token_url=NEBULA_URL('/oneview/oauth2/token'),\n client_secret=client_secret, scope=\" \".join(client_scope))\n return nebula\n\nresp = get_nebula_client(CLIENT_ID, CLIENT_SECRET, CLIENT_ACCOUNT).get(NEBULA_URL('/oneview/v1/endpoints'))\n\nprint(resp.json())\n```\n\n## Javascript example\nThe following Javascript example uses the `simple-oauth2` module available on `npm`:\n\n```javascript\nconst oauth2Module = require('simple-oauth2')\n\nconst CLIENT_ACCOUNT = ''\nconst CLIENT_ID = ''\nconst CLIENT_SECRET = ''\nconst CLIENT_SCOPE = ['read'];\nconst URL = 'https://api.threatdown.com'\nconst TOKEN_PATH = 'oneview/oauth2/token'\nconst credentials = {\n client: {\n id: CLIENT_ID,\n secret: CLIENT_SECRET\n },\n auth: {\n tokenHost: URL,\n tokenPath: TOKEN_PATH\n }\n};\n\nconst tokenConfig = {\n scope: CLIENT_SCOPE,\n};\n\nconst oauth2 = oauth2Module.create(credentials);\n\nasync function reqToken() {\n try {\n const result = await oauth2.clientCredentials.getToken(tokenConfig);\n return oauth2.accessToken.create(result);\n } catch (error) {\n throw error;\n }\n}\n\nreqToken()\n .then(({\n access_token,\n expires_in,\n scope,\n token_type\n }) => console.log(\n access_token,\n expires_in,\n scope,\n token_type))\n .catch(e => console.log(e))\n ```\n","summary":"Get an access token","status":{"outage":["oauth2"]},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"PostDetectionsSearchRes200","properties":{"access_token":{"type":"string","title":"Access token to be used to authenticate in API requests"},"expires_in":{"type":"number","title":"Time in seconds before the token expires"},"scope":{"type":"string","title":"The granted scope for this access token"},"token_type":{"type":"string","title":"The type of the token"}}}}}}},"tags":["Authentication"],"operationId":"api.oneview.oauth2.token"}},"/oneview/v1/sites":{"post":{"description":"Create a new OneView site","summary":"Create new site","security":[{"client_credentials":["write"]},{"user_permissions":["sites.create"]}],"status":{"outage":["auth","ov"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"Payload for creating one site","description":"","examples":[{"company_name":"Malwarebytes Inc.","firstname":"Bob","lastname":"Ensley","email":"bensley@company.com","account_owner":["bensley@company.com"],"site_end_date":"string"}],"required":["company_name","firstname","lastname","email","account_owner"],"properties":{"company_name":{"type":"string","title":"Name of the customer","description":"The name of your customer. Friendly name to associate to the account created.","default":"","examples":["string"]},"firstname":{"type":"string","title":"First name of responsible","description":"First name of the contact","default":"","examples":["Bob"]},"lastname":{"type":"string","title":"Last name","description":"Last name of the contact.","default":"","examples":["Ensley"]},"email":{"type":"string","title":"Email","description":"Email address of the contact","default":"","examples":["bensley@company.it"]},"account_owner":{"type":"array","title":"Owner of the account","description":"The email(s) of the owner(s) of this account.","default":[],"examples":[["boss@company.it"]]},"site_end_date":{"type":"string","title":"End of site in yyyy-mm-dd format (Ex. \"2021-05-02\")","pattern":"^\\d{4}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])$","examples":["2021-05-02"]}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"Site response schema","description":"The expected response when getting a site","examples":[{"id":"cc99c6bf-1610-43c1-a793-f955c098449c","company_name":"Malwarebytes Inc.","firstname":"Bob","lastname":"Ensley","email":"bensley@company.com","account_owner":["mensley@company.com"],"site_end_date":"2021-05-02"}],"required":["id","company_name","firstname","lastname","email","account_owner"],"properties":{"id":{"type":"string","title":"UUID of the customer","description":"The unique identifier of this customer.","default":"","examples":["cc99c6bf-1610-43c1-a793-f955c098449c"]},"company_name":{"type":"string","title":"Name of the customer","description":"The name of your customer. Friendly name to associate to the account created.","default":"","examples":["string"]},"firstname":{"type":"string","title":"First name of responsible","description":"First name of the contact","default":"","examples":["Bob"]},"lastname":{"type":"string","title":"Last name","description":"Last name of the contact.","default":"","examples":["Ensley"]},"email":{"type":"string","title":"Email","description":"Email address of the contact","default":"","examples":["bensley@company.it"]},"account_owner":{"type":"array","title":"Owner of the account","description":"The email(s) of the owner(s) of this account.","items":{"type":"string"},"default":[],"examples":[["boss@company.it"]]},"site_end_date":{"type":"string","title":"End of customer in yyyy-mm-dd format (Ex. \"2021-05-02\")","pattern":"^\\d{4}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])$","examples":["2021-05-02"]}}}}}}},"tags":["Sites"],"operationId":"api.oneview.create.customer"},"get":{"description":"Get a list of all your managed sites","summary":"Get all sites","security":[{"client_credentials":["read"]},{"user_permissions":["sites.view"]}],"status":{"outage":["auth","ov"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}},{"name":"id","required":false,"in":"query","schema":{"type":"string"}},{"name":"company_name","required":false,"in":"query","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"Customer response schema","description":"The expected response when getting all sites","examples":[{"sites":{"id":"cc99c6bf-1610-43c1-a793-f955c098449c","company_name":"Malwarebytes Inc.","firstname":"Bob","lastname":"Ensley","email":"bensley@company.com","account_owner":["mensley@company.com"],"site_end_date":"2021-05-02"}}],"properties":{"sites":{"type":"array","items":{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"Site response schema","description":"The expected response when getting a site","examples":[{"id":"cc99c6bf-1610-43c1-a793-f955c098449c","company_name":"Malwarebytes Inc.","firstname":"Bob","lastname":"Ensley","email":"bensley@company.com","account_owner":["mensley@company.com"],"site_end_date":"2021-05-02"}],"required":["id","company_name","firstname","lastname","email","account_owner"],"properties":{"id":{"type":"string","title":"UUID of the site","description":"The unique identifier of this site.","default":"","examples":["cc99c6bf-1610-43c1-a793-f955c098449c"]},"account_id":{"type":"string","title":"UUID of the account","description":"Unique identifier for accessing security resources associated to this site, like endpoints and detections. You need to create a valid subscription to see this field","default":"","examples":["cc99c6bf-1610-43c1-a793-f955c098449c"]},"cloud_evaluation":{"type":"boolean","title":"Cloud Evaluation","description":"True if the account is valid for cloud evaluation","default":"","examples":[true]},"account_status":{"type":"string","title":"Status","description":"Status of the account. 'ACTIVE' for a live account with valid subscription","default":"","examples":["NOT_APPLICABLE"]},"company_name":{"type":"string","title":"Name of the site","description":"The name of your customer. Friendly name to associate to the account created.","default":"","examples":["string"]},"firstname":{"type":"string","title":"First name of responsible","description":"First name of the contact","default":"","examples":["Bob"]},"lastname":{"type":"string","title":"Last name","description":"Last name of the contact.","default":"","examples":["Ensley"]},"email":{"type":"string","title":"Email","description":"Email address of the contact","default":"","examples":["bensley@company.it"]},"account_owner":{"type":"array","title":"Owner of the account","description":"The email(s) of the owner(s) of this account.","items":{"type":"object","examples":[{"id":"fe366ce017519c74c3f1b2655ae1075b","email":"oneviewuser@domain.it","firstname":"Bob","lastname":"Alice","roles":["Administrator"]}],"required":["id","email","firstname","lastname","roles"],"properties":{"id":{"type":"string","title":"UUID","description":"The unique identifier of the account owner.","default":"","examples":["fe366ce017519c74c3f1b2655ae1075b"]},"email":{"type":"string","title":"Email","description":"The email of the owner of the account","default":"","examples":["aensley.ygi2bhac-qa-@yopmail.com"]},"firstname":{"type":"string","title":"First Name","description":"First name of the account owner.","default":"","examples":["Bob"]},"lastname":{"type":"string","title":"Last name","description":"Last name of the account owner","default":"","examples":["Smith"]},"roles":{"anyOf":[{"type":"array","items":{"type":"string"}},{"type":"null"}],"title":"Roles","description":"The role(s) of the owener of the account","default":[],"examples":[["Administrator"]]}}}},"site_end_date":{"type":"string","title":"End of site in yyyy-mm-dd format (Ex. \"2021-05-02\")","pattern":"^\\d{4}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])$","examples":["2021-05-02"]}}}}}}}}}},"tags":["Sites"],"operationId":"api.oneview.get.all.customers"}},"/oneview/v1/sites/{id}":{"delete":{"description":"Delete a OneView site","summary":"Delete site","security":[{"client_credentials":["write"]},{"user_permissions":["sites.delete"]}],"status":{"outage":["auth","ov"]},"parameters":[{"name":"id","required":true,"in":"path","description":"Valid OneView site ID (Ex. \"30616562663436302D643733312D346238622D623338332D613031343538363566383333\")","schema":{"type":"string","pattern":"^[A-Fa-f0-9]+$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"Customer response schema","description":"The expected response when deleting a customer","examples":[{"id":"cc99c6bf-1610-43c1-a793-f955c098449c","deleted":true}],"required":["id","deleted"],"properties":{"id":{"type":"string","title":"UUID of the customer","description":"The unique identifier of this customer.","default":"","examples":["cc99c6bf-1610-43c1-a793-f955c098449c"]},"deleted":{"type":"boolean","title":"Status","description":"Boolean indicating whether the customer was deleted successfully or not.","default":"","examples":[true]}}}}}}},"tags":["Sites"],"operationId":"api.oneview.delete.customer"},"get":{"description":"Get one site by its unique identifier","summary":"Get site by ID","security":[{"client_credentials":["read"]},{"user_permissions":["sites.view"]}],"status":{"outage":["auth","ov"]},"parameters":[{"name":"id","required":true,"in":"path","description":"Valid OneView site ID (Ex. \"30616562663436302D643733312D346238622D623338332D613031343538363566383333\")","schema":{"type":"string","pattern":"^[A-Fa-f0-9]+$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"Site response schema","description":"The expected response when getting a site","examples":[{"id":"cc99c6bf-1610-43c1-a793-f955c098449c","company_name":"Malwarebytes Inc.","firstname":"Bob","lastname":"Ensley","email":"bensley@company.com","account_owner":["mensley@company.com"],"site_end_date":"2021-05-02"}],"required":["id","company_name","firstname","lastname","email","account_owner"],"properties":{"id":{"type":"string","title":"UUID of the site","description":"The unique identifier of this site.","default":"","examples":["cc99c6bf-1610-43c1-a793-f955c098449c"]},"account_id":{"type":"string","title":"UUID of the account","description":"Unique identifier for accessing security resources associated to this site, like endpoints and detections. You need to create a valid subscription to see this field","default":"","examples":["cc99c6bf-1610-43c1-a793-f955c098449c"]},"cloud_evaluation":{"type":"boolean","title":"Cloud Evaluation","description":"True if the account is valid for cloud evaluation","default":"","examples":[true]},"account_status":{"type":"string","title":"Status","description":"Status of the account. 'ACTIVE' for a live account with valid subscription","default":"","examples":["NOT_APPLICABLE"]},"company_name":{"type":"string","title":"Name of the site","description":"The name of your customer. Friendly name to associate to the account created.","default":"","examples":["string"]},"firstname":{"type":"string","title":"First name of responsible","description":"First name of the contact","default":"","examples":["Bob"]},"lastname":{"type":"string","title":"Last name","description":"Last name of the contact.","default":"","examples":["Ensley"]},"email":{"type":"string","title":"Email","description":"Email address of the contact","default":"","examples":["bensley@company.it"]},"account_owner":{"type":"array","title":"Owner of the account","description":"The email(s) of the owner(s) of this account.","items":{"type":"object","examples":[{"id":"fe366ce017519c74c3f1b2655ae1075b","email":"oneviewuser@domain.it","firstname":"Bob","lastname":"Alice","roles":["Administrator"]}],"required":["id","email","firstname","lastname","roles"],"properties":{"id":{"type":"string","title":"UUID","description":"The unique identifier of the account owner.","default":"","examples":["fe366ce017519c74c3f1b2655ae1075b"]},"email":{"type":"string","title":"Email","description":"The email of the owner of the account","default":"","examples":["aensley.ygi2bhac-qa-@yopmail.com"]},"firstname":{"type":"string","title":"First Name","description":"First name of the account owner.","default":"","examples":["Bob"]},"lastname":{"type":"string","title":"Last name","description":"Last name of the account owner","default":"","examples":["Smith"]},"roles":{"anyOf":[{"type":"array","items":{"type":"string"}},{"type":"null"}],"title":"Roles","description":"The role(s) of the owener of the account","default":[],"examples":[["Administrator"]]}}}},"site_end_date":{"type":"string","title":"End of site in yyyy-mm-dd format (Ex. \"2021-05-02\")","pattern":"^\\d{4}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])$","examples":["2021-05-02"]}}}}}}},"tags":["Sites"],"operationId":"api.oneview.get.customer"},"put":{"description":"Update a OneView site","summary":"Update site","security":[{"client_credentials":["write"]},{"user_permissions":["sites.manage"]}],"status":{"outage":["auth","ov"]},"parameters":[{"name":"id","required":true,"in":"path","description":"Valid OneView site ID (Ex. \"30616562663436302D643733312D346238622D623338332D613031343538363566383333\")","schema":{"type":"string","pattern":"^[A-Fa-f0-9]+$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"Payload for updating one site","description":"","examples":[{"company_name":"Malwarebytes Inc.","firstname":"Bob","lastname":"Ensley","email":"bensley@company.com","account_owner":["bensley@company.com"],"site_end_date":"string"}],"required":["company_name","firstname","lastname","email","account_owner"],"properties":{"company_name":{"type":"string","title":"Name of the site","description":"The name of your site. Friendly name to associate to the account created.","default":"","examples":["string"]},"firstname":{"type":"string","title":"First name of responsible","description":"First name of the contact","default":"","examples":["Bob"]},"lastname":{"type":"string","title":"Last name","description":"Last name of the contact.","default":"","examples":["Ensley"]},"email":{"type":"string","title":"Email","description":"Email address of the contact","default":"","examples":["bensley@company.it"]},"account_owner":{"type":"array","title":"Owner of the account","description":"The email(s) of the owner(s) of this account.","default":[],"examples":[["boss@company.it"]]},"site_end_date":{"type":"string","title":"End of customer in yyyy-mm-dd format (Ex. \"2021-05-02\")","pattern":"^\\d{4}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])$","examples":["2021-05-02"]}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"Site response schema","description":"The expected response when updating a site","examples":[{"id":"cc99c6bf-1610-43c1-a793-f955c098449c","company_name":"Malwarebytes Inc.","firstname":"Bob","lastname":"Ensley","email":"bensley@company.com","account_owner":["mensley@company.com"],"site_end_date":"2021-05-02"}],"required":["id","company_name","firstname","lastname","email","account_owner"],"properties":{"id":{"type":"string","title":"UUID of the customer","description":"The unique identifier of this customer.","default":"","examples":["cc99c6bf-1610-43c1-a793-f955c098449c"]},"company_name":{"type":"string","title":"Name of the customer","description":"The name of your customer. Friendly name to associate to the account created.","default":"","examples":["string"]},"firstname":{"type":"string","title":"First name of responsible","description":"First name of the contact","default":"","examples":["Bob"]},"lastname":{"type":"string","title":"Last name","description":"Last name of the contact.","default":"","examples":["Ensley"]},"email":{"type":"string","title":"Email","description":"Email address of the contact","default":"","examples":["bensley@company.it"]},"account_owner":{"type":"array","title":"Owner of the account","description":"The email(s) of the owner(s) of this account.","items":{"type":"string"},"default":[],"examples":[["boss@company.it"]]},"site_end_date":{"type":"string","title":"End of customer in yyyy-mm-dd format (Ex. \"2021-05-02\")","pattern":"^\\d{4}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])$","examples":["2021-05-02"]}}}}}}},"tags":["Sites"],"operationId":"api.oneview.update.customer"}},"/oneview/v1/sites/nebula-accounts/{id}":{"get":{"description":"Get one site by the unique field nebula account_id","summary":"Get site by nebula account ID","security":[{"client_credentials":["read"]},{"user_permissions":["sites.view"]}],"status":{"outage":["auth","ov"]},"parameters":[{"name":"id","required":true,"in":"path","description":"Valid UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"Site response schema","description":"The expected response when getting a site","examples":[{"id":"cc99c6bf-1610-43c1-a793-f955c098449c","company_name":"Malwarebytes Inc.","firstname":"Bob","lastname":"Ensley","email":"bensley@company.com","account_owner":["mensley@company.com"],"site_end_date":"2021-05-02"}],"required":["id","company_name","firstname","lastname","email","account_owner"],"properties":{"id":{"type":"string","title":"UUID of the site","description":"The unique identifier of this site.","default":"","examples":["cc99c6bf-1610-43c1-a793-f955c098449c"]},"account_id":{"type":"string","title":"UUID of the account","description":"Unique identifier for accessing security resources associated to this site, like endpoints and detections. You need to create a valid subscription to see this field","default":"","examples":["cc99c6bf-1610-43c1-a793-f955c098449c"]},"cloud_evaluation":{"type":"boolean","title":"Cloud Evaluation","description":"True if the account is valid for cloud evaluation","default":"","examples":[true]},"account_status":{"type":"string","title":"Status","description":"Status of the account. 'ACTIVE' for a live account with valid subscription","default":"","examples":["NOT_APPLICABLE"]},"company_name":{"type":"string","title":"Name of the site","description":"The name of your customer. Friendly name to associate to the account created.","default":"","examples":["string"]},"firstname":{"type":"string","title":"First name of responsible","description":"First name of the contact","default":"","examples":["Bob"]},"lastname":{"type":"string","title":"Last name","description":"Last name of the contact.","default":"","examples":["Ensley"]},"email":{"type":"string","title":"Email","description":"Email address of the contact","default":"","examples":["bensley@company.it"]},"account_owner":{"type":"array","title":"Owner of the account","description":"The email(s) of the owner(s) of this account.","items":{"type":"object","examples":[{"id":"fe366ce017519c74c3f1b2655ae1075b","email":"oneviewuser@domain.it","firstname":"Bob","lastname":"Alice","roles":["Administrator"]}],"required":["id","email","firstname","lastname","roles"],"properties":{"id":{"type":"string","title":"UUID","description":"The unique identifier of the account owner.","default":"","examples":["fe366ce017519c74c3f1b2655ae1075b"]},"email":{"type":"string","title":"Email","description":"The email of the owner of the account","default":"","examples":["aensley.ygi2bhac-qa-@yopmail.com"]},"firstname":{"type":"string","title":"First Name","description":"First name of the account owner.","default":"","examples":["Bob"]},"lastname":{"type":"string","title":"Last name","description":"Last name of the account owner","default":"","examples":["Smith"]},"roles":{"anyOf":[{"type":"array","items":{"type":"string"}},{"type":"null"}],"title":"Roles","description":"The role(s) of the owener of the account","default":[],"examples":[["Administrator"]]}}}},"site_end_date":{"type":"string","title":"End of site in yyyy-mm-dd format (Ex. \"2021-05-02\")","pattern":"^\\d{4}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])$","examples":["2021-05-02"]}}}}}}},"tags":["Sites"],"operationId":"api.oneview.get.customer.by.nebula-account"}},"/oneview/v1/sites/{id}/secret":{"get":{"description":"Returns the site (child account) level tamper protection password for a OneView site. Use this when the effective tamper protection level is \"site\". Returns an error if no site password is set.","summary":"Get site tamper protection password","security":[{"client_credentials":["read"]},{"user_permissions":["tamperProtection.view"]}],"status":{"outage":["auth","ov"]},"parameters":[{"name":"id","required":true,"in":"path","description":"Valid OneView site ID (Ex. \"30616562663436302D643733312D346238622D623338332D613031343538363566383333\")","schema":{"type":"string","pattern":"^[A-Fa-f0-9]+$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Response of policy tamper protection secret","properties":{"secret":{"type":"string","title":"Secret of policy tamper protection"}}}}}}},"tags":["Sites"],"operationId":"api.v2.oneview.get-secret.site"}},"/oneview/v1/users":{"post":{"description":"Create a new OneView User","summary":"Create new user","security":[{"client_credentials":["write"]},{"user_permissions":["users.create"]}],"status":{"outage":["auth","ov"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"The body for creating a new user","description":"The payload for creating a new contact.","examples":[{"email":"user@company.it","firstname":"Bob","lastname":"Ensley","phone":"+13425352","role":["Site Administrator"],"sites":["f7452176-1984-4cf3-af24-9cfe57ad7871","9a1482c4-012a-470c-ba53-ad326920f337"]}],"required":["email","firstname","lastname","role","sites"],"properties":{"email":{"type":"string","title":"Email","description":"Email of the invited user.","examples":["user@company.it"]},"firstname":{"type":"string","title":"First name","description":"First name of the user.","default":"","examples":["Bob"]},"lastname":{"type":"string","title":"Last name","description":"Last name of the user.","examples":["Ensley"]},"phone":{"type":"string","title":"Phone number","description":"The phone number of the user.","examples":["+13142425124"]},"role":{"type":"array","title":"Role","description":"Role assigned to this user.","maxItems":1,"examples":[["Site Administrator"]],"items":{"type":"string","enum":["Administrator","Customer Administrator","Site Administrator","Viewer"]}},"sites":{"type":"array","title":"Sites","description":"List of customer sites to assign to this user","default":[],"examples":[["f7452176-1984-4cf3-af24-9cfe57ad7871","9a1482c4-012a-470c-ba53-ad326920f337"]],"items":{"type":"string"}}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"The body for creating a new user","description":"The payload for creating a new contact.","examples":[{"email":"user@company.it","firstname":"Bob","lastname":"Ensley","phone":"+13425352","role":["Site Administrator"],"sites":["f7452176-1984-4cf3-af24-9cfe57ad7871","9a1482c4-012a-470c-ba53-ad326920f337"]}],"required":["id","email","firstname","lastname","roles","sites"],"properties":{"id":{"type":"string","title":"ID","description":"Unique identifier for the user"},"email":{"type":"string","title":"Email","description":"Email of the invited user.","examples":["user@company.it"]},"firstname":{"type":"string","title":"First name","description":"First name of the user.","default":"","examples":["Bob"]},"lastname":{"type":"string","title":"Last name","description":"Last name of the user.","examples":["Ensley"]},"phone":{"type":"string","title":"Phone number","description":"The phone number of the user.","examples":["+13142425124"]},"roles":{"type":"array","title":"Role","description":"Role assigned to this user.","maxItems":1,"examples":[["Site Administrator"]],"items":{"type":"string","enum":["Administrator","Customer Administrator","Site Administrator","Viewer"]}},"sites":{"type":"array","title":"Sites","description":"List of sites assigned to this user","items":{"type":"string"}}}}}}}},"tags":["Users"],"operationId":"api.oneview.create.contact"},"get":{"description":"Get all users","summary":"Get all users","security":[{"client_credentials":["read"]},{"user_permissions":["users.view"]}],"status":{"outage":["auth","ov"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}},{"name":"next_cursor","required":false,"in":"query","description":"The pagination cursor for next set of results. For further documentation, check Pagination section.","schema":{"type":"string"}},{"name":"page_size","required":false,"in":"query","description":"The size of the page","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"Contacts response schema","description":"The expected response when getting all users","examples":[{"users":[{"id":"fe366ce017519c74c3f1b2655ae1075b","email":"aensley.ygi2bhac-qa-@yopmail.com","firstname":"Bob","lastname":"Smith","phone":"+15346646346","roles":["Administrator"],"sites":["604aad35-0556-4c32-a715-b7dcffb8108f","716cbe76-b956-44ac-a1dc-6f632fb04980","912cd87d-47e1-4660-acec-12010f84950a","c2cdd31b-17c2-491c-871a-4f268ac18e0b"]}]}],"properties":{"users":{"type":"array","items":{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"The body for creating a new user","description":"The payload for creating a new contact.","examples":[{"email":"user@company.it","firstname":"Bob","lastname":"Ensley","phone":"+13425352","role":["Site Administrator"],"sites":["f7452176-1984-4cf3-af24-9cfe57ad7871","9a1482c4-012a-470c-ba53-ad326920f337"]}],"required":["id","email","firstname","lastname","roles","sites"],"properties":{"id":{"type":"string","title":"ID","description":"Unique identifier for the user"},"email":{"type":"string","title":"Email","description":"Email of the invited user.","examples":["user@company.it"]},"firstname":{"type":"string","title":"First name","description":"First name of the user.","default":"","examples":["Bob"]},"lastname":{"type":"string","title":"Last name","description":"Last name of the user.","examples":["Ensley"]},"phone":{"type":"string","title":"Phone number","description":"The phone number of the user.","examples":["+13142425124"]},"roles":{"type":"array","title":"Role","description":"Role assigned to this user.","maxItems":1,"examples":[["Site Administrator"]],"items":{"type":"string","enum":["Administrator","Customer Administrator","Site Administrator","Viewer"]}},"sites":{"type":"array","title":"Sites","description":"List of sites assigned to this user","items":{"type":"string"}}}}},"total_count":{"type":"integer","title":"Total Count","description":"Total count of results."},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}}}}},"tags":["Users"],"operationId":"api.oneview.get-all.contact"}},"/oneview/v1/users/{id}":{"delete":{"description":"Delete one user by its id","summary":"Delete user","security":[{"client_credentials":["write"]},{"user_permissions":["users.delete"]}],"status":{"outage":["auth","ov"]},"parameters":[{"name":"id","required":true,"in":"path","description":"Valid UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"Customer response schema","description":"The expected response when deleting a contact","examples":[{"id":"cc99c6bf-1610-43c1-a793-f955c098449c","deleted":true}],"required":["id","deleted"],"properties":{"id":{"type":"string","title":"UUID of the contact","description":"The unique identifier of this contact.","default":"","examples":["cc99c6bf-1610-43c1-a793-f955c098449c"]},"deleted":{"type":"boolean","title":"Status","description":"Boolean indicating whether the contact was deleted successfully or not.","default":"","examples":[true]}}}}}}},"tags":["Users"],"operationId":"api.oneview.delete.contact"},"get":{"description":"Get user by ID","summary":"Get user by ID","security":[{"client_credentials":["read"]},{"user_permissions":["users.view"]}],"status":{"outage":["auth","ov"]},"parameters":[{"name":"id","required":true,"in":"path","description":"Valid UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"The body for creating a new user","description":"The payload for creating a new contact.","examples":[{"email":"user@company.it","firstname":"Bob","lastname":"Ensley","phone":"+13425352","role":["Site Administrator"],"sites":["f7452176-1984-4cf3-af24-9cfe57ad7871","9a1482c4-012a-470c-ba53-ad326920f337"]}],"required":["id","email","firstname","lastname","roles","sites"],"properties":{"id":{"type":"string","title":"ID","description":"Unique identifier for the user"},"email":{"type":"string","title":"Email","description":"Email of the invited user.","examples":["user@company.it"]},"firstname":{"type":"string","title":"First name","description":"First name of the user.","default":"","examples":["Bob"]},"lastname":{"type":"string","title":"Last name","description":"Last name of the user.","examples":["Ensley"]},"phone":{"type":"string","title":"Phone number","description":"The phone number of the user.","examples":["+13142425124"]},"roles":{"type":"array","title":"Role","description":"Role assigned to this user.","maxItems":1,"examples":[["Site Administrator"]],"items":{"type":"string","enum":["Administrator","Customer Administrator","Site Administrator","Viewer"]}},"sites":{"type":"array","title":"Sites","description":"List of sites assigned to this user","items":{"type":"string"}}}}}}}},"tags":["Users"],"operationId":"api.oneview.get.contact"},"put":{"description":"Update data about a user","summary":"Update user","security":[{"client_credentials":["write"]},{"user_permissions":["users.edit"]}],"status":{"outage":["auth","ov"]},"parameters":[{"name":"id","required":true,"in":"path","description":"Valid UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"The body for creating a new user","description":"The payload for creating a new contact.","examples":[{"email":"user@company.it","firstname":"Bob","lastname":"Ensley","phone":"+13425352","role":["Site Administrator"],"sites":["f7452176-1984-4cf3-af24-9cfe57ad7871","9a1482c4-012a-470c-ba53-ad326920f337"]}],"required":["email","firstname","lastname","role","sites"],"properties":{"email":{"type":"string","title":"Email","description":"Email of the invited user.","examples":["user@company.it"]},"firstname":{"type":"string","title":"First name","description":"First name of the user.","default":"","examples":["Bob"]},"lastname":{"type":"string","title":"Last name","description":"Last name of the user.","examples":["Ensley"]},"phone":{"type":"string","title":"Phone number","description":"The phone number of the user.","examples":["+13142425124"]},"role":{"type":"array","title":"Role","description":"Role assigned to this user.","maxItems":1,"examples":[["Site Administrator"]],"items":{"type":"string","enum":["Administrator","Customer Administrator","Site Administrator","Viewer"]}},"sites":{"type":"array","title":"Sites","description":"List of customer sites to assign to this user","default":[],"examples":[["f7452176-1984-4cf3-af24-9cfe57ad7871","9a1482c4-012a-470c-ba53-ad326920f337"]],"items":{"type":"string"}}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"The body for creating a new user","description":"The payload for creating a new contact.","examples":[{"email":"user@company.it","firstname":"Bob","lastname":"Ensley","phone":"+13425352","role":["Site Administrator"],"sites":["f7452176-1984-4cf3-af24-9cfe57ad7871","9a1482c4-012a-470c-ba53-ad326920f337"]}],"required":["id","email","firstname","lastname","roles","sites"],"properties":{"id":{"type":"string","title":"ID","description":"Unique identifier for the user"},"email":{"type":"string","title":"Email","description":"Email of the invited user.","examples":["user@company.it"]},"firstname":{"type":"string","title":"First name","description":"First name of the user.","default":"","examples":["Bob"]},"lastname":{"type":"string","title":"Last name","description":"Last name of the user.","examples":["Ensley"]},"phone":{"type":"string","title":"Phone number","description":"The phone number of the user.","examples":["+13142425124"]},"roles":{"type":"array","title":"Role","description":"Role assigned to this user.","maxItems":1,"examples":[["Site Administrator"]],"items":{"type":"string","enum":["Administrator","Customer Administrator","Site Administrator","Viewer"]}},"sites":{"type":"array","title":"Sites","description":"List of sites assigned to this user","items":{"type":"string"}}}}}}}},"tags":["Users"],"operationId":"api.oneview.update.contact"}},"/oneview/v1/users/resend-invite":{"put":{"description":"Resend user invite","summary":"Resend user invite","security":[{"client_credentials":["execute"]},{"user_permissions":["users.edit"]}],"status":{"outage":["auth","ov"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"title":"Resend user invite","description":"Resend user invite","type":"object","required":["email"],"properties":{"email":{"type":"string","format":"email","description":"User's email"}}}}}},"responses":{"200":{"description":"Successful response"}},"tags":["Users"],"operationId":"api.oneview.resend-invite.contact"}},"/oneview/v1/info/account":{"get":{"description":"Get account id associated to the requesting client","summary":"Account info","security":[{"client_credentials":["read"]},{"user_permissions":["account.view"]}],"status":{"outage":["auth","ov"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Get account id","properties":{"account_id":{"type":"string","title":"The top-level account id","pattern":"^[A-Fa-f0-9]+$","examples":["30616562663436302D643733312D346238622D623338332D613031343538363566383333"]},"nebula_parent_account_id":{"type":"string","title":"The top-level Nebula Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}}}},"tags":["Info"],"operationId":"api.oneview.get.info"}},"/oneview/v1/detections/export":{"post":{"description":"Export detections data. You can export across multiple accounts. Specify your interested fields and the output format.\n\nSupported output formats: csv, xlsx, json.\n\n## Settings\n\n| Name | Description |\n|------|-------------|\n| groups | List of queries. The constraints accepted are the same accepted by the search detections route. Refer to [Search detections API](#operation/api.v2.rmm.search.detections) for more information about the constraints accepted. |\n| download | If set to true, the server will set the `Content-Disposition` header using the `filename` and `format` |\n| select | Which fields to select, and which field name to map to. See request schema for allowed values |\n| type | Output encoding (for `csv` and `json` format) |\n| filename | Name of the file to be set in `Content-Disposition` header if `download` = true |\n\n## Examples\n\n### Download HTML file\n\nA request with this body sent by a browser will download a file called `nameofthefile.html`, displaying a table with columns: `Path`, `Name`, `Machine ID`, `Machine Name` for all detections on `windows` endpoints within account id `1e14cd0a-2ef3-4db3-b8a4-c89894d9aa34`:\n\n```json\n\t{\n\t\t\"groups\": [{\n\t\t\t\"account_ids\": [\"1e14cd0a-2ef3-4db3-b8a4-c89894d9aa34\"],\n\t\t\t\"os_info.os_platform\": \"windows\"\n\t\t}],\n\t\t\"format\": \"html\",\n\t\t\"type\": \"string\",\n\t\t\"filename\": \"nameofthefile\",\n\t\t\"download\": true,\n\t\t\"select\": [{\n\t\t\t\"field\": \"path\",\n\t\t\t\"newField\": \"Path\"\n\t\t},{\n\t\t\t\"field\": \"threat_name\",\n\t\t\t\"newField\": \"Name\"\n\t\t}, {\n\t\t\t\"field\": \"machine_id\",\n\t\t\t\"newField\": \"Machine ID\"\n\t\t}, {\n\t\t\t\"field\": \"machine_name\",\n\t\t\t\"newField\": \"Machine Name\"\n\t\t}]\n\t}\n```\n\n### Download xlsx file\n\nA request with this body sent by a browser will download a file called `report.html`, displaying a table with columns: `Path`, `Name`, `Machine ID`, `Machine Name` for all `windows` endpoints within account id `1e14cd0a-2ef3-4db3-b8a4-c89894d9aa34` and the endpoint with id `211a4cfc-557e-4ba7-a96f-70685a07c29e`:\n\n```json\n\t{\n\t\t\"groups\": [{\n\t\t\t\"account_ids\": [\"1e14cd0a-2ef3-4db3-b8a4-c89894d9aa34\"],\n\t\t\t\"os_info.os_platform\": \"windows\"\n\t\t}],\n\t\t\"populate\": { \"account\": true, \"last_job\": true },\n\t\t\"format\": \"xlsx\",\n\t\t\"type\": \"base64\",\n\t\t\"filename\": \"report\",\n\t\t\"download\": true,\n\t\t\"select\": [{\n\t\t\t\"field\": \"path\",\n\t\t\t\"newField\": \"Path\"\n\t\t},{\n\t\t\t\"field\": \"threat_name\",\n\t\t\t\"newField\": \"Name\"\n\t\t}, {\n\t\t\t\"field\": \"machine_id\",\n\t\t\t\"newField\": \"Machine ID\"\n\t\t}, {\n\t\t\t\"field\": \"machine_name\",\n\t\t\t\"newField\": \"Machine Name\"\n\t\t}]\n\t}\n```\n\n\n","summary":"Export detections","security":[{"client_credentials":["execute"]},{"user_permissions":["detections.view"]}],"status":{"outage":["auth","search_stateless"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Export request","required":["groups","select","format"],"properties":{"format":{"type":"string","title":"The output file","enum":["csv","xlsx","html","ods","txt","rtf","json"]},"download":{"type":"boolean","title":"Whether to instruct the client to download the response as a file. Only clients like browsers are supported"},"type":{"type":"string","title":"The encoding of the output","enum":["string","base64","binary"],"default":"string"},"select":{"type":"array","title":"Which fields to select from the response","items":{"type":"object","title":"Field","required":["field","newField"],"properties":{"newField":{"type":"string","title":"the new value"},"field":{"type":"string","title":"The response field to map to a new value","enum":["type","group_id","path","status","id","machine_id","account_id","account.name","group.name","detection_id","scanned_at","scanned_at_offset_seconds","reported_at","resource_created_at","resource_modified_at","category","is_rtp_stream_event","process_name","cleaned_at","machine_name","machine_ip","child_trace_count","source_location","destination_location","machine_location","trace_ip","trace_port","threat_name","is_root_detection","agent.at","agent.last_user","agent.fully_qualified_host_name","agent.started_at_local","agent.started_at_offset","agent.os_info.os_type","agent.os_info.os_version","agent.os_info.os_platform","agent.os_info.os_architecture","agent.os_info.os_release_name","agent.domain_name","agent.engine_version","agent.policy_etag","agent.host_name","agent.nics.ips","agent.nics.mac_address","agent.object_guid","rid_details.rule_id","rid_details.ip","rid_details.attack_user","rid_details.protocol","rid_details.port","rid_details.attempts","rid_details.duration","rid_details.create_time","rid_details.expire_time","sha256","md5","affected_application","scan_result.device.disk_model","action_taken"]}}}},"groups":{"type":"array","title":"List of queries","items":{"type":"object","required":["account_ids"],"title":"List of queries to fetch endpoints","additionalProperties":true,"properties":{"account_ids":{"type":"array","title":"List of account IDs for this query","items":{"type":"string","title":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}}}}}}},"responses":{"200":{"description":"Successful response"}},"tags":["Detections"],"operationId":"api.v2.rmm.post.export.detections"}},"/oneview/v1/detections/export/async":{"post":{"description":"Export detections asynchronously","summary":"Export detections asynchronously","security":[{"client_credentials":["execute"]},{"user_permissions":["detections.view"]}],"status":{"outage":["auth","search_stateless"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Export request","required":["groups","select","format"],"properties":{"format":{"type":"string","title":"The output file","enum":["csv","xlsx","html","ods","txt","rtf","json"]},"download":{"type":"boolean","title":"Whether to instruct the client to download the response as a file. Only clients like browsers are supported"},"type":{"type":"string","title":"The encoding of the output","enum":["string","base64","binary"],"default":"string"},"select":{"type":"array","title":"Which fields to select from the response","items":{"type":"object","title":"Field","required":["field","newField"],"properties":{"newField":{"type":"string","title":"the new value"},"field":{"type":"string","title":"The response field to map to a new value","enum":["type","group_id","path","status","id","machine_id","account_id","account.name","group.name","detection_id","scanned_at","scanned_at_offset_seconds","reported_at","resource_created_at","resource_modified_at","category","is_rtp_stream_event","process_name","cleaned_at","machine_name","machine_ip","child_trace_count","source_location","destination_location","machine_location","trace_ip","trace_port","threat_name","is_root_detection","agent.at","agent.last_user","agent.fully_qualified_host_name","agent.started_at_local","agent.started_at_offset","agent.os_info.os_type","agent.os_info.os_version","agent.os_info.os_platform","agent.os_info.os_architecture","agent.os_info.os_release_name","agent.domain_name","agent.engine_version","agent.policy_etag","agent.host_name","agent.nics.ips","agent.nics.mac_address","agent.object_guid","rid_details.rule_id","rid_details.ip","rid_details.attack_user","rid_details.protocol","rid_details.port","rid_details.attempts","rid_details.duration","rid_details.create_time","rid_details.expire_time","sha256","md5","affected_application","scan_result.device.disk_model","action_taken"]}}}},"groups":{"type":"array","title":"List of queries","items":{"type":"object","required":["account_ids"],"title":"List of queries to fetch endpoints","additionalProperties":true,"properties":{"account_ids":{"type":"array","title":"List of account IDs for this query","items":{"type":"string","title":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}}}}}}},"responses":{"200":{"description":"Successful response"}},"tags":["Detections"],"operationId":"api.v2.rmm.post.export.detections.async"}},"/oneview/v1/accounts/{account_id}/detections/{id}":{"get":{"description":"Get detection and its full information by its detection ID.","summary":"Get detection by ID","security":[{"client_credentials":["read"]},{"user_permissions":["detections.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":true,"in":"path","description":"Valid UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"account_id","required":false,"in":"path","description":"Valid account UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Get detection by id","additionalProperties":true,"required":["id","scan_id","machine_id","detection_id","scanned_at","scanned_at_local","reported_at","status","type","path","category"],"properties":{"id":{"type":"string","title":"The ID of the detection (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"scan_id":{"type":"string","title":"Scan ID this detection belongs to (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"machine_id":{"type":"string","title":"Endpoint ID this detection belongs to (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"machine_name":{"type":"string","title":"Machine name"},"group_id":{"type":"string","title":"Group ID the endpoint has (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"group_name":{"type":"string","title":"Group name the endpoint has"},"policy_id":{"type":"string","title":"The ID of the policy associated to the machine where this detection happened (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"policy_name":{"type":"string","title":"Policy name"},"detection_id":{"type":"string","title":"Detection id from endpoint"},"scanned_at":{"type":"string","title":"Scanned at time (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^\\d{4}-[0-1]\\d-[0-3]\\d[(t|T)\\s](?:[0-2]\\d:[0-5]\\d:[0-5]\\d|23:59:60)(?:\\.\\d+)?(?:(z|Z)|[+-]\\d{2}:\\d{2})$","examples":["2020-03-23T17:23:17.860482Z"]},"scanned_at_local":{"type":"string","title":"Scanned at local time (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^\\d{4}-[0-1]\\d-[0-3]\\d[(t|T)\\s](?:[0-2]\\d:[0-5]\\d:[0-5]\\d|23:59:60)(?:\\.\\d+)?(?:(z|Z)|[+-]\\d{2}:\\d{2})$","examples":["2020-03-23T17:23:17.860482Z"]},"reported_at":{"type":"string","title":"Detection reported at time (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^\\d{4}-[0-1]\\d-[0-3]\\d[(t|T)\\s](?:[0-2]\\d:[0-5]\\d:[0-5]\\d|23:59:60)(?:\\.\\d+)?(?:(z|Z)|[+-]\\d{2}:\\d{2})$","examples":["2020-03-23T17:23:17.860482Z"]},"resource_created_at":{"type":"string","title":"The creation timestamp of the original quarantined file","format":"date-time"},"resource_modified_at":{"type":"string","title":"The modification timestamp of the original quarantined file","format":"date-time"},"status":{"type":"string","title":"Status"},"action_taken":{"type":"string","title":"Action Taken","examples":["unknown","failed","noActionByUser","quarantined","replaced","deleteOnReboot","replaceOnReboot","blocked","whitelisted","unquarantined"]},"threat_name":{"type":"string","title":"Threat name"},"type":{"type":"array","title":"Type","items":{"type":"string","title":"Items"}},"path":{"type":"string","title":"Path"},"category":{"type":"string","title":"Category"},"ip_address":{"type":"string","title":"IP address"},"url":{"type":"string","title":"Url"},"port":{"type":"string","title":"Port"},"affected_application":{"type":"string","title":"Affected application"},"md5":{"type":"string","title":"Md5"},"process_name":{"type":"string","title":"Process name"},"auto_removal_at":{"type":["string","null"],"title":"Automatic removal timestamp","description":"When the quarantined item will be automatically removed.","format":"date-time","examples":["2020-03-23T17:23:17.860482Z"]}}}}}}},"tags":["Detections"],"operationId":"api.v2.rmm.get.detections.id"}},"/oneview/v1/detections":{"post":{"description":"Search detections across all your managed accounts. The search will be scoped to the account_ids you specify in the request body.","summary":"Search detections across accounts","security":[{"client_credentials":["read"]},{"user_permissions":["detections.view"]}],"status":{"outage":["auth","search_stateless"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Search detections request. Leading wildcards are not supported for constraint fields without '.keyword' suffix.","required":["account_ids"],"properties":{"scan_type":{"type":"string","title":"Type of the scan"},"schedule_id":{"type":"string","title":"ID of the schedule"},"schedule_etag":{"type":"string","title":"ETAG of the schedule"},"job_id":{"type":"string","title":"ID of the job originating this detection"},"domain_name":{"type":"string","title":"Filter the search to the endpoints with specified domain name"},"engine_version":{"type":"string","title":"Filter the search to the endpoints with specified engine version"},"last_user":{"type":"string","title":"Last user that logged into the machine"},"last_user.keyword":{"type":"string","title":"Last user that logged into the machine (exact match). This 'contains' type search will look for the exact match anywhere in the field."},"plugins.siem.reboot_reason":{"type":"string","title":"Filter the search to the endpoints with specified reboot reason, as reported by the SIEM plugin"},"plugins.siem.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified SIEM plugin version"},"plugins.browser_phishing_protection.plugin_version":{"plugins.incident_response.reboot_reason":{"type":"string","title":"Filter the search to the endpoints with specified Browser Phishing Protection plugin version"},"type":"string","title":"Filter the search to the endpoints with specified reboot reason, as reported by IR plugin"},"plugins.incident_response.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified IR plugin version"},"plugins.endpoint_detection_and_response.reboot_reason":{"type":"string","title":"Filter the search to the endpoints with specified reboot reason, as reported by EDR plugin"},"plugins.endpoint_detection_and_response.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified EDR plugin version"},"plugins.endpoint_protection.reboot_reason":{"type":"string","title":"Filter the search to the endpoints with specified reboot reason, as reported by EP plugin"},"plugins.endpoint_protection.update_package_version":{"type":"string","title":"Filter the search to the endpoints with specified EP update package version"},"plugins.endpoint_protection.component_package_version":{"type":"string","title":"Filter the search to the endpoints with specified EP component package version"},"plugins.endpoint_protection.sdk_version":{"type":"string","title":"Filter the search to the endpoints with specified EP SDK version"},"plugins.endpoint_protection.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified EP plugin version"},"plugins.asset_manager.reboot_reason":{"type":"string","title":"Filter the search to the endpoints with specified reboot reason, as reported by asset manager plugin"},"plugins.asset_manager.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified asset manager plugin version"},"fully_qualified_host_name":{"type":"string","title":"Filter the search to the endpoints with specified, fully qualified host name"},"host_name":{"type":"string","title":"Filter the search to the endpoints with specified host name"},"os_info.os_release_name":{"type":"string","title":"Filter the search to the endpoints with specified release name of OS"},"os_info.os_architecture":{"type":"string","title":"Filter the search to the endpoints with specified OS architecture"},"os_info.os_platform":{"type":"string","title":"Filter the search to the endpoints with specified OS"},"os_info.os_version":{"type":"string","title":"Filter the search to the endpoints with specified OS version"},"os_info.os_type":{"type":"string","title":"Filter the search to the endpoints with specified OS type"},"nics.description":{"type":"string","title":"Filter the search to the endpoints with specified NICS description"},"nics.mac_address":{"type":"string","title":"Filter the search to the endpoints with specified NICS MAC address"},"nics.ips":{"type":"string","title":"Filter the search to the endpoints with specified ips"},"host_name.keyword":{"type":"string","title":"Filter the search to the endpoints that have the specified host's name. This 'contains' type search will look for the exact match anywhere in the field."},"fully_qualified_host_name.keyword":{"type":"string","title":"Filter the search to the endpoints that have the specified, fully_qualified_host's name. This 'contains' type search will look for the exact match anywhere in the field."},"engine_version.keyword":{"type":"string","title":"Filter the search by engine version. This 'contains' type search will look for the exact match anywhere in the field."},"domain_name.keyword":{"type":"string","title":"Filter the search by domain name. This 'contains' type search will look for the exact match anywhere in the field."},"at_after":{"type":"string","title":"At after cursor (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"at_before":{"type":"string","title":"At after cursor (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"protection_status":{"type":"string","title":"Protection status of the endpoint(s)","pattern":"(^$|protected|scan_only|unprotected|unknown|pending|mobile_protection)"},"machine_name.keyword":{"type":"string","title":"The name of the machine. This 'contains' type search will look for the exact match anywhere in the field."},"machine_name":{"type":"string","title":"The name of the machine"},"process_name.keyword":{"type":"string","title":"The name of the process that originated this detection. This 'contains' type search will look for the exact match anywhere in the field."},"process_name":{"type":"string","title":"The name of the process that originated this detection"},"affected_application.keyword":{"type":"string","title":"The application affected by this detection. This 'contains' type search will look for the exact match anywhere in the field."},"affected_application":{"type":"string","title":"The application affected by this detection"},"category":{"type":"string","title":"The category of this detection"},"not.category":{"type":"string","title":"The category to exclude from search"},"md5":{"type":"string","title":"The md5 hash of this detection"},"sha256":{"type":"string","title":"The sha256 hash of this detection"},"path.keyword":{"type":"string","title":"The path where this detection happened. This 'contains' type search will look for the exact match anywhere in the field."},"path":{"type":"string","title":"The path where this detection happened"},"type":{"type":"string","title":"The type of the detection"},"not.type":{"type":"string","title":"The type to exclude from search"},"threat_name.keyword":{"type":"string","title":"The name of the threat. This 'contains' type search will look for the exact match anywhere in the field."},"threat_name":{"type":"string","title":"The name of the threat"},"status":{"type":"string","title":"The status of the detection"},"action_taken":{"type":"string","title":"The action taken of the detection","examples":["unknown","failed","noActionByUser","quarantined","replaced","deleteOnReboot","replaceOnReboot","blocked","whitelisted","unquarantined"]},"correlation_hash":{"type":"string","title":"The hash"},"group_id":{"type":"string","title":"The ID of the group to which the endpoint is assigned (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"machine_id":{"type":"string","title":"The ID of the endpoint (machine) where this detection originated (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"detection_id":{"type":"string","title":"The ID of the detection (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"parent_detection_id":{"type":"string","title":"The ID of the parent detection (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"scan_id":{"type":"string","title":"The ID of the scan (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"trace_id":{"type":"string","title":"The ID of the parent trace (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"device_control.physical_disk_name":{"type":"string","title":"Physical disk name of device control detection (exact search)"},"not.device_control.physical_disk_name":{"type":"string","title":"Physical disk name of device control detection (contains search)"},"device_control.physical_disk_name.keyword":{"type":"string","title":"Physical disk name of device control detection. Search for the matches that are not equal to the value"},"not.device_control.physical_disk_name.keyword":{"type":"string","title":"Physical disk name of device control detection. Search for the matches that do not contain the value"},"start_date":{"type":"string","title":"Get results after this date. Defaults to 1 week if not specified. (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"end_date":{"type":"string","title":"Get results before this date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"scanned_at_after":{"type":"string","title":"Get results generated by a scan happening after this date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"scanned_at_before":{"type":"string","title":"Get results generated by a scan happening before this date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"reported_at_after":{"type":"string","title":"Get results reported after this date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"reported_at_before":{"type":"string","title":"Get results reported before this date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"cleaned_at_after":{"type":"string","title":"Get results cleaned after this date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"cleaned_at_before":{"type":"string","title":"Get results cleaned before this date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"is_root_detection":{"type":"boolean","title":"Whether this detection is the root detection"},"is_rtp_stream_event":{"type":"boolean","title":"Whether this is a Real-Time Protectionevent"},"object_guid":{"type":"string","title":"object_guid filter"},"sort_field":{"type":"string","title":"If the sort field is used, then sort_order is required.","enum":["trace_id","scan_id","machine_id","group_id","account_id","detection_id","parent_detection_id","correlation_hash","status","threat_name.keyword","type","path.keyword","category","md5","sha256","affected_application.keyword","process_name.keyword","machine_name.keyword","scanned_at","reported_at","resource_created_at","resource_modified_at","cleaned_at","is_root_detection","is_rtp_stream_event","object_guid","scan_result.device.disk_model"]},"sort_order":{"type":"string","title":"Sorting direction","enum":["asc","desc"]},"page_size":{"type":"number","title":"The size of the page. If you only need aggregations, set it to 0","minimum":0,"maximum":2000},"aggregations":{"type":"array","title":"The Aggregations Schema","items":{"type":"string","title":"Aggregations","default":[],"enum":["trace_id","scan_id","machine_id","group_id","account_id","detection_id","parent_detection_id","correlation_hash","status","threat_name.keyword","type","path.keyword","category","md5","affected_application.keyword","process_name.keyword","machine_name.keyword","daily_detections_by_category","protection_status","os_info.os_release_name.keyword","nics.ips","nics.mac_address","nics.description.keyword","os_info.os_type","os_info.os_version.keyword","os_info.os_platform","os_info.os_architecture","host_name.keyword","fully_qualified_host_name.keyword","plugins.asset_manager.plugin_version.keyword","plugins.asset_manager.reboot_reason","plugins.endpoint_protection.plugin_version.keyword","plugins.endpoint_protection.sdk_version.keyword","plugins.endpoint_protection.component_package_version.keyword","plugins.endpoint_protection.update_package_version.keyword","plugins.endpoint_protection.reboot_reason","plugins.endpoint_detection_and_response.plugin_version.keyword","plugins.endpoint_detection_and_response.reboot_reason","plugins.incident_response.plugin_version.keyword","plugins.incident_response.reboot_reason","plugins.siem.plugin_version.keyword","plugins.siem.reboot_reason","engine_version.keyword","domain_name.keyword","policy_etag","last_user.keyword","object_guid","scan_result.device.disk_model","category_by_status"]}},"populate":{"type":"object","title":"The populate object Schema","properties":{"group":{"type":"boolean","title":"Populate with the group data"},"endpoint":{"type":"boolean","title":"Populate with the endpoint data (agent, machine_location)"},"scan_result":{"type":"boolean","title":"Populate with the scan_result data"}}},"account_ids":{"type":"array","title":"The account ids to filter your search","items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]},"aggregate_by_account":{"type":"boolean"}},"allOf":[{"type":"object","title":"Active Directory Search Filters","properties":{"active_directory.user.display_name":{"type":"string","title":"Filter the search by active_directory.user.display_name. Search for the matches that are equal to the value"},"active_directory.user.display_name.keyword":{"type":"string","title":"Filter the search by active_directory.user.display_name.keyword. Search for the matches that contain the value"},"active_directory.user.ou":{"type":"string","title":"Filter the search by active_directory.user.ou. Search for the matches that are equal to the value"},"active_directory.user.ou.keyword":{"type":"string","title":"Filter the search by active_directory.user.ou.keyword. Search for the matches that contain the value"},"active_directory.user.ou.path":{"type":"string","title":"Filter the search by active_directory.user.ou.path. Search for the matches that are equal to the value"},"active_directory.user.ou.path.keyword":{"type":"string","title":"Filter the search by active_directory.user.ou.path.keyword. Search for the matches that contain the value"},"active_directory.user.sam_account_name":{"type":"string","title":"Filter the search by active_directory.user.sam_account_name. Search for the matches that are equal to the value"},"active_directory.user.sam_account_name.keyword":{"type":"string","title":"Filter the search by active_directory.user.sam_account_name.keyword. Search for the matches that contain the value"},"active_directory.machine.display_name":{"type":"string","title":"Filter the search by active_directory.machine.display_name. Search for the matches that are equal to the value"},"active_directory.machine.display_name.keyword":{"type":"string","title":"Filter the search by active_directory.machine.display_name.keyword. Search for the matches that contain the value"},"active_directory.machine.ou":{"type":"string","title":"Filter the search by active_directory.machine.ou. Search for the matches that are equal to the value"},"active_directory.machine.ou.keyword":{"type":"string","title":"Filter the search by active_directory.machine.ou.keyword. Search for the matches that contain the value"},"active_directory.machine.ou.path":{"type":"string","title":"Filter the search by active_directory.machine.ou.path. Search for the matches that are equal to the value"},"active_directory.machine.ou.path.keyword":{"type":"string","title":"Filter the search by active_directory.machine.ou.path.keyword. Search for the matches that contain the value"},"active_directory.machine.sam_account_name":{"type":"string","title":"Filter the search by active_directory.machine.sam_account_name. Search for the matches that are equal to the value"},"active_directory.machine.sam_account_name.keyword":{"type":"string","title":"Filter the search by active_directory.machine.sam_account_name.keyword. Search for the matches that contain the value"}}}]}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Search detections result","properties":{"detections":{"type":"array","title":"Detections","items":{"type":"object","title":"Detection items","additionalProperties":false,"properties":{"id":{"type":"string","title":"ID"},"type":{"type":"array","title":"Type","items":{"type":"string","title":"Type items"}},"status":{"type":"string","title":"Status"},"path":{"type":"string","title":"Path"},"group_id":{"type":"string","title":"Group ID"},"group":{"type":"object","title":"The Group Schema","additionalProperties":true},"is_root_detection":{"type":"boolean","title":"Is root detection"},"machine_id":{"type":"string","title":"Endpoint ID"},"account_id":{"type":"string","title":"Account ID"},"detection_id":{"type":"string","title":"Detection ID"},"scanned_at":{"type":"string","title":"Scanned at"},"scanned_at_offset_seconds":{"type":"integer","title":"Scanned at offset seconds"},"reported_at":{"type":"string","title":"Reported at"},"resource_created_at":{"type":"string","title":"The creation timestamp of the original quarantined file","format":"date-time"},"resource_modified_at":{"type":"string","title":"The modification timestamp of the original quarantined file","format":"date-time"},"threat_name":{"type":"string","title":"Threat name"},"category":{"type":"string","title":"Category"},"action_taken":{"type":"string","title":"Action taken"},"is_rtp_stream_event":{"type":"boolean","title":"Is rtp stream event"},"process_name":{"type":"string","title":"Process name"},"cleaned_at":{"type":"string","title":"Cleaned at"},"machine_name":{"type":"string","title":"Endpoint name"},"trace_id":{"type":"string","title":"Trace ID"},"scan_id":{"type":"string","title":"Scan ID"},"affected_application":{"type":"string","title":"Affected application"},"last_user":{"type":"string","title":"Last user"},"md5":{"type":"string","title":"MD5"},"sha256":{"type":"string","title":"SHA256"},"machine_ip":{"type":"string","title":"Machine IP address"},"child_trace_count":{"type":"integer","title":"Child trace count"},"agent":{"allOf":[{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"The root schema","description":"The root schema comprises the entire JSON document.","default":{},"examples":[{"at":"2020-10-23T14:20:51.006558Z","is_software_update_available":false,"started_at_local":"2020-10-23T14:20:50.920306Z","started_at_offset":-25200,"nics":[{"ips":["10.151.110.52"],"description":"Intel(R) 82574L Gigabit Network Connection","mac_address":"005056B91173"}],"os_info":{"os_type":"Workstation","os_version":"6.3.9600","os_platform":"Windows","os_architecture":"x86","os_release_name":"Microsoft Windows 8.1 Pro"},"fully_qualified_host_name":"sahamedw8-1x86","plugins":{"windows_remote_intrusion_detection_and_prevention":{"product_name":"Windows Remote Intrusion Detection and Prevention","plugin_version":"1.2.0.21"},"endpoint_protection":{"sdk_version":"4.2.1.90","product_name":"Endpoint Protection","plugin_version":"1.2.0.844","update_package_version":"1.0.31870","component_package_version":"1.0.1085","reboot_reasons":0},"asset_manager":{"product_name":"Asset Manager","plugin_version":"1.2.0.330","reboot_reasons":0},"endpoint_detection_and_response":{"product_name":"Endpoint Detection and Response","plugin_version":"1.2.0.297","reboot_reasons":0}},"engine_version":"1.2.0.821","policy_etag":"c6ea44914b72c92cba939ac3bd369dc4","last_user":"SAHAMEDW8-1X86\\Administrator","serial_number":"c02thb32g8wn","host_name":"sahamedw8-1x86","machine_id":"f2bcafe1-cb2b-4833-b6c9-6148b9511c8f","machine_ip":"216.75.233.210"}],"properties":{"at":{"type":"string","title":"The at schema","default":"","examples":["2020-10-23T14:20:51.006558Z"]},"is_software_update_available":{"type":"boolean","title":"The is_software_update_available schema","default":false,"examples":[false]},"started_at_local":{"type":"string","title":"The started_at_local schema","default":"","examples":["2020-10-23T14:20:50.920306Z"]},"started_at_offset":{"type":"integer","title":"The started_at_offset schema","default":0,"examples":[-25200]},"nics":{"type":"array","title":"The nics schema","default":[],"examples":[[{"ips":["10.151.110.52"],"description":"Intel(R) 82574L Gigabit Network Connection","mac_address":"005056B91173"}]],"additionalItems":true,"items":{"anyOf":[{"type":"object","title":"The first anyOf schema","default":{},"examples":[{"ips":["10.151.110.52"],"description":"Intel(R) 82574L Gigabit Network Connection","mac_address":"005056B91173"}],"properties":{"ips":{"type":"array","title":"The ips schema","default":[],"examples":[["10.151.110.52"]],"additionalItems":true,"items":{"anyOf":[{"type":"string","title":"The first anyOf schema","default":"","examples":["10.151.110.52"]}]}},"description":{"type":"string","title":"The description schema","default":"","examples":["Intel(R) 82574L Gigabit Network Connection"]},"mac_address":{"type":"string","title":"The mac_address schema","default":"","examples":["005056B91173"]}},"additionalProperties":true}]}},"os_info":{"type":"object","title":"The os_info schema","default":{},"examples":[{"os_type":"Workstation","os_version":"6.3.9600","os_platform":"Windows","os_architecture":"x86","os_release_name":"Microsoft Windows 8.1 Pro"}],"properties":{"os_type":{"type":"string","title":"The os_type schema","default":"","examples":["Workstation"]},"os_version":{"type":"string","title":"The os_version schema","default":"","examples":["6.3.9600"]},"os_platform":{"type":"string","title":"The os_platform schema","default":"","examples":["Windows"]},"os_architecture":{"type":"string","title":"The os_architecture schema","default":"","examples":["x86"]},"os_release_name":{"type":"string","title":"The os_release_name schema","default":"","examples":["Microsoft Windows 8.1 Pro"]}},"additionalProperties":true},"fully_qualified_host_name":{"type":"string","title":"The fully_qualified_host_name schema","default":"","examples":["sahamedw8-1x86"]},"plugins":{"type":"object","title":"The plugins schema","default":{},"examples":[{"windows_remote_intrusion_detection_and_prevention":{"product_name":"Windows Remote Intrusion Detection and Prevention","plugin_version":"1.2.0.21"},"endpoint_protection":{"sdk_version":"4.2.1.90","product_name":"Endpoint Protection","plugin_version":"1.2.0.844","update_package_version":"1.0.31870","component_package_version":"1.0.1085","reboot_reasons":0},"asset_manager":{"product_name":"Asset Manager","plugin_version":"1.2.0.330","reboot_reasons":0},"endpoint_detection_and_response":{"product_name":"Endpoint Detection and Response","plugin_version":"1.2.0.297","reboot_reasons":0}}],"properties":{"windows_remote_intrusion_detection_and_prevention":{"type":"object","title":"The windows_remote_intrusion_detection_and_prevention schema","default":{},"examples":[{"product_name":"Windows Remote Intrusion Detection and Prevention","plugin_version":"1.2.0.21"}],"properties":{"product_name":{"type":"string","title":"The product_name schema","default":"","examples":["Windows Remote Intrusion Detection and Prevention"]},"plugin_version":{"type":"string","title":"The plugin_version schema","default":"","examples":["1.2.0.21"]}},"additionalProperties":true},"endpoint_protection":{"type":"object","title":"The endpoint_protection schema","default":{},"examples":[{"sdk_version":"4.2.1.90","product_name":"Endpoint Protection","plugin_version":"1.2.0.844","update_package_version":"1.0.31870","component_package_version":"1.0.1085","reboot_reasons":0}],"properties":{"sdk_version":{"type":"string","title":"The sdk_version schema","default":"","examples":["4.2.1.90"]},"product_name":{"type":"string","title":"The product_name schema","default":"","examples":["Endpoint Protection"]},"plugin_version":{"type":"string","title":"The plugin_version schema","default":"","examples":["1.2.0.844"]},"update_package_version":{"type":"string","title":"The update_package_version schema","default":"","examples":["1.0.31870"]},"component_package_version":{"type":"string","title":"The component_package_version schema","default":"","examples":["1.0.1085"]},"reboot_reasons":{"type":"integer","title":"The reboot_reasons schema","default":0,"examples":[0]}},"additionalProperties":true},"asset_manager":{"type":"object","title":"The asset_manager schema","default":{},"examples":[{"product_name":"Asset Manager","plugin_version":"1.2.0.330","reboot_reasons":0}],"properties":{"product_name":{"type":"string","title":"The product_name schema","default":"","examples":["Asset Manager"]},"plugin_version":{"type":"string","title":"The plugin_version schema","default":"","examples":["1.2.0.330"]},"reboot_reasons":{"type":"integer","title":"The reboot_reasons schema","default":0,"examples":[0]}},"additionalProperties":true},"endpoint_detection_and_response":{"type":"object","title":"The endpoint_detection_and_response schema","default":{},"examples":[{"product_name":"Endpoint Detection and Response","plugin_version":"1.2.0.297","reboot_reasons":0}],"properties":{"product_name":{"type":"string","title":"The product_name schema","default":"","examples":["Endpoint Detection and Response"]},"plugin_version":{"type":"string","title":"The plugin_version schema","default":"","examples":["1.2.0.297"]},"reboot_reasons":{"type":"integer","title":"The reboot_reasons schema","default":0,"examples":[0]}},"additionalProperties":true}},"additionalProperties":true},"engine_version":{"type":"string","title":"The engine_version schema","default":"","examples":["1.2.0.821"]},"policy_etag":{"type":"string","title":"The policy_etag schema","default":"","examples":["c6ea44914b72c92cba939ac3bd369dc4"]},"last_user":{"type":"string","title":"The last_user schema","default":"","examples":["SAHAMEDW8-1X86\\Administrator"]},"host_name":{"type":"string","title":"The host_name schema","default":"","examples":["sahamedw8-1x86"]},"machine_id":{"type":"string","title":"The machine_id schema","default":"","examples":["f2bcafe1-cb2b-4833-b6c9-6148b9511c8f"]},"machine_ip":{"type":"string","title":"The machine_ip schema","default":"","examples":["216.75.233.210"]},"object_guid":{"type":"string","title":"The object_guid schema","default":""}}},{"title":"Agent information. Included if the request includes populate 'endpoint'"}]},"machine_location":{"allOf":[{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"The root schema","description":"The root schema comprises the entire JSON document.","default":{},"examples":[{"city":"Santa Clara","continent":"North America","subdivisions":["California"],"country":"United States","country_iso":"US","accuracy_radius":10,"point":{"lat":37.3417,"lon":-121.9753},"postal_code":"95051","anonymous_proxy":false,"time_zone":"America/Los_Angeles"}],"properties":{"city":{"type":"string","title":"The city schema","default":"","examples":["Santa Clara"]},"continent":{"type":"string","title":"The continent schema","default":"","examples":["North America"]},"subdivisions":{"type":"array","title":"The subdivisions schema","default":[],"examples":[["California"]],"items":{"anyOf":[{"type":"string","title":"The first anyOf schema","default":"","examples":["California"]}]}},"country":{"type":"string","title":"The country schema","default":"","examples":["United States"]},"country_iso":{"type":"string","title":"The country_iso schema","default":"","examples":["United States"]},"accuracy_radius":{"type":"integer","title":"The accuracy_radius schema","default":0,"examples":[10]},"point":{"type":"object","title":"The point schema","default":{},"examples":[{"lat":37.3417,"lon":-121.9753}],"properties":{"lat":{"allOf":[{"bignumber":true},{"type":"number","title":"The latitude","default":0,"examples":[37.3417]}]},"lon":{"allOf":[{"bignumber":true},{"type":"number","title":"The longitude","default":0,"examples":[-121.9753]}]}}},"postal_code":{"type":"string","title":"The postal_code schema","default":"","examples":["95051"]},"anonymous_proxy":{"type":"boolean","title":"The anonymous_proxy schema","default":false,"examples":[false]},"time_zone":{"type":"string","title":"The time_zone schema","default":"","examples":["America/Los_Angeles"]}}},{"title":"Machine location. Included if the request includes populate 'endpoint'"}]},"source_location":{"allOf":[{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"The root schema","description":"The root schema comprises the entire JSON document.","default":{},"examples":[{"city":"Santa Clara","continent":"North America","subdivisions":["California"],"country":"United States","country_iso":"US","accuracy_radius":10,"point":{"lat":37.3417,"lon":-121.9753},"postal_code":"95051","anonymous_proxy":false,"time_zone":"America/Los_Angeles"}],"properties":{"city":{"type":"string","title":"The city schema","default":"","examples":["Santa Clara"]},"continent":{"type":"string","title":"The continent schema","default":"","examples":["North America"]},"subdivisions":{"type":"array","title":"The subdivisions schema","default":[],"examples":[["California"]],"items":{"anyOf":[{"type":"string","title":"The first anyOf schema","default":"","examples":["California"]}]}},"country":{"type":"string","title":"The country schema","default":"","examples":["United States"]},"country_iso":{"type":"string","title":"The country_iso schema","default":"","examples":["United States"]},"accuracy_radius":{"type":"integer","title":"The accuracy_radius schema","default":0,"examples":[10]},"point":{"type":"object","title":"The point schema","default":{},"examples":[{"lat":37.3417,"lon":-121.9753}],"properties":{"lat":{"allOf":[{"bignumber":true},{"type":"number","title":"The latitude","default":0,"examples":[37.3417]}]},"lon":{"allOf":[{"bignumber":true},{"type":"number","title":"The longitude","default":0,"examples":[-121.9753]}]}}},"postal_code":{"type":"string","title":"The postal_code schema","default":"","examples":["95051"]},"anonymous_proxy":{"type":"boolean","title":"The anonymous_proxy schema","default":false,"examples":[false]},"time_zone":{"type":"string","title":"The time_zone schema","default":"","examples":["America/Los_Angeles"]}}},{"title":"Source location for RID category"}]},"destination_location":{"allOf":[{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"The root schema","description":"The root schema comprises the entire JSON document.","default":{},"examples":[{"city":"Santa Clara","continent":"North America","subdivisions":["California"],"country":"United States","country_iso":"US","accuracy_radius":10,"point":{"lat":37.3417,"lon":-121.9753},"postal_code":"95051","anonymous_proxy":false,"time_zone":"America/Los_Angeles"}],"properties":{"city":{"type":"string","title":"The city schema","default":"","examples":["Santa Clara"]},"continent":{"type":"string","title":"The continent schema","default":"","examples":["North America"]},"subdivisions":{"type":"array","title":"The subdivisions schema","default":[],"examples":[["California"]],"items":{"anyOf":[{"type":"string","title":"The first anyOf schema","default":"","examples":["California"]}]}},"country":{"type":"string","title":"The country schema","default":"","examples":["United States"]},"country_iso":{"type":"string","title":"The country_iso schema","default":"","examples":["United States"]},"accuracy_radius":{"type":"integer","title":"The accuracy_radius schema","default":0,"examples":[10]},"point":{"type":"object","title":"The point schema","default":{},"examples":[{"lat":37.3417,"lon":-121.9753}],"properties":{"lat":{"allOf":[{"bignumber":true},{"type":"number","title":"The latitude","default":0,"examples":[37.3417]}]},"lon":{"allOf":[{"bignumber":true},{"type":"number","title":"The longitude","default":0,"examples":[-121.9753]}]}}},"postal_code":{"type":"string","title":"The postal_code schema","default":"","examples":["95051"]},"anonymous_proxy":{"type":"boolean","title":"The anonymous_proxy schema","default":false,"examples":[false]},"time_zone":{"type":"string","title":"The time_zone schema","default":"","examples":["America/Los_Angeles"]}}},{"title":"Destination location for RID category"}]},"account":{"parent":{"title":"Parent account ID","type":"string"},"name":{"title":"Account name","type":"string"},"deleted":{"title":"Account deleted","type":"boolean"},"options":{"type":"object","properties":{"msp":{"type":"object","properties":{"name":{"type":"string"}}}}}},"active_directory":{"type":"object","patternProperties":{"^(user|machine)$":{"type":"object","properties":{"display_name":{"type":"string"},"distinguished_name":{"type":"string"},"sam_account_name":{"type":"string"},"ou":{"type":"string"}}}}},"rid_details":{"type":"object","title":"Remote intrusion detection details","properties":{"rule_id":{"type":"string"},"ip":{"type":"string"},"attack_user":{"type":"string"},"protocol":{"type":"string"},"port":{"type":"integer"},"attempts":{"type":"integer"},"duration":{"type":"integer"},"create_time":{"type":"string"},"expire_time":{"type":"string"},"deleted":{"type":"boolean"},"document_id":{"type":"string"},"version":{"type":"integer"}}},"device_control":{"type":"object","title":"Device control object schema","properties":{"timestamp":{"type":"string","description":"Timestamp of the detection"},"physical_disk_name":{"type":"string","description":"Physical disk name"},"device_id":{"type":"string","description":"Device ID"},"disk_interface":{"type":"string","description":"Disk interface"},"manufacturer":{"type":"string","decription":"Manufacturer"},"serial_number":{"type":"string","description":"Serial number"},"drive_compressed":{"type":"boolean","description":"Boolean field to indicate if drive is compressed"},"file_system":{"type":"string","description":"File system"},"volume_name":{"type":"string","description":"Volume name"},"volume_serial":{"type":"string","description":"Volume serial number"},"volume_device_path":{"type":"string","description":"Volume device path"},"block_status":{"type":"string","description":"Block status"},"drive_metadata":{"type":"object","decription":"Drive metadata","additionalProperties":true},"pnp_device_id":{"type":"string","decription":"PNP device ID"},"scanned_at":{"type":"string","description":"Scanned at"}}},"scan_result":{"title":"Scan Result. Included if the request includes populate 'scan_result'","type":"object","properties":{"scan_id":{"type":"string"},"account_id":{"type":"string"},"machine_id":{"type":"string"},"reported_at":{"type":"string"},"scan_type":{"type":"string"},"started_at":{"type":"string"},"started_at_offset_seconds":{"type":"integer"},"duration":{"allOf":[{"bignumber":true},{"type":"number"}]},"found_count":{"type":"integer"},"quarantined_count":{"type":"integer"},"deleted_count":{"type":"integer"},"device":{"type":"object","title":"Device control object schema","properties":{"timestamp":{"type":"string","description":"Timestamp of the detection"},"physical_disk_name":{"type":"string","description":"Physical disk name"},"device_id":{"type":"string","description":"Device ID"},"disk_interface":{"type":"string","description":"Disk interface"},"manufacturer":{"type":"string","decription":"Manufacturer"},"serial_number":{"type":"string","description":"Serial number"},"drive_compressed":{"type":"boolean","description":"Boolean field to indicate if drive is compressed"},"file_system":{"type":"string","description":"File system"},"volume_name":{"type":"string","description":"Volume name"},"volume_serial":{"type":"string","description":"Volume serial number"},"volume_device_path":{"type":"string","description":"Volume device path"},"block_status":{"type":"string","description":"Block status"},"drive_metadata":{"type":"object","decription":"Drive metadata","additionalProperties":true},"pnp_device_id":{"type":"string","decription":"PNP device ID"},"scanned_at":{"type":"string","description":"Scanned at"}}},"metadata":{"properties":{"application_version":{"type":"string"},"components_update_package_version":{"type":"string"},"cpu":{"type":"string"},"db_sdk_update_package_version":{"type":"string"},"detection_date_time":{"type":"string"},"file_system":{"type":"string"},"files_detected":{"type":"integer"},"folders_detected":{"type":"integer"},"id":{"type":"string"},"license_state":{"type":"string"},"logged_on_user_name":{"type":"string"},"modules_detected":{"type":"integer"},"os":{"type":"string"},"processes_detected":{"type":"integer"},"registry_data_detected":{"type":"integer"},"registry_keys_detected":{"type":"integer"},"registry_values_detected":{"type":"integer"},"schema_version":{"type":"integer"},"source_details":{"properties":{"objects_scanned":{"type":"integer"},"scan_duration_secs":{"type":"integer"},"scan_options":{"properties":{"pum_handling":{"type":"string"},"pup_handling":{"type":"string"},"scan_archives":{"type":"boolean"},"scan_file_system":{"type":"boolean"},"scan_memory_objects":{"type":"boolean"},"scan_pums":{"type":"boolean"},"scan_pups":{"type":"boolean"},"scan_rootkits":{"type":"boolean"},"scan_startup_and_registry":{"type":"boolean"},"scan_type":{"type":"string"},"use_heuristics":{"type":"boolean"}}},"scan_result":{"type":"string"},"type":{"type":"string"}}},"user_admin":{"type":"boolean"}}},"schedule_id":{"type":"string"},"schedule_etag":{"type":"string"},"job_id":{"type":"string"}}}}}},"aggregations":{"type":"object","title":"Aggregations","additionalProperties":true},"total_count":{"type":"integer","title":"Total count of found detections"},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}}}}},"tags":["Detections"],"operationId":"api.v2.rmm.search.detections"}},"/oneview/v1/accounts/{account_id}/detections/submit-fp":{"post":{"description":"Submit false positive for a detection","summary":"Submit false positive","security":[{"client_credentials":["execute"]},{"user_permissions":["detections.performActions"]}],"status":{"outage":["auth","search_stateless"]},"parameters":[{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"description":"Submit Web Detection False Positive Request","type":"object","allOf":[{"description":"Submit Web Detection False Positive Request","type":"object","required":["ids"],"properties":{"ids":{"type":"array","items":{"type":"string","description":"The ID of the detection to be marked as false positive. The ID is a UUIDv4 string.","format":"uuid"}},"additional_info":{"type":"string","description":"Additional information about the false positive"},"start_date":{"type":"string","description":"The start date of the detection","format":"date-time"},"end_date":{"type":"string","description":"The end date of the detection","format":"date-time"}}},{"type":"object","required":["account_ids"],"properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]}}}},"responses":{"200":{"description":"Successful response"}},"tags":["Detections"],"operationId":"api.v2.rmm.detections.submit.fp"}},"/oneview/v1/cve/export":{"post":{"description":"Export CVE data. You can export across multiple accounts. Specify your interested fields and the output format.\n\nSupported output formats: csv, xlsx, json.\n\n## Settings\n\n| Name | Description |\n|------|-------------|\n| groups | List of queries. The constraints accepted are the same accepted by the search assets software route. Refer to [Search CVE API](#operation/api.v2.rmm.search.cve) for more information about the constraints accepted. |\n| download | If set to true, the server will set the `Content-Disposition` header using the `filename` and `format` |\n| select | Which fields to select, and which field name to map to. See request schema for allowed values |\n| type | Output encoding (for `csv` and `json` format) |\n| filename | Name of the file to be set in `Content-Disposition` header if `download` = true |\n\n## Examples\n\n### Download HTML file\n\nA request with this body sent by a browser will download a file called `nameofthefile.html`, displaying a table with columns: `Path`, `Name`, `Machine ID`, `Machine Name` for all detections on `windows` endpoints within account id `1e14cd0a-2ef3-4db3-b8a4-c89894d9aa34`:\n\n```json\n\t{\n\t\t\"groups\": [{\n \"account_id\": \"1e14cd0a-2ef3-4db3-b8a4-c89894d9aa34\",\n\t\t\t\"severity\": \"critical\"\n\t\t}],\n\t\t\"format\": \"html\",\n\t\t\"type\": \"string\",\n\t\t\"filename\": \"nameofthefile\",\n\t\t\"download\": true,\n\t\t\"select\": [\n {\"field\": \"account_id\", \"newField\": \"account_id\"},\n {\"field\": \"group_id\", \"newField\": \"groupId\"},\n {\"field\": \"vendor\", \"newField\": \"vendor\"},\n {\"field\": \"product\", \"newField\": \"product\"},\n {\"field\": \"installation_date\", \"newField\": \"installationDate\"},\n {\"field\": \"created_at\", \"newField\": \"createdAt\"}\n ]\n\t}\n```\n\n","summary":"Export CVE","security":[{"client_credentials":["execute"]},{"user_permissions":["vulnerabilities.view"]}],"status":{"outage":["auth","search_stateless"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Export request","allOf":[{"type":"object","title":"Export request","required":["groups","select","format"],"properties":{"format":{"type":"string","title":"The output file","enum":["csv","xlsx","html","ods","txt","rtf","json"]},"download":{"type":"boolean","title":"Whether to instruct the client to download the response as a file. Only clients like browsers are supported"},"type":{"type":"string","title":"The encoding of the output","enum":["string","base64","binary"],"default":"string"},"select":{"type":"array","title":"Which fields to select from the response","items":{"type":"object","title":"Field","required":["field","newField"],"properties":{"newField":{"type":"string","title":"the new value"},"field":{"type":"string","title":"The response field to map to a new value","enum":["account_id","account_name","parent_account_id","group_id","root_group_id","group_name","machine_id","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","installed_version","normalized_installed_version","display_installed_version","installation_date","host_name","fully_qualified_host_name","domain_name","alias","created_at","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","cve_id","cisa_exploitable","known_ransomware_campaign_use","severity","severity_score","published_at","description","cvss20_score","cvss30_score","latest_version_available","product_signature","architecture","language","supports_update","supports_uninstall","ignored_until","ignored_by","ignored_by_name","ignored_reason","ignored_at","active_directory.user.display_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.machine.display_name","active_directory.machine.sam_account_name","active_directory.machine.ou"]}}}},"groups":{"type":"array","title":"List of queries","items":{"type":"object","title":"Query to fetch CVEs","allOf":[{"type":"object","title":"Search assets cve request. Leading wildcards are not supported for constraint fields without '.keyword' suffix.","properties":{"account_name":{"type":"string","title":"Filter the search by account_name. Search for an exact match"},"account_name.keyword":{"type":"string","title":"Filter the search by account_name.keyword. Search for the matches that contain the value"},"not.account_name":{"type":"string","title":"Filter the search by not.account_name. Search for the matches that are not equal to the value"},"not.account_name.keyword":{"type":"string","title":"Filter the search by not.account_name.keyword. Search for the matches that do not contain the value"},"parent_account_id":{"type":"string","title":"Filter the search by parent_account_id. Search for an exact match"},"parent_account_id.keyword":{"type":"string","title":"Filter the search by parent_account_id.keyword. Search for the matches that contain the value"},"not.parent_account_id":{"type":"string","title":"Filter the search by not.parent_account_id. Search for the matches that are not equal to the value"},"not.parent_account_id.keyword":{"type":"string","title":"Filter the search by not.parent_account_id.keyword. Search for the matches that do not contain the value"},"group_id":{"type":"string","title":"Filter the search by group_id. Search for an exact match"},"group_id.keyword":{"type":"string","title":"Filter the search by group_id.keyword. Search for the matches that contain the value"},"not.group_id":{"type":"string","title":"Filter the search by not.group_id. Search for the matches that are not equal to the value"},"not.group_id.keyword":{"type":"string","title":"Filter the search by not.group_id.keyword. Search for the matches that do not contain the value"},"root_group_id":{"type":"string","title":"Filter the search by root_group_id. Search for an exact match"},"root_group_id.keyword":{"type":"string","title":"Filter the search by root_group_id.keyword. Search for the matches that contain the value"},"not.root_group_id":{"type":"string","title":"Filter the search by not.root_group_id. Search for the matches that are not equal to the value"},"not.root_group_id.keyword":{"type":"string","title":"Filter the search by not.root_group_id.keyword. Search for the matches that do not contain the value"},"group_name":{"type":"string","title":"Filter the search by group_name. Search for an exact match"},"group_name.keyword":{"type":"string","title":"Filter the search by group_name.keyword. Search for the matches that contain the value"},"not.group_name":{"type":"string","title":"Filter the search by not.group_name. Search for the matches that are not equal to the value"},"not.group_name.keyword":{"type":"string","title":"Filter the search by not.group_name.keyword. Search for the matches that do not contain the value"},"machine_id":{"type":"string","title":"Filter the search by machine_id. Search for an exact match"},"machine_id.keyword":{"type":"string","title":"Filter the search by machine_id.keyword. Search for the matches that contain the value"},"not.machine_id":{"type":"string","title":"Filter the search by not.machine_id. Search for the matches that are not equal to the value"},"not.machine_id.keyword":{"type":"string","title":"Filter the search by not.machine_id.keyword. Search for the matches that do not contain the value"},"object_guid":{"type":"string","title":"Filter the search by object_guid. Search for an exact match"},"object_guid.keyword":{"type":"string","title":"Filter the search by object_guid.keyword. Search for the matches that contain the value"},"not.object_guid":{"type":"string","title":"Filter the search by not.object_guid. Search for the matches that are not equal to the value"},"not.object_guid.keyword":{"type":"string","title":"Filter the search by not.object_guid.keyword. Search for the matches that do not contain the value"},"host_name":{"type":"string","title":"Filter the search by host_name. Search for an exact match"},"host_name.keyword":{"type":"string","title":"Filter the search by host_name.keyword. Search for the matches that contain the value"},"not.host_name":{"type":"string","title":"Filter the search by not.host_name. Search for the matches that are not equal to the value"},"not.host_name.keyword":{"type":"string","title":"Filter the search by not.host_name.keyword. Search for the matches that do not contain the value"},"fully_qualified_host_name":{"type":"string","title":"Filter the search by fully_qualified_host_name. Search for an exact match"},"fully_qualified_host_name.keyword":{"type":"string","title":"Filter the search by fully_qualified_host_name.keyword. Search for the matches that contain the value"},"not.fully_qualified_host_name":{"type":"string","title":"Filter the search by not.fully_qualified_host_name. Search for the matches that are not equal to the value"},"not.fully_qualified_host_name.keyword":{"type":"string","title":"Filter the search by not.fully_qualified_host_name.keyword. Search for the matches that do not contain the value"},"domain_name":{"type":"string","title":"Filter the search by domain_name. Search for an exact match"},"domain_name.keyword":{"type":"string","title":"Filter the search by domain_name.keyword. Search for the matches that contain the value"},"not.domain_name":{"type":"string","title":"Filter the search by not.domain_name. Search for the matches that are not equal to the value"},"not.domain_name.keyword":{"type":"string","title":"Filter the search by not.domain_name.keyword. Search for the matches that do not contain the value"},"alias":{"type":"string","title":"Filter the search by alias. Search for an exact match"},"alias.keyword":{"type":"string","title":"Filter the search by alias.keyword. Search for the matches that contain the value"},"not.alias":{"type":"string","title":"Filter the search by not.alias. Search for the matches that are not equal to the value"},"not.alias.keyword":{"type":"string","title":"Filter the search by not.alias.keyword. Search for the matches that do not contain the value"},"sort_name":{"type":"string","title":"Filter the search by sort_name. Search for an exact match"},"sort_name.keyword":{"type":"string","title":"Filter the search by sort_name.keyword. Search for the matches that contain the value"},"not.sort_name":{"type":"string","title":"Filter the search by not.sort_name. Search for the matches that are not equal to the value"},"not.sort_name.keyword":{"type":"string","title":"Filter the search by not.sort_name.keyword. Search for the matches that do not contain the value"},"vendor":{"type":"string","title":"Filter the search by vendor. Search for an exact match"},"vendor.keyword":{"type":"string","title":"Filter the search by vendor.keyword. Search for the matches that contain the value"},"not.vendor":{"type":"string","title":"Filter the search by not.vendor. Search for the matches that are not equal to the value"},"not.vendor.keyword":{"type":"string","title":"Filter the search by not.vendor.keyword. Search for the matches that do not contain the value"},"normalized_vendor":{"type":"string","title":"Filter the search by normalized_vendor. Search for an exact match"},"normalized_vendor.keyword":{"type":"string","title":"Filter the search by normalized_vendor.keyword. Search for the matches that contain the value"},"not.normalized_vendor":{"type":"string","title":"Filter the search by not.normalized_vendor. Search for the matches that are not equal to the value"},"not.normalized_vendor.keyword":{"type":"string","title":"Filter the search by not.normalized_vendor.keyword. Search for the matches that do not contain the value"},"display_vendor":{"type":"string","title":"Filter the search by display_vendor. Search for an exact match"},"display_vendor.keyword":{"type":"string","title":"Filter the search by display_vendor.keyword. Search for the matches that contain the value"},"not.display_vendor":{"type":"string","title":"Filter the search by not.display_vendor. Search for the matches that are not equal to the value"},"not.display_vendor.keyword":{"type":"string","title":"Filter the search by not.display_vendor.keyword. Search for the matches that do not contain the value"},"product":{"type":"string","title":"Filter the search by product. Search for an exact match"},"product.keyword":{"type":"string","title":"Filter the search by product.keyword. Search for the matches that contain the value"},"not.product":{"type":"string","title":"Filter the search by not.product. Search for the matches that are not equal to the value"},"not.product.keyword":{"type":"string","title":"Filter the search by not.product.keyword. Search for the matches that do not contain the value"},"normalized_product":{"type":"string","title":"Filter the search by normalized_product. Search for an exact match"},"normalized_product.keyword":{"type":"string","title":"Filter the search by normalized_product.keyword. Search for the matches that contain the value"},"not.normalized_product":{"type":"string","title":"Filter the search by not.normalized_product. Search for the matches that are not equal to the value"},"not.normalized_product.keyword":{"type":"string","title":"Filter the search by not.normalized_product.keyword. Search for the matches that do not contain the value"},"display_product":{"type":"string","title":"Filter the search by display_product. Search for an exact match"},"display_product.keyword":{"type":"string","title":"Filter the search by display_product.keyword. Search for the matches that contain the value"},"not.display_product":{"type":"string","title":"Filter the search by not.display_product. Search for the matches that are not equal to the value"},"not.display_product.keyword":{"type":"string","title":"Filter the search by not.display_product.keyword. Search for the matches that do not contain the value"},"installed_version":{"type":"string","title":"Filter the search by installed_version. Search for an exact match"},"installed_version.keyword":{"type":"string","title":"Filter the search by installed_version.keyword. Search for the matches that contain the value"},"not.installed_version":{"type":"string","title":"Filter the search by not.installed_version. Search for the matches that are not equal to the value"},"not.installed_version.keyword":{"type":"string","title":"Filter the search by not.installed_version.keyword. Search for the matches that do not contain the value"},"normalized_installed_version":{"type":"string","title":"Filter the search by normalized_installed_version. Search for an exact match"},"normalized_installed_version.keyword":{"type":"string","title":"Filter the search by normalized_installed_version.keyword. Search for the matches that contain the value"},"not.normalized_installed_version":{"type":"string","title":"Filter the search by not.normalized_installed_version. Search for the matches that are not equal to the value"},"not.normalized_installed_version.keyword":{"type":"string","title":"Filter the search by not.normalized_installed_version.keyword. Search for the matches that do not contain the value"},"display_installed_version":{"type":"string","title":"Filter the search by display_installed_version. Search for an exact match"},"display_installed_version.keyword":{"type":"string","title":"Filter the search by display_installed_version.keyword. Search for the matches that contain the value"},"not.display_installed_version":{"type":"string","title":"Filter the search by not.display_installed_version. Search for the matches that are not equal to the value"},"not.display_installed_version.keyword":{"type":"string","title":"Filter the search by not.display_installed_version.keyword. Search for the matches that do not contain the value"},"os_info.os_type":{"type":"string","title":"Filter the search by os_info.os_type. Search for an exact match"},"os_info.os_type.keyword":{"type":"string","title":"Filter the search by os_info.os_type.keyword. Search for the matches that contain the value"},"not.os_info.os_type":{"type":"string","title":"Filter the search by not.os_info.os_type. Search for the matches that are not equal to the value"},"not.os_info.os_type.keyword":{"type":"string","title":"Filter the search by not.os_info.os_type.keyword. Search for the matches that do not contain the value"},"os_info.os_version":{"type":"string","title":"Filter the search by os_info.os_version. Search for an exact match"},"os_info.os_version.keyword":{"type":"string","title":"Filter the search by os_info.os_version.keyword. Search for the matches that contain the value"},"not.os_info.os_version":{"type":"string","title":"Filter the search by not.os_info.os_version. Search for the matches that are not equal to the value"},"not.os_info.os_version.keyword":{"type":"string","title":"Filter the search by not.os_info.os_version.keyword. Search for the matches that do not contain the value"},"os_info.os_platform":{"type":"string","title":"Filter the search by os_info.os_platform. Search for an exact match"},"os_info.os_platform.keyword":{"type":"string","title":"Filter the search by os_info.os_platform.keyword. Search for the matches that contain the value"},"not.os_info.os_platform":{"type":"string","title":"Filter the search by not.os_info.os_platform. Search for the matches that are not equal to the value"},"not.os_info.os_platform.keyword":{"type":"string","title":"Filter the search by not.os_info.os_platform.keyword. Search for the matches that do not contain the value"},"os_info.os_architecture":{"type":"string","title":"Filter the search by os_info.os_architecture. Search for an exact match"},"os_info.os_architecture.keyword":{"type":"string","title":"Filter the search by os_info.os_architecture.keyword. Search for the matches that contain the value"},"not.os_info.os_architecture":{"type":"string","title":"Filter the search by not.os_info.os_architecture. Search for the matches that are not equal to the value"},"not.os_info.os_architecture.keyword":{"type":"string","title":"Filter the search by not.os_info.os_architecture.keyword. Search for the matches that do not contain the value"},"os_info.os_release_name":{"type":"string","title":"Filter the search by os_info.os_release_name. Search for an exact match"},"os_info.os_release_name.keyword":{"type":"string","title":"Filter the search by os_info.os_release_name.keyword. Search for the matches that contain the value"},"not.os_info.os_release_name":{"type":"string","title":"Filter the search by not.os_info.os_release_name. Search for the matches that are not equal to the value"},"not.os_info.os_release_name.keyword":{"type":"string","title":"Filter the search by not.os_info.os_release_name.keyword. Search for the matches that do not contain the value"},"cve_id":{"type":"string","title":"Filter the search by cve_id. Search for an exact match"},"cve_id.keyword":{"type":"string","title":"Filter the search by cve_id.keyword. Search for the matches that contain the value"},"not.cve_id":{"type":"string","title":"Filter the search by not.cve_id. Search for the matches that are not equal to the value"},"not.cve_id.keyword":{"type":"string","title":"Filter the search by not.cve_id.keyword. Search for the matches that do not contain the value"},"severity":{"type":"string","title":"Filter the search by severity. Search for an exact match"},"severity.keyword":{"type":"string","title":"Filter the search by severity.keyword. Search for the matches that contain the value"},"not.severity":{"type":"string","title":"Filter the search by not.severity. Search for the matches that are not equal to the value"},"not.severity.keyword":{"type":"string","title":"Filter the search by not.severity.keyword. Search for the matches that do not contain the value"},"document_id":{"type":"string","title":"Filter with document_id"},"document_id.keyword":{"type":"string","title":"Filter with document_id.keyword"},"not.document_id":{"type":"array","title":"Filter the search by not.document_id. Search for the matches that are not equal to the value"},"cisa_exploitable":{"type":"boolean","title":"Filter the search by cisa_exploitable. Search for an exact match"},"known_ransomware_campaign_use":{"type":"boolean","title":"Filter the search by known_ransomware_campaign_use. Search for an exact match"},"severity_score":{"type":"number","title":"Filter the search by severity_score. Search for an exact match"},"severity_score_lt":{"type":"number","title":"Filter the search by severity_score_lt. Search for the documents that are less than the value"},"severity_score_lte":{"type":"number","title":"Filter the search by severity_score_lte. Search for the documents that are less than the value"},"severity_score_gt":{"type":"number","title":"Filter the search by severity_score_gt. Search for the documents that are greater than the value"},"severity_score_gte":{"type":"number","title":"Filter the search by severity_score_gte. Search for the documents that are greater than the value"},"installation_date_before":{"type":"string","format":"date-time","title":"Filter the search by installation_date_before. Search for an exact match"},"installation_date_after":{"type":"string","format":"date-time","title":"Filter the search by installation_date_after. Search for an exact match"},"created_at_before":{"type":"string","format":"date-time","title":"Filter the search by created_at_before. Search for an exact match"},"created_at_after":{"type":"string","format":"date-time","title":"Filter the search by created_at_after. Search for an exact match"},"published_at_before":{"type":"string","format":"date-time","title":"Filter the search by published_at_before. Search for an exact match"},"published_at_after":{"type":"string","format":"date-time","title":"Filter the search by published_at_after. Search for an exact match"},"ignored_until_before":{"type":"string","format":"date-time","title":"Filter the search by ignored_until_before"},"ignored_until_after":{"type":"string","format":"date-time","title":"Filter the search by ignored_until_after"},"ignored_at_before":{"type":"string","format":"date-time","title":"Filter the search by ignored_at_before"},"ignored_at_after":{"type":"string","format":"date-time","title":"Filter the search by ignored_at_after"},"only_ignored_cves":{"type":"boolean","title":"Display only ignored CVEs. If true, the search will include only ignored CVEs. If false, the search will not include ignored CVEs. Default is false","default":false},"cvss20_score":{"type":"number","title":"Filter the search by cvss20_score. Search for an exact match of the integer value"},"cvss20_score_lt":{"type":"number","title":"Filter the search by cvss20_score_lt. Search for the documents that are less than the value"},"cvss20_score_lte":{"type":"number","title":"Filter the search by cvss20_score_lte. Search for the documents that are less or equal than the value"},"cvss20_score_gt":{"type":"number","title":"Filter the search by cvss20_score_gt. Search for the documents that are greater than the value"},"cvss20_score_gte":{"type":"number","title":"Filter the search by cvss20_score_gte. Search for the documents that are greater or equal than the value"},"cvss30_score":{"type":"number","title":"Filter the search by cvss30_score. Search for an exact match of the integer value"},"cvss30_score_lt":{"type":"number","title":"Filter the search by cvss30_score_lt. Search for the documents that are less than the value"},"cvss30_score_lte":{"type":"number","title":"Filter the search by cvss30_score_lte. Search for the documents that are less or equal than the value"},"cvss30_score_gt":{"type":"number","title":"Filter the search by cvss30_score_gt. Search for the documents that are greater than the value"},"cvss30_score_gte":{"type":"number","title":"Filter the search by cvss30_score_gte. Search for the documents that are greater or equal than the value"},"product_signature":{"type":"number","title":"Filter the search by product_signature. Search for an exact match"},"latest_version_available":{"type":"string","title":"Filter the search by latest_version_available. Search for an exact match"},"architecture":{"type":"string","title":"Filter the search by software architecture. Search for an exact match"},"language":{"type":"string","title":"Filter the search by software language. Search for an exact match"},"supports_update":{"type":"boolean","title":"Filter the search by supports_update. Search for an exact match"},"supports_uninstall":{"type":"boolean","title":"Filter the search by supports_uninstall. Search for an exact match"},"name_multi_search":{"type":"string","title":"Filter with alises"},"ignored_by":{"type":"string","title":"Filter the search by ignored_by. Search for an exact match"},"ignored_by.keyword":{"type":"string","title":"Filter the search by ignored_by.keyword. Search for the matches that contain the value"},"not.ignored_by":{"type":"string","title":"Filter the search by not.ignored_by. Search for the matches that are not equal to the value"},"not.ignored_by.keyword":{"type":"string","title":"Filter the search by not.ignored_by.keyword. Search for the matches that do not contain the value"},"exists":{"type":"array","title":"Filter the results for records that have these fields","items":{"type":"string","enum":["domain_name","product_signature","ignored_until"]}},"not.exists":{"type":"array","title":"Filter the results for records that do not have these fields","items":{"type":"string","enum":["domain_name","product_signature","ignored_until"]}},"sort_field":{"type":"string","title":"Sort field","enum":["account_id","account_name","parent_account_id","group_id","root_group_id","machine_id","object_guid","host_name","fully_qualified_host_name","alias","sort_name","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","installed_version","normalized_installed_version","display_installed_version","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","cve_id","severity","installation_date","created_at","published_at","cisa_exploitable","known_ransomware_campaign_use","severity_score","cvss20_score","cvss30_score","group_name","domain_name","supports_update","supports_uninstall","ignored_until","ignored_at","active_directory.user.display_name","active_directory.machine.display_name","active_directory.user.ou","active_directory.machine.ou","active_directory.user.sam_account_name","active_directory.machine.sam_account_name"]},"sort_order":{"type":"string","title":"Sorting direction","default":"asc","enum":["asc","desc"]},"page_size":{"type":"number","title":"The size of the page. If you only need aggregations, set it to 0","minimum":0,"default":50,"maximum":2000},"aggregations":{"type":"array","title":"The Aggregations Schema","items":{"type":"string","title":"Aggregations","default":[],"enum":["account_id","account_name","parent_account_id","group_id","root_group_id","machine_id","endpoints","object_guid","host_name","fully_qualified_host_name","alias","sort_name","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","installed_version","normalized_installed_version","display_installed_version","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","cve_id","severity","severity_score","cisa_exploitable","known_ransomware_campaign_use","cvss20_score","cvss30_score"]}},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}},"allOf":[{"type":"object","title":"Active Directory Search Filters","properties":{"active_directory.user.display_name":{"type":"string","title":"Filter the search by active_directory.user.display_name. Search for the matches that are equal to the value"},"active_directory.user.display_name.keyword":{"type":"string","title":"Filter the search by active_directory.user.display_name.keyword. Search for the matches that contain the value"},"active_directory.user.ou":{"type":"string","title":"Filter the search by active_directory.user.ou. Search for the matches that are equal to the value"},"active_directory.user.ou.keyword":{"type":"string","title":"Filter the search by active_directory.user.ou.keyword. Search for the matches that contain the value"},"active_directory.user.ou.path":{"type":"string","title":"Filter the search by active_directory.user.ou.path. Search for the matches that are equal to the value"},"active_directory.user.ou.path.keyword":{"type":"string","title":"Filter the search by active_directory.user.ou.path.keyword. Search for the matches that contain the value"},"active_directory.user.sam_account_name":{"type":"string","title":"Filter the search by active_directory.user.sam_account_name. Search for the matches that are equal to the value"},"active_directory.user.sam_account_name.keyword":{"type":"string","title":"Filter the search by active_directory.user.sam_account_name.keyword. Search for the matches that contain the value"},"active_directory.machine.display_name":{"type":"string","title":"Filter the search by active_directory.machine.display_name. Search for the matches that are equal to the value"},"active_directory.machine.display_name.keyword":{"type":"string","title":"Filter the search by active_directory.machine.display_name.keyword. Search for the matches that contain the value"},"active_directory.machine.ou":{"type":"string","title":"Filter the search by active_directory.machine.ou. Search for the matches that are equal to the value"},"active_directory.machine.ou.keyword":{"type":"string","title":"Filter the search by active_directory.machine.ou.keyword. Search for the matches that contain the value"},"active_directory.machine.ou.path":{"type":"string","title":"Filter the search by active_directory.machine.ou.path. Search for the matches that are equal to the value"},"active_directory.machine.ou.path.keyword":{"type":"string","title":"Filter the search by active_directory.machine.ou.path.keyword. Search for the matches that contain the value"},"active_directory.machine.sam_account_name":{"type":"string","title":"Filter the search by active_directory.machine.sam_account_name. Search for the matches that are equal to the value"},"active_directory.machine.sam_account_name.keyword":{"type":"string","title":"Filter the search by active_directory.machine.sam_account_name.keyword. Search for the matches that contain the value"}}}]}]}}}}],"properties":{"groups":{"type":"array","title":"List of search queries","items":{"type":"object","required":["account_ids"],"allOf":[{"type":"object","title":"Search assets cve request. Leading wildcards are not supported for constraint fields without '.keyword' suffix.","properties":{"account_name":{"type":"string","title":"Filter the search by account_name. Search for an exact match"},"account_name.keyword":{"type":"string","title":"Filter the search by account_name.keyword. Search for the matches that contain the value"},"not.account_name":{"type":"string","title":"Filter the search by not.account_name. Search for the matches that are not equal to the value"},"not.account_name.keyword":{"type":"string","title":"Filter the search by not.account_name.keyword. Search for the matches that do not contain the value"},"parent_account_id":{"type":"string","title":"Filter the search by parent_account_id. Search for an exact match"},"parent_account_id.keyword":{"type":"string","title":"Filter the search by parent_account_id.keyword. Search for the matches that contain the value"},"not.parent_account_id":{"type":"string","title":"Filter the search by not.parent_account_id. Search for the matches that are not equal to the value"},"not.parent_account_id.keyword":{"type":"string","title":"Filter the search by not.parent_account_id.keyword. Search for the matches that do not contain the value"},"group_id":{"type":"string","title":"Filter the search by group_id. Search for an exact match"},"group_id.keyword":{"type":"string","title":"Filter the search by group_id.keyword. Search for the matches that contain the value"},"not.group_id":{"type":"string","title":"Filter the search by not.group_id. Search for the matches that are not equal to the value"},"not.group_id.keyword":{"type":"string","title":"Filter the search by not.group_id.keyword. Search for the matches that do not contain the value"},"root_group_id":{"type":"string","title":"Filter the search by root_group_id. Search for an exact match"},"root_group_id.keyword":{"type":"string","title":"Filter the search by root_group_id.keyword. Search for the matches that contain the value"},"not.root_group_id":{"type":"string","title":"Filter the search by not.root_group_id. Search for the matches that are not equal to the value"},"not.root_group_id.keyword":{"type":"string","title":"Filter the search by not.root_group_id.keyword. Search for the matches that do not contain the value"},"group_name":{"type":"string","title":"Filter the search by group_name. Search for an exact match"},"group_name.keyword":{"type":"string","title":"Filter the search by group_name.keyword. Search for the matches that contain the value"},"not.group_name":{"type":"string","title":"Filter the search by not.group_name. Search for the matches that are not equal to the value"},"not.group_name.keyword":{"type":"string","title":"Filter the search by not.group_name.keyword. Search for the matches that do not contain the value"},"machine_id":{"type":"string","title":"Filter the search by machine_id. Search for an exact match"},"machine_id.keyword":{"type":"string","title":"Filter the search by machine_id.keyword. Search for the matches that contain the value"},"not.machine_id":{"type":"string","title":"Filter the search by not.machine_id. Search for the matches that are not equal to the value"},"not.machine_id.keyword":{"type":"string","title":"Filter the search by not.machine_id.keyword. Search for the matches that do not contain the value"},"object_guid":{"type":"string","title":"Filter the search by object_guid. Search for an exact match"},"object_guid.keyword":{"type":"string","title":"Filter the search by object_guid.keyword. Search for the matches that contain the value"},"not.object_guid":{"type":"string","title":"Filter the search by not.object_guid. Search for the matches that are not equal to the value"},"not.object_guid.keyword":{"type":"string","title":"Filter the search by not.object_guid.keyword. Search for the matches that do not contain the value"},"host_name":{"type":"string","title":"Filter the search by host_name. Search for an exact match"},"host_name.keyword":{"type":"string","title":"Filter the search by host_name.keyword. Search for the matches that contain the value"},"not.host_name":{"type":"string","title":"Filter the search by not.host_name. Search for the matches that are not equal to the value"},"not.host_name.keyword":{"type":"string","title":"Filter the search by not.host_name.keyword. Search for the matches that do not contain the value"},"fully_qualified_host_name":{"type":"string","title":"Filter the search by fully_qualified_host_name. Search for an exact match"},"fully_qualified_host_name.keyword":{"type":"string","title":"Filter the search by fully_qualified_host_name.keyword. Search for the matches that contain the value"},"not.fully_qualified_host_name":{"type":"string","title":"Filter the search by not.fully_qualified_host_name. Search for the matches that are not equal to the value"},"not.fully_qualified_host_name.keyword":{"type":"string","title":"Filter the search by not.fully_qualified_host_name.keyword. Search for the matches that do not contain the value"},"domain_name":{"type":"string","title":"Filter the search by domain_name. Search for an exact match"},"domain_name.keyword":{"type":"string","title":"Filter the search by domain_name.keyword. Search for the matches that contain the value"},"not.domain_name":{"type":"string","title":"Filter the search by not.domain_name. Search for the matches that are not equal to the value"},"not.domain_name.keyword":{"type":"string","title":"Filter the search by not.domain_name.keyword. Search for the matches that do not contain the value"},"alias":{"type":"string","title":"Filter the search by alias. Search for an exact match"},"alias.keyword":{"type":"string","title":"Filter the search by alias.keyword. Search for the matches that contain the value"},"not.alias":{"type":"string","title":"Filter the search by not.alias. Search for the matches that are not equal to the value"},"not.alias.keyword":{"type":"string","title":"Filter the search by not.alias.keyword. Search for the matches that do not contain the value"},"sort_name":{"type":"string","title":"Filter the search by sort_name. Search for an exact match"},"sort_name.keyword":{"type":"string","title":"Filter the search by sort_name.keyword. Search for the matches that contain the value"},"not.sort_name":{"type":"string","title":"Filter the search by not.sort_name. Search for the matches that are not equal to the value"},"not.sort_name.keyword":{"type":"string","title":"Filter the search by not.sort_name.keyword. Search for the matches that do not contain the value"},"vendor":{"type":"string","title":"Filter the search by vendor. Search for an exact match"},"vendor.keyword":{"type":"string","title":"Filter the search by vendor.keyword. Search for the matches that contain the value"},"not.vendor":{"type":"string","title":"Filter the search by not.vendor. Search for the matches that are not equal to the value"},"not.vendor.keyword":{"type":"string","title":"Filter the search by not.vendor.keyword. Search for the matches that do not contain the value"},"normalized_vendor":{"type":"string","title":"Filter the search by normalized_vendor. Search for an exact match"},"normalized_vendor.keyword":{"type":"string","title":"Filter the search by normalized_vendor.keyword. Search for the matches that contain the value"},"not.normalized_vendor":{"type":"string","title":"Filter the search by not.normalized_vendor. Search for the matches that are not equal to the value"},"not.normalized_vendor.keyword":{"type":"string","title":"Filter the search by not.normalized_vendor.keyword. Search for the matches that do not contain the value"},"display_vendor":{"type":"string","title":"Filter the search by display_vendor. Search for an exact match"},"display_vendor.keyword":{"type":"string","title":"Filter the search by display_vendor.keyword. Search for the matches that contain the value"},"not.display_vendor":{"type":"string","title":"Filter the search by not.display_vendor. Search for the matches that are not equal to the value"},"not.display_vendor.keyword":{"type":"string","title":"Filter the search by not.display_vendor.keyword. Search for the matches that do not contain the value"},"product":{"type":"string","title":"Filter the search by product. Search for an exact match"},"product.keyword":{"type":"string","title":"Filter the search by product.keyword. Search for the matches that contain the value"},"not.product":{"type":"string","title":"Filter the search by not.product. Search for the matches that are not equal to the value"},"not.product.keyword":{"type":"string","title":"Filter the search by not.product.keyword. Search for the matches that do not contain the value"},"normalized_product":{"type":"string","title":"Filter the search by normalized_product. Search for an exact match"},"normalized_product.keyword":{"type":"string","title":"Filter the search by normalized_product.keyword. Search for the matches that contain the value"},"not.normalized_product":{"type":"string","title":"Filter the search by not.normalized_product. Search for the matches that are not equal to the value"},"not.normalized_product.keyword":{"type":"string","title":"Filter the search by not.normalized_product.keyword. Search for the matches that do not contain the value"},"display_product":{"type":"string","title":"Filter the search by display_product. Search for an exact match"},"display_product.keyword":{"type":"string","title":"Filter the search by display_product.keyword. Search for the matches that contain the value"},"not.display_product":{"type":"string","title":"Filter the search by not.display_product. Search for the matches that are not equal to the value"},"not.display_product.keyword":{"type":"string","title":"Filter the search by not.display_product.keyword. Search for the matches that do not contain the value"},"installed_version":{"type":"string","title":"Filter the search by installed_version. Search for an exact match"},"installed_version.keyword":{"type":"string","title":"Filter the search by installed_version.keyword. Search for the matches that contain the value"},"not.installed_version":{"type":"string","title":"Filter the search by not.installed_version. Search for the matches that are not equal to the value"},"not.installed_version.keyword":{"type":"string","title":"Filter the search by not.installed_version.keyword. Search for the matches that do not contain the value"},"normalized_installed_version":{"type":"string","title":"Filter the search by normalized_installed_version. Search for an exact match"},"normalized_installed_version.keyword":{"type":"string","title":"Filter the search by normalized_installed_version.keyword. Search for the matches that contain the value"},"not.normalized_installed_version":{"type":"string","title":"Filter the search by not.normalized_installed_version. Search for the matches that are not equal to the value"},"not.normalized_installed_version.keyword":{"type":"string","title":"Filter the search by not.normalized_installed_version.keyword. Search for the matches that do not contain the value"},"display_installed_version":{"type":"string","title":"Filter the search by display_installed_version. Search for an exact match"},"display_installed_version.keyword":{"type":"string","title":"Filter the search by display_installed_version.keyword. Search for the matches that contain the value"},"not.display_installed_version":{"type":"string","title":"Filter the search by not.display_installed_version. Search for the matches that are not equal to the value"},"not.display_installed_version.keyword":{"type":"string","title":"Filter the search by not.display_installed_version.keyword. Search for the matches that do not contain the value"},"os_info.os_type":{"type":"string","title":"Filter the search by os_info.os_type. Search for an exact match"},"os_info.os_type.keyword":{"type":"string","title":"Filter the search by os_info.os_type.keyword. Search for the matches that contain the value"},"not.os_info.os_type":{"type":"string","title":"Filter the search by not.os_info.os_type. Search for the matches that are not equal to the value"},"not.os_info.os_type.keyword":{"type":"string","title":"Filter the search by not.os_info.os_type.keyword. Search for the matches that do not contain the value"},"os_info.os_version":{"type":"string","title":"Filter the search by os_info.os_version. Search for an exact match"},"os_info.os_version.keyword":{"type":"string","title":"Filter the search by os_info.os_version.keyword. Search for the matches that contain the value"},"not.os_info.os_version":{"type":"string","title":"Filter the search by not.os_info.os_version. Search for the matches that are not equal to the value"},"not.os_info.os_version.keyword":{"type":"string","title":"Filter the search by not.os_info.os_version.keyword. Search for the matches that do not contain the value"},"os_info.os_platform":{"type":"string","title":"Filter the search by os_info.os_platform. Search for an exact match"},"os_info.os_platform.keyword":{"type":"string","title":"Filter the search by os_info.os_platform.keyword. Search for the matches that contain the value"},"not.os_info.os_platform":{"type":"string","title":"Filter the search by not.os_info.os_platform. Search for the matches that are not equal to the value"},"not.os_info.os_platform.keyword":{"type":"string","title":"Filter the search by not.os_info.os_platform.keyword. Search for the matches that do not contain the value"},"os_info.os_architecture":{"type":"string","title":"Filter the search by os_info.os_architecture. Search for an exact match"},"os_info.os_architecture.keyword":{"type":"string","title":"Filter the search by os_info.os_architecture.keyword. Search for the matches that contain the value"},"not.os_info.os_architecture":{"type":"string","title":"Filter the search by not.os_info.os_architecture. Search for the matches that are not equal to the value"},"not.os_info.os_architecture.keyword":{"type":"string","title":"Filter the search by not.os_info.os_architecture.keyword. Search for the matches that do not contain the value"},"os_info.os_release_name":{"type":"string","title":"Filter the search by os_info.os_release_name. Search for an exact match"},"os_info.os_release_name.keyword":{"type":"string","title":"Filter the search by os_info.os_release_name.keyword. Search for the matches that contain the value"},"not.os_info.os_release_name":{"type":"string","title":"Filter the search by not.os_info.os_release_name. Search for the matches that are not equal to the value"},"not.os_info.os_release_name.keyword":{"type":"string","title":"Filter the search by not.os_info.os_release_name.keyword. Search for the matches that do not contain the value"},"cve_id":{"type":"string","title":"Filter the search by cve_id. Search for an exact match"},"cve_id.keyword":{"type":"string","title":"Filter the search by cve_id.keyword. Search for the matches that contain the value"},"not.cve_id":{"type":"string","title":"Filter the search by not.cve_id. Search for the matches that are not equal to the value"},"not.cve_id.keyword":{"type":"string","title":"Filter the search by not.cve_id.keyword. Search for the matches that do not contain the value"},"severity":{"type":"string","title":"Filter the search by severity. Search for an exact match"},"severity.keyword":{"type":"string","title":"Filter the search by severity.keyword. Search for the matches that contain the value"},"not.severity":{"type":"string","title":"Filter the search by not.severity. Search for the matches that are not equal to the value"},"not.severity.keyword":{"type":"string","title":"Filter the search by not.severity.keyword. Search for the matches that do not contain the value"},"document_id":{"type":"string","title":"Filter with document_id"},"document_id.keyword":{"type":"string","title":"Filter with document_id.keyword"},"not.document_id":{"type":"array","title":"Filter the search by not.document_id. Search for the matches that are not equal to the value"},"cisa_exploitable":{"type":"boolean","title":"Filter the search by cisa_exploitable. Search for an exact match"},"known_ransomware_campaign_use":{"type":"boolean","title":"Filter the search by known_ransomware_campaign_use. Search for an exact match"},"severity_score":{"type":"number","title":"Filter the search by severity_score. Search for an exact match"},"severity_score_lt":{"type":"number","title":"Filter the search by severity_score_lt. Search for the documents that are less than the value"},"severity_score_lte":{"type":"number","title":"Filter the search by severity_score_lte. Search for the documents that are less than the value"},"severity_score_gt":{"type":"number","title":"Filter the search by severity_score_gt. Search for the documents that are greater than the value"},"severity_score_gte":{"type":"number","title":"Filter the search by severity_score_gte. Search for the documents that are greater than the value"},"installation_date_before":{"type":"string","format":"date-time","title":"Filter the search by installation_date_before. Search for an exact match"},"installation_date_after":{"type":"string","format":"date-time","title":"Filter the search by installation_date_after. Search for an exact match"},"created_at_before":{"type":"string","format":"date-time","title":"Filter the search by created_at_before. Search for an exact match"},"created_at_after":{"type":"string","format":"date-time","title":"Filter the search by created_at_after. Search for an exact match"},"published_at_before":{"type":"string","format":"date-time","title":"Filter the search by published_at_before. Search for an exact match"},"published_at_after":{"type":"string","format":"date-time","title":"Filter the search by published_at_after. Search for an exact match"},"ignored_until_before":{"type":"string","format":"date-time","title":"Filter the search by ignored_until_before"},"ignored_until_after":{"type":"string","format":"date-time","title":"Filter the search by ignored_until_after"},"ignored_at_before":{"type":"string","format":"date-time","title":"Filter the search by ignored_at_before"},"ignored_at_after":{"type":"string","format":"date-time","title":"Filter the search by ignored_at_after"},"only_ignored_cves":{"type":"boolean","title":"Display only ignored CVEs. If true, the search will include only ignored CVEs. If false, the search will not include ignored CVEs. Default is false","default":false},"cvss20_score":{"type":"number","title":"Filter the search by cvss20_score. Search for an exact match of the integer value"},"cvss20_score_lt":{"type":"number","title":"Filter the search by cvss20_score_lt. Search for the documents that are less than the value"},"cvss20_score_lte":{"type":"number","title":"Filter the search by cvss20_score_lte. Search for the documents that are less or equal than the value"},"cvss20_score_gt":{"type":"number","title":"Filter the search by cvss20_score_gt. Search for the documents that are greater than the value"},"cvss20_score_gte":{"type":"number","title":"Filter the search by cvss20_score_gte. Search for the documents that are greater or equal than the value"},"cvss30_score":{"type":"number","title":"Filter the search by cvss30_score. Search for an exact match of the integer value"},"cvss30_score_lt":{"type":"number","title":"Filter the search by cvss30_score_lt. Search for the documents that are less than the value"},"cvss30_score_lte":{"type":"number","title":"Filter the search by cvss30_score_lte. Search for the documents that are less or equal than the value"},"cvss30_score_gt":{"type":"number","title":"Filter the search by cvss30_score_gt. Search for the documents that are greater than the value"},"cvss30_score_gte":{"type":"number","title":"Filter the search by cvss30_score_gte. Search for the documents that are greater or equal than the value"},"product_signature":{"type":"number","title":"Filter the search by product_signature. Search for an exact match"},"latest_version_available":{"type":"string","title":"Filter the search by latest_version_available. Search for an exact match"},"architecture":{"type":"string","title":"Filter the search by software architecture. Search for an exact match"},"language":{"type":"string","title":"Filter the search by software language. Search for an exact match"},"supports_update":{"type":"boolean","title":"Filter the search by supports_update. Search for an exact match"},"supports_uninstall":{"type":"boolean","title":"Filter the search by supports_uninstall. Search for an exact match"},"name_multi_search":{"type":"string","title":"Filter with alises"},"ignored_by":{"type":"string","title":"Filter the search by ignored_by. Search for an exact match"},"ignored_by.keyword":{"type":"string","title":"Filter the search by ignored_by.keyword. Search for the matches that contain the value"},"not.ignored_by":{"type":"string","title":"Filter the search by not.ignored_by. Search for the matches that are not equal to the value"},"not.ignored_by.keyword":{"type":"string","title":"Filter the search by not.ignored_by.keyword. Search for the matches that do not contain the value"},"exists":{"type":"array","title":"Filter the results for records that have these fields","items":{"type":"string","enum":["domain_name","product_signature","ignored_until"]}},"not.exists":{"type":"array","title":"Filter the results for records that do not have these fields","items":{"type":"string","enum":["domain_name","product_signature","ignored_until"]}},"sort_field":{"type":"string","title":"Sort field","enum":["account_id","account_name","parent_account_id","group_id","root_group_id","machine_id","object_guid","host_name","fully_qualified_host_name","alias","sort_name","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","installed_version","normalized_installed_version","display_installed_version","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","cve_id","severity","installation_date","created_at","published_at","cisa_exploitable","known_ransomware_campaign_use","severity_score","cvss20_score","cvss30_score","group_name","domain_name","supports_update","supports_uninstall","ignored_until","ignored_at","active_directory.user.display_name","active_directory.machine.display_name","active_directory.user.ou","active_directory.machine.ou","active_directory.user.sam_account_name","active_directory.machine.sam_account_name"]},"sort_order":{"type":"string","title":"Sorting direction","default":"asc","enum":["asc","desc"]},"page_size":{"type":"number","title":"The size of the page. If you only need aggregations, set it to 0","minimum":0,"default":50,"maximum":2000},"aggregations":{"type":"array","title":"The Aggregations Schema","items":{"type":"string","title":"Aggregations","default":[],"enum":["account_id","account_name","parent_account_id","group_id","root_group_id","machine_id","endpoints","object_guid","host_name","fully_qualified_host_name","alias","sort_name","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","installed_version","normalized_installed_version","display_installed_version","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","cve_id","severity","severity_score","cisa_exploitable","known_ransomware_campaign_use","cvss20_score","cvss30_score"]}},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}},"allOf":[{"type":"object","title":"Active Directory Search Filters","properties":{"active_directory.user.display_name":{"type":"string","title":"Filter the search by active_directory.user.display_name. Search for the matches that are equal to the value"},"active_directory.user.display_name.keyword":{"type":"string","title":"Filter the search by active_directory.user.display_name.keyword. Search for the matches that contain the value"},"active_directory.user.ou":{"type":"string","title":"Filter the search by active_directory.user.ou. Search for the matches that are equal to the value"},"active_directory.user.ou.keyword":{"type":"string","title":"Filter the search by active_directory.user.ou.keyword. Search for the matches that contain the value"},"active_directory.user.ou.path":{"type":"string","title":"Filter the search by active_directory.user.ou.path. Search for the matches that are equal to the value"},"active_directory.user.ou.path.keyword":{"type":"string","title":"Filter the search by active_directory.user.ou.path.keyword. Search for the matches that contain the value"},"active_directory.user.sam_account_name":{"type":"string","title":"Filter the search by active_directory.user.sam_account_name. Search for the matches that are equal to the value"},"active_directory.user.sam_account_name.keyword":{"type":"string","title":"Filter the search by active_directory.user.sam_account_name.keyword. Search for the matches that contain the value"},"active_directory.machine.display_name":{"type":"string","title":"Filter the search by active_directory.machine.display_name. Search for the matches that are equal to the value"},"active_directory.machine.display_name.keyword":{"type":"string","title":"Filter the search by active_directory.machine.display_name.keyword. Search for the matches that contain the value"},"active_directory.machine.ou":{"type":"string","title":"Filter the search by active_directory.machine.ou. Search for the matches that are equal to the value"},"active_directory.machine.ou.keyword":{"type":"string","title":"Filter the search by active_directory.machine.ou.keyword. Search for the matches that contain the value"},"active_directory.machine.ou.path":{"type":"string","title":"Filter the search by active_directory.machine.ou.path. Search for the matches that are equal to the value"},"active_directory.machine.ou.path.keyword":{"type":"string","title":"Filter the search by active_directory.machine.ou.path.keyword. Search for the matches that contain the value"},"active_directory.machine.sam_account_name":{"type":"string","title":"Filter the search by active_directory.machine.sam_account_name. Search for the matches that are equal to the value"},"active_directory.machine.sam_account_name.keyword":{"type":"string","title":"Filter the search by active_directory.machine.sam_account_name.keyword. Search for the matches that contain the value"}}}]},{"type":"object","required":["account_ids"],"properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]}}}}}}},"responses":{"200":{"description":"Successful response"}},"tags":["Vulnerability Management"],"operationId":"api.v2.rmm.post.export.cve"}},"/oneview/v1/cve/export/async":{"post":{"description":"Export CVE asynchronously","summary":"Export CVE asynchronously","security":[{"client_credentials":["execute"]},{"user_permissions":["vulnerabilities.view"]}],"status":{"outage":["auth","search_stateless"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Export request","allOf":[{"type":"object","title":"Export request","required":["groups","select","format"],"properties":{"format":{"type":"string","title":"The output file","enum":["csv","xlsx","html","ods","txt","rtf","json"]},"download":{"type":"boolean","title":"Whether to instruct the client to download the response as a file. Only clients like browsers are supported"},"type":{"type":"string","title":"The encoding of the output","enum":["string","base64","binary"],"default":"string"},"select":{"type":"array","title":"Which fields to select from the response","items":{"type":"object","title":"Field","required":["field","newField"],"properties":{"newField":{"type":"string","title":"the new value"},"field":{"type":"string","title":"The response field to map to a new value","enum":["account_id","account_name","parent_account_id","group_id","root_group_id","group_name","machine_id","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","installed_version","normalized_installed_version","display_installed_version","installation_date","host_name","fully_qualified_host_name","domain_name","alias","created_at","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","cve_id","cisa_exploitable","known_ransomware_campaign_use","severity","severity_score","published_at","description","cvss20_score","cvss30_score","latest_version_available","product_signature","architecture","language","supports_update","supports_uninstall","ignored_until","ignored_by","ignored_by_name","ignored_reason","ignored_at","active_directory.user.display_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.machine.display_name","active_directory.machine.sam_account_name","active_directory.machine.ou"]}}}},"groups":{"type":"array","title":"List of queries","items":{"type":"object","title":"Query to fetch CVEs","allOf":[{"type":"object","title":"Search assets cve request. Leading wildcards are not supported for constraint fields without '.keyword' suffix.","properties":{"account_name":{"type":"string","title":"Filter the search by account_name. Search for an exact match"},"account_name.keyword":{"type":"string","title":"Filter the search by account_name.keyword. Search for the matches that contain the value"},"not.account_name":{"type":"string","title":"Filter the search by not.account_name. Search for the matches that are not equal to the value"},"not.account_name.keyword":{"type":"string","title":"Filter the search by not.account_name.keyword. Search for the matches that do not contain the value"},"parent_account_id":{"type":"string","title":"Filter the search by parent_account_id. Search for an exact match"},"parent_account_id.keyword":{"type":"string","title":"Filter the search by parent_account_id.keyword. Search for the matches that contain the value"},"not.parent_account_id":{"type":"string","title":"Filter the search by not.parent_account_id. Search for the matches that are not equal to the value"},"not.parent_account_id.keyword":{"type":"string","title":"Filter the search by not.parent_account_id.keyword. Search for the matches that do not contain the value"},"group_id":{"type":"string","title":"Filter the search by group_id. Search for an exact match"},"group_id.keyword":{"type":"string","title":"Filter the search by group_id.keyword. Search for the matches that contain the value"},"not.group_id":{"type":"string","title":"Filter the search by not.group_id. Search for the matches that are not equal to the value"},"not.group_id.keyword":{"type":"string","title":"Filter the search by not.group_id.keyword. Search for the matches that do not contain the value"},"root_group_id":{"type":"string","title":"Filter the search by root_group_id. Search for an exact match"},"root_group_id.keyword":{"type":"string","title":"Filter the search by root_group_id.keyword. Search for the matches that contain the value"},"not.root_group_id":{"type":"string","title":"Filter the search by not.root_group_id. Search for the matches that are not equal to the value"},"not.root_group_id.keyword":{"type":"string","title":"Filter the search by not.root_group_id.keyword. Search for the matches that do not contain the value"},"group_name":{"type":"string","title":"Filter the search by group_name. Search for an exact match"},"group_name.keyword":{"type":"string","title":"Filter the search by group_name.keyword. Search for the matches that contain the value"},"not.group_name":{"type":"string","title":"Filter the search by not.group_name. Search for the matches that are not equal to the value"},"not.group_name.keyword":{"type":"string","title":"Filter the search by not.group_name.keyword. Search for the matches that do not contain the value"},"machine_id":{"type":"string","title":"Filter the search by machine_id. Search for an exact match"},"machine_id.keyword":{"type":"string","title":"Filter the search by machine_id.keyword. Search for the matches that contain the value"},"not.machine_id":{"type":"string","title":"Filter the search by not.machine_id. Search for the matches that are not equal to the value"},"not.machine_id.keyword":{"type":"string","title":"Filter the search by not.machine_id.keyword. Search for the matches that do not contain the value"},"object_guid":{"type":"string","title":"Filter the search by object_guid. Search for an exact match"},"object_guid.keyword":{"type":"string","title":"Filter the search by object_guid.keyword. Search for the matches that contain the value"},"not.object_guid":{"type":"string","title":"Filter the search by not.object_guid. Search for the matches that are not equal to the value"},"not.object_guid.keyword":{"type":"string","title":"Filter the search by not.object_guid.keyword. Search for the matches that do not contain the value"},"host_name":{"type":"string","title":"Filter the search by host_name. Search for an exact match"},"host_name.keyword":{"type":"string","title":"Filter the search by host_name.keyword. Search for the matches that contain the value"},"not.host_name":{"type":"string","title":"Filter the search by not.host_name. Search for the matches that are not equal to the value"},"not.host_name.keyword":{"type":"string","title":"Filter the search by not.host_name.keyword. Search for the matches that do not contain the value"},"fully_qualified_host_name":{"type":"string","title":"Filter the search by fully_qualified_host_name. Search for an exact match"},"fully_qualified_host_name.keyword":{"type":"string","title":"Filter the search by fully_qualified_host_name.keyword. Search for the matches that contain the value"},"not.fully_qualified_host_name":{"type":"string","title":"Filter the search by not.fully_qualified_host_name. Search for the matches that are not equal to the value"},"not.fully_qualified_host_name.keyword":{"type":"string","title":"Filter the search by not.fully_qualified_host_name.keyword. Search for the matches that do not contain the value"},"domain_name":{"type":"string","title":"Filter the search by domain_name. Search for an exact match"},"domain_name.keyword":{"type":"string","title":"Filter the search by domain_name.keyword. Search for the matches that contain the value"},"not.domain_name":{"type":"string","title":"Filter the search by not.domain_name. Search for the matches that are not equal to the value"},"not.domain_name.keyword":{"type":"string","title":"Filter the search by not.domain_name.keyword. Search for the matches that do not contain the value"},"alias":{"type":"string","title":"Filter the search by alias. Search for an exact match"},"alias.keyword":{"type":"string","title":"Filter the search by alias.keyword. Search for the matches that contain the value"},"not.alias":{"type":"string","title":"Filter the search by not.alias. Search for the matches that are not equal to the value"},"not.alias.keyword":{"type":"string","title":"Filter the search by not.alias.keyword. Search for the matches that do not contain the value"},"sort_name":{"type":"string","title":"Filter the search by sort_name. Search for an exact match"},"sort_name.keyword":{"type":"string","title":"Filter the search by sort_name.keyword. Search for the matches that contain the value"},"not.sort_name":{"type":"string","title":"Filter the search by not.sort_name. Search for the matches that are not equal to the value"},"not.sort_name.keyword":{"type":"string","title":"Filter the search by not.sort_name.keyword. Search for the matches that do not contain the value"},"vendor":{"type":"string","title":"Filter the search by vendor. Search for an exact match"},"vendor.keyword":{"type":"string","title":"Filter the search by vendor.keyword. Search for the matches that contain the value"},"not.vendor":{"type":"string","title":"Filter the search by not.vendor. Search for the matches that are not equal to the value"},"not.vendor.keyword":{"type":"string","title":"Filter the search by not.vendor.keyword. Search for the matches that do not contain the value"},"normalized_vendor":{"type":"string","title":"Filter the search by normalized_vendor. Search for an exact match"},"normalized_vendor.keyword":{"type":"string","title":"Filter the search by normalized_vendor.keyword. Search for the matches that contain the value"},"not.normalized_vendor":{"type":"string","title":"Filter the search by not.normalized_vendor. Search for the matches that are not equal to the value"},"not.normalized_vendor.keyword":{"type":"string","title":"Filter the search by not.normalized_vendor.keyword. Search for the matches that do not contain the value"},"display_vendor":{"type":"string","title":"Filter the search by display_vendor. Search for an exact match"},"display_vendor.keyword":{"type":"string","title":"Filter the search by display_vendor.keyword. Search for the matches that contain the value"},"not.display_vendor":{"type":"string","title":"Filter the search by not.display_vendor. Search for the matches that are not equal to the value"},"not.display_vendor.keyword":{"type":"string","title":"Filter the search by not.display_vendor.keyword. Search for the matches that do not contain the value"},"product":{"type":"string","title":"Filter the search by product. Search for an exact match"},"product.keyword":{"type":"string","title":"Filter the search by product.keyword. Search for the matches that contain the value"},"not.product":{"type":"string","title":"Filter the search by not.product. Search for the matches that are not equal to the value"},"not.product.keyword":{"type":"string","title":"Filter the search by not.product.keyword. Search for the matches that do not contain the value"},"normalized_product":{"type":"string","title":"Filter the search by normalized_product. Search for an exact match"},"normalized_product.keyword":{"type":"string","title":"Filter the search by normalized_product.keyword. Search for the matches that contain the value"},"not.normalized_product":{"type":"string","title":"Filter the search by not.normalized_product. Search for the matches that are not equal to the value"},"not.normalized_product.keyword":{"type":"string","title":"Filter the search by not.normalized_product.keyword. Search for the matches that do not contain the value"},"display_product":{"type":"string","title":"Filter the search by display_product. Search for an exact match"},"display_product.keyword":{"type":"string","title":"Filter the search by display_product.keyword. Search for the matches that contain the value"},"not.display_product":{"type":"string","title":"Filter the search by not.display_product. Search for the matches that are not equal to the value"},"not.display_product.keyword":{"type":"string","title":"Filter the search by not.display_product.keyword. Search for the matches that do not contain the value"},"installed_version":{"type":"string","title":"Filter the search by installed_version. Search for an exact match"},"installed_version.keyword":{"type":"string","title":"Filter the search by installed_version.keyword. Search for the matches that contain the value"},"not.installed_version":{"type":"string","title":"Filter the search by not.installed_version. Search for the matches that are not equal to the value"},"not.installed_version.keyword":{"type":"string","title":"Filter the search by not.installed_version.keyword. Search for the matches that do not contain the value"},"normalized_installed_version":{"type":"string","title":"Filter the search by normalized_installed_version. Search for an exact match"},"normalized_installed_version.keyword":{"type":"string","title":"Filter the search by normalized_installed_version.keyword. Search for the matches that contain the value"},"not.normalized_installed_version":{"type":"string","title":"Filter the search by not.normalized_installed_version. Search for the matches that are not equal to the value"},"not.normalized_installed_version.keyword":{"type":"string","title":"Filter the search by not.normalized_installed_version.keyword. Search for the matches that do not contain the value"},"display_installed_version":{"type":"string","title":"Filter the search by display_installed_version. Search for an exact match"},"display_installed_version.keyword":{"type":"string","title":"Filter the search by display_installed_version.keyword. Search for the matches that contain the value"},"not.display_installed_version":{"type":"string","title":"Filter the search by not.display_installed_version. Search for the matches that are not equal to the value"},"not.display_installed_version.keyword":{"type":"string","title":"Filter the search by not.display_installed_version.keyword. Search for the matches that do not contain the value"},"os_info.os_type":{"type":"string","title":"Filter the search by os_info.os_type. Search for an exact match"},"os_info.os_type.keyword":{"type":"string","title":"Filter the search by os_info.os_type.keyword. Search for the matches that contain the value"},"not.os_info.os_type":{"type":"string","title":"Filter the search by not.os_info.os_type. Search for the matches that are not equal to the value"},"not.os_info.os_type.keyword":{"type":"string","title":"Filter the search by not.os_info.os_type.keyword. Search for the matches that do not contain the value"},"os_info.os_version":{"type":"string","title":"Filter the search by os_info.os_version. Search for an exact match"},"os_info.os_version.keyword":{"type":"string","title":"Filter the search by os_info.os_version.keyword. Search for the matches that contain the value"},"not.os_info.os_version":{"type":"string","title":"Filter the search by not.os_info.os_version. Search for the matches that are not equal to the value"},"not.os_info.os_version.keyword":{"type":"string","title":"Filter the search by not.os_info.os_version.keyword. Search for the matches that do not contain the value"},"os_info.os_platform":{"type":"string","title":"Filter the search by os_info.os_platform. Search for an exact match"},"os_info.os_platform.keyword":{"type":"string","title":"Filter the search by os_info.os_platform.keyword. Search for the matches that contain the value"},"not.os_info.os_platform":{"type":"string","title":"Filter the search by not.os_info.os_platform. Search for the matches that are not equal to the value"},"not.os_info.os_platform.keyword":{"type":"string","title":"Filter the search by not.os_info.os_platform.keyword. Search for the matches that do not contain the value"},"os_info.os_architecture":{"type":"string","title":"Filter the search by os_info.os_architecture. Search for an exact match"},"os_info.os_architecture.keyword":{"type":"string","title":"Filter the search by os_info.os_architecture.keyword. Search for the matches that contain the value"},"not.os_info.os_architecture":{"type":"string","title":"Filter the search by not.os_info.os_architecture. Search for the matches that are not equal to the value"},"not.os_info.os_architecture.keyword":{"type":"string","title":"Filter the search by not.os_info.os_architecture.keyword. Search for the matches that do not contain the value"},"os_info.os_release_name":{"type":"string","title":"Filter the search by os_info.os_release_name. Search for an exact match"},"os_info.os_release_name.keyword":{"type":"string","title":"Filter the search by os_info.os_release_name.keyword. Search for the matches that contain the value"},"not.os_info.os_release_name":{"type":"string","title":"Filter the search by not.os_info.os_release_name. Search for the matches that are not equal to the value"},"not.os_info.os_release_name.keyword":{"type":"string","title":"Filter the search by not.os_info.os_release_name.keyword. Search for the matches that do not contain the value"},"cve_id":{"type":"string","title":"Filter the search by cve_id. Search for an exact match"},"cve_id.keyword":{"type":"string","title":"Filter the search by cve_id.keyword. Search for the matches that contain the value"},"not.cve_id":{"type":"string","title":"Filter the search by not.cve_id. Search for the matches that are not equal to the value"},"not.cve_id.keyword":{"type":"string","title":"Filter the search by not.cve_id.keyword. Search for the matches that do not contain the value"},"severity":{"type":"string","title":"Filter the search by severity. Search for an exact match"},"severity.keyword":{"type":"string","title":"Filter the search by severity.keyword. Search for the matches that contain the value"},"not.severity":{"type":"string","title":"Filter the search by not.severity. Search for the matches that are not equal to the value"},"not.severity.keyword":{"type":"string","title":"Filter the search by not.severity.keyword. Search for the matches that do not contain the value"},"document_id":{"type":"string","title":"Filter with document_id"},"document_id.keyword":{"type":"string","title":"Filter with document_id.keyword"},"not.document_id":{"type":"array","title":"Filter the search by not.document_id. Search for the matches that are not equal to the value"},"cisa_exploitable":{"type":"boolean","title":"Filter the search by cisa_exploitable. Search for an exact match"},"known_ransomware_campaign_use":{"type":"boolean","title":"Filter the search by known_ransomware_campaign_use. Search for an exact match"},"severity_score":{"type":"number","title":"Filter the search by severity_score. Search for an exact match"},"severity_score_lt":{"type":"number","title":"Filter the search by severity_score_lt. Search for the documents that are less than the value"},"severity_score_lte":{"type":"number","title":"Filter the search by severity_score_lte. Search for the documents that are less than the value"},"severity_score_gt":{"type":"number","title":"Filter the search by severity_score_gt. Search for the documents that are greater than the value"},"severity_score_gte":{"type":"number","title":"Filter the search by severity_score_gte. Search for the documents that are greater than the value"},"installation_date_before":{"type":"string","format":"date-time","title":"Filter the search by installation_date_before. Search for an exact match"},"installation_date_after":{"type":"string","format":"date-time","title":"Filter the search by installation_date_after. Search for an exact match"},"created_at_before":{"type":"string","format":"date-time","title":"Filter the search by created_at_before. Search for an exact match"},"created_at_after":{"type":"string","format":"date-time","title":"Filter the search by created_at_after. Search for an exact match"},"published_at_before":{"type":"string","format":"date-time","title":"Filter the search by published_at_before. Search for an exact match"},"published_at_after":{"type":"string","format":"date-time","title":"Filter the search by published_at_after. Search for an exact match"},"ignored_until_before":{"type":"string","format":"date-time","title":"Filter the search by ignored_until_before"},"ignored_until_after":{"type":"string","format":"date-time","title":"Filter the search by ignored_until_after"},"ignored_at_before":{"type":"string","format":"date-time","title":"Filter the search by ignored_at_before"},"ignored_at_after":{"type":"string","format":"date-time","title":"Filter the search by ignored_at_after"},"only_ignored_cves":{"type":"boolean","title":"Display only ignored CVEs. If true, the search will include only ignored CVEs. If false, the search will not include ignored CVEs. Default is false","default":false},"cvss20_score":{"type":"number","title":"Filter the search by cvss20_score. Search for an exact match of the integer value"},"cvss20_score_lt":{"type":"number","title":"Filter the search by cvss20_score_lt. Search for the documents that are less than the value"},"cvss20_score_lte":{"type":"number","title":"Filter the search by cvss20_score_lte. Search for the documents that are less or equal than the value"},"cvss20_score_gt":{"type":"number","title":"Filter the search by cvss20_score_gt. Search for the documents that are greater than the value"},"cvss20_score_gte":{"type":"number","title":"Filter the search by cvss20_score_gte. Search for the documents that are greater or equal than the value"},"cvss30_score":{"type":"number","title":"Filter the search by cvss30_score. Search for an exact match of the integer value"},"cvss30_score_lt":{"type":"number","title":"Filter the search by cvss30_score_lt. Search for the documents that are less than the value"},"cvss30_score_lte":{"type":"number","title":"Filter the search by cvss30_score_lte. Search for the documents that are less or equal than the value"},"cvss30_score_gt":{"type":"number","title":"Filter the search by cvss30_score_gt. Search for the documents that are greater than the value"},"cvss30_score_gte":{"type":"number","title":"Filter the search by cvss30_score_gte. Search for the documents that are greater or equal than the value"},"product_signature":{"type":"number","title":"Filter the search by product_signature. Search for an exact match"},"latest_version_available":{"type":"string","title":"Filter the search by latest_version_available. Search for an exact match"},"architecture":{"type":"string","title":"Filter the search by software architecture. Search for an exact match"},"language":{"type":"string","title":"Filter the search by software language. Search for an exact match"},"supports_update":{"type":"boolean","title":"Filter the search by supports_update. Search for an exact match"},"supports_uninstall":{"type":"boolean","title":"Filter the search by supports_uninstall. Search for an exact match"},"name_multi_search":{"type":"string","title":"Filter with alises"},"ignored_by":{"type":"string","title":"Filter the search by ignored_by. Search for an exact match"},"ignored_by.keyword":{"type":"string","title":"Filter the search by ignored_by.keyword. Search for the matches that contain the value"},"not.ignored_by":{"type":"string","title":"Filter the search by not.ignored_by. Search for the matches that are not equal to the value"},"not.ignored_by.keyword":{"type":"string","title":"Filter the search by not.ignored_by.keyword. Search for the matches that do not contain the value"},"exists":{"type":"array","title":"Filter the results for records that have these fields","items":{"type":"string","enum":["domain_name","product_signature","ignored_until"]}},"not.exists":{"type":"array","title":"Filter the results for records that do not have these fields","items":{"type":"string","enum":["domain_name","product_signature","ignored_until"]}},"sort_field":{"type":"string","title":"Sort field","enum":["account_id","account_name","parent_account_id","group_id","root_group_id","machine_id","object_guid","host_name","fully_qualified_host_name","alias","sort_name","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","installed_version","normalized_installed_version","display_installed_version","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","cve_id","severity","installation_date","created_at","published_at","cisa_exploitable","known_ransomware_campaign_use","severity_score","cvss20_score","cvss30_score","group_name","domain_name","supports_update","supports_uninstall","ignored_until","ignored_at","active_directory.user.display_name","active_directory.machine.display_name","active_directory.user.ou","active_directory.machine.ou","active_directory.user.sam_account_name","active_directory.machine.sam_account_name"]},"sort_order":{"type":"string","title":"Sorting direction","default":"asc","enum":["asc","desc"]},"page_size":{"type":"number","title":"The size of the page. If you only need aggregations, set it to 0","minimum":0,"default":50,"maximum":2000},"aggregations":{"type":"array","title":"The Aggregations Schema","items":{"type":"string","title":"Aggregations","default":[],"enum":["account_id","account_name","parent_account_id","group_id","root_group_id","machine_id","endpoints","object_guid","host_name","fully_qualified_host_name","alias","sort_name","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","installed_version","normalized_installed_version","display_installed_version","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","cve_id","severity","severity_score","cisa_exploitable","known_ransomware_campaign_use","cvss20_score","cvss30_score"]}},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}},"allOf":[{"type":"object","title":"Active Directory Search Filters","properties":{"active_directory.user.display_name":{"type":"string","title":"Filter the search by active_directory.user.display_name. Search for the matches that are equal to the value"},"active_directory.user.display_name.keyword":{"type":"string","title":"Filter the search by active_directory.user.display_name.keyword. Search for the matches that contain the value"},"active_directory.user.ou":{"type":"string","title":"Filter the search by active_directory.user.ou. Search for the matches that are equal to the value"},"active_directory.user.ou.keyword":{"type":"string","title":"Filter the search by active_directory.user.ou.keyword. Search for the matches that contain the value"},"active_directory.user.ou.path":{"type":"string","title":"Filter the search by active_directory.user.ou.path. Search for the matches that are equal to the value"},"active_directory.user.ou.path.keyword":{"type":"string","title":"Filter the search by active_directory.user.ou.path.keyword. Search for the matches that contain the value"},"active_directory.user.sam_account_name":{"type":"string","title":"Filter the search by active_directory.user.sam_account_name. Search for the matches that are equal to the value"},"active_directory.user.sam_account_name.keyword":{"type":"string","title":"Filter the search by active_directory.user.sam_account_name.keyword. Search for the matches that contain the value"},"active_directory.machine.display_name":{"type":"string","title":"Filter the search by active_directory.machine.display_name. Search for the matches that are equal to the value"},"active_directory.machine.display_name.keyword":{"type":"string","title":"Filter the search by active_directory.machine.display_name.keyword. Search for the matches that contain the value"},"active_directory.machine.ou":{"type":"string","title":"Filter the search by active_directory.machine.ou. Search for the matches that are equal to the value"},"active_directory.machine.ou.keyword":{"type":"string","title":"Filter the search by active_directory.machine.ou.keyword. Search for the matches that contain the value"},"active_directory.machine.ou.path":{"type":"string","title":"Filter the search by active_directory.machine.ou.path. Search for the matches that are equal to the value"},"active_directory.machine.ou.path.keyword":{"type":"string","title":"Filter the search by active_directory.machine.ou.path.keyword. Search for the matches that contain the value"},"active_directory.machine.sam_account_name":{"type":"string","title":"Filter the search by active_directory.machine.sam_account_name. Search for the matches that are equal to the value"},"active_directory.machine.sam_account_name.keyword":{"type":"string","title":"Filter the search by active_directory.machine.sam_account_name.keyword. Search for the matches that contain the value"}}}]}]}}}}],"properties":{"groups":{"type":"array","title":"List of search queries","items":{"type":"object","required":["account_ids"],"allOf":[{"type":"object","title":"Search assets cve request. Leading wildcards are not supported for constraint fields without '.keyword' suffix.","properties":{"account_name":{"type":"string","title":"Filter the search by account_name. Search for an exact match"},"account_name.keyword":{"type":"string","title":"Filter the search by account_name.keyword. Search for the matches that contain the value"},"not.account_name":{"type":"string","title":"Filter the search by not.account_name. Search for the matches that are not equal to the value"},"not.account_name.keyword":{"type":"string","title":"Filter the search by not.account_name.keyword. Search for the matches that do not contain the value"},"parent_account_id":{"type":"string","title":"Filter the search by parent_account_id. Search for an exact match"},"parent_account_id.keyword":{"type":"string","title":"Filter the search by parent_account_id.keyword. Search for the matches that contain the value"},"not.parent_account_id":{"type":"string","title":"Filter the search by not.parent_account_id. Search for the matches that are not equal to the value"},"not.parent_account_id.keyword":{"type":"string","title":"Filter the search by not.parent_account_id.keyword. Search for the matches that do not contain the value"},"group_id":{"type":"string","title":"Filter the search by group_id. Search for an exact match"},"group_id.keyword":{"type":"string","title":"Filter the search by group_id.keyword. Search for the matches that contain the value"},"not.group_id":{"type":"string","title":"Filter the search by not.group_id. Search for the matches that are not equal to the value"},"not.group_id.keyword":{"type":"string","title":"Filter the search by not.group_id.keyword. Search for the matches that do not contain the value"},"root_group_id":{"type":"string","title":"Filter the search by root_group_id. Search for an exact match"},"root_group_id.keyword":{"type":"string","title":"Filter the search by root_group_id.keyword. Search for the matches that contain the value"},"not.root_group_id":{"type":"string","title":"Filter the search by not.root_group_id. Search for the matches that are not equal to the value"},"not.root_group_id.keyword":{"type":"string","title":"Filter the search by not.root_group_id.keyword. Search for the matches that do not contain the value"},"group_name":{"type":"string","title":"Filter the search by group_name. Search for an exact match"},"group_name.keyword":{"type":"string","title":"Filter the search by group_name.keyword. Search for the matches that contain the value"},"not.group_name":{"type":"string","title":"Filter the search by not.group_name. Search for the matches that are not equal to the value"},"not.group_name.keyword":{"type":"string","title":"Filter the search by not.group_name.keyword. Search for the matches that do not contain the value"},"machine_id":{"type":"string","title":"Filter the search by machine_id. Search for an exact match"},"machine_id.keyword":{"type":"string","title":"Filter the search by machine_id.keyword. Search for the matches that contain the value"},"not.machine_id":{"type":"string","title":"Filter the search by not.machine_id. Search for the matches that are not equal to the value"},"not.machine_id.keyword":{"type":"string","title":"Filter the search by not.machine_id.keyword. Search for the matches that do not contain the value"},"object_guid":{"type":"string","title":"Filter the search by object_guid. Search for an exact match"},"object_guid.keyword":{"type":"string","title":"Filter the search by object_guid.keyword. Search for the matches that contain the value"},"not.object_guid":{"type":"string","title":"Filter the search by not.object_guid. Search for the matches that are not equal to the value"},"not.object_guid.keyword":{"type":"string","title":"Filter the search by not.object_guid.keyword. Search for the matches that do not contain the value"},"host_name":{"type":"string","title":"Filter the search by host_name. Search for an exact match"},"host_name.keyword":{"type":"string","title":"Filter the search by host_name.keyword. Search for the matches that contain the value"},"not.host_name":{"type":"string","title":"Filter the search by not.host_name. Search for the matches that are not equal to the value"},"not.host_name.keyword":{"type":"string","title":"Filter the search by not.host_name.keyword. Search for the matches that do not contain the value"},"fully_qualified_host_name":{"type":"string","title":"Filter the search by fully_qualified_host_name. Search for an exact match"},"fully_qualified_host_name.keyword":{"type":"string","title":"Filter the search by fully_qualified_host_name.keyword. Search for the matches that contain the value"},"not.fully_qualified_host_name":{"type":"string","title":"Filter the search by not.fully_qualified_host_name. Search for the matches that are not equal to the value"},"not.fully_qualified_host_name.keyword":{"type":"string","title":"Filter the search by not.fully_qualified_host_name.keyword. Search for the matches that do not contain the value"},"domain_name":{"type":"string","title":"Filter the search by domain_name. Search for an exact match"},"domain_name.keyword":{"type":"string","title":"Filter the search by domain_name.keyword. Search for the matches that contain the value"},"not.domain_name":{"type":"string","title":"Filter the search by not.domain_name. Search for the matches that are not equal to the value"},"not.domain_name.keyword":{"type":"string","title":"Filter the search by not.domain_name.keyword. Search for the matches that do not contain the value"},"alias":{"type":"string","title":"Filter the search by alias. Search for an exact match"},"alias.keyword":{"type":"string","title":"Filter the search by alias.keyword. Search for the matches that contain the value"},"not.alias":{"type":"string","title":"Filter the search by not.alias. Search for the matches that are not equal to the value"},"not.alias.keyword":{"type":"string","title":"Filter the search by not.alias.keyword. Search for the matches that do not contain the value"},"sort_name":{"type":"string","title":"Filter the search by sort_name. Search for an exact match"},"sort_name.keyword":{"type":"string","title":"Filter the search by sort_name.keyword. Search for the matches that contain the value"},"not.sort_name":{"type":"string","title":"Filter the search by not.sort_name. Search for the matches that are not equal to the value"},"not.sort_name.keyword":{"type":"string","title":"Filter the search by not.sort_name.keyword. Search for the matches that do not contain the value"},"vendor":{"type":"string","title":"Filter the search by vendor. Search for an exact match"},"vendor.keyword":{"type":"string","title":"Filter the search by vendor.keyword. Search for the matches that contain the value"},"not.vendor":{"type":"string","title":"Filter the search by not.vendor. Search for the matches that are not equal to the value"},"not.vendor.keyword":{"type":"string","title":"Filter the search by not.vendor.keyword. Search for the matches that do not contain the value"},"normalized_vendor":{"type":"string","title":"Filter the search by normalized_vendor. Search for an exact match"},"normalized_vendor.keyword":{"type":"string","title":"Filter the search by normalized_vendor.keyword. Search for the matches that contain the value"},"not.normalized_vendor":{"type":"string","title":"Filter the search by not.normalized_vendor. Search for the matches that are not equal to the value"},"not.normalized_vendor.keyword":{"type":"string","title":"Filter the search by not.normalized_vendor.keyword. Search for the matches that do not contain the value"},"display_vendor":{"type":"string","title":"Filter the search by display_vendor. Search for an exact match"},"display_vendor.keyword":{"type":"string","title":"Filter the search by display_vendor.keyword. Search for the matches that contain the value"},"not.display_vendor":{"type":"string","title":"Filter the search by not.display_vendor. Search for the matches that are not equal to the value"},"not.display_vendor.keyword":{"type":"string","title":"Filter the search by not.display_vendor.keyword. Search for the matches that do not contain the value"},"product":{"type":"string","title":"Filter the search by product. Search for an exact match"},"product.keyword":{"type":"string","title":"Filter the search by product.keyword. Search for the matches that contain the value"},"not.product":{"type":"string","title":"Filter the search by not.product. Search for the matches that are not equal to the value"},"not.product.keyword":{"type":"string","title":"Filter the search by not.product.keyword. Search for the matches that do not contain the value"},"normalized_product":{"type":"string","title":"Filter the search by normalized_product. Search for an exact match"},"normalized_product.keyword":{"type":"string","title":"Filter the search by normalized_product.keyword. Search for the matches that contain the value"},"not.normalized_product":{"type":"string","title":"Filter the search by not.normalized_product. Search for the matches that are not equal to the value"},"not.normalized_product.keyword":{"type":"string","title":"Filter the search by not.normalized_product.keyword. Search for the matches that do not contain the value"},"display_product":{"type":"string","title":"Filter the search by display_product. Search for an exact match"},"display_product.keyword":{"type":"string","title":"Filter the search by display_product.keyword. Search for the matches that contain the value"},"not.display_product":{"type":"string","title":"Filter the search by not.display_product. Search for the matches that are not equal to the value"},"not.display_product.keyword":{"type":"string","title":"Filter the search by not.display_product.keyword. Search for the matches that do not contain the value"},"installed_version":{"type":"string","title":"Filter the search by installed_version. Search for an exact match"},"installed_version.keyword":{"type":"string","title":"Filter the search by installed_version.keyword. Search for the matches that contain the value"},"not.installed_version":{"type":"string","title":"Filter the search by not.installed_version. Search for the matches that are not equal to the value"},"not.installed_version.keyword":{"type":"string","title":"Filter the search by not.installed_version.keyword. Search for the matches that do not contain the value"},"normalized_installed_version":{"type":"string","title":"Filter the search by normalized_installed_version. Search for an exact match"},"normalized_installed_version.keyword":{"type":"string","title":"Filter the search by normalized_installed_version.keyword. Search for the matches that contain the value"},"not.normalized_installed_version":{"type":"string","title":"Filter the search by not.normalized_installed_version. Search for the matches that are not equal to the value"},"not.normalized_installed_version.keyword":{"type":"string","title":"Filter the search by not.normalized_installed_version.keyword. Search for the matches that do not contain the value"},"display_installed_version":{"type":"string","title":"Filter the search by display_installed_version. Search for an exact match"},"display_installed_version.keyword":{"type":"string","title":"Filter the search by display_installed_version.keyword. Search for the matches that contain the value"},"not.display_installed_version":{"type":"string","title":"Filter the search by not.display_installed_version. Search for the matches that are not equal to the value"},"not.display_installed_version.keyword":{"type":"string","title":"Filter the search by not.display_installed_version.keyword. Search for the matches that do not contain the value"},"os_info.os_type":{"type":"string","title":"Filter the search by os_info.os_type. Search for an exact match"},"os_info.os_type.keyword":{"type":"string","title":"Filter the search by os_info.os_type.keyword. Search for the matches that contain the value"},"not.os_info.os_type":{"type":"string","title":"Filter the search by not.os_info.os_type. Search for the matches that are not equal to the value"},"not.os_info.os_type.keyword":{"type":"string","title":"Filter the search by not.os_info.os_type.keyword. Search for the matches that do not contain the value"},"os_info.os_version":{"type":"string","title":"Filter the search by os_info.os_version. Search for an exact match"},"os_info.os_version.keyword":{"type":"string","title":"Filter the search by os_info.os_version.keyword. Search for the matches that contain the value"},"not.os_info.os_version":{"type":"string","title":"Filter the search by not.os_info.os_version. Search for the matches that are not equal to the value"},"not.os_info.os_version.keyword":{"type":"string","title":"Filter the search by not.os_info.os_version.keyword. Search for the matches that do not contain the value"},"os_info.os_platform":{"type":"string","title":"Filter the search by os_info.os_platform. Search for an exact match"},"os_info.os_platform.keyword":{"type":"string","title":"Filter the search by os_info.os_platform.keyword. Search for the matches that contain the value"},"not.os_info.os_platform":{"type":"string","title":"Filter the search by not.os_info.os_platform. Search for the matches that are not equal to the value"},"not.os_info.os_platform.keyword":{"type":"string","title":"Filter the search by not.os_info.os_platform.keyword. Search for the matches that do not contain the value"},"os_info.os_architecture":{"type":"string","title":"Filter the search by os_info.os_architecture. Search for an exact match"},"os_info.os_architecture.keyword":{"type":"string","title":"Filter the search by os_info.os_architecture.keyword. Search for the matches that contain the value"},"not.os_info.os_architecture":{"type":"string","title":"Filter the search by not.os_info.os_architecture. Search for the matches that are not equal to the value"},"not.os_info.os_architecture.keyword":{"type":"string","title":"Filter the search by not.os_info.os_architecture.keyword. Search for the matches that do not contain the value"},"os_info.os_release_name":{"type":"string","title":"Filter the search by os_info.os_release_name. Search for an exact match"},"os_info.os_release_name.keyword":{"type":"string","title":"Filter the search by os_info.os_release_name.keyword. Search for the matches that contain the value"},"not.os_info.os_release_name":{"type":"string","title":"Filter the search by not.os_info.os_release_name. Search for the matches that are not equal to the value"},"not.os_info.os_release_name.keyword":{"type":"string","title":"Filter the search by not.os_info.os_release_name.keyword. Search for the matches that do not contain the value"},"cve_id":{"type":"string","title":"Filter the search by cve_id. Search for an exact match"},"cve_id.keyword":{"type":"string","title":"Filter the search by cve_id.keyword. Search for the matches that contain the value"},"not.cve_id":{"type":"string","title":"Filter the search by not.cve_id. Search for the matches that are not equal to the value"},"not.cve_id.keyword":{"type":"string","title":"Filter the search by not.cve_id.keyword. Search for the matches that do not contain the value"},"severity":{"type":"string","title":"Filter the search by severity. Search for an exact match"},"severity.keyword":{"type":"string","title":"Filter the search by severity.keyword. Search for the matches that contain the value"},"not.severity":{"type":"string","title":"Filter the search by not.severity. Search for the matches that are not equal to the value"},"not.severity.keyword":{"type":"string","title":"Filter the search by not.severity.keyword. Search for the matches that do not contain the value"},"document_id":{"type":"string","title":"Filter with document_id"},"document_id.keyword":{"type":"string","title":"Filter with document_id.keyword"},"not.document_id":{"type":"array","title":"Filter the search by not.document_id. Search for the matches that are not equal to the value"},"cisa_exploitable":{"type":"boolean","title":"Filter the search by cisa_exploitable. Search for an exact match"},"known_ransomware_campaign_use":{"type":"boolean","title":"Filter the search by known_ransomware_campaign_use. Search for an exact match"},"severity_score":{"type":"number","title":"Filter the search by severity_score. Search for an exact match"},"severity_score_lt":{"type":"number","title":"Filter the search by severity_score_lt. Search for the documents that are less than the value"},"severity_score_lte":{"type":"number","title":"Filter the search by severity_score_lte. Search for the documents that are less than the value"},"severity_score_gt":{"type":"number","title":"Filter the search by severity_score_gt. Search for the documents that are greater than the value"},"severity_score_gte":{"type":"number","title":"Filter the search by severity_score_gte. Search for the documents that are greater than the value"},"installation_date_before":{"type":"string","format":"date-time","title":"Filter the search by installation_date_before. Search for an exact match"},"installation_date_after":{"type":"string","format":"date-time","title":"Filter the search by installation_date_after. Search for an exact match"},"created_at_before":{"type":"string","format":"date-time","title":"Filter the search by created_at_before. Search for an exact match"},"created_at_after":{"type":"string","format":"date-time","title":"Filter the search by created_at_after. Search for an exact match"},"published_at_before":{"type":"string","format":"date-time","title":"Filter the search by published_at_before. Search for an exact match"},"published_at_after":{"type":"string","format":"date-time","title":"Filter the search by published_at_after. Search for an exact match"},"ignored_until_before":{"type":"string","format":"date-time","title":"Filter the search by ignored_until_before"},"ignored_until_after":{"type":"string","format":"date-time","title":"Filter the search by ignored_until_after"},"ignored_at_before":{"type":"string","format":"date-time","title":"Filter the search by ignored_at_before"},"ignored_at_after":{"type":"string","format":"date-time","title":"Filter the search by ignored_at_after"},"only_ignored_cves":{"type":"boolean","title":"Display only ignored CVEs. If true, the search will include only ignored CVEs. If false, the search will not include ignored CVEs. Default is false","default":false},"cvss20_score":{"type":"number","title":"Filter the search by cvss20_score. Search for an exact match of the integer value"},"cvss20_score_lt":{"type":"number","title":"Filter the search by cvss20_score_lt. Search for the documents that are less than the value"},"cvss20_score_lte":{"type":"number","title":"Filter the search by cvss20_score_lte. Search for the documents that are less or equal than the value"},"cvss20_score_gt":{"type":"number","title":"Filter the search by cvss20_score_gt. Search for the documents that are greater than the value"},"cvss20_score_gte":{"type":"number","title":"Filter the search by cvss20_score_gte. Search for the documents that are greater or equal than the value"},"cvss30_score":{"type":"number","title":"Filter the search by cvss30_score. Search for an exact match of the integer value"},"cvss30_score_lt":{"type":"number","title":"Filter the search by cvss30_score_lt. Search for the documents that are less than the value"},"cvss30_score_lte":{"type":"number","title":"Filter the search by cvss30_score_lte. Search for the documents that are less or equal than the value"},"cvss30_score_gt":{"type":"number","title":"Filter the search by cvss30_score_gt. Search for the documents that are greater than the value"},"cvss30_score_gte":{"type":"number","title":"Filter the search by cvss30_score_gte. Search for the documents that are greater or equal than the value"},"product_signature":{"type":"number","title":"Filter the search by product_signature. Search for an exact match"},"latest_version_available":{"type":"string","title":"Filter the search by latest_version_available. Search for an exact match"},"architecture":{"type":"string","title":"Filter the search by software architecture. Search for an exact match"},"language":{"type":"string","title":"Filter the search by software language. Search for an exact match"},"supports_update":{"type":"boolean","title":"Filter the search by supports_update. Search for an exact match"},"supports_uninstall":{"type":"boolean","title":"Filter the search by supports_uninstall. Search for an exact match"},"name_multi_search":{"type":"string","title":"Filter with alises"},"ignored_by":{"type":"string","title":"Filter the search by ignored_by. Search for an exact match"},"ignored_by.keyword":{"type":"string","title":"Filter the search by ignored_by.keyword. Search for the matches that contain the value"},"not.ignored_by":{"type":"string","title":"Filter the search by not.ignored_by. Search for the matches that are not equal to the value"},"not.ignored_by.keyword":{"type":"string","title":"Filter the search by not.ignored_by.keyword. Search for the matches that do not contain the value"},"exists":{"type":"array","title":"Filter the results for records that have these fields","items":{"type":"string","enum":["domain_name","product_signature","ignored_until"]}},"not.exists":{"type":"array","title":"Filter the results for records that do not have these fields","items":{"type":"string","enum":["domain_name","product_signature","ignored_until"]}},"sort_field":{"type":"string","title":"Sort field","enum":["account_id","account_name","parent_account_id","group_id","root_group_id","machine_id","object_guid","host_name","fully_qualified_host_name","alias","sort_name","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","installed_version","normalized_installed_version","display_installed_version","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","cve_id","severity","installation_date","created_at","published_at","cisa_exploitable","known_ransomware_campaign_use","severity_score","cvss20_score","cvss30_score","group_name","domain_name","supports_update","supports_uninstall","ignored_until","ignored_at","active_directory.user.display_name","active_directory.machine.display_name","active_directory.user.ou","active_directory.machine.ou","active_directory.user.sam_account_name","active_directory.machine.sam_account_name"]},"sort_order":{"type":"string","title":"Sorting direction","default":"asc","enum":["asc","desc"]},"page_size":{"type":"number","title":"The size of the page. If you only need aggregations, set it to 0","minimum":0,"default":50,"maximum":2000},"aggregations":{"type":"array","title":"The Aggregations Schema","items":{"type":"string","title":"Aggregations","default":[],"enum":["account_id","account_name","parent_account_id","group_id","root_group_id","machine_id","endpoints","object_guid","host_name","fully_qualified_host_name","alias","sort_name","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","installed_version","normalized_installed_version","display_installed_version","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","cve_id","severity","severity_score","cisa_exploitable","known_ransomware_campaign_use","cvss20_score","cvss30_score"]}},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}},"allOf":[{"type":"object","title":"Active Directory Search Filters","properties":{"active_directory.user.display_name":{"type":"string","title":"Filter the search by active_directory.user.display_name. Search for the matches that are equal to the value"},"active_directory.user.display_name.keyword":{"type":"string","title":"Filter the search by active_directory.user.display_name.keyword. Search for the matches that contain the value"},"active_directory.user.ou":{"type":"string","title":"Filter the search by active_directory.user.ou. Search for the matches that are equal to the value"},"active_directory.user.ou.keyword":{"type":"string","title":"Filter the search by active_directory.user.ou.keyword. Search for the matches that contain the value"},"active_directory.user.ou.path":{"type":"string","title":"Filter the search by active_directory.user.ou.path. Search for the matches that are equal to the value"},"active_directory.user.ou.path.keyword":{"type":"string","title":"Filter the search by active_directory.user.ou.path.keyword. Search for the matches that contain the value"},"active_directory.user.sam_account_name":{"type":"string","title":"Filter the search by active_directory.user.sam_account_name. Search for the matches that are equal to the value"},"active_directory.user.sam_account_name.keyword":{"type":"string","title":"Filter the search by active_directory.user.sam_account_name.keyword. Search for the matches that contain the value"},"active_directory.machine.display_name":{"type":"string","title":"Filter the search by active_directory.machine.display_name. Search for the matches that are equal to the value"},"active_directory.machine.display_name.keyword":{"type":"string","title":"Filter the search by active_directory.machine.display_name.keyword. Search for the matches that contain the value"},"active_directory.machine.ou":{"type":"string","title":"Filter the search by active_directory.machine.ou. Search for the matches that are equal to the value"},"active_directory.machine.ou.keyword":{"type":"string","title":"Filter the search by active_directory.machine.ou.keyword. Search for the matches that contain the value"},"active_directory.machine.ou.path":{"type":"string","title":"Filter the search by active_directory.machine.ou.path. Search for the matches that are equal to the value"},"active_directory.machine.ou.path.keyword":{"type":"string","title":"Filter the search by active_directory.machine.ou.path.keyword. Search for the matches that contain the value"},"active_directory.machine.sam_account_name":{"type":"string","title":"Filter the search by active_directory.machine.sam_account_name. Search for the matches that are equal to the value"},"active_directory.machine.sam_account_name.keyword":{"type":"string","title":"Filter the search by active_directory.machine.sam_account_name.keyword. Search for the matches that contain the value"}}}]},{"type":"object","required":["account_ids"],"properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]}}}}}}},"responses":{"200":{"description":"Successful response"}},"tags":["Vulnerability Management"],"operationId":"api.v2.rmm.post.export.cve.async"}},"/oneview/v1/cve/{id}":{"get":{"description":"Get CVE details by id","summary":"Get CVE details by id","security":[{"client_credentials":["read"]},{"user_permissions":["vulnerabilities.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","properties":{"cve":{"type":"string","title":"CVE identifier"},"cwe":{"type":"string","title":"CWE identifier"},"is_cisa_exploitable":{"type":"boolean","title":"whether is cisa exploitable"},"known_ransomware_campaign_use":{"type":"boolean","title":"whether is known to be used in ransomware campaigns"},"published_epoch":{"type":"integer","title":"Published epoch"},"last_modified_epoch":{"type":"integer","title":"last modified epoch"},"references":{"title":"List of references","type":"array","items":[{"type":"object","properties":{"url":{"type":"string"},"name":{"type":"string"},"reference_type":{"type":"string"},"source":{"type":"string"}},"required":["url","name","reference_type","source"]}]},"cvss_2_0":{"type":"object","properties":{"score":{"type":"string"},"access_vector":{"type":"string"},"access_complexity":{"type":"string"},"authentication":{"type":"string"},"confidentiality_impact":{"type":"string"},"integrity_impact":{"type":"string"},"availability_impact":{"type":"string"},"source":{"type":"string"},"impact_score":{"type":"string"},"exploitability_score":{"type":"string"}},"required":["score","access_vector","access_complexity","authentication","confidentiality_impact","integrity_impact","availability_impact","source","impact_score","exploitability_score"]},"severity_index":{"type":"integer"},"severity":{"type":"string"},"vulnerable_software_list":{"type":"array","items":[{"type":"string"}]},"cvss_3_0":{"type":"object","properties":{"impact_score":{"type":"string"},"vector_string":{"type":"string"},"attack_vector":{"type":"string"},"attack_complexity":{"type":"string"},"privileges_required":{"type":"string"},"user_interaction":{"type":"string"},"scope":{"type":"string"},"confidentiality_impact":{"type":"string"},"integrity_impact":{"type":"string"},"availability_impact":{"type":"string"},"base_score":{"type":"string"},"base_severity":{"type":"string"},"exploitability_score":{"type":"string"},"opswat_temporal_score":{"type":"object","properties":{"exploitability":{"type":"string"},"remediation_level":{"type":"string"},"report_confidence":{"type":"string"},"temporal_score":{"type":"string"},"generated_on_epoch":{"type":"integer"},"cve_last_modified_epoch":{"type":"integer"}},"required":["exploitability","remediation_level","report_confidence","temporal_score","generated_on_epoch","cve_last_modified_epoch"]},"revision":{"type":"string"}},"required":["impact_score","vector_string","attack_vector","attack_complexity","privileges_required","user_interaction","scope","confidentiality_impact","integrity_impact","availability_impact","base_score","base_severity","exploitability_score","opswat_temporal_score","revision"]},"resolution":{"type":"array","items":[{"type":"object","properties":{"product_id":{"type":"integer"},"signature_ids":{"type":"array","items":{"type":"number"}},"product_name":{"type":"string"},"text":{"type":"string"},"advisory_url":{"type":"string"},"higher_than_version":{"type":"string"},"higher_than_or_equal_to_version":{"type":"string"}},"required":["product_id","product_name"]}]},"opswat_product_info":{"type":"array","items":[{"type":"object","properties":{"product":{"type":"object","properties":{"name":{"type":"string"},"id":{"type":"integer"}},"required":["name","id"]},"ranges":{"type":"array","items":[{"type":"object","properties":{"start":{"type":"string"},"limit":{"type":"string"}},"required":["start","limit"]}]},"vendor":{"type":"object","properties":{"id":{"type":"integer"},"name":{"type":"string"}},"required":["id","name"]}},"required":["product","ranges","vendor"]},{"type":"object","properties":{"product":{"type":"object","properties":{"name":{"type":"string"},"id":{"type":"integer"}},"required":["name","id"]},"ranges":{"type":"array","items":[{"type":"object","properties":{"start":{"type":"string"},"limit":{"type":"string"}},"required":["start","limit"]}]},"vendor":{"type":"object","properties":{"id":{"type":"integer"},"name":{"type":"string"}},"required":["id","name"]}},"required":["product","ranges","vendor"]}]},"description":{"type":"string"}},"required":["cve","published_epoch","last_modified_epoch","references","cvss_2_0","severity_index","severity","vulnerable_software_list","description"]}}}}},"tags":["Vulnerability Management"],"operationId":"api.v2.rmm.get.cve.id"}},"/oneview/v1/cve/bulk":{"post":{"description":"Get CVE details in bulk.","summary":"Get CVE details","security":[{"client_credentials":["read"]},{"user_permissions":["vulnerabilities.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Get CVE-s by CVE IDs","required":["ids"],"properties":{"ids":{"type":"array","items":{"type":"string"},"title":"CVE IDs to search for"}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"array","title":"Get CVEs","items":{"type":"object","properties":{"cve":{"type":"string","title":"CVE identifier"},"cwe":{"type":"string","title":"CWE identifier"},"is_cisa_exploitable":{"type":"boolean","title":"whether is cisa exploitable"},"known_ransomware_campaign_use":{"type":"boolean","title":"whether is known to be used in ransomware campaigns"},"published_epoch":{"type":"integer","title":"Published epoch"},"last_modified_epoch":{"type":"integer","title":"last modified epoch"},"references":{"title":"List of references","type":"array","items":[{"type":"object","properties":{"url":{"type":"string"},"name":{"type":"string"},"reference_type":{"type":"string"},"source":{"type":"string"}},"required":["url","name","reference_type","source"]}]},"cvss_2_0":{"type":"object","properties":{"score":{"type":"string"},"access_vector":{"type":"string"},"access_complexity":{"type":"string"},"authentication":{"type":"string"},"confidentiality_impact":{"type":"string"},"integrity_impact":{"type":"string"},"availability_impact":{"type":"string"},"source":{"type":"string"},"impact_score":{"type":"string"},"exploitability_score":{"type":"string"}},"required":["score","access_vector","access_complexity","authentication","confidentiality_impact","integrity_impact","availability_impact","source","impact_score","exploitability_score"]},"severity_index":{"type":"integer"},"severity":{"type":"string"},"vulnerable_software_list":{"type":"array","items":[{"type":"string"}]},"cvss_3_0":{"type":"object","properties":{"impact_score":{"type":"string"},"vector_string":{"type":"string"},"attack_vector":{"type":"string"},"attack_complexity":{"type":"string"},"privileges_required":{"type":"string"},"user_interaction":{"type":"string"},"scope":{"type":"string"},"confidentiality_impact":{"type":"string"},"integrity_impact":{"type":"string"},"availability_impact":{"type":"string"},"base_score":{"type":"string"},"base_severity":{"type":"string"},"exploitability_score":{"type":"string"},"opswat_temporal_score":{"type":"object","properties":{"exploitability":{"type":"string"},"remediation_level":{"type":"string"},"report_confidence":{"type":"string"},"temporal_score":{"type":"string"},"generated_on_epoch":{"type":"integer"},"cve_last_modified_epoch":{"type":"integer"}},"required":["exploitability","remediation_level","report_confidence","temporal_score","generated_on_epoch","cve_last_modified_epoch"]},"revision":{"type":"string"}},"required":["impact_score","vector_string","attack_vector","attack_complexity","privileges_required","user_interaction","scope","confidentiality_impact","integrity_impact","availability_impact","base_score","base_severity","exploitability_score","opswat_temporal_score","revision"]},"resolution":{"type":"array","items":[{"type":"object","properties":{"product_id":{"type":"integer"},"signature_ids":{"type":"array","items":{"type":"number"}},"product_name":{"type":"string"},"text":{"type":"string"},"advisory_url":{"type":"string"},"higher_than_version":{"type":"string"},"higher_than_or_equal_to_version":{"type":"string"}},"required":["product_id","product_name"]}]},"opswat_product_info":{"type":"array","items":[{"type":"object","properties":{"product":{"type":"object","properties":{"name":{"type":"string"},"id":{"type":"integer"}},"required":["name","id"]},"ranges":{"type":"array","items":[{"type":"object","properties":{"start":{"type":"string"},"limit":{"type":"string"}},"required":["start","limit"]}]},"vendor":{"type":"object","properties":{"id":{"type":"integer"},"name":{"type":"string"}},"required":["id","name"]}},"required":["product","ranges","vendor"]},{"type":"object","properties":{"product":{"type":"object","properties":{"name":{"type":"string"},"id":{"type":"integer"}},"required":["name","id"]},"ranges":{"type":"array","items":[{"type":"object","properties":{"start":{"type":"string"},"limit":{"type":"string"}},"required":["start","limit"]}]},"vendor":{"type":"object","properties":{"id":{"type":"integer"},"name":{"type":"string"}},"required":["id","name"]}},"required":["product","ranges","vendor"]}]},"description":{"type":"string"}},"required":["cve","published_epoch","last_modified_epoch","references","cvss_2_0","severity_index","severity","vulnerable_software_list","description"]}}}}}},"tags":["Vulnerability Management"],"operationId":"api.v2.rmm.get.cves.bulk"}},"/oneview/v1/cve/ignore":{"post":{"description":"Placeholder. Please extend this","summary":"Placeholder. Please extend this","deprecated":false,"security":[{"client_credentials":["write"]},{"user_permissions":["vulnerabilities.manage"]}],"status":{"outage":["auth","search_stateless"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Ignore CVE Request","description":"Request body for ignoring CVEs","allOf":[{"type":"object","title":"Ignore CVE Request","description":"Request body for ignoring CVEs","properties":{"action":{"type":"string","enum":["ignore","update","unignore"],"description":"The action to perform on the CVEs. Use 'ignore' to ignore and 'unignore' to remove the ignore status.","default":"ignore"},"ignored_reason":{"type":"string","description":"The reason for ignoring the CVEs"},"ignored_until":{"type":["string","null"],"format":"date-time","description":"The date until which the CVEs should be ignored. Omit to ignore indefinitely."},"groups":{"type":"array","title":"List of queries","items":{"type":"object","title":"Query to fetch CVEs","allOf":[{"type":"object","title":"Search assets cve request. Leading wildcards are not supported for constraint fields without '.keyword' suffix.","properties":{"account_name":{"type":"string","title":"Filter the search by account_name. Search for an exact match"},"account_name.keyword":{"type":"string","title":"Filter the search by account_name.keyword. Search for the matches that contain the value"},"not.account_name":{"type":"string","title":"Filter the search by not.account_name. Search for the matches that are not equal to the value"},"not.account_name.keyword":{"type":"string","title":"Filter the search by not.account_name.keyword. Search for the matches that do not contain the value"},"parent_account_id":{"type":"string","title":"Filter the search by parent_account_id. Search for an exact match"},"parent_account_id.keyword":{"type":"string","title":"Filter the search by parent_account_id.keyword. Search for the matches that contain the value"},"not.parent_account_id":{"type":"string","title":"Filter the search by not.parent_account_id. Search for the matches that are not equal to the value"},"not.parent_account_id.keyword":{"type":"string","title":"Filter the search by not.parent_account_id.keyword. Search for the matches that do not contain the value"},"group_id":{"type":"string","title":"Filter the search by group_id. Search for an exact match"},"group_id.keyword":{"type":"string","title":"Filter the search by group_id.keyword. Search for the matches that contain the value"},"not.group_id":{"type":"string","title":"Filter the search by not.group_id. Search for the matches that are not equal to the value"},"not.group_id.keyword":{"type":"string","title":"Filter the search by not.group_id.keyword. Search for the matches that do not contain the value"},"root_group_id":{"type":"string","title":"Filter the search by root_group_id. Search for an exact match"},"root_group_id.keyword":{"type":"string","title":"Filter the search by root_group_id.keyword. Search for the matches that contain the value"},"not.root_group_id":{"type":"string","title":"Filter the search by not.root_group_id. Search for the matches that are not equal to the value"},"not.root_group_id.keyword":{"type":"string","title":"Filter the search by not.root_group_id.keyword. Search for the matches that do not contain the value"},"group_name":{"type":"string","title":"Filter the search by group_name. Search for an exact match"},"group_name.keyword":{"type":"string","title":"Filter the search by group_name.keyword. Search for the matches that contain the value"},"not.group_name":{"type":"string","title":"Filter the search by not.group_name. Search for the matches that are not equal to the value"},"not.group_name.keyword":{"type":"string","title":"Filter the search by not.group_name.keyword. Search for the matches that do not contain the value"},"machine_id":{"type":"string","title":"Filter the search by machine_id. Search for an exact match"},"machine_id.keyword":{"type":"string","title":"Filter the search by machine_id.keyword. Search for the matches that contain the value"},"not.machine_id":{"type":"string","title":"Filter the search by not.machine_id. Search for the matches that are not equal to the value"},"not.machine_id.keyword":{"type":"string","title":"Filter the search by not.machine_id.keyword. Search for the matches that do not contain the value"},"object_guid":{"type":"string","title":"Filter the search by object_guid. Search for an exact match"},"object_guid.keyword":{"type":"string","title":"Filter the search by object_guid.keyword. Search for the matches that contain the value"},"not.object_guid":{"type":"string","title":"Filter the search by not.object_guid. Search for the matches that are not equal to the value"},"not.object_guid.keyword":{"type":"string","title":"Filter the search by not.object_guid.keyword. Search for the matches that do not contain the value"},"host_name":{"type":"string","title":"Filter the search by host_name. Search for an exact match"},"host_name.keyword":{"type":"string","title":"Filter the search by host_name.keyword. Search for the matches that contain the value"},"not.host_name":{"type":"string","title":"Filter the search by not.host_name. Search for the matches that are not equal to the value"},"not.host_name.keyword":{"type":"string","title":"Filter the search by not.host_name.keyword. Search for the matches that do not contain the value"},"fully_qualified_host_name":{"type":"string","title":"Filter the search by fully_qualified_host_name. Search for an exact match"},"fully_qualified_host_name.keyword":{"type":"string","title":"Filter the search by fully_qualified_host_name.keyword. Search for the matches that contain the value"},"not.fully_qualified_host_name":{"type":"string","title":"Filter the search by not.fully_qualified_host_name. Search for the matches that are not equal to the value"},"not.fully_qualified_host_name.keyword":{"type":"string","title":"Filter the search by not.fully_qualified_host_name.keyword. Search for the matches that do not contain the value"},"domain_name":{"type":"string","title":"Filter the search by domain_name. Search for an exact match"},"domain_name.keyword":{"type":"string","title":"Filter the search by domain_name.keyword. Search for the matches that contain the value"},"not.domain_name":{"type":"string","title":"Filter the search by not.domain_name. Search for the matches that are not equal to the value"},"not.domain_name.keyword":{"type":"string","title":"Filter the search by not.domain_name.keyword. Search for the matches that do not contain the value"},"alias":{"type":"string","title":"Filter the search by alias. Search for an exact match"},"alias.keyword":{"type":"string","title":"Filter the search by alias.keyword. Search for the matches that contain the value"},"not.alias":{"type":"string","title":"Filter the search by not.alias. Search for the matches that are not equal to the value"},"not.alias.keyword":{"type":"string","title":"Filter the search by not.alias.keyword. Search for the matches that do not contain the value"},"sort_name":{"type":"string","title":"Filter the search by sort_name. Search for an exact match"},"sort_name.keyword":{"type":"string","title":"Filter the search by sort_name.keyword. Search for the matches that contain the value"},"not.sort_name":{"type":"string","title":"Filter the search by not.sort_name. Search for the matches that are not equal to the value"},"not.sort_name.keyword":{"type":"string","title":"Filter the search by not.sort_name.keyword. Search for the matches that do not contain the value"},"vendor":{"type":"string","title":"Filter the search by vendor. Search for an exact match"},"vendor.keyword":{"type":"string","title":"Filter the search by vendor.keyword. Search for the matches that contain the value"},"not.vendor":{"type":"string","title":"Filter the search by not.vendor. Search for the matches that are not equal to the value"},"not.vendor.keyword":{"type":"string","title":"Filter the search by not.vendor.keyword. Search for the matches that do not contain the value"},"normalized_vendor":{"type":"string","title":"Filter the search by normalized_vendor. Search for an exact match"},"normalized_vendor.keyword":{"type":"string","title":"Filter the search by normalized_vendor.keyword. Search for the matches that contain the value"},"not.normalized_vendor":{"type":"string","title":"Filter the search by not.normalized_vendor. Search for the matches that are not equal to the value"},"not.normalized_vendor.keyword":{"type":"string","title":"Filter the search by not.normalized_vendor.keyword. Search for the matches that do not contain the value"},"display_vendor":{"type":"string","title":"Filter the search by display_vendor. Search for an exact match"},"display_vendor.keyword":{"type":"string","title":"Filter the search by display_vendor.keyword. Search for the matches that contain the value"},"not.display_vendor":{"type":"string","title":"Filter the search by not.display_vendor. Search for the matches that are not equal to the value"},"not.display_vendor.keyword":{"type":"string","title":"Filter the search by not.display_vendor.keyword. Search for the matches that do not contain the value"},"product":{"type":"string","title":"Filter the search by product. Search for an exact match"},"product.keyword":{"type":"string","title":"Filter the search by product.keyword. Search for the matches that contain the value"},"not.product":{"type":"string","title":"Filter the search by not.product. Search for the matches that are not equal to the value"},"not.product.keyword":{"type":"string","title":"Filter the search by not.product.keyword. Search for the matches that do not contain the value"},"normalized_product":{"type":"string","title":"Filter the search by normalized_product. Search for an exact match"},"normalized_product.keyword":{"type":"string","title":"Filter the search by normalized_product.keyword. Search for the matches that contain the value"},"not.normalized_product":{"type":"string","title":"Filter the search by not.normalized_product. Search for the matches that are not equal to the value"},"not.normalized_product.keyword":{"type":"string","title":"Filter the search by not.normalized_product.keyword. Search for the matches that do not contain the value"},"display_product":{"type":"string","title":"Filter the search by display_product. Search for an exact match"},"display_product.keyword":{"type":"string","title":"Filter the search by display_product.keyword. Search for the matches that contain the value"},"not.display_product":{"type":"string","title":"Filter the search by not.display_product. Search for the matches that are not equal to the value"},"not.display_product.keyword":{"type":"string","title":"Filter the search by not.display_product.keyword. Search for the matches that do not contain the value"},"installed_version":{"type":"string","title":"Filter the search by installed_version. Search for an exact match"},"installed_version.keyword":{"type":"string","title":"Filter the search by installed_version.keyword. Search for the matches that contain the value"},"not.installed_version":{"type":"string","title":"Filter the search by not.installed_version. Search for the matches that are not equal to the value"},"not.installed_version.keyword":{"type":"string","title":"Filter the search by not.installed_version.keyword. Search for the matches that do not contain the value"},"normalized_installed_version":{"type":"string","title":"Filter the search by normalized_installed_version. Search for an exact match"},"normalized_installed_version.keyword":{"type":"string","title":"Filter the search by normalized_installed_version.keyword. Search for the matches that contain the value"},"not.normalized_installed_version":{"type":"string","title":"Filter the search by not.normalized_installed_version. Search for the matches that are not equal to the value"},"not.normalized_installed_version.keyword":{"type":"string","title":"Filter the search by not.normalized_installed_version.keyword. Search for the matches that do not contain the value"},"display_installed_version":{"type":"string","title":"Filter the search by display_installed_version. Search for an exact match"},"display_installed_version.keyword":{"type":"string","title":"Filter the search by display_installed_version.keyword. Search for the matches that contain the value"},"not.display_installed_version":{"type":"string","title":"Filter the search by not.display_installed_version. Search for the matches that are not equal to the value"},"not.display_installed_version.keyword":{"type":"string","title":"Filter the search by not.display_installed_version.keyword. Search for the matches that do not contain the value"},"os_info.os_type":{"type":"string","title":"Filter the search by os_info.os_type. Search for an exact match"},"os_info.os_type.keyword":{"type":"string","title":"Filter the search by os_info.os_type.keyword. Search for the matches that contain the value"},"not.os_info.os_type":{"type":"string","title":"Filter the search by not.os_info.os_type. Search for the matches that are not equal to the value"},"not.os_info.os_type.keyword":{"type":"string","title":"Filter the search by not.os_info.os_type.keyword. Search for the matches that do not contain the value"},"os_info.os_version":{"type":"string","title":"Filter the search by os_info.os_version. Search for an exact match"},"os_info.os_version.keyword":{"type":"string","title":"Filter the search by os_info.os_version.keyword. Search for the matches that contain the value"},"not.os_info.os_version":{"type":"string","title":"Filter the search by not.os_info.os_version. Search for the matches that are not equal to the value"},"not.os_info.os_version.keyword":{"type":"string","title":"Filter the search by not.os_info.os_version.keyword. Search for the matches that do not contain the value"},"os_info.os_platform":{"type":"string","title":"Filter the search by os_info.os_platform. Search for an exact match"},"os_info.os_platform.keyword":{"type":"string","title":"Filter the search by os_info.os_platform.keyword. Search for the matches that contain the value"},"not.os_info.os_platform":{"type":"string","title":"Filter the search by not.os_info.os_platform. Search for the matches that are not equal to the value"},"not.os_info.os_platform.keyword":{"type":"string","title":"Filter the search by not.os_info.os_platform.keyword. Search for the matches that do not contain the value"},"os_info.os_architecture":{"type":"string","title":"Filter the search by os_info.os_architecture. Search for an exact match"},"os_info.os_architecture.keyword":{"type":"string","title":"Filter the search by os_info.os_architecture.keyword. Search for the matches that contain the value"},"not.os_info.os_architecture":{"type":"string","title":"Filter the search by not.os_info.os_architecture. Search for the matches that are not equal to the value"},"not.os_info.os_architecture.keyword":{"type":"string","title":"Filter the search by not.os_info.os_architecture.keyword. Search for the matches that do not contain the value"},"os_info.os_release_name":{"type":"string","title":"Filter the search by os_info.os_release_name. Search for an exact match"},"os_info.os_release_name.keyword":{"type":"string","title":"Filter the search by os_info.os_release_name.keyword. Search for the matches that contain the value"},"not.os_info.os_release_name":{"type":"string","title":"Filter the search by not.os_info.os_release_name. Search for the matches that are not equal to the value"},"not.os_info.os_release_name.keyword":{"type":"string","title":"Filter the search by not.os_info.os_release_name.keyword. Search for the matches that do not contain the value"},"cve_id":{"type":"string","title":"Filter the search by cve_id. Search for an exact match"},"cve_id.keyword":{"type":"string","title":"Filter the search by cve_id.keyword. Search for the matches that contain the value"},"not.cve_id":{"type":"string","title":"Filter the search by not.cve_id. Search for the matches that are not equal to the value"},"not.cve_id.keyword":{"type":"string","title":"Filter the search by not.cve_id.keyword. Search for the matches that do not contain the value"},"severity":{"type":"string","title":"Filter the search by severity. Search for an exact match"},"severity.keyword":{"type":"string","title":"Filter the search by severity.keyword. Search for the matches that contain the value"},"not.severity":{"type":"string","title":"Filter the search by not.severity. Search for the matches that are not equal to the value"},"not.severity.keyword":{"type":"string","title":"Filter the search by not.severity.keyword. Search for the matches that do not contain the value"},"document_id":{"type":"string","title":"Filter with document_id"},"document_id.keyword":{"type":"string","title":"Filter with document_id.keyword"},"not.document_id":{"type":"array","title":"Filter the search by not.document_id. Search for the matches that are not equal to the value"},"cisa_exploitable":{"type":"boolean","title":"Filter the search by cisa_exploitable. Search for an exact match"},"known_ransomware_campaign_use":{"type":"boolean","title":"Filter the search by known_ransomware_campaign_use. Search for an exact match"},"severity_score":{"type":"number","title":"Filter the search by severity_score. Search for an exact match"},"severity_score_lt":{"type":"number","title":"Filter the search by severity_score_lt. Search for the documents that are less than the value"},"severity_score_lte":{"type":"number","title":"Filter the search by severity_score_lte. Search for the documents that are less than the value"},"severity_score_gt":{"type":"number","title":"Filter the search by severity_score_gt. Search for the documents that are greater than the value"},"severity_score_gte":{"type":"number","title":"Filter the search by severity_score_gte. Search for the documents that are greater than the value"},"installation_date_before":{"type":"string","format":"date-time","title":"Filter the search by installation_date_before. Search for an exact match"},"installation_date_after":{"type":"string","format":"date-time","title":"Filter the search by installation_date_after. Search for an exact match"},"created_at_before":{"type":"string","format":"date-time","title":"Filter the search by created_at_before. Search for an exact match"},"created_at_after":{"type":"string","format":"date-time","title":"Filter the search by created_at_after. Search for an exact match"},"published_at_before":{"type":"string","format":"date-time","title":"Filter the search by published_at_before. Search for an exact match"},"published_at_after":{"type":"string","format":"date-time","title":"Filter the search by published_at_after. Search for an exact match"},"ignored_until_before":{"type":"string","format":"date-time","title":"Filter the search by ignored_until_before"},"ignored_until_after":{"type":"string","format":"date-time","title":"Filter the search by ignored_until_after"},"ignored_at_before":{"type":"string","format":"date-time","title":"Filter the search by ignored_at_before"},"ignored_at_after":{"type":"string","format":"date-time","title":"Filter the search by ignored_at_after"},"only_ignored_cves":{"type":"boolean","title":"Display only ignored CVEs. If true, the search will include only ignored CVEs. If false, the search will not include ignored CVEs. Default is false","default":false},"cvss20_score":{"type":"number","title":"Filter the search by cvss20_score. Search for an exact match of the integer value"},"cvss20_score_lt":{"type":"number","title":"Filter the search by cvss20_score_lt. Search for the documents that are less than the value"},"cvss20_score_lte":{"type":"number","title":"Filter the search by cvss20_score_lte. Search for the documents that are less or equal than the value"},"cvss20_score_gt":{"type":"number","title":"Filter the search by cvss20_score_gt. Search for the documents that are greater than the value"},"cvss20_score_gte":{"type":"number","title":"Filter the search by cvss20_score_gte. Search for the documents that are greater or equal than the value"},"cvss30_score":{"type":"number","title":"Filter the search by cvss30_score. Search for an exact match of the integer value"},"cvss30_score_lt":{"type":"number","title":"Filter the search by cvss30_score_lt. Search for the documents that are less than the value"},"cvss30_score_lte":{"type":"number","title":"Filter the search by cvss30_score_lte. Search for the documents that are less or equal than the value"},"cvss30_score_gt":{"type":"number","title":"Filter the search by cvss30_score_gt. Search for the documents that are greater than the value"},"cvss30_score_gte":{"type":"number","title":"Filter the search by cvss30_score_gte. Search for the documents that are greater or equal than the value"},"product_signature":{"type":"number","title":"Filter the search by product_signature. Search for an exact match"},"latest_version_available":{"type":"string","title":"Filter the search by latest_version_available. Search for an exact match"},"architecture":{"type":"string","title":"Filter the search by software architecture. Search for an exact match"},"language":{"type":"string","title":"Filter the search by software language. Search for an exact match"},"supports_update":{"type":"boolean","title":"Filter the search by supports_update. Search for an exact match"},"supports_uninstall":{"type":"boolean","title":"Filter the search by supports_uninstall. Search for an exact match"},"name_multi_search":{"type":"string","title":"Filter with alises"},"ignored_by":{"type":"string","title":"Filter the search by ignored_by. Search for an exact match"},"ignored_by.keyword":{"type":"string","title":"Filter the search by ignored_by.keyword. Search for the matches that contain the value"},"not.ignored_by":{"type":"string","title":"Filter the search by not.ignored_by. Search for the matches that are not equal to the value"},"not.ignored_by.keyword":{"type":"string","title":"Filter the search by not.ignored_by.keyword. Search for the matches that do not contain the value"},"exists":{"type":"array","title":"Filter the results for records that have these fields","items":{"type":"string","enum":["domain_name","product_signature","ignored_until"]}},"not.exists":{"type":"array","title":"Filter the results for records that do not have these fields","items":{"type":"string","enum":["domain_name","product_signature","ignored_until"]}},"sort_field":{"type":"string","title":"Sort field","enum":["account_id","account_name","parent_account_id","group_id","root_group_id","machine_id","object_guid","host_name","fully_qualified_host_name","alias","sort_name","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","installed_version","normalized_installed_version","display_installed_version","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","cve_id","severity","installation_date","created_at","published_at","cisa_exploitable","known_ransomware_campaign_use","severity_score","cvss20_score","cvss30_score","group_name","domain_name","supports_update","supports_uninstall","ignored_until","ignored_at","active_directory.user.display_name","active_directory.machine.display_name","active_directory.user.ou","active_directory.machine.ou","active_directory.user.sam_account_name","active_directory.machine.sam_account_name"]},"sort_order":{"type":"string","title":"Sorting direction","default":"asc","enum":["asc","desc"]},"page_size":{"type":"number","title":"The size of the page. If you only need aggregations, set it to 0","minimum":0,"default":50,"maximum":2000},"aggregations":{"type":"array","title":"The Aggregations Schema","items":{"type":"string","title":"Aggregations","default":[],"enum":["account_id","account_name","parent_account_id","group_id","root_group_id","machine_id","endpoints","object_guid","host_name","fully_qualified_host_name","alias","sort_name","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","installed_version","normalized_installed_version","display_installed_version","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","cve_id","severity","severity_score","cisa_exploitable","known_ransomware_campaign_use","cvss20_score","cvss30_score"]}},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}},"allOf":[{"type":"object","title":"Active Directory Search Filters","properties":{"active_directory.user.display_name":{"type":"string","title":"Filter the search by active_directory.user.display_name. Search for the matches that are equal to the value"},"active_directory.user.display_name.keyword":{"type":"string","title":"Filter the search by active_directory.user.display_name.keyword. Search for the matches that contain the value"},"active_directory.user.ou":{"type":"string","title":"Filter the search by active_directory.user.ou. Search for the matches that are equal to the value"},"active_directory.user.ou.keyword":{"type":"string","title":"Filter the search by active_directory.user.ou.keyword. Search for the matches that contain the value"},"active_directory.user.ou.path":{"type":"string","title":"Filter the search by active_directory.user.ou.path. Search for the matches that are equal to the value"},"active_directory.user.ou.path.keyword":{"type":"string","title":"Filter the search by active_directory.user.ou.path.keyword. Search for the matches that contain the value"},"active_directory.user.sam_account_name":{"type":"string","title":"Filter the search by active_directory.user.sam_account_name. Search for the matches that are equal to the value"},"active_directory.user.sam_account_name.keyword":{"type":"string","title":"Filter the search by active_directory.user.sam_account_name.keyword. Search for the matches that contain the value"},"active_directory.machine.display_name":{"type":"string","title":"Filter the search by active_directory.machine.display_name. Search for the matches that are equal to the value"},"active_directory.machine.display_name.keyword":{"type":"string","title":"Filter the search by active_directory.machine.display_name.keyword. Search for the matches that contain the value"},"active_directory.machine.ou":{"type":"string","title":"Filter the search by active_directory.machine.ou. Search for the matches that are equal to the value"},"active_directory.machine.ou.keyword":{"type":"string","title":"Filter the search by active_directory.machine.ou.keyword. Search for the matches that contain the value"},"active_directory.machine.ou.path":{"type":"string","title":"Filter the search by active_directory.machine.ou.path. Search for the matches that are equal to the value"},"active_directory.machine.ou.path.keyword":{"type":"string","title":"Filter the search by active_directory.machine.ou.path.keyword. Search for the matches that contain the value"},"active_directory.machine.sam_account_name":{"type":"string","title":"Filter the search by active_directory.machine.sam_account_name. Search for the matches that are equal to the value"},"active_directory.machine.sam_account_name.keyword":{"type":"string","title":"Filter the search by active_directory.machine.sam_account_name.keyword. Search for the matches that contain the value"}}}]}]}}},"required":["groups"],"if":{"properties":{"action":{"const":"unignore"}},"required":["action"]},"then":{"not":{"anyOf":[{"required":["ignored_reason"]},{"required":["ignored_until"]}]},"errorMessage":"The 'ignored_reason' and 'ignored_until' fields must not be provided when unignoring CVEs."}},{"type":"object","required":["account_ids"],"properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]}}}},"responses":{"200":{"description":"Successful response"}},"tags":["Vulnerability Management"],"operationId":"api.v2.rmm.ignore.cve"}},"/oneview/v1/cve":{"post":{"description":"Search CVE across all your managed accounts. The search will be scoped to the account_ids you specify in the request body.","summary":"Search CVE","security":[{"client_credentials":["read"]},{"user_permissions":["vulnerabilities.view"]}],"status":{"outage":["auth","search_stateless"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"allOf":[{"type":"object","title":"Search assets cve request. Leading wildcards are not supported for constraint fields without '.keyword' suffix.","properties":{"account_name":{"type":"string","title":"Filter the search by account_name. Search for an exact match"},"account_name.keyword":{"type":"string","title":"Filter the search by account_name.keyword. Search for the matches that contain the value"},"not.account_name":{"type":"string","title":"Filter the search by not.account_name. Search for the matches that are not equal to the value"},"not.account_name.keyword":{"type":"string","title":"Filter the search by not.account_name.keyword. Search for the matches that do not contain the value"},"parent_account_id":{"type":"string","title":"Filter the search by parent_account_id. Search for an exact match"},"parent_account_id.keyword":{"type":"string","title":"Filter the search by parent_account_id.keyword. Search for the matches that contain the value"},"not.parent_account_id":{"type":"string","title":"Filter the search by not.parent_account_id. Search for the matches that are not equal to the value"},"not.parent_account_id.keyword":{"type":"string","title":"Filter the search by not.parent_account_id.keyword. Search for the matches that do not contain the value"},"group_id":{"type":"string","title":"Filter the search by group_id. Search for an exact match"},"group_id.keyword":{"type":"string","title":"Filter the search by group_id.keyword. Search for the matches that contain the value"},"not.group_id":{"type":"string","title":"Filter the search by not.group_id. Search for the matches that are not equal to the value"},"not.group_id.keyword":{"type":"string","title":"Filter the search by not.group_id.keyword. Search for the matches that do not contain the value"},"root_group_id":{"type":"string","title":"Filter the search by root_group_id. Search for an exact match"},"root_group_id.keyword":{"type":"string","title":"Filter the search by root_group_id.keyword. Search for the matches that contain the value"},"not.root_group_id":{"type":"string","title":"Filter the search by not.root_group_id. Search for the matches that are not equal to the value"},"not.root_group_id.keyword":{"type":"string","title":"Filter the search by not.root_group_id.keyword. Search for the matches that do not contain the value"},"group_name":{"type":"string","title":"Filter the search by group_name. Search for an exact match"},"group_name.keyword":{"type":"string","title":"Filter the search by group_name.keyword. Search for the matches that contain the value"},"not.group_name":{"type":"string","title":"Filter the search by not.group_name. Search for the matches that are not equal to the value"},"not.group_name.keyword":{"type":"string","title":"Filter the search by not.group_name.keyword. Search for the matches that do not contain the value"},"machine_id":{"type":"string","title":"Filter the search by machine_id. Search for an exact match"},"machine_id.keyword":{"type":"string","title":"Filter the search by machine_id.keyword. Search for the matches that contain the value"},"not.machine_id":{"type":"string","title":"Filter the search by not.machine_id. Search for the matches that are not equal to the value"},"not.machine_id.keyword":{"type":"string","title":"Filter the search by not.machine_id.keyword. Search for the matches that do not contain the value"},"object_guid":{"type":"string","title":"Filter the search by object_guid. Search for an exact match"},"object_guid.keyword":{"type":"string","title":"Filter the search by object_guid.keyword. Search for the matches that contain the value"},"not.object_guid":{"type":"string","title":"Filter the search by not.object_guid. Search for the matches that are not equal to the value"},"not.object_guid.keyword":{"type":"string","title":"Filter the search by not.object_guid.keyword. Search for the matches that do not contain the value"},"host_name":{"type":"string","title":"Filter the search by host_name. Search for an exact match"},"host_name.keyword":{"type":"string","title":"Filter the search by host_name.keyword. Search for the matches that contain the value"},"not.host_name":{"type":"string","title":"Filter the search by not.host_name. Search for the matches that are not equal to the value"},"not.host_name.keyword":{"type":"string","title":"Filter the search by not.host_name.keyword. Search for the matches that do not contain the value"},"fully_qualified_host_name":{"type":"string","title":"Filter the search by fully_qualified_host_name. Search for an exact match"},"fully_qualified_host_name.keyword":{"type":"string","title":"Filter the search by fully_qualified_host_name.keyword. Search for the matches that contain the value"},"not.fully_qualified_host_name":{"type":"string","title":"Filter the search by not.fully_qualified_host_name. Search for the matches that are not equal to the value"},"not.fully_qualified_host_name.keyword":{"type":"string","title":"Filter the search by not.fully_qualified_host_name.keyword. Search for the matches that do not contain the value"},"domain_name":{"type":"string","title":"Filter the search by domain_name. Search for an exact match"},"domain_name.keyword":{"type":"string","title":"Filter the search by domain_name.keyword. Search for the matches that contain the value"},"not.domain_name":{"type":"string","title":"Filter the search by not.domain_name. Search for the matches that are not equal to the value"},"not.domain_name.keyword":{"type":"string","title":"Filter the search by not.domain_name.keyword. Search for the matches that do not contain the value"},"alias":{"type":"string","title":"Filter the search by alias. Search for an exact match"},"alias.keyword":{"type":"string","title":"Filter the search by alias.keyword. Search for the matches that contain the value"},"not.alias":{"type":"string","title":"Filter the search by not.alias. Search for the matches that are not equal to the value"},"not.alias.keyword":{"type":"string","title":"Filter the search by not.alias.keyword. Search for the matches that do not contain the value"},"sort_name":{"type":"string","title":"Filter the search by sort_name. Search for an exact match"},"sort_name.keyword":{"type":"string","title":"Filter the search by sort_name.keyword. Search for the matches that contain the value"},"not.sort_name":{"type":"string","title":"Filter the search by not.sort_name. Search for the matches that are not equal to the value"},"not.sort_name.keyword":{"type":"string","title":"Filter the search by not.sort_name.keyword. Search for the matches that do not contain the value"},"vendor":{"type":"string","title":"Filter the search by vendor. Search for an exact match"},"vendor.keyword":{"type":"string","title":"Filter the search by vendor.keyword. Search for the matches that contain the value"},"not.vendor":{"type":"string","title":"Filter the search by not.vendor. Search for the matches that are not equal to the value"},"not.vendor.keyword":{"type":"string","title":"Filter the search by not.vendor.keyword. Search for the matches that do not contain the value"},"normalized_vendor":{"type":"string","title":"Filter the search by normalized_vendor. Search for an exact match"},"normalized_vendor.keyword":{"type":"string","title":"Filter the search by normalized_vendor.keyword. Search for the matches that contain the value"},"not.normalized_vendor":{"type":"string","title":"Filter the search by not.normalized_vendor. Search for the matches that are not equal to the value"},"not.normalized_vendor.keyword":{"type":"string","title":"Filter the search by not.normalized_vendor.keyword. Search for the matches that do not contain the value"},"display_vendor":{"type":"string","title":"Filter the search by display_vendor. Search for an exact match"},"display_vendor.keyword":{"type":"string","title":"Filter the search by display_vendor.keyword. Search for the matches that contain the value"},"not.display_vendor":{"type":"string","title":"Filter the search by not.display_vendor. Search for the matches that are not equal to the value"},"not.display_vendor.keyword":{"type":"string","title":"Filter the search by not.display_vendor.keyword. Search for the matches that do not contain the value"},"product":{"type":"string","title":"Filter the search by product. Search for an exact match"},"product.keyword":{"type":"string","title":"Filter the search by product.keyword. Search for the matches that contain the value"},"not.product":{"type":"string","title":"Filter the search by not.product. Search for the matches that are not equal to the value"},"not.product.keyword":{"type":"string","title":"Filter the search by not.product.keyword. Search for the matches that do not contain the value"},"normalized_product":{"type":"string","title":"Filter the search by normalized_product. Search for an exact match"},"normalized_product.keyword":{"type":"string","title":"Filter the search by normalized_product.keyword. Search for the matches that contain the value"},"not.normalized_product":{"type":"string","title":"Filter the search by not.normalized_product. Search for the matches that are not equal to the value"},"not.normalized_product.keyword":{"type":"string","title":"Filter the search by not.normalized_product.keyword. Search for the matches that do not contain the value"},"display_product":{"type":"string","title":"Filter the search by display_product. Search for an exact match"},"display_product.keyword":{"type":"string","title":"Filter the search by display_product.keyword. Search for the matches that contain the value"},"not.display_product":{"type":"string","title":"Filter the search by not.display_product. Search for the matches that are not equal to the value"},"not.display_product.keyword":{"type":"string","title":"Filter the search by not.display_product.keyword. Search for the matches that do not contain the value"},"installed_version":{"type":"string","title":"Filter the search by installed_version. Search for an exact match"},"installed_version.keyword":{"type":"string","title":"Filter the search by installed_version.keyword. Search for the matches that contain the value"},"not.installed_version":{"type":"string","title":"Filter the search by not.installed_version. Search for the matches that are not equal to the value"},"not.installed_version.keyword":{"type":"string","title":"Filter the search by not.installed_version.keyword. Search for the matches that do not contain the value"},"normalized_installed_version":{"type":"string","title":"Filter the search by normalized_installed_version. Search for an exact match"},"normalized_installed_version.keyword":{"type":"string","title":"Filter the search by normalized_installed_version.keyword. Search for the matches that contain the value"},"not.normalized_installed_version":{"type":"string","title":"Filter the search by not.normalized_installed_version. Search for the matches that are not equal to the value"},"not.normalized_installed_version.keyword":{"type":"string","title":"Filter the search by not.normalized_installed_version.keyword. Search for the matches that do not contain the value"},"display_installed_version":{"type":"string","title":"Filter the search by display_installed_version. Search for an exact match"},"display_installed_version.keyword":{"type":"string","title":"Filter the search by display_installed_version.keyword. Search for the matches that contain the value"},"not.display_installed_version":{"type":"string","title":"Filter the search by not.display_installed_version. Search for the matches that are not equal to the value"},"not.display_installed_version.keyword":{"type":"string","title":"Filter the search by not.display_installed_version.keyword. Search for the matches that do not contain the value"},"os_info.os_type":{"type":"string","title":"Filter the search by os_info.os_type. Search for an exact match"},"os_info.os_type.keyword":{"type":"string","title":"Filter the search by os_info.os_type.keyword. Search for the matches that contain the value"},"not.os_info.os_type":{"type":"string","title":"Filter the search by not.os_info.os_type. Search for the matches that are not equal to the value"},"not.os_info.os_type.keyword":{"type":"string","title":"Filter the search by not.os_info.os_type.keyword. Search for the matches that do not contain the value"},"os_info.os_version":{"type":"string","title":"Filter the search by os_info.os_version. Search for an exact match"},"os_info.os_version.keyword":{"type":"string","title":"Filter the search by os_info.os_version.keyword. Search for the matches that contain the value"},"not.os_info.os_version":{"type":"string","title":"Filter the search by not.os_info.os_version. Search for the matches that are not equal to the value"},"not.os_info.os_version.keyword":{"type":"string","title":"Filter the search by not.os_info.os_version.keyword. Search for the matches that do not contain the value"},"os_info.os_platform":{"type":"string","title":"Filter the search by os_info.os_platform. Search for an exact match"},"os_info.os_platform.keyword":{"type":"string","title":"Filter the search by os_info.os_platform.keyword. Search for the matches that contain the value"},"not.os_info.os_platform":{"type":"string","title":"Filter the search by not.os_info.os_platform. Search for the matches that are not equal to the value"},"not.os_info.os_platform.keyword":{"type":"string","title":"Filter the search by not.os_info.os_platform.keyword. Search for the matches that do not contain the value"},"os_info.os_architecture":{"type":"string","title":"Filter the search by os_info.os_architecture. Search for an exact match"},"os_info.os_architecture.keyword":{"type":"string","title":"Filter the search by os_info.os_architecture.keyword. Search for the matches that contain the value"},"not.os_info.os_architecture":{"type":"string","title":"Filter the search by not.os_info.os_architecture. Search for the matches that are not equal to the value"},"not.os_info.os_architecture.keyword":{"type":"string","title":"Filter the search by not.os_info.os_architecture.keyword. Search for the matches that do not contain the value"},"os_info.os_release_name":{"type":"string","title":"Filter the search by os_info.os_release_name. Search for an exact match"},"os_info.os_release_name.keyword":{"type":"string","title":"Filter the search by os_info.os_release_name.keyword. Search for the matches that contain the value"},"not.os_info.os_release_name":{"type":"string","title":"Filter the search by not.os_info.os_release_name. Search for the matches that are not equal to the value"},"not.os_info.os_release_name.keyword":{"type":"string","title":"Filter the search by not.os_info.os_release_name.keyword. Search for the matches that do not contain the value"},"cve_id":{"type":"string","title":"Filter the search by cve_id. Search for an exact match"},"cve_id.keyword":{"type":"string","title":"Filter the search by cve_id.keyword. Search for the matches that contain the value"},"not.cve_id":{"type":"string","title":"Filter the search by not.cve_id. Search for the matches that are not equal to the value"},"not.cve_id.keyword":{"type":"string","title":"Filter the search by not.cve_id.keyword. Search for the matches that do not contain the value"},"severity":{"type":"string","title":"Filter the search by severity. Search for an exact match"},"severity.keyword":{"type":"string","title":"Filter the search by severity.keyword. Search for the matches that contain the value"},"not.severity":{"type":"string","title":"Filter the search by not.severity. Search for the matches that are not equal to the value"},"not.severity.keyword":{"type":"string","title":"Filter the search by not.severity.keyword. Search for the matches that do not contain the value"},"document_id":{"type":"string","title":"Filter with document_id"},"document_id.keyword":{"type":"string","title":"Filter with document_id.keyword"},"not.document_id":{"type":"array","title":"Filter the search by not.document_id. Search for the matches that are not equal to the value"},"cisa_exploitable":{"type":"boolean","title":"Filter the search by cisa_exploitable. Search for an exact match"},"known_ransomware_campaign_use":{"type":"boolean","title":"Filter the search by known_ransomware_campaign_use. Search for an exact match"},"severity_score":{"type":"number","title":"Filter the search by severity_score. Search for an exact match"},"severity_score_lt":{"type":"number","title":"Filter the search by severity_score_lt. Search for the documents that are less than the value"},"severity_score_lte":{"type":"number","title":"Filter the search by severity_score_lte. Search for the documents that are less than the value"},"severity_score_gt":{"type":"number","title":"Filter the search by severity_score_gt. Search for the documents that are greater than the value"},"severity_score_gte":{"type":"number","title":"Filter the search by severity_score_gte. Search for the documents that are greater than the value"},"installation_date_before":{"type":"string","format":"date-time","title":"Filter the search by installation_date_before. Search for an exact match"},"installation_date_after":{"type":"string","format":"date-time","title":"Filter the search by installation_date_after. Search for an exact match"},"created_at_before":{"type":"string","format":"date-time","title":"Filter the search by created_at_before. Search for an exact match"},"created_at_after":{"type":"string","format":"date-time","title":"Filter the search by created_at_after. Search for an exact match"},"published_at_before":{"type":"string","format":"date-time","title":"Filter the search by published_at_before. Search for an exact match"},"published_at_after":{"type":"string","format":"date-time","title":"Filter the search by published_at_after. Search for an exact match"},"ignored_until_before":{"type":"string","format":"date-time","title":"Filter the search by ignored_until_before"},"ignored_until_after":{"type":"string","format":"date-time","title":"Filter the search by ignored_until_after"},"ignored_at_before":{"type":"string","format":"date-time","title":"Filter the search by ignored_at_before"},"ignored_at_after":{"type":"string","format":"date-time","title":"Filter the search by ignored_at_after"},"only_ignored_cves":{"type":"boolean","title":"Display only ignored CVEs. If true, the search will include only ignored CVEs. If false, the search will not include ignored CVEs. Default is false","default":false},"cvss20_score":{"type":"number","title":"Filter the search by cvss20_score. Search for an exact match of the integer value"},"cvss20_score_lt":{"type":"number","title":"Filter the search by cvss20_score_lt. Search for the documents that are less than the value"},"cvss20_score_lte":{"type":"number","title":"Filter the search by cvss20_score_lte. Search for the documents that are less or equal than the value"},"cvss20_score_gt":{"type":"number","title":"Filter the search by cvss20_score_gt. Search for the documents that are greater than the value"},"cvss20_score_gte":{"type":"number","title":"Filter the search by cvss20_score_gte. Search for the documents that are greater or equal than the value"},"cvss30_score":{"type":"number","title":"Filter the search by cvss30_score. Search for an exact match of the integer value"},"cvss30_score_lt":{"type":"number","title":"Filter the search by cvss30_score_lt. Search for the documents that are less than the value"},"cvss30_score_lte":{"type":"number","title":"Filter the search by cvss30_score_lte. Search for the documents that are less or equal than the value"},"cvss30_score_gt":{"type":"number","title":"Filter the search by cvss30_score_gt. Search for the documents that are greater than the value"},"cvss30_score_gte":{"type":"number","title":"Filter the search by cvss30_score_gte. Search for the documents that are greater or equal than the value"},"product_signature":{"type":"number","title":"Filter the search by product_signature. Search for an exact match"},"latest_version_available":{"type":"string","title":"Filter the search by latest_version_available. Search for an exact match"},"architecture":{"type":"string","title":"Filter the search by software architecture. Search for an exact match"},"language":{"type":"string","title":"Filter the search by software language. Search for an exact match"},"supports_update":{"type":"boolean","title":"Filter the search by supports_update. Search for an exact match"},"supports_uninstall":{"type":"boolean","title":"Filter the search by supports_uninstall. Search for an exact match"},"name_multi_search":{"type":"string","title":"Filter with alises"},"ignored_by":{"type":"string","title":"Filter the search by ignored_by. Search for an exact match"},"ignored_by.keyword":{"type":"string","title":"Filter the search by ignored_by.keyword. Search for the matches that contain the value"},"not.ignored_by":{"type":"string","title":"Filter the search by not.ignored_by. Search for the matches that are not equal to the value"},"not.ignored_by.keyword":{"type":"string","title":"Filter the search by not.ignored_by.keyword. Search for the matches that do not contain the value"},"exists":{"type":"array","title":"Filter the results for records that have these fields","items":{"type":"string","enum":["domain_name","product_signature","ignored_until"]}},"not.exists":{"type":"array","title":"Filter the results for records that do not have these fields","items":{"type":"string","enum":["domain_name","product_signature","ignored_until"]}},"sort_field":{"type":"string","title":"Sort field","enum":["account_id","account_name","parent_account_id","group_id","root_group_id","machine_id","object_guid","host_name","fully_qualified_host_name","alias","sort_name","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","installed_version","normalized_installed_version","display_installed_version","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","cve_id","severity","installation_date","created_at","published_at","cisa_exploitable","known_ransomware_campaign_use","severity_score","cvss20_score","cvss30_score","group_name","domain_name","supports_update","supports_uninstall","ignored_until","ignored_at","active_directory.user.display_name","active_directory.machine.display_name","active_directory.user.ou","active_directory.machine.ou","active_directory.user.sam_account_name","active_directory.machine.sam_account_name"]},"sort_order":{"type":"string","title":"Sorting direction","default":"asc","enum":["asc","desc"]},"page_size":{"type":"number","title":"The size of the page. If you only need aggregations, set it to 0","minimum":0,"default":50,"maximum":2000},"aggregations":{"type":"array","title":"The Aggregations Schema","items":{"type":"string","title":"Aggregations","default":[],"enum":["account_id","account_name","parent_account_id","group_id","root_group_id","machine_id","endpoints","object_guid","host_name","fully_qualified_host_name","alias","sort_name","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","installed_version","normalized_installed_version","display_installed_version","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","cve_id","severity","severity_score","cisa_exploitable","known_ransomware_campaign_use","cvss20_score","cvss30_score"]}},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}},"allOf":[{"type":"object","title":"Active Directory Search Filters","properties":{"active_directory.user.display_name":{"type":"string","title":"Filter the search by active_directory.user.display_name. Search for the matches that are equal to the value"},"active_directory.user.display_name.keyword":{"type":"string","title":"Filter the search by active_directory.user.display_name.keyword. Search for the matches that contain the value"},"active_directory.user.ou":{"type":"string","title":"Filter the search by active_directory.user.ou. Search for the matches that are equal to the value"},"active_directory.user.ou.keyword":{"type":"string","title":"Filter the search by active_directory.user.ou.keyword. Search for the matches that contain the value"},"active_directory.user.ou.path":{"type":"string","title":"Filter the search by active_directory.user.ou.path. Search for the matches that are equal to the value"},"active_directory.user.ou.path.keyword":{"type":"string","title":"Filter the search by active_directory.user.ou.path.keyword. Search for the matches that contain the value"},"active_directory.user.sam_account_name":{"type":"string","title":"Filter the search by active_directory.user.sam_account_name. Search for the matches that are equal to the value"},"active_directory.user.sam_account_name.keyword":{"type":"string","title":"Filter the search by active_directory.user.sam_account_name.keyword. Search for the matches that contain the value"},"active_directory.machine.display_name":{"type":"string","title":"Filter the search by active_directory.machine.display_name. Search for the matches that are equal to the value"},"active_directory.machine.display_name.keyword":{"type":"string","title":"Filter the search by active_directory.machine.display_name.keyword. Search for the matches that contain the value"},"active_directory.machine.ou":{"type":"string","title":"Filter the search by active_directory.machine.ou. Search for the matches that are equal to the value"},"active_directory.machine.ou.keyword":{"type":"string","title":"Filter the search by active_directory.machine.ou.keyword. Search for the matches that contain the value"},"active_directory.machine.ou.path":{"type":"string","title":"Filter the search by active_directory.machine.ou.path. Search for the matches that are equal to the value"},"active_directory.machine.ou.path.keyword":{"type":"string","title":"Filter the search by active_directory.machine.ou.path.keyword. Search for the matches that contain the value"},"active_directory.machine.sam_account_name":{"type":"string","title":"Filter the search by active_directory.machine.sam_account_name. Search for the matches that are equal to the value"},"active_directory.machine.sam_account_name.keyword":{"type":"string","title":"Filter the search by active_directory.machine.sam_account_name.keyword. Search for the matches that contain the value"}}}]},{"type":"object","required":["account_ids"],"properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}],"properties":{"aggregate_by_account":{"type":"boolean","title":"Include aggregation results per account"}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Search assets CVE result","properties":{"results":{"type":"array","items":{"type":"object","properties":{"account_id":{"type":"string"},"parent_account_id":{"type":"string"},"group_id":{"type":"string"},"root_group_id":{"type":"string"},"machine_id":{"type":"string"},"vendor":{"type":"string"},"normalized_vendor":{"type":"string"},"display_vendor":{"type":"string"},"product":{"type":"string"},"normalized_product":{"type":"string"},"display_product":{"type":"string"},"installed_version":{"type":"string"},"normalized_installed_version":{"type":"string"},"display_installed_version":{"type":"string"},"installation_date":{"type":"string"},"host_name":{"type":"string"},"fully_qualified_host_name":{"type":"string"},"alias":{"type":"string"},"created_at":{"type":"string"},"os_info":{"properties":{"os_type":{"type":"string"},"os_version":{"type":"string"},"os_platform":{"type":"string"},"os_architecture":{"type":"string"},"os_release_name":{"type":"string"}}},"cve_id":{"type":"string"},"cisa_exploitable":{"type":"boolean"},"known_ransomware_campaign_use":{"type":"boolean"},"severity":{"type":"string"},"severity_score":{"type":"number"},"published_at":{"type":"string"},"cvss30_score":{"type":"number"},"cvss20_score":{"type":"number"},"description":{"type":"string"},"ignored_until":{"type":"string","format":"date-time"},"ignored_by":{"type":"string"},"ignored_by_name":{"type":"string"},"ignored_reason":{"type":"string"},"active_directory":{"type":"object","patternProperties":{"^(user|machine)$":{"type":"object","properties":{"display_name":{"type":"string"},"distinguished_name":{"type":"string"},"sam_account_name":{"type":"string"},"ou":{"type":"string"}}}}}}}},"aggregations":{"type":"object","title":"Aggregations","additionalProperties":true},"total_count":{"type":"integer","title":"Total count of found detections"},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}},"required":["results","total_count"]}}}}},"tags":["Vulnerability Management"],"operationId":"api.v2.rmm.search.cve"}},"/oneview/v1/cve/search-groupby":{"post":{"description":"Search CVE grouped by a specific field across all your managed account.","summary":"Search CVE groupBy","security":[{"client_credentials":["read"]},{"user_permissions":["vulnerabilities.view"]}],"status":{"incident":["read_nebula_data"],"outage":["auth","search_stateful"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"allOf":[{"type":"object","title":"The Post CVE Search GroupBy Request Schema","required":["group_by","page_size"],"allOf":[{"type":"object","title":"Search assets cve request. Leading wildcards are not supported for constraint fields without '.keyword' suffix.","properties":{"account_name":{"type":"string","title":"Filter the search by account_name. Search for an exact match"},"account_name.keyword":{"type":"string","title":"Filter the search by account_name.keyword. Search for the matches that contain the value"},"not.account_name":{"type":"string","title":"Filter the search by not.account_name. Search for the matches that are not equal to the value"},"not.account_name.keyword":{"type":"string","title":"Filter the search by not.account_name.keyword. Search for the matches that do not contain the value"},"parent_account_id":{"type":"string","title":"Filter the search by parent_account_id. Search for an exact match"},"parent_account_id.keyword":{"type":"string","title":"Filter the search by parent_account_id.keyword. Search for the matches that contain the value"},"not.parent_account_id":{"type":"string","title":"Filter the search by not.parent_account_id. Search for the matches that are not equal to the value"},"not.parent_account_id.keyword":{"type":"string","title":"Filter the search by not.parent_account_id.keyword. Search for the matches that do not contain the value"},"group_id":{"type":"string","title":"Filter the search by group_id. Search for an exact match"},"group_id.keyword":{"type":"string","title":"Filter the search by group_id.keyword. Search for the matches that contain the value"},"not.group_id":{"type":"string","title":"Filter the search by not.group_id. Search for the matches that are not equal to the value"},"not.group_id.keyword":{"type":"string","title":"Filter the search by not.group_id.keyword. Search for the matches that do not contain the value"},"root_group_id":{"type":"string","title":"Filter the search by root_group_id. Search for an exact match"},"root_group_id.keyword":{"type":"string","title":"Filter the search by root_group_id.keyword. Search for the matches that contain the value"},"not.root_group_id":{"type":"string","title":"Filter the search by not.root_group_id. Search for the matches that are not equal to the value"},"not.root_group_id.keyword":{"type":"string","title":"Filter the search by not.root_group_id.keyword. Search for the matches that do not contain the value"},"group_name":{"type":"string","title":"Filter the search by group_name. Search for an exact match"},"group_name.keyword":{"type":"string","title":"Filter the search by group_name.keyword. Search for the matches that contain the value"},"not.group_name":{"type":"string","title":"Filter the search by not.group_name. Search for the matches that are not equal to the value"},"not.group_name.keyword":{"type":"string","title":"Filter the search by not.group_name.keyword. Search for the matches that do not contain the value"},"machine_id":{"type":"string","title":"Filter the search by machine_id. Search for an exact match"},"machine_id.keyword":{"type":"string","title":"Filter the search by machine_id.keyword. Search for the matches that contain the value"},"not.machine_id":{"type":"string","title":"Filter the search by not.machine_id. Search for the matches that are not equal to the value"},"not.machine_id.keyword":{"type":"string","title":"Filter the search by not.machine_id.keyword. Search for the matches that do not contain the value"},"object_guid":{"type":"string","title":"Filter the search by object_guid. Search for an exact match"},"object_guid.keyword":{"type":"string","title":"Filter the search by object_guid.keyword. Search for the matches that contain the value"},"not.object_guid":{"type":"string","title":"Filter the search by not.object_guid. Search for the matches that are not equal to the value"},"not.object_guid.keyword":{"type":"string","title":"Filter the search by not.object_guid.keyword. Search for the matches that do not contain the value"},"host_name":{"type":"string","title":"Filter the search by host_name. Search for an exact match"},"host_name.keyword":{"type":"string","title":"Filter the search by host_name.keyword. Search for the matches that contain the value"},"not.host_name":{"type":"string","title":"Filter the search by not.host_name. Search for the matches that are not equal to the value"},"not.host_name.keyword":{"type":"string","title":"Filter the search by not.host_name.keyword. Search for the matches that do not contain the value"},"fully_qualified_host_name":{"type":"string","title":"Filter the search by fully_qualified_host_name. Search for an exact match"},"fully_qualified_host_name.keyword":{"type":"string","title":"Filter the search by fully_qualified_host_name.keyword. Search for the matches that contain the value"},"not.fully_qualified_host_name":{"type":"string","title":"Filter the search by not.fully_qualified_host_name. Search for the matches that are not equal to the value"},"not.fully_qualified_host_name.keyword":{"type":"string","title":"Filter the search by not.fully_qualified_host_name.keyword. Search for the matches that do not contain the value"},"domain_name":{"type":"string","title":"Filter the search by domain_name. Search for an exact match"},"domain_name.keyword":{"type":"string","title":"Filter the search by domain_name.keyword. Search for the matches that contain the value"},"not.domain_name":{"type":"string","title":"Filter the search by not.domain_name. Search for the matches that are not equal to the value"},"not.domain_name.keyword":{"type":"string","title":"Filter the search by not.domain_name.keyword. Search for the matches that do not contain the value"},"alias":{"type":"string","title":"Filter the search by alias. Search for an exact match"},"alias.keyword":{"type":"string","title":"Filter the search by alias.keyword. Search for the matches that contain the value"},"not.alias":{"type":"string","title":"Filter the search by not.alias. Search for the matches that are not equal to the value"},"not.alias.keyword":{"type":"string","title":"Filter the search by not.alias.keyword. Search for the matches that do not contain the value"},"sort_name":{"type":"string","title":"Filter the search by sort_name. Search for an exact match"},"sort_name.keyword":{"type":"string","title":"Filter the search by sort_name.keyword. Search for the matches that contain the value"},"not.sort_name":{"type":"string","title":"Filter the search by not.sort_name. Search for the matches that are not equal to the value"},"not.sort_name.keyword":{"type":"string","title":"Filter the search by not.sort_name.keyword. Search for the matches that do not contain the value"},"vendor":{"type":"string","title":"Filter the search by vendor. Search for an exact match"},"vendor.keyword":{"type":"string","title":"Filter the search by vendor.keyword. Search for the matches that contain the value"},"not.vendor":{"type":"string","title":"Filter the search by not.vendor. Search for the matches that are not equal to the value"},"not.vendor.keyword":{"type":"string","title":"Filter the search by not.vendor.keyword. Search for the matches that do not contain the value"},"normalized_vendor":{"type":"string","title":"Filter the search by normalized_vendor. Search for an exact match"},"normalized_vendor.keyword":{"type":"string","title":"Filter the search by normalized_vendor.keyword. Search for the matches that contain the value"},"not.normalized_vendor":{"type":"string","title":"Filter the search by not.normalized_vendor. Search for the matches that are not equal to the value"},"not.normalized_vendor.keyword":{"type":"string","title":"Filter the search by not.normalized_vendor.keyword. Search for the matches that do not contain the value"},"display_vendor":{"type":"string","title":"Filter the search by display_vendor. Search for an exact match"},"display_vendor.keyword":{"type":"string","title":"Filter the search by display_vendor.keyword. Search for the matches that contain the value"},"not.display_vendor":{"type":"string","title":"Filter the search by not.display_vendor. Search for the matches that are not equal to the value"},"not.display_vendor.keyword":{"type":"string","title":"Filter the search by not.display_vendor.keyword. Search for the matches that do not contain the value"},"product":{"type":"string","title":"Filter the search by product. Search for an exact match"},"product.keyword":{"type":"string","title":"Filter the search by product.keyword. Search for the matches that contain the value"},"not.product":{"type":"string","title":"Filter the search by not.product. Search for the matches that are not equal to the value"},"not.product.keyword":{"type":"string","title":"Filter the search by not.product.keyword. Search for the matches that do not contain the value"},"normalized_product":{"type":"string","title":"Filter the search by normalized_product. Search for an exact match"},"normalized_product.keyword":{"type":"string","title":"Filter the search by normalized_product.keyword. Search for the matches that contain the value"},"not.normalized_product":{"type":"string","title":"Filter the search by not.normalized_product. Search for the matches that are not equal to the value"},"not.normalized_product.keyword":{"type":"string","title":"Filter the search by not.normalized_product.keyword. Search for the matches that do not contain the value"},"display_product":{"type":"string","title":"Filter the search by display_product. Search for an exact match"},"display_product.keyword":{"type":"string","title":"Filter the search by display_product.keyword. Search for the matches that contain the value"},"not.display_product":{"type":"string","title":"Filter the search by not.display_product. Search for the matches that are not equal to the value"},"not.display_product.keyword":{"type":"string","title":"Filter the search by not.display_product.keyword. Search for the matches that do not contain the value"},"installed_version":{"type":"string","title":"Filter the search by installed_version. Search for an exact match"},"installed_version.keyword":{"type":"string","title":"Filter the search by installed_version.keyword. Search for the matches that contain the value"},"not.installed_version":{"type":"string","title":"Filter the search by not.installed_version. Search for the matches that are not equal to the value"},"not.installed_version.keyword":{"type":"string","title":"Filter the search by not.installed_version.keyword. Search for the matches that do not contain the value"},"normalized_installed_version":{"type":"string","title":"Filter the search by normalized_installed_version. Search for an exact match"},"normalized_installed_version.keyword":{"type":"string","title":"Filter the search by normalized_installed_version.keyword. Search for the matches that contain the value"},"not.normalized_installed_version":{"type":"string","title":"Filter the search by not.normalized_installed_version. Search for the matches that are not equal to the value"},"not.normalized_installed_version.keyword":{"type":"string","title":"Filter the search by not.normalized_installed_version.keyword. Search for the matches that do not contain the value"},"display_installed_version":{"type":"string","title":"Filter the search by display_installed_version. Search for an exact match"},"display_installed_version.keyword":{"type":"string","title":"Filter the search by display_installed_version.keyword. Search for the matches that contain the value"},"not.display_installed_version":{"type":"string","title":"Filter the search by not.display_installed_version. Search for the matches that are not equal to the value"},"not.display_installed_version.keyword":{"type":"string","title":"Filter the search by not.display_installed_version.keyword. Search for the matches that do not contain the value"},"os_info.os_type":{"type":"string","title":"Filter the search by os_info.os_type. Search for an exact match"},"os_info.os_type.keyword":{"type":"string","title":"Filter the search by os_info.os_type.keyword. Search for the matches that contain the value"},"not.os_info.os_type":{"type":"string","title":"Filter the search by not.os_info.os_type. Search for the matches that are not equal to the value"},"not.os_info.os_type.keyword":{"type":"string","title":"Filter the search by not.os_info.os_type.keyword. Search for the matches that do not contain the value"},"os_info.os_version":{"type":"string","title":"Filter the search by os_info.os_version. Search for an exact match"},"os_info.os_version.keyword":{"type":"string","title":"Filter the search by os_info.os_version.keyword. Search for the matches that contain the value"},"not.os_info.os_version":{"type":"string","title":"Filter the search by not.os_info.os_version. Search for the matches that are not equal to the value"},"not.os_info.os_version.keyword":{"type":"string","title":"Filter the search by not.os_info.os_version.keyword. Search for the matches that do not contain the value"},"os_info.os_platform":{"type":"string","title":"Filter the search by os_info.os_platform. Search for an exact match"},"os_info.os_platform.keyword":{"type":"string","title":"Filter the search by os_info.os_platform.keyword. Search for the matches that contain the value"},"not.os_info.os_platform":{"type":"string","title":"Filter the search by not.os_info.os_platform. Search for the matches that are not equal to the value"},"not.os_info.os_platform.keyword":{"type":"string","title":"Filter the search by not.os_info.os_platform.keyword. Search for the matches that do not contain the value"},"os_info.os_architecture":{"type":"string","title":"Filter the search by os_info.os_architecture. Search for an exact match"},"os_info.os_architecture.keyword":{"type":"string","title":"Filter the search by os_info.os_architecture.keyword. Search for the matches that contain the value"},"not.os_info.os_architecture":{"type":"string","title":"Filter the search by not.os_info.os_architecture. Search for the matches that are not equal to the value"},"not.os_info.os_architecture.keyword":{"type":"string","title":"Filter the search by not.os_info.os_architecture.keyword. Search for the matches that do not contain the value"},"os_info.os_release_name":{"type":"string","title":"Filter the search by os_info.os_release_name. Search for an exact match"},"os_info.os_release_name.keyword":{"type":"string","title":"Filter the search by os_info.os_release_name.keyword. Search for the matches that contain the value"},"not.os_info.os_release_name":{"type":"string","title":"Filter the search by not.os_info.os_release_name. Search for the matches that are not equal to the value"},"not.os_info.os_release_name.keyword":{"type":"string","title":"Filter the search by not.os_info.os_release_name.keyword. Search for the matches that do not contain the value"},"cve_id":{"type":"string","title":"Filter the search by cve_id. Search for an exact match"},"cve_id.keyword":{"type":"string","title":"Filter the search by cve_id.keyword. Search for the matches that contain the value"},"not.cve_id":{"type":"string","title":"Filter the search by not.cve_id. Search for the matches that are not equal to the value"},"not.cve_id.keyword":{"type":"string","title":"Filter the search by not.cve_id.keyword. Search for the matches that do not contain the value"},"severity":{"type":"string","title":"Filter the search by severity. Search for an exact match"},"severity.keyword":{"type":"string","title":"Filter the search by severity.keyword. Search for the matches that contain the value"},"not.severity":{"type":"string","title":"Filter the search by not.severity. Search for the matches that are not equal to the value"},"not.severity.keyword":{"type":"string","title":"Filter the search by not.severity.keyword. Search for the matches that do not contain the value"},"document_id":{"type":"string","title":"Filter with document_id"},"document_id.keyword":{"type":"string","title":"Filter with document_id.keyword"},"not.document_id":{"type":"array","title":"Filter the search by not.document_id. Search for the matches that are not equal to the value"},"cisa_exploitable":{"type":"boolean","title":"Filter the search by cisa_exploitable. Search for an exact match"},"known_ransomware_campaign_use":{"type":"boolean","title":"Filter the search by known_ransomware_campaign_use. Search for an exact match"},"severity_score":{"type":"number","title":"Filter the search by severity_score. Search for an exact match"},"severity_score_lt":{"type":"number","title":"Filter the search by severity_score_lt. Search for the documents that are less than the value"},"severity_score_lte":{"type":"number","title":"Filter the search by severity_score_lte. Search for the documents that are less than the value"},"severity_score_gt":{"type":"number","title":"Filter the search by severity_score_gt. Search for the documents that are greater than the value"},"severity_score_gte":{"type":"number","title":"Filter the search by severity_score_gte. Search for the documents that are greater than the value"},"installation_date_before":{"type":"string","format":"date-time","title":"Filter the search by installation_date_before. Search for an exact match"},"installation_date_after":{"type":"string","format":"date-time","title":"Filter the search by installation_date_after. Search for an exact match"},"created_at_before":{"type":"string","format":"date-time","title":"Filter the search by created_at_before. Search for an exact match"},"created_at_after":{"type":"string","format":"date-time","title":"Filter the search by created_at_after. Search for an exact match"},"published_at_before":{"type":"string","format":"date-time","title":"Filter the search by published_at_before. Search for an exact match"},"published_at_after":{"type":"string","format":"date-time","title":"Filter the search by published_at_after. Search for an exact match"},"ignored_until_before":{"type":"string","format":"date-time","title":"Filter the search by ignored_until_before"},"ignored_until_after":{"type":"string","format":"date-time","title":"Filter the search by ignored_until_after"},"ignored_at_before":{"type":"string","format":"date-time","title":"Filter the search by ignored_at_before"},"ignored_at_after":{"type":"string","format":"date-time","title":"Filter the search by ignored_at_after"},"only_ignored_cves":{"type":"boolean","title":"Display only ignored CVEs. If true, the search will include only ignored CVEs. If false, the search will not include ignored CVEs. Default is false","default":false},"cvss20_score":{"type":"number","title":"Filter the search by cvss20_score. Search for an exact match of the integer value"},"cvss20_score_lt":{"type":"number","title":"Filter the search by cvss20_score_lt. Search for the documents that are less than the value"},"cvss20_score_lte":{"type":"number","title":"Filter the search by cvss20_score_lte. Search for the documents that are less or equal than the value"},"cvss20_score_gt":{"type":"number","title":"Filter the search by cvss20_score_gt. Search for the documents that are greater than the value"},"cvss20_score_gte":{"type":"number","title":"Filter the search by cvss20_score_gte. Search for the documents that are greater or equal than the value"},"cvss30_score":{"type":"number","title":"Filter the search by cvss30_score. Search for an exact match of the integer value"},"cvss30_score_lt":{"type":"number","title":"Filter the search by cvss30_score_lt. Search for the documents that are less than the value"},"cvss30_score_lte":{"type":"number","title":"Filter the search by cvss30_score_lte. Search for the documents that are less or equal than the value"},"cvss30_score_gt":{"type":"number","title":"Filter the search by cvss30_score_gt. Search for the documents that are greater than the value"},"cvss30_score_gte":{"type":"number","title":"Filter the search by cvss30_score_gte. Search for the documents that are greater or equal than the value"},"product_signature":{"type":"number","title":"Filter the search by product_signature. Search for an exact match"},"latest_version_available":{"type":"string","title":"Filter the search by latest_version_available. Search for an exact match"},"architecture":{"type":"string","title":"Filter the search by software architecture. Search for an exact match"},"language":{"type":"string","title":"Filter the search by software language. Search for an exact match"},"supports_update":{"type":"boolean","title":"Filter the search by supports_update. Search for an exact match"},"supports_uninstall":{"type":"boolean","title":"Filter the search by supports_uninstall. Search for an exact match"},"name_multi_search":{"type":"string","title":"Filter with alises"},"ignored_by":{"type":"string","title":"Filter the search by ignored_by. Search for an exact match"},"ignored_by.keyword":{"type":"string","title":"Filter the search by ignored_by.keyword. Search for the matches that contain the value"},"not.ignored_by":{"type":"string","title":"Filter the search by not.ignored_by. Search for the matches that are not equal to the value"},"not.ignored_by.keyword":{"type":"string","title":"Filter the search by not.ignored_by.keyword. Search for the matches that do not contain the value"},"exists":{"type":"array","title":"Filter the results for records that have these fields","items":{"type":"string","enum":["domain_name","product_signature","ignored_until"]}},"not.exists":{"type":"array","title":"Filter the results for records that do not have these fields","items":{"type":"string","enum":["domain_name","product_signature","ignored_until"]}},"sort_field":{"type":"string","title":"Sort field","enum":["account_id","account_name","parent_account_id","group_id","root_group_id","machine_id","object_guid","host_name","fully_qualified_host_name","alias","sort_name","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","installed_version","normalized_installed_version","display_installed_version","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","cve_id","severity","installation_date","created_at","published_at","cisa_exploitable","known_ransomware_campaign_use","severity_score","cvss20_score","cvss30_score","group_name","domain_name","supports_update","supports_uninstall","ignored_until","ignored_at","active_directory.user.display_name","active_directory.machine.display_name","active_directory.user.ou","active_directory.machine.ou","active_directory.user.sam_account_name","active_directory.machine.sam_account_name"]},"sort_order":{"type":"string","title":"Sorting direction","default":"asc","enum":["asc","desc"]},"page_size":{"type":"number","title":"The size of the page. If you only need aggregations, set it to 0","minimum":0,"default":50,"maximum":2000},"aggregations":{"type":"array","title":"The Aggregations Schema","items":{"type":"string","title":"Aggregations","default":[],"enum":["account_id","account_name","parent_account_id","group_id","root_group_id","machine_id","endpoints","object_guid","host_name","fully_qualified_host_name","alias","sort_name","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","installed_version","normalized_installed_version","display_installed_version","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","cve_id","severity","severity_score","cisa_exploitable","known_ransomware_campaign_use","cvss20_score","cvss30_score"]}},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}},"allOf":[{"type":"object","title":"Active Directory Search Filters","properties":{"active_directory.user.display_name":{"type":"string","title":"Filter the search by active_directory.user.display_name. Search for the matches that are equal to the value"},"active_directory.user.display_name.keyword":{"type":"string","title":"Filter the search by active_directory.user.display_name.keyword. Search for the matches that contain the value"},"active_directory.user.ou":{"type":"string","title":"Filter the search by active_directory.user.ou. Search for the matches that are equal to the value"},"active_directory.user.ou.keyword":{"type":"string","title":"Filter the search by active_directory.user.ou.keyword. Search for the matches that contain the value"},"active_directory.user.ou.path":{"type":"string","title":"Filter the search by active_directory.user.ou.path. Search for the matches that are equal to the value"},"active_directory.user.ou.path.keyword":{"type":"string","title":"Filter the search by active_directory.user.ou.path.keyword. Search for the matches that contain the value"},"active_directory.user.sam_account_name":{"type":"string","title":"Filter the search by active_directory.user.sam_account_name. Search for the matches that are equal to the value"},"active_directory.user.sam_account_name.keyword":{"type":"string","title":"Filter the search by active_directory.user.sam_account_name.keyword. Search for the matches that contain the value"},"active_directory.machine.display_name":{"type":"string","title":"Filter the search by active_directory.machine.display_name. Search for the matches that are equal to the value"},"active_directory.machine.display_name.keyword":{"type":"string","title":"Filter the search by active_directory.machine.display_name.keyword. Search for the matches that contain the value"},"active_directory.machine.ou":{"type":"string","title":"Filter the search by active_directory.machine.ou. Search for the matches that are equal to the value"},"active_directory.machine.ou.keyword":{"type":"string","title":"Filter the search by active_directory.machine.ou.keyword. Search for the matches that contain the value"},"active_directory.machine.ou.path":{"type":"string","title":"Filter the search by active_directory.machine.ou.path. Search for the matches that are equal to the value"},"active_directory.machine.ou.path.keyword":{"type":"string","title":"Filter the search by active_directory.machine.ou.path.keyword. Search for the matches that contain the value"},"active_directory.machine.sam_account_name":{"type":"string","title":"Filter the search by active_directory.machine.sam_account_name. Search for the matches that are equal to the value"},"active_directory.machine.sam_account_name.keyword":{"type":"string","title":"Filter the search by active_directory.machine.sam_account_name.keyword. Search for the matches that contain the value"}}}]}],"properties":{"group_by":{"type":"string","title":"The groupBy Schema","enum":["account_id","parent_account_id","group_id","root_group_id","machine_id","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","installed_version","normalized_installed_version","display_installed_version","installation_date","host_name","fully_qualified_host_name","alias","created_at","os_type","os_version","os_platform","os_architecture","os_release_name","cve_id","cisa_exploitable","known_ransomware_campaign_use","severity","severity_score","published_at","cvss20_score","cvss30_score","domain_name","active_directory.user.display_name","active_directory.user.ou","active_directory.machine.display_name","active_directory.machine.ou"]},"page_size":{"type":"number","title":"The page_size Schema","minimum":50,"maximum":2000},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}},{"type":"object","required":["account_ids"],"properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"The Post CVE Search GroupBy Response Schema","required":["results","next_cursor"],"properties":{"results":{"type":"array","title":"The Results Schema","default":[],"items":{"type":"object","title":"The Items Schema","required":["value","total"],"properties":{"value":{"type":"string","title":"The Value Schema"},"total":{"type":"integer","title":"The Total Schema"},"host_name":{"type":"string","title":"The host name Schema (only for machine_id aggregation)"},"fully_qualified_host_name":{"type":"string","title":"The host name Schema (only for machine_id aggregation)"},"tags":{"type":"object","additionalProperties":true,"title":"The tags Schema (only for machine_id aggregation)"},"account_id":{"type":"string","title":"The account_id Schema (only for machine_id aggregation)"},"group_name":{"type":"string","title":"The group name Schema (only for group_id aggregation)"},"account_name":{"type":"string","title":"The account_name Schema (only for account_id aggregation)"}}}},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}}}}},"tags":["Vulnerability Management"],"operationId":"api.v2.rmm.search.cve.group"}},"/oneview/v1/accounts/{account_id}/devicecontrol/exclusions":{"post":{"description":"Create a device exclusion.","summary":"Create a device exclusion","security":[{"client_credentials":["write"]},{"user_permissions":["deviceControl.createAllowlistRule"]}],"status":{"outage":["auth"]},"parameters":[{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Create Device Exclusion","additionalProperties":true,"required":["enabled","exclude_from","account_level"],"properties":{"vendor":{"type":"string","title":"Device Vendor"},"product":{"type":"string","title":"Product"},"serial":{"type":"string","title":"Device Serial Number"},"value":{"type":"string","title":"String value","examples":["%PROGRAMDATA%"]},"enabled":{"type":"boolean","title":"Enable"},"comment":{"type":"string","title":"Comment"},"exclude_from":{"type":"object","title":"Exclusion applied to","properties":{"exploit_protection":{"type":["boolean","null"],"title":"Uses multiple protection layers to guard against attempted exploits of vulnerabilities in legitimate applications"},"malware_protection":{"type":["boolean","null"],"title":"Protects against malware infections and zero-day threats"},"ransomware_protection":{"type":["boolean","null"],"title":"Detects and blocks ransomware threats using advanced behavior analysis"},"suspicious_activity":{"type":["boolean","null"],"title":"Uses advanced machine learning to identify suspicious processes that require additional review"},"website_protection":{"type":["boolean","null"],"title":"Blocks network traffic from malicious websites and IP addresses"},"bruteforce_protection":{"type":["boolean","null"],"title":"Bruteforce attack protection on RDP, IMAP and so on."}}},"account_level":{"type":"boolean","title":"Account level"},"policy_ids":{"type":"array","title":"IDs of Policies","items":{"type":"string","title":"ID of the Policy"}}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"title":"Device Exclusion response schema","type":"object","additionalProperties":true,"allOf":[{"type":"object","title":"Create Device Exclusion","additionalProperties":true,"required":["enabled","exclude_from","account_level"],"properties":{"vendor":{"type":"string","title":"Device Vendor"},"product":{"type":"string","title":"Product"},"serial":{"type":"string","title":"Device Serial Number"},"value":{"type":"string","title":"String value","examples":["%PROGRAMDATA%"]},"enabled":{"type":"boolean","title":"Enable"},"comment":{"type":"string","title":"Comment"},"exclude_from":{"type":"object","title":"Exclusion applied to","properties":{"exploit_protection":{"type":["boolean","null"],"title":"Uses multiple protection layers to guard against attempted exploits of vulnerabilities in legitimate applications"},"malware_protection":{"type":["boolean","null"],"title":"Protects against malware infections and zero-day threats"},"ransomware_protection":{"type":["boolean","null"],"title":"Detects and blocks ransomware threats using advanced behavior analysis"},"suspicious_activity":{"type":["boolean","null"],"title":"Uses advanced machine learning to identify suspicious processes that require additional review"},"website_protection":{"type":["boolean","null"],"title":"Blocks network traffic from malicious websites and IP addresses"},"bruteforce_protection":{"type":["boolean","null"],"title":"Bruteforce attack protection on RDP, IMAP and so on."}}},"account_level":{"type":"boolean","title":"Account level"},"policy_ids":{"type":"array","title":"IDs of Policies","items":{"type":"string","title":"ID of the Policy"}}}}],"properties":{"id":{"type":"string","title":"UUID of the exclusion (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"type":{"type":"integer","title":"16: Device Control Exclusion","const":16},"created_at":{"type":"string","title":"Created at"},"updated_at":{"type":"string","title":"Updated at"},"created_by":{"type":"string","title":"Created by"},"updated_by":{"type":"string","title":"Updated by"}}}}}}},"tags":["Device Control"],"operationId":"api.rmm.post.device.exclusions"},"get":{"description":"Get all device exclusions.","summary":"Get all device exclusions","security":[{"client_credentials":["read"]},{"user_permissions":["deviceControl.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}},{"name":"next_cursor","required":false,"in":"query","description":"The pagination cursor for next set of results. For further documentation, check Pagination section.","schema":{"type":"string"}},{"name":"search_string","required":false,"in":"query","description":"Search with exclusion string.","schema":{"type":"string"}},{"name":"policy_ids","required":false,"in":"query","description":"Search with exclusion policy ids.","schema":{"type":"string"}},{"name":"type","required":false,"in":"query","description":"Search with exclusion type","schema":{"type":"number"}},{"name":"since","required":false,"in":"query","description":"Timestamp to filter since exclusion times.","schema":{"type":"string"}},{"name":"until","required":false,"in":"query","description":"Timestamp to filter until exclusion times.","schema":{"type":"string"}},{"name":"sort_by","required":false,"in":"query","description":"Field to sort results with.","schema":{"type":"string","enum":["enabled","value","created_at","updated_at","created_by","updated_by","type"]}},{"name":"sort_order","required":false,"in":"query","description":"Sorting direction","schema":{"type":"string","enum":["asc","desc"]}},{"name":"populate_risk","required":false,"in":"query","description":"Populate risk fields on exclusions","schema":{"type":"boolean"}},{"name":"risk","required":false,"in":"query","description":"Filter exclusions by risk level (validated by Retina)","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"title":"Device exclusion response schema","type":"object","additionalProperties":true,"properties":{"exclusions":{"type":"array","title":"Exclusions","items":{"title":"Device Exclusion response schema","type":"object","additionalProperties":true,"allOf":[{"type":"object","title":"Create Device Exclusion","additionalProperties":true,"required":["enabled","exclude_from","account_level"],"properties":{"vendor":{"type":"string","title":"Device Vendor"},"product":{"type":"string","title":"Product"},"serial":{"type":"string","title":"Device Serial Number"},"value":{"type":"string","title":"String value","examples":["%PROGRAMDATA%"]},"enabled":{"type":"boolean","title":"Enable"},"comment":{"type":"string","title":"Comment"},"exclude_from":{"type":"object","title":"Exclusion applied to","properties":{"exploit_protection":{"type":["boolean","null"],"title":"Uses multiple protection layers to guard against attempted exploits of vulnerabilities in legitimate applications"},"malware_protection":{"type":["boolean","null"],"title":"Protects against malware infections and zero-day threats"},"ransomware_protection":{"type":["boolean","null"],"title":"Detects and blocks ransomware threats using advanced behavior analysis"},"suspicious_activity":{"type":["boolean","null"],"title":"Uses advanced machine learning to identify suspicious processes that require additional review"},"website_protection":{"type":["boolean","null"],"title":"Blocks network traffic from malicious websites and IP addresses"},"bruteforce_protection":{"type":["boolean","null"],"title":"Bruteforce attack protection on RDP, IMAP and so on."}}},"account_level":{"type":"boolean","title":"Account level"},"policy_ids":{"type":"array","title":"IDs of Policies","items":{"type":"string","title":"ID of the Policy"}}}}],"properties":{"id":{"type":"string","title":"UUID of the exclusion (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"type":{"type":"integer","title":"16: Device Control Exclusion","const":16},"created_at":{"type":"string","title":"Created at"},"updated_at":{"type":"string","title":"Updated at"},"created_by":{"type":"string","title":"Created by"},"updated_by":{"type":"string","title":"Updated by"}}}},"total_count":{"type":"integer","title":"Total Count","description":"Total count of results."},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}}}}},"tags":["Device Control"],"operationId":"api.rmm.get.device.exclusions"}},"/oneview/v1/accounts/{account_id}/devicecontrol/exclusions/bulk":{"post":{"description":"Create device exclusions in bulk.","summary":"Create device exclusions in bulk","security":[{"client_credentials":["write"]},{"user_permissions":["deviceControl.createAllowlistRule"]}],"status":{"outage":["auth"]},"parameters":[{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"array","title":"Create Device Exclusion Bulk","items":{"allOf":[{"type":"object","title":"Create Device Exclusion","additionalProperties":true,"required":["enabled","exclude_from","account_level"],"properties":{"vendor":{"type":"string","title":"Device Vendor"},"product":{"type":"string","title":"Product"},"serial":{"type":"string","title":"Device Serial Number"},"value":{"type":"string","title":"String value","examples":["%PROGRAMDATA%"]},"enabled":{"type":"boolean","title":"Enable"},"comment":{"type":"string","title":"Comment"},"exclude_from":{"type":"object","title":"Exclusion applied to","properties":{"exploit_protection":{"type":["boolean","null"],"title":"Uses multiple protection layers to guard against attempted exploits of vulnerabilities in legitimate applications"},"malware_protection":{"type":["boolean","null"],"title":"Protects against malware infections and zero-day threats"},"ransomware_protection":{"type":["boolean","null"],"title":"Detects and blocks ransomware threats using advanced behavior analysis"},"suspicious_activity":{"type":["boolean","null"],"title":"Uses advanced machine learning to identify suspicious processes that require additional review"},"website_protection":{"type":["boolean","null"],"title":"Blocks network traffic from malicious websites and IP addresses"},"bruteforce_protection":{"type":["boolean","null"],"title":"Bruteforce attack protection on RDP, IMAP and so on."}}},"account_level":{"type":"boolean","title":"Account level"},"policy_ids":{"type":"array","title":"IDs of Policies","items":{"type":"string","title":"ID of the Policy"}}}}]}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{}}}},"tags":["Device Control"],"operationId":"api.rmm.post.device.exclusions.bulk"}},"/oneview/v1/accounts/{account_id}/devicecontrol/exclusions/{id}":{"delete":{"description":"Delete a device exclusion.","summary":"Delete a device exclusion","security":[{"client_credentials":["write"]},{"user_permissions":["deviceControl.deleteAllowlistRule"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":true,"in":"path","description":"Valid UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"Successful response"}},"tags":["Device Control"],"operationId":"api.rmm.delete.device.exclusions"},"get":{"description":"Get a device exclusion by its ID.","summary":"Get a device exclusion","security":[{"client_credentials":["read"]},{"user_permissions":["deviceControl.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":true,"in":"path","description":"ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"title":"Device Exclusion response schema","type":"object","additionalProperties":true,"allOf":[{"type":"object","title":"Create Device Exclusion","additionalProperties":true,"required":["enabled","exclude_from","account_level"],"properties":{"vendor":{"type":"string","title":"Device Vendor"},"product":{"type":"string","title":"Product"},"serial":{"type":"string","title":"Device Serial Number"},"value":{"type":"string","title":"String value","examples":["%PROGRAMDATA%"]},"enabled":{"type":"boolean","title":"Enable"},"comment":{"type":"string","title":"Comment"},"exclude_from":{"type":"object","title":"Exclusion applied to","properties":{"exploit_protection":{"type":["boolean","null"],"title":"Uses multiple protection layers to guard against attempted exploits of vulnerabilities in legitimate applications"},"malware_protection":{"type":["boolean","null"],"title":"Protects against malware infections and zero-day threats"},"ransomware_protection":{"type":["boolean","null"],"title":"Detects and blocks ransomware threats using advanced behavior analysis"},"suspicious_activity":{"type":["boolean","null"],"title":"Uses advanced machine learning to identify suspicious processes that require additional review"},"website_protection":{"type":["boolean","null"],"title":"Blocks network traffic from malicious websites and IP addresses"},"bruteforce_protection":{"type":["boolean","null"],"title":"Bruteforce attack protection on RDP, IMAP and so on."}}},"account_level":{"type":"boolean","title":"Account level"},"policy_ids":{"type":"array","title":"IDs of Policies","items":{"type":"string","title":"ID of the Policy"}}}}],"properties":{"id":{"type":"string","title":"UUID of the exclusion (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"type":{"type":"integer","title":"16: Device Control Exclusion","const":16},"created_at":{"type":"string","title":"Created at"},"updated_at":{"type":"string","title":"Updated at"},"created_by":{"type":"string","title":"Created by"},"updated_by":{"type":"string","title":"Updated by"}}}}}}},"tags":["Device Control"],"operationId":"api.rmm.get.device.exclusions.id"},"put":{"description":"Update a device exclusion.","summary":"Update a device exclusion","security":[{"client_credentials":["write"]},{"user_permissions":["deviceControl.editAllowlistRule"]}],"status":{"outage":["auth"]},"parameters":[{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Create Device Exclusion","additionalProperties":true,"required":["enabled","exclude_from","account_level"],"properties":{"vendor":{"type":"string","title":"Device Vendor"},"product":{"type":"string","title":"Product"},"serial":{"type":"string","title":"Device Serial Number"},"value":{"type":"string","title":"String value","examples":["%PROGRAMDATA%"]},"enabled":{"type":"boolean","title":"Enable"},"comment":{"type":"string","title":"Comment"},"exclude_from":{"type":"object","title":"Exclusion applied to","properties":{"exploit_protection":{"type":["boolean","null"],"title":"Uses multiple protection layers to guard against attempted exploits of vulnerabilities in legitimate applications"},"malware_protection":{"type":["boolean","null"],"title":"Protects against malware infections and zero-day threats"},"ransomware_protection":{"type":["boolean","null"],"title":"Detects and blocks ransomware threats using advanced behavior analysis"},"suspicious_activity":{"type":["boolean","null"],"title":"Uses advanced machine learning to identify suspicious processes that require additional review"},"website_protection":{"type":["boolean","null"],"title":"Blocks network traffic from malicious websites and IP addresses"},"bruteforce_protection":{"type":["boolean","null"],"title":"Bruteforce attack protection on RDP, IMAP and so on."}}},"account_level":{"type":"boolean","title":"Account level"},"policy_ids":{"type":"array","title":"IDs of Policies","items":{"type":"string","title":"ID of the Policy"}}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"title":"Device Exclusion response schema","type":"object","additionalProperties":true,"allOf":[{"type":"object","title":"Create Device Exclusion","additionalProperties":true,"required":["enabled","exclude_from","account_level"],"properties":{"vendor":{"type":"string","title":"Device Vendor"},"product":{"type":"string","title":"Product"},"serial":{"type":"string","title":"Device Serial Number"},"value":{"type":"string","title":"String value","examples":["%PROGRAMDATA%"]},"enabled":{"type":"boolean","title":"Enable"},"comment":{"type":"string","title":"Comment"},"exclude_from":{"type":"object","title":"Exclusion applied to","properties":{"exploit_protection":{"type":["boolean","null"],"title":"Uses multiple protection layers to guard against attempted exploits of vulnerabilities in legitimate applications"},"malware_protection":{"type":["boolean","null"],"title":"Protects against malware infections and zero-day threats"},"ransomware_protection":{"type":["boolean","null"],"title":"Detects and blocks ransomware threats using advanced behavior analysis"},"suspicious_activity":{"type":["boolean","null"],"title":"Uses advanced machine learning to identify suspicious processes that require additional review"},"website_protection":{"type":["boolean","null"],"title":"Blocks network traffic from malicious websites and IP addresses"},"bruteforce_protection":{"type":["boolean","null"],"title":"Bruteforce attack protection on RDP, IMAP and so on."}}},"account_level":{"type":"boolean","title":"Account level"},"policy_ids":{"type":"array","title":"IDs of Policies","items":{"type":"string","title":"ID of the Policy"}}}}],"properties":{"id":{"type":"string","title":"UUID of the exclusion (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"type":{"type":"integer","title":"16: Device Control Exclusion","const":16},"created_at":{"type":"string","title":"Created at"},"updated_at":{"type":"string","title":"Updated at"},"created_by":{"type":"string","title":"Created by"},"updated_by":{"type":"string","title":"Updated by"}}}}}}},"tags":["Device Control"],"operationId":"api.rmm.put.device.exclusions"}},"/oneview/v1/devicecontrol/export":{"post":{"description":"Export Device Control events. You can export across multiple accounts. Specify your interested fields and the output format.\n\nSupported output formats: csv, xlsx, json.\n\n## Settings\n\n| Name | Description |\n|------|-------------|\n| groups | List of queries. The constraints accepted are the same accepted by the search device control event route. Refer to [Search Device Control Events API](#operation/api.v2.rmm.search.devicecontrol) for more information about the constraints accepted. |\n| download | If set to true, the server will set the `Content-Disposition` header using the `filename` and `format` |\n| select | Which fields to select, and which field name to map to. See request schema for allowed values |\n| type | Output encoding (for `csv` and `json` format) |\n| filename | Name of the file to be set in `Content-Disposition` header if `download` = true |\n\n## Examples\n\n### Download CSV file\n\nA request with this body sent by a browser will download a file called `nameofthefile.csv`, displaying a table with columns: `Date`, `Action Taken`, `Device`, `Machine Name` for all events with `Blocked` status, starting from `2022/02/01` within account id `1e14cd0a-2ef3-4db3-b8a4-c89894d9aa34`:\n\n```json\n\t{\n \"download\":true,\n \"format\":\"csv\",\n \"groups\":[\n {\n \"status\":\"blocked\",\n \"account_ids\":[\n \"1e14cd0a-2ef3-4db3-b8a4-c89894d9aa34\"\n ],\n \"start_date\":\"2022-02-01T00:00:00-00:00\"\n }\n ],\n \"populate\":{\n \"account\":true,\n \"endpoint\":true,\n \"group\":true\n },\n \"select\":[\n {\n \"field\":\"scanned_at\",\n \"newField\":\"Date\"\n },\n {\n \"field\":\"status\",\n \"newField\":\"Action taken\"\n },\n {\n \"field\":\"device_control.physical_disk_name\",\n \"newField\":\"Device\"\n },\n {\n \"field\":\"machine_name\",\n \"newField\":\"Endpoint\"\n }\n ],\n \"type\":\"string\"\n}\n```\n\n\n","summary":"Export device control events","security":[{"client_credentials":["execute"]},{"user_permissions":["deviceControl.view"]}],"status":{"outage":["auth","search_stateless"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Export request","required":["groups","select","format"],"properties":{"format":{"type":"string","title":"The output file","enum":["csv","xlsx","html","ods","txt","rtf","json"]},"download":{"type":"boolean","title":"Whether to instruct the client to download the response as a file. Only clients like browsers are supported"},"type":{"type":"string","title":"The encoding of the output","enum":["string","base64","binary"],"default":"string"},"select":{"type":"array","title":"Which fields to select from the response","items":{"type":"object","title":"Field","required":["field","newField"],"properties":{"newField":{"type":"string","title":"the new value"},"field":{"type":"string","title":"The response field to map to a new value","enum":["type","group_id","path","status","id","machine_id","account_id","account.name","group.name","detection_id","scanned_at","scanned_at_offset_seconds","reported_at","category","is_rtp_stream_event","process_name","cleaned_at","machine_name","machine_ip","child_trace_count","source_location","destination_location","machine_location","trace_ip","trace_port","threat_name","is_root_detection","agent.at","agent.last_user","agent.fully_qualified_host_name","agent.started_at_local","agent.started_at_offset","agent.os_info.os_type","agent.os_info.os_version","agent.os_info.os_platform","agent.os_info.os_architecture","agent.os_info.os_release_name","agent.domain_name","agent.engine_version","agent.policy_etag","agent.host_name","agent.nics.ips","agent.nics.mac_address","agent.object_guid","sha256","md5","device_control.physical_disk_name","device_control.pnp_device_id","device_control.device_id","device_control.disk_interface","device_control.manufacturer","device_control.serial_number","device_control.file_system","device_control.volume_name","device_control.volume_serial","device_control.volume_device_path","device_control.block_status","device_control.timestamp","device_control.drive_compressed","action_taken","device_control.access","active_directory.user.display_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.machine.display_name","active_directory.machine.sam_account_name","active_directory.machine.ou"]}}}},"groups":{"type":"array","title":"List of queries","items":{"type":"object","required":["account_ids"],"title":"List of queries to fetch endpoints","additionalProperties":true,"properties":{"account_ids":{"type":"array","title":"List of account IDs for this query","items":{"type":"string","title":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}}}}}}},"responses":{"200":{"description":"Successful response"}},"tags":["Device Control"],"operationId":"api.v2.rmm.post.export.devicecontrol"}},"/oneview/v1/devicecontrol/export/async":{"post":{"description":"Export device control events asynchronously","summary":"Export device control events asynchronously","security":[{"client_credentials":["execute"]},{"user_permissions":["deviceControl.view"]}],"status":{"outage":["auth","search_stateless"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Export request","required":["groups","select","format"],"properties":{"format":{"type":"string","title":"The output file","enum":["csv","xlsx","html","ods","txt","rtf","json"]},"download":{"type":"boolean","title":"Whether to instruct the client to download the response as a file. Only clients like browsers are supported"},"type":{"type":"string","title":"The encoding of the output","enum":["string","base64","binary"],"default":"string"},"select":{"type":"array","title":"Which fields to select from the response","items":{"type":"object","title":"Field","required":["field","newField"],"properties":{"newField":{"type":"string","title":"the new value"},"field":{"type":"string","title":"The response field to map to a new value","enum":["type","group_id","path","status","id","machine_id","account_id","account.name","group.name","detection_id","scanned_at","scanned_at_offset_seconds","reported_at","category","is_rtp_stream_event","process_name","cleaned_at","machine_name","machine_ip","child_trace_count","source_location","destination_location","machine_location","trace_ip","trace_port","threat_name","is_root_detection","agent.at","agent.last_user","agent.fully_qualified_host_name","agent.started_at_local","agent.started_at_offset","agent.os_info.os_type","agent.os_info.os_version","agent.os_info.os_platform","agent.os_info.os_architecture","agent.os_info.os_release_name","agent.domain_name","agent.engine_version","agent.policy_etag","agent.host_name","agent.nics.ips","agent.nics.mac_address","agent.object_guid","sha256","md5","device_control.physical_disk_name","device_control.pnp_device_id","device_control.device_id","device_control.disk_interface","device_control.manufacturer","device_control.serial_number","device_control.file_system","device_control.volume_name","device_control.volume_serial","device_control.volume_device_path","device_control.block_status","device_control.timestamp","device_control.drive_compressed","action_taken","device_control.access","active_directory.user.display_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.machine.display_name","active_directory.machine.sam_account_name","active_directory.machine.ou"]}}}},"groups":{"type":"array","title":"List of queries","items":{"type":"object","required":["account_ids"],"title":"List of queries to fetch endpoints","additionalProperties":true,"properties":{"account_ids":{"type":"array","title":"List of account IDs for this query","items":{"type":"string","title":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}}}}}}},"responses":{"200":{"description":"Successful response"}},"tags":["Device Control"],"operationId":"api.v2.rmm.post.export.devicecontrol.async"}},"/oneview/v1/accounts/{account_id}/devicecontrol/{id}":{"get":{"description":"Get device control event and its full information by the device control event ID.","summary":"Get detection control event by ID","security":[{"client_credentials":["read"]},{"user_permissions":["deviceControl.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":true,"in":"path","description":"Valid UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"account_id","required":false,"in":"path","description":"Valid account UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Get device control event by id","additionalProperties":false,"properties":{"id":{"type":"string","title":"ID"},"type":{"type":"array","title":"Type","items":{"type":"string","title":"Type items"}},"status":{"type":"string","title":"Status"},"path":{"type":"string","title":"Path"},"group_id":{"type":"string","title":"Group ID"},"is_root_detection":{"type":"boolean","title":"Is root detection"},"machine_id":{"type":"string","title":"Endpoint ID"},"account_id":{"type":"string","title":"Account ID"},"detection_id":{"type":"string","title":"Detection ID"},"scanned_at":{"type":"string","title":"Scanned at"},"scanned_at_offset_seconds":{"type":"integer","title":"Scanned at offset seconds"},"reported_at":{"type":"string","title":"Reported at"},"threat_name":{"type":"string","title":"Threat name"},"category":{"type":"string","title":"Category"},"is_rtp_stream_event":{"type":"boolean","title":"Is rtp stream event"},"process_name":{"type":"string","title":"Process name"},"cleaned_at":{"type":"string","title":"Cleaned at"},"machine_name":{"type":"string","title":"Endpoint name"},"trace_id":{"type":"string","title":"Trace ID"},"scan_id":{"type":"string","title":"Scan ID"},"affected_application":{"type":"string","title":"Affected application"},"last_user":{"type":"string","title":"Last user"},"md5":{"type":"string","title":"MD5"},"sha256":{"type":"string","title":"SHA256"},"machine_ip":{"type":"string","title":"Machine IP address"},"child_trace_count":{"type":"integer","title":"Child trace count"},"action_taken":{"type":"string","title":"Action taken"},"agent":{"allOf":[{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"The root schema","description":"The root schema comprises the entire JSON document.","default":{},"examples":[{"at":"2020-10-23T14:20:51.006558Z","is_software_update_available":false,"started_at_local":"2020-10-23T14:20:50.920306Z","started_at_offset":-25200,"nics":[{"ips":["10.151.110.52"],"description":"Intel(R) 82574L Gigabit Network Connection","mac_address":"005056B91173"}],"os_info":{"os_type":"Workstation","os_version":"6.3.9600","os_platform":"Windows","os_architecture":"x86","os_release_name":"Microsoft Windows 8.1 Pro"},"fully_qualified_host_name":"sahamedw8-1x86","plugins":{"windows_remote_intrusion_detection_and_prevention":{"product_name":"Windows Remote Intrusion Detection and Prevention","plugin_version":"1.2.0.21"},"endpoint_protection":{"sdk_version":"4.2.1.90","product_name":"Endpoint Protection","plugin_version":"1.2.0.844","update_package_version":"1.0.31870","component_package_version":"1.0.1085","reboot_reasons":0},"asset_manager":{"product_name":"Asset Manager","plugin_version":"1.2.0.330","reboot_reasons":0},"endpoint_detection_and_response":{"product_name":"Endpoint Detection and Response","plugin_version":"1.2.0.297","reboot_reasons":0}},"engine_version":"1.2.0.821","policy_etag":"c6ea44914b72c92cba939ac3bd369dc4","last_user":"SAHAMEDW8-1X86\\Administrator","serial_number":"c02thb32g8wn","host_name":"sahamedw8-1x86","machine_id":"f2bcafe1-cb2b-4833-b6c9-6148b9511c8f","machine_ip":"216.75.233.210"}],"properties":{"at":{"type":"string","title":"The at schema","default":"","examples":["2020-10-23T14:20:51.006558Z"]},"is_software_update_available":{"type":"boolean","title":"The is_software_update_available schema","default":false,"examples":[false]},"started_at_local":{"type":"string","title":"The started_at_local schema","default":"","examples":["2020-10-23T14:20:50.920306Z"]},"started_at_offset":{"type":"integer","title":"The started_at_offset schema","default":0,"examples":[-25200]},"nics":{"type":"array","title":"The nics schema","default":[],"examples":[[{"ips":["10.151.110.52"],"description":"Intel(R) 82574L Gigabit Network Connection","mac_address":"005056B91173"}]],"additionalItems":true,"items":{"anyOf":[{"type":"object","title":"The first anyOf schema","default":{},"examples":[{"ips":["10.151.110.52"],"description":"Intel(R) 82574L Gigabit Network Connection","mac_address":"005056B91173"}],"properties":{"ips":{"type":"array","title":"The ips schema","default":[],"examples":[["10.151.110.52"]],"additionalItems":true,"items":{"anyOf":[{"type":"string","title":"The first anyOf schema","default":"","examples":["10.151.110.52"]}]}},"description":{"type":"string","title":"The description schema","default":"","examples":["Intel(R) 82574L Gigabit Network Connection"]},"mac_address":{"type":"string","title":"The mac_address schema","default":"","examples":["005056B91173"]}},"additionalProperties":true}]}},"os_info":{"type":"object","title":"The os_info schema","default":{},"examples":[{"os_type":"Workstation","os_version":"6.3.9600","os_platform":"Windows","os_architecture":"x86","os_release_name":"Microsoft Windows 8.1 Pro"}],"properties":{"os_type":{"type":"string","title":"The os_type schema","default":"","examples":["Workstation"]},"os_version":{"type":"string","title":"The os_version schema","default":"","examples":["6.3.9600"]},"os_platform":{"type":"string","title":"The os_platform schema","default":"","examples":["Windows"]},"os_architecture":{"type":"string","title":"The os_architecture schema","default":"","examples":["x86"]},"os_release_name":{"type":"string","title":"The os_release_name schema","default":"","examples":["Microsoft Windows 8.1 Pro"]}},"additionalProperties":true},"fully_qualified_host_name":{"type":"string","title":"The fully_qualified_host_name schema","default":"","examples":["sahamedw8-1x86"]},"plugins":{"type":"object","title":"The plugins schema","default":{},"examples":[{"windows_remote_intrusion_detection_and_prevention":{"product_name":"Windows Remote Intrusion Detection and Prevention","plugin_version":"1.2.0.21"},"endpoint_protection":{"sdk_version":"4.2.1.90","product_name":"Endpoint Protection","plugin_version":"1.2.0.844","update_package_version":"1.0.31870","component_package_version":"1.0.1085","reboot_reasons":0},"asset_manager":{"product_name":"Asset Manager","plugin_version":"1.2.0.330","reboot_reasons":0},"endpoint_detection_and_response":{"product_name":"Endpoint Detection and Response","plugin_version":"1.2.0.297","reboot_reasons":0}}],"properties":{"windows_remote_intrusion_detection_and_prevention":{"type":"object","title":"The windows_remote_intrusion_detection_and_prevention schema","default":{},"examples":[{"product_name":"Windows Remote Intrusion Detection and Prevention","plugin_version":"1.2.0.21"}],"properties":{"product_name":{"type":"string","title":"The product_name schema","default":"","examples":["Windows Remote Intrusion Detection and Prevention"]},"plugin_version":{"type":"string","title":"The plugin_version schema","default":"","examples":["1.2.0.21"]}},"additionalProperties":true},"endpoint_protection":{"type":"object","title":"The endpoint_protection schema","default":{},"examples":[{"sdk_version":"4.2.1.90","product_name":"Endpoint Protection","plugin_version":"1.2.0.844","update_package_version":"1.0.31870","component_package_version":"1.0.1085","reboot_reasons":0}],"properties":{"sdk_version":{"type":"string","title":"The sdk_version schema","default":"","examples":["4.2.1.90"]},"product_name":{"type":"string","title":"The product_name schema","default":"","examples":["Endpoint Protection"]},"plugin_version":{"type":"string","title":"The plugin_version schema","default":"","examples":["1.2.0.844"]},"update_package_version":{"type":"string","title":"The update_package_version schema","default":"","examples":["1.0.31870"]},"component_package_version":{"type":"string","title":"The component_package_version schema","default":"","examples":["1.0.1085"]},"reboot_reasons":{"type":"integer","title":"The reboot_reasons schema","default":0,"examples":[0]}},"additionalProperties":true},"asset_manager":{"type":"object","title":"The asset_manager schema","default":{},"examples":[{"product_name":"Asset Manager","plugin_version":"1.2.0.330","reboot_reasons":0}],"properties":{"product_name":{"type":"string","title":"The product_name schema","default":"","examples":["Asset Manager"]},"plugin_version":{"type":"string","title":"The plugin_version schema","default":"","examples":["1.2.0.330"]},"reboot_reasons":{"type":"integer","title":"The reboot_reasons schema","default":0,"examples":[0]}},"additionalProperties":true},"endpoint_detection_and_response":{"type":"object","title":"The endpoint_detection_and_response schema","default":{},"examples":[{"product_name":"Endpoint Detection and Response","plugin_version":"1.2.0.297","reboot_reasons":0}],"properties":{"product_name":{"type":"string","title":"The product_name schema","default":"","examples":["Endpoint Detection and Response"]},"plugin_version":{"type":"string","title":"The plugin_version schema","default":"","examples":["1.2.0.297"]},"reboot_reasons":{"type":"integer","title":"The reboot_reasons schema","default":0,"examples":[0]}},"additionalProperties":true}},"additionalProperties":true},"engine_version":{"type":"string","title":"The engine_version schema","default":"","examples":["1.2.0.821"]},"policy_etag":{"type":"string","title":"The policy_etag schema","default":"","examples":["c6ea44914b72c92cba939ac3bd369dc4"]},"last_user":{"type":"string","title":"The last_user schema","default":"","examples":["SAHAMEDW8-1X86\\Administrator"]},"host_name":{"type":"string","title":"The host_name schema","default":"","examples":["sahamedw8-1x86"]},"machine_id":{"type":"string","title":"The machine_id schema","default":"","examples":["f2bcafe1-cb2b-4833-b6c9-6148b9511c8f"]},"machine_ip":{"type":"string","title":"The machine_ip schema","default":"","examples":["216.75.233.210"]},"object_guid":{"type":"string","title":"The object_guid schema","default":""}}},{"title":"Agent information. Included if the request includes populate 'endpoint'"}]},"machine_location":{"allOf":[{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"The root schema","description":"The root schema comprises the entire JSON document.","default":{},"examples":[{"city":"Santa Clara","continent":"North America","subdivisions":["California"],"country":"United States","country_iso":"US","accuracy_radius":10,"point":{"lat":37.3417,"lon":-121.9753},"postal_code":"95051","anonymous_proxy":false,"time_zone":"America/Los_Angeles"}],"properties":{"city":{"type":"string","title":"The city schema","default":"","examples":["Santa Clara"]},"continent":{"type":"string","title":"The continent schema","default":"","examples":["North America"]},"subdivisions":{"type":"array","title":"The subdivisions schema","default":[],"examples":[["California"]],"items":{"anyOf":[{"type":"string","title":"The first anyOf schema","default":"","examples":["California"]}]}},"country":{"type":"string","title":"The country schema","default":"","examples":["United States"]},"country_iso":{"type":"string","title":"The country_iso schema","default":"","examples":["United States"]},"accuracy_radius":{"type":"integer","title":"The accuracy_radius schema","default":0,"examples":[10]},"point":{"type":"object","title":"The point schema","default":{},"examples":[{"lat":37.3417,"lon":-121.9753}],"properties":{"lat":{"allOf":[{"bignumber":true},{"type":"number","title":"The latitude","default":0,"examples":[37.3417]}]},"lon":{"allOf":[{"bignumber":true},{"type":"number","title":"The longitude","default":0,"examples":[-121.9753]}]}}},"postal_code":{"type":"string","title":"The postal_code schema","default":"","examples":["95051"]},"anonymous_proxy":{"type":"boolean","title":"The anonymous_proxy schema","default":false,"examples":[false]},"time_zone":{"type":"string","title":"The time_zone schema","default":"","examples":["America/Los_Angeles"]}}},{"title":"Machine location. Included if the request includes populate 'endpoint'"}]},"source_location":{"allOf":[{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"The root schema","description":"The root schema comprises the entire JSON document.","default":{},"examples":[{"city":"Santa Clara","continent":"North America","subdivisions":["California"],"country":"United States","country_iso":"US","accuracy_radius":10,"point":{"lat":37.3417,"lon":-121.9753},"postal_code":"95051","anonymous_proxy":false,"time_zone":"America/Los_Angeles"}],"properties":{"city":{"type":"string","title":"The city schema","default":"","examples":["Santa Clara"]},"continent":{"type":"string","title":"The continent schema","default":"","examples":["North America"]},"subdivisions":{"type":"array","title":"The subdivisions schema","default":[],"examples":[["California"]],"items":{"anyOf":[{"type":"string","title":"The first anyOf schema","default":"","examples":["California"]}]}},"country":{"type":"string","title":"The country schema","default":"","examples":["United States"]},"country_iso":{"type":"string","title":"The country_iso schema","default":"","examples":["United States"]},"accuracy_radius":{"type":"integer","title":"The accuracy_radius schema","default":0,"examples":[10]},"point":{"type":"object","title":"The point schema","default":{},"examples":[{"lat":37.3417,"lon":-121.9753}],"properties":{"lat":{"allOf":[{"bignumber":true},{"type":"number","title":"The latitude","default":0,"examples":[37.3417]}]},"lon":{"allOf":[{"bignumber":true},{"type":"number","title":"The longitude","default":0,"examples":[-121.9753]}]}}},"postal_code":{"type":"string","title":"The postal_code schema","default":"","examples":["95051"]},"anonymous_proxy":{"type":"boolean","title":"The anonymous_proxy schema","default":false,"examples":[false]},"time_zone":{"type":"string","title":"The time_zone schema","default":"","examples":["America/Los_Angeles"]}}},{"title":"Source location for RID category"}]},"destination_location":{"allOf":[{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"The root schema","description":"The root schema comprises the entire JSON document.","default":{},"examples":[{"city":"Santa Clara","continent":"North America","subdivisions":["California"],"country":"United States","country_iso":"US","accuracy_radius":10,"point":{"lat":37.3417,"lon":-121.9753},"postal_code":"95051","anonymous_proxy":false,"time_zone":"America/Los_Angeles"}],"properties":{"city":{"type":"string","title":"The city schema","default":"","examples":["Santa Clara"]},"continent":{"type":"string","title":"The continent schema","default":"","examples":["North America"]},"subdivisions":{"type":"array","title":"The subdivisions schema","default":[],"examples":[["California"]],"items":{"anyOf":[{"type":"string","title":"The first anyOf schema","default":"","examples":["California"]}]}},"country":{"type":"string","title":"The country schema","default":"","examples":["United States"]},"country_iso":{"type":"string","title":"The country_iso schema","default":"","examples":["United States"]},"accuracy_radius":{"type":"integer","title":"The accuracy_radius schema","default":0,"examples":[10]},"point":{"type":"object","title":"The point schema","default":{},"examples":[{"lat":37.3417,"lon":-121.9753}],"properties":{"lat":{"allOf":[{"bignumber":true},{"type":"number","title":"The latitude","default":0,"examples":[37.3417]}]},"lon":{"allOf":[{"bignumber":true},{"type":"number","title":"The longitude","default":0,"examples":[-121.9753]}]}}},"postal_code":{"type":"string","title":"The postal_code schema","default":"","examples":["95051"]},"anonymous_proxy":{"type":"boolean","title":"The anonymous_proxy schema","default":false,"examples":[false]},"time_zone":{"type":"string","title":"The time_zone schema","default":"","examples":["America/Los_Angeles"]}}},{"title":"Destination location for RID category"}]},"account":{"parent":{"title":"Parent account ID","type":"string"},"name":{"title":"Account name","type":"string"},"deleted":{"title":"Account deleted","type":"boolean"},"options":{"type":"object","properties":{"msp":{"type":"object","properties":{"name":{"type":"string"}}}}}},"device_control":{"title":"Device Control. Included if the detection is a device control event.","type":"object","properties":{"timestamp":{"type":"string"},"physical_disk_name":{"type":"string"},"device_id":{"type":"string"},"disk_interface":{"type":"string"},"manufacturer":{"type":"string"},"serial_number":{"type":"string"},"drive_compressed":{"type":"boolean"},"file_system":{"type":"string"},"volume_name":{"type":"string"},"volume_serial":{"type":"string"},"volume_device_path":{"type":"string"},"block_status":{"type":"string"},"drive_metadata":{"type":"object","additionalProperties":true},"path":{"type":"string"},"type":{"type":"array"},"status":{"type":"string"},"access":{"type":"string"}}}}}}}}},"tags":["Device Control"],"operationId":"api.v2.rmm.get.devicecontrol.id"}},"/oneview/v1/accounts/{account_id}/devicecontrol/exclusions/suggestions":{"get":{"description":"Get excludable devices.","summary":"Get excludable devices","security":[{"client_credentials":["read"]},{"user_permissions":["deviceControl.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}},{"name":"vendor","required":false,"in":"query","description":"Vendor","schema":{"type":"string"}},{"name":"product","required":false,"in":"query","description":"Product","schema":{"type":"string"}},{"name":"serial","required":false,"in":"query","description":"Serial number","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"title":"Get devices that are excludable by account","type":"object","required":["devices","total_count"],"properties":{"devices":{"type":"array","title":"Devices","items":{"type":"object","properties":{"vendor":{"type":"string"},"product":{"type":"string"},"serial":{"type":"string"}}}},"total_count":{"type":"integer","title":"Total Count","description":"Total count of results."}}}}}}},"tags":["Device Control"],"operationId":"api.rmm.get.device.exclusions.suggestions"}},"/oneview/v1/devicecontrol":{"post":{"description":"Search device control events across all your managed accounts. The search will be scoped to the account_ids you specify in the request body.","summary":"Search device control events across accounts","security":[{"client_credentials":["read"]},{"user_permissions":["deviceControl.view"]}],"status":{"outage":["auth","search_stateless"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Search device control request. Leading wildcards are not supported for constraint fields without '.keyword' suffix.","allOf":[{"type":"object","required":["account_ids"],"properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}},{"type":"object","title":"Search device control request. Leading wildcards are not supported for constraint fields without '.keyword' suffix.","required":[],"properties":{"protection_status":{"type":"string","title":"Protection status of the endpoint(s)","pattern":"(^$|protected|scan_only|unprotected|unknown|pending|mobile_protection)"},"scan_type":{"type":"string","title":"Type of the scan"},"schedule_id":{"type":"string","title":"ID of the schedule"},"schedule_etag":{"type":"string","title":"ETAG of the schedule"},"job_id":{"type":"string","title":"ID of the job originating this detection"},"domain_name":{"type":"string","title":"Filter the search to the endpoints with specified domain name"},"engine_version":{"type":"string","title":"Filter the search to the endpoints with specified engine version"},"last_user":{"type":"string","title":"Last user that logged into the machine"},"last_user.keyword":{"type":"string","title":"Last user that logged into the machine (exact match). This 'contains' type search will look for the exact match anywhere in the field."},"plugins.siem.reboot_reason":{"type":"string","title":"Filter the search to the endpoints with specified reboot reason, as reported by the SIEM plugin"},"plugins.siem.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified SIEM plugin version"},"plugins.browser_phishing_protection.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified Browser Phishing Protection plugin version"},"plugins.incident_response.reboot_reason":{"type":"string","title":"Filter the search to the endpoints with specified reboot reason, as reported by IR plugin"},"plugins.incident_response.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified IR plugin version"},"plugins.endpoint_detection_response.reboot_reason":{"type":"string","title":"Filter the search to the endpoints with specified reboot reason, as reported by EDR plugin"},"plugins.endpoint_detection_response.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified EDR plugin version"},"plugins.endpoint_protection.reboot_reason":{"type":"string","title":"Filter the search to the endpoints with specified reboot reason, as reported by EP plugin"},"plugins.endpoint_protection.update_package_version":{"type":"string","title":"Filter the search to the endpoints with specified EP update package version"},"plugins.endpoint_protection.component_package_version":{"type":"string","title":"Filter the search to the endpoints with specified EP component package version"},"plugins.endpoint_protection.sdk_version":{"type":"string","title":"Filter the search to the endpoints with specified EP SDK version"},"plugins.endpoint_protection.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified EP plugin version"},"plugins.asset_manager.reboot_reason":{"type":"string","title":"Filter the search to the endpoints with specified reboot reason, as reported by asset manager plugin"},"plugins.asset_manager.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified asset manager plugin version"},"fully_qualified_host_name":{"type":"string","title":"Filter the search to the endpoints with specified, fully qualified host name"},"host_name":{"type":"string","title":"Filter the search to the endpoints with specified host name"},"os_info.os_release_name":{"type":"string","title":"Filter the search to the endpoints with specified release name of OS"},"os_info.os_architecture":{"type":"string","title":"Filter the search to the endpoints with specified OS architecture"},"os_info.os_platform":{"type":"string","title":"Filter the search to the endpoints with specified OS"},"os_info.os_version":{"type":"string","title":"Filter the search to the endpoints with specified OS version"},"os_info.os_type":{"type":"string","title":"Filter the search to the endpoints with specified OS type"},"nics.description":{"type":"string","title":"Filter the search to the endpoints with specified NICS description"},"nics.mac_address":{"type":"string","title":"Filter the search to the endpoints with specified NICS MAC address"},"nics.ips":{"type":"string","format":"ipv4","title":"Filter the search to the endpoints with specified ips"},"host_name.keyword":{"type":"string","title":"Filter the search to the endpoints that have the specified host's name. This 'contains' type search will look for the exact match anywhere in the field."},"fully_qualified_host_name.keyword":{"type":"string","title":"Filter the search to the endpoints that have the specified, fully_qualified_host's name. This 'contains' type search will look for the exact match anywhere in the field."},"engine_version.keyword":{"type":"string","title":"Filter the search by engine version. This 'contains' type search will look for the exact match anywhere in the field."},"domain_name.keyword":{"type":"string","title":"Filter the search by domain name. This 'contains' type search will look for the exact match anywhere in the field."},"at_after":{"type":"string","title":"At after cursor (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"at_before":{"type":"string","title":"At before cursor (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"machine_name.keyword":{"type":"string","title":"The name of the machine. This 'contains' type search will look for the exact match anywhere in the field."},"machine_name":{"type":"string","title":"The name of the machine"},"process_name.keyword":{"type":"string","title":"The name of the process that originated this detection. This 'contains' type search will look for the exact match anywhere in the field."},"process_name":{"type":"string","title":"The name of the process that originated this detection"},"affected_application.keyword":{"type":"string","title":"The application affected by this detection. This 'contains' type search will look for the exact match anywhere in the field."},"affected_application":{"type":"string","title":"The application affected by this detection"},"category":{"type":"string","title":"The category of this detection"},"md5":{"type":"string","title":"The md5 hash of this detection"},"sha256":{"type":"string","title":"The sha256 hash of this detection"},"path.keyword":{"type":"string","title":"The path where this detection happened. This 'contains' type search will look for the exact match anywhere in the field."},"path":{"type":"string","title":"The path where this detection happened"},"type":{"type":"string","title":"The type of the detection"},"threat_name.keyword":{"type":"string","title":"The name of the threat. This 'contains' type search will look for the exact match anywhere in the field."},"threat_name":{"type":"string","title":"The name of the threat"},"status":{"type":"string","title":"The status of the detection"},"correlation_hash":{"type":"string","title":"The hash"},"group_id":{"type":"string","title":"The ID of the group to which the endpoint is assigned (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"group_name":{"type":"string","title":"The name of the group to which the endpoint is assigned"},"machine_id":{"type":"string","title":"The ID of the endpoint (machine) where this detection originated (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"detection_id":{"type":"string","title":"The ID of the detection (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"parent_detection_id":{"type":"string","title":"The ID of the parent detection (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"scan_id":{"type":"string","title":"The ID of the scan (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"trace_id":{"type":"string","title":"The ID of the parent trace (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"start_date":{"type":"string","title":"Get results after this date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"end_date":{"type":"string","title":"Get results before this date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"scanned_at_after":{"type":"string","title":"Get results generated by a scan happening after this date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"scanned_at_before":{"type":"string","title":"Get results generated by a scan happening before this date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"reported_at_after":{"type":"string","title":"Get results reported after this date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"reported_at_before":{"type":"string","title":"Get results reported before this date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"cleaned_at_after":{"type":"string","title":"Get results cleaned after this date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"cleaned_at_before":{"type":"string","title":"Get results cleaned before this date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"is_root_detection":{"type":"boolean","title":"Whether this detection is the root detection"},"is_rtp_stream_event":{"type":"boolean","title":"Whether this is a Real-Time Protection event"},"object_guid":{"type":"string","title":"object_guid filter"},"device_control.physical_disk_name":{"type":"string","title":"Filter the search by device_control.physical_disk_name. Search for an exact match"},"device_control.physical_disk_name.keyword":{"type":"string","title":"Filter the search by device_control.physical_disk_name.keyword. Search for the matches that contain the value"},"not.device_control.physical_disk_name":{"type":"string","title":"Filter the search by not.device_control.physical_disk_name. Search for the matches that are not equal to the value"},"not.device_control.physical_disk_name.keyword":{"type":"string","title":"Filter the search by not.device_control.physical_disk_name.keyword. Search for the matches that doesnt contain the value"},"device_control.pnp_device_id":{"type":"string","title":"Filter the search by device_control.pnp_device_id. Search for an exact match"},"device_control.pnp_device_id.keyword":{"type":"string","title":"Filter the search by device_control.pnp_device_id.keyword. Search for the matches that contain the value"},"not.device_control.pnp_device_id":{"type":"string","title":"Filter the search by not.device_control.pnp_device_id. Search for the matches that are not equal to the value"},"not.device_control.pnp_device_id.keyword":{"type":"string","title":"Filter the search by not.device_control.pnp_device_id.keyword. Search for the matches that doesnt contain the value"},"device_control.device_id":{"type":"string","title":"Filter the search by device_control.device_id. Search for an exact match"},"device_control.device_id.keyword":{"type":"string","title":"Filter the search by device_control.device_id.keyword. Search for the matches that contain the value"},"not.device_control.device_id":{"type":"string","title":"Filter the search by not.device_control.device_id. Search for the matches that are not equal to the value"},"not.device_control.device_id.keyword":{"type":"string","title":"Filter the search by not.device_control.device_id.keyword. Search for the matches that doesnt contain the value"},"device_control.disk_interface":{"type":"string","title":"Filter the search by device_control.disk_interface. Search for an exact match"},"device_control.disk_interface.keyword":{"type":"string","title":"Filter the search by device_control.disk_interface.keyword. Search for the matches that contain the value"},"not.device_control.disk_interface":{"type":"string","title":"Filter the search by not.device_control.disk_interface. Search for the matches that are not equal to the value"},"not.device_control.disk_interface.keyword":{"type":"string","title":"Filter the search by not.device_control.disk_interface.keyword. Search for the matches that doesnt contain the value"},"device_control.manufacturer":{"type":"string","title":"Filter the search by device_control.manufacturer. Search for an exact match"},"device_control.manufacturer.keyword":{"type":"string","title":"Filter the search by device_control.manufacturer.keyword. Search for the matches that contain the value"},"not.device_control.manufacturer":{"type":"string","title":"Filter the search by not.device_control.manufacturer. Search for the matches that are not equal to the value"},"not.device_control.manufacturer.keyword":{"type":"string","title":"Filter the search by not.device_control.manufacturer.keyword. Search for the matches that doesnt contain the value"},"device_control.serial_number":{"type":"string","title":"Filter the search by device_control.serial_number. Search for an exact match"},"device_control.serial_number.keyword":{"type":"string","title":"Filter the search by device_control.serial_number.keyword. Search for the matches that contain the value"},"not.device_control.serial_number":{"type":"string","title":"Filter the search by not.device_control.serial_number. Search for the matches that are not equal to the value"},"not.device_control.serial_number.keyword":{"type":"string","title":"Filter the search by not.device_control.serial_number.keyword. Search for the matches that doesnt contain the value"},"device_control.file_system":{"type":"string","title":"Filter the search by device_control.file_system. Search for an exact match"},"device_control.file_system.keyword":{"type":"string","title":"Filter the search by device_control.file_system.keyword. Search for the matches that contain the value"},"not.device_control.file_system":{"type":"string","title":"Filter the search by not.device_control.file_system. Search for the matches that are not equal to the value"},"not.device_control.file_system.keyword":{"type":"string","title":"Filter the search by not.device_control.file_system.keyword. Search for the matches that doesnt contain the value"},"device_control.volume_name":{"type":"string","title":"Filter the search by device_control.volume_name. Search for an exact match"},"device_control.volume_name.keyword":{"type":"string","title":"Filter the search by device_control.volume_name.keyword. Search for the matches that contain the value"},"not.device_control.volume_name":{"type":"string","title":"Filter the search by not.device_control.volume_name. Search for the matches that are not equal to the value"},"not.device_control.volume_name.keyword":{"type":"string","title":"Filter the search by not.device_control.volume_name.keyword. Search for the matches that doesnt contain the value"},"device_control.volume_serial":{"type":"string","title":"Filter the search by device_control.volume_serial. Search for an exact match"},"device_control.volume_serial.keyword":{"type":"string","title":"Filter the search by device_control.volume_serial.keyword. Search for the matches that contain the value"},"not.device_control.volume_serial":{"type":"string","title":"Filter the search by not.device_control.volume_serial. Search for the matches that are not equal to the value"},"not.device_control.volume_serial.keyword":{"type":"string","title":"Filter the search by not.device_control.volume_serial.keyword. Search for the matches that doesnt contain the value"},"device_control.volume_device_path":{"type":"string","title":"Filter the search by device_control.volume_device_path. Search for an exact match"},"device_control.volume_device_path.keyword":{"type":"string","title":"Filter the search by device_control.volume_device_path.keyword. Search for the matches that contain the value"},"not.device_control.volume_device_path":{"type":"string","title":"Filter the search by not.device_control.volume_device_path. Search for the matches that are not equal to the value"},"not.device_control.volume_device_path.keyword":{"type":"string","title":"Filter the search by not.device_control.volume_device_path.keyword. Search for the matches that doesnt contain the value"},"device_control.block_status":{"type":"string","title":"Filter the search by device_control.block_status. Search for an exact match"},"device_control.block_status.keyword":{"type":"string","title":"Filter the search by device_control.block_status.keyword. Search for the matches that contain the value"},"not.device_control.block_status":{"type":"string","title":"Filter the search by not.device_control.block_status. Search for the matches that are not equal to the value"},"not.device_control.block_status.keyword":{"type":"string","title":"Filter the search by not.device_control.block_status.keyword. Search for the matches that doesnt contain the value"},"device_control.drive_compressed":{"type":"boolean","title":"Filter the search by device_control.drive_compressed. Search for an exact match"},"device_control.timestamp_before":{"type":"string","format":"date-time","title":"Results include device control events that have been occured before the specified date"},"device_control.timestamp_after":{"type":"string","format":"date-time","title":"Results include device control events that have been occured after the specified date"},"device_control.access":{"type":"string","title":"Access"},"action_taken":{"type":"string","title":"Filter the search by action_taken. Search for an exact match"},"action_taken.keyword":{"type":"string","title":"Filter the search by action_taken.keyword. Search for the matches that contain the value"},"not.action_taken":{"type":"string","title":"Filter the search by not.action_taken. Search for the matches that are not equal to the value"},"not.action_taken.keyword":{"type":"string","title":"Filter the search by not.action_taken.keyword. Search for the matches that doesnt contain the value"},"sort_field":{"type":"string","title":"If the sort field is used, then sort_order is required.","enum":["trace_id","scan_id","machine_id","group_id","group_name","account_id","detection_id","parent_detection_id","correlation_hash","status","threat_name.keyword","type","path.keyword","category","md5","sha256","affected_application.keyword","process_name.keyword","machine_name.keyword","scanned_at","reported_at","cleaned_at","is_root_detection","is_rtp_stream_event","object_guid","device_control.physical_disk_name","device_control.pnp_device_id","device_control.device_id","device_control.disk_interface","device_control.manufacturer","device_control.serial_number","device_control.file_system","device_control.volume_name","device_control.volume_serial","device_control.volume_device_path","device_control.block_status","device_control.drive_compressed","device_control.timestamp","active_directory.user.display_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.machine.display_name","active_directory.machine.sam_account_name","active_directory.machine.ou"]},"sort_order":{"type":"string","title":"Sorting direction","enum":["asc","desc"]},"page_size":{"type":"number","title":"The size of the page. If you only need aggregations, set it to 0","minimum":0,"maximum":2000},"aggregations":{"type":"array","title":"The Aggregations Schema","items":{"type":"string","title":"Aggregations","default":[],"enum":["trace_id","scan_id","machine_id","group_id","account_id","detection_id","parent_detection_id","correlation_hash","status","threat_name.keyword","type","path.keyword","category","md5","affected_application.keyword","process_name.keyword","machine_name.keyword","daily_detections_by_category","protection_status","os_info.os_release_name.keyword","nics.ips","nics.mac_address","nics.description.keyword","os_info.os_type","os_info.os_version.keyword","os_info.os_platform","os_info.os_architecture","host_name.keyword","fully_qualified_host_name.keyword","plugins.asset_manager.plugin_version.keyword","plugins.asset_manager.reboot_reason","plugins.endpoint_protection.plugin_version.keyword","plugins.endpoint_protection.sdk_version.keyword","plugins.endpoint_protection.component_package_version.keyword","plugins.endpoint_protection.update_package_version.keyword","plugins.endpoint_protection.reboot_reason","plugins.endpoint_detection_response.plugin_version.keyword","plugins.endpoint_detection_response.reboot_reason","plugins.endpoint_detection_and_response.plugin_version.keyword","plugins.endpoint_detection_and_response.reboot_reason","plugins.incident_response.plugin_version.keyword","plugins.incident_response.reboot_reason","plugins.siem.plugin_version.keyword","plugins.siem.reboot_reason","engine_version.keyword","domain_name.keyword","policy_etag","last_user.keyword","object_guid","device_control.physical_disk_name","device_control.pnp_device_id","device_control.device_id","device_control.disk_interface","device_control.manufacturer","device_control.serial_number","device_control.file_system","device_control.volume_name","device_control.volume_serial","device_control.volume_device_path","device_control.block_status","device_control.drive_compressed","device_control.timestamp"]}},"populate":{"type":"object","title":"The populate object Schema","properties":{"group":{"type":"boolean","title":"Populate with the group data"},"endpoint":{"type":"boolean","title":"Populate with the endpoint data (agent, machine_location)"},"scan_result":{"type":"boolean","title":"Populate with the scan_result data"}}},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]},"aggregate_by_account":{"type":"boolean"}},"allOf":[{"type":"object","title":"Active Directory Search Filters","properties":{"active_directory.user.display_name":{"type":"string","title":"Filter the search by active_directory.user.display_name. Search for the matches that are equal to the value"},"active_directory.user.display_name.keyword":{"type":"string","title":"Filter the search by active_directory.user.display_name.keyword. Search for the matches that contain the value"},"active_directory.user.ou":{"type":"string","title":"Filter the search by active_directory.user.ou. Search for the matches that are equal to the value"},"active_directory.user.ou.keyword":{"type":"string","title":"Filter the search by active_directory.user.ou.keyword. Search for the matches that contain the value"},"active_directory.user.ou.path":{"type":"string","title":"Filter the search by active_directory.user.ou.path. Search for the matches that are equal to the value"},"active_directory.user.ou.path.keyword":{"type":"string","title":"Filter the search by active_directory.user.ou.path.keyword. Search for the matches that contain the value"},"active_directory.user.sam_account_name":{"type":"string","title":"Filter the search by active_directory.user.sam_account_name. Search for the matches that are equal to the value"},"active_directory.user.sam_account_name.keyword":{"type":"string","title":"Filter the search by active_directory.user.sam_account_name.keyword. Search for the matches that contain the value"},"active_directory.machine.display_name":{"type":"string","title":"Filter the search by active_directory.machine.display_name. Search for the matches that are equal to the value"},"active_directory.machine.display_name.keyword":{"type":"string","title":"Filter the search by active_directory.machine.display_name.keyword. Search for the matches that contain the value"},"active_directory.machine.ou":{"type":"string","title":"Filter the search by active_directory.machine.ou. Search for the matches that are equal to the value"},"active_directory.machine.ou.keyword":{"type":"string","title":"Filter the search by active_directory.machine.ou.keyword. Search for the matches that contain the value"},"active_directory.machine.ou.path":{"type":"string","title":"Filter the search by active_directory.machine.ou.path. Search for the matches that are equal to the value"},"active_directory.machine.ou.path.keyword":{"type":"string","title":"Filter the search by active_directory.machine.ou.path.keyword. Search for the matches that contain the value"},"active_directory.machine.sam_account_name":{"type":"string","title":"Filter the search by active_directory.machine.sam_account_name. Search for the matches that are equal to the value"},"active_directory.machine.sam_account_name.keyword":{"type":"string","title":"Filter the search by active_directory.machine.sam_account_name.keyword. Search for the matches that contain the value"}}}]}]}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Search device control result","properties":{"detections":{"type":"array","title":"Detections","items":{"type":"object","title":"Detection items","additionalProperties":false,"properties":{"id":{"type":"string","title":"ID"},"type":{"type":"array","title":"Type","items":{"type":"string","title":"Type items"}},"status":{"type":"string","title":"Status"},"path":{"type":"string","title":"Path"},"group_id":{"type":"string","title":"Group ID"},"group":{"type":"object","title":"The Group Schema","additionalProperties":true},"is_root_detection":{"type":"boolean","title":"Is root detection"},"machine_id":{"type":"string","title":"Endpoint ID"},"account_id":{"type":"string","title":"Account ID"},"detection_id":{"type":"string","title":"Detection ID"},"scanned_at":{"type":"string","title":"Scanned at"},"scanned_at_offset_seconds":{"type":"integer","title":"Scanned at offset seconds"},"reported_at":{"type":"string","title":"Reported at"},"threat_name":{"type":"string","title":"Threat name"},"category":{"type":"string","title":"Category"},"is_rtp_stream_event":{"type":"boolean","title":"Is rtp stream event"},"process_name":{"type":"string","title":"Process name"},"cleaned_at":{"type":"string","title":"Cleaned at"},"machine_name":{"type":"string","title":"Endpoint name"},"trace_id":{"type":"string","title":"Trace ID"},"scan_id":{"type":"string","title":"Scan ID"},"affected_application":{"type":"string","title":"Affected application"},"last_user":{"type":"string","title":"Last user"},"md5":{"type":"string","title":"MD5"},"sha256":{"type":"string","title":"SHA256"},"machine_ip":{"type":"string","title":"Machine IP address"},"child_trace_count":{"type":"integer","title":"Child trace count"},"action_taken":{"type":"string","title":"Action taken"},"agent":{"allOf":[{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"The root schema","description":"The root schema comprises the entire JSON document.","default":{},"examples":[{"at":"2020-10-23T14:20:51.006558Z","is_software_update_available":false,"started_at_local":"2020-10-23T14:20:50.920306Z","started_at_offset":-25200,"nics":[{"ips":["10.151.110.52"],"description":"Intel(R) 82574L Gigabit Network Connection","mac_address":"005056B91173"}],"os_info":{"os_type":"Workstation","os_version":"6.3.9600","os_platform":"Windows","os_architecture":"x86","os_release_name":"Microsoft Windows 8.1 Pro"},"fully_qualified_host_name":"sahamedw8-1x86","plugins":{"windows_remote_intrusion_detection_and_prevention":{"product_name":"Windows Remote Intrusion Detection and Prevention","plugin_version":"1.2.0.21"},"endpoint_protection":{"sdk_version":"4.2.1.90","product_name":"Endpoint Protection","plugin_version":"1.2.0.844","update_package_version":"1.0.31870","component_package_version":"1.0.1085","reboot_reasons":0},"asset_manager":{"product_name":"Asset Manager","plugin_version":"1.2.0.330","reboot_reasons":0},"endpoint_detection_and_response":{"product_name":"Endpoint Detection and Response","plugin_version":"1.2.0.297","reboot_reasons":0}},"engine_version":"1.2.0.821","policy_etag":"c6ea44914b72c92cba939ac3bd369dc4","last_user":"SAHAMEDW8-1X86\\Administrator","serial_number":"c02thb32g8wn","host_name":"sahamedw8-1x86","machine_id":"f2bcafe1-cb2b-4833-b6c9-6148b9511c8f","machine_ip":"216.75.233.210"}],"properties":{"at":{"type":"string","title":"The at schema","default":"","examples":["2020-10-23T14:20:51.006558Z"]},"is_software_update_available":{"type":"boolean","title":"The is_software_update_available schema","default":false,"examples":[false]},"started_at_local":{"type":"string","title":"The started_at_local schema","default":"","examples":["2020-10-23T14:20:50.920306Z"]},"started_at_offset":{"type":"integer","title":"The started_at_offset schema","default":0,"examples":[-25200]},"nics":{"type":"array","title":"The nics schema","default":[],"examples":[[{"ips":["10.151.110.52"],"description":"Intel(R) 82574L Gigabit Network Connection","mac_address":"005056B91173"}]],"additionalItems":true,"items":{"anyOf":[{"type":"object","title":"The first anyOf schema","default":{},"examples":[{"ips":["10.151.110.52"],"description":"Intel(R) 82574L Gigabit Network Connection","mac_address":"005056B91173"}],"properties":{"ips":{"type":"array","title":"The ips schema","default":[],"examples":[["10.151.110.52"]],"additionalItems":true,"items":{"anyOf":[{"type":"string","title":"The first anyOf schema","default":"","examples":["10.151.110.52"]}]}},"description":{"type":"string","title":"The description schema","default":"","examples":["Intel(R) 82574L Gigabit Network Connection"]},"mac_address":{"type":"string","title":"The mac_address schema","default":"","examples":["005056B91173"]}},"additionalProperties":true}]}},"os_info":{"type":"object","title":"The os_info schema","default":{},"examples":[{"os_type":"Workstation","os_version":"6.3.9600","os_platform":"Windows","os_architecture":"x86","os_release_name":"Microsoft Windows 8.1 Pro"}],"properties":{"os_type":{"type":"string","title":"The os_type schema","default":"","examples":["Workstation"]},"os_version":{"type":"string","title":"The os_version schema","default":"","examples":["6.3.9600"]},"os_platform":{"type":"string","title":"The os_platform schema","default":"","examples":["Windows"]},"os_architecture":{"type":"string","title":"The os_architecture schema","default":"","examples":["x86"]},"os_release_name":{"type":"string","title":"The os_release_name schema","default":"","examples":["Microsoft Windows 8.1 Pro"]}},"additionalProperties":true},"fully_qualified_host_name":{"type":"string","title":"The fully_qualified_host_name schema","default":"","examples":["sahamedw8-1x86"]},"plugins":{"type":"object","title":"The plugins schema","default":{},"examples":[{"windows_remote_intrusion_detection_and_prevention":{"product_name":"Windows Remote Intrusion Detection and Prevention","plugin_version":"1.2.0.21"},"endpoint_protection":{"sdk_version":"4.2.1.90","product_name":"Endpoint Protection","plugin_version":"1.2.0.844","update_package_version":"1.0.31870","component_package_version":"1.0.1085","reboot_reasons":0},"asset_manager":{"product_name":"Asset Manager","plugin_version":"1.2.0.330","reboot_reasons":0},"endpoint_detection_and_response":{"product_name":"Endpoint Detection and Response","plugin_version":"1.2.0.297","reboot_reasons":0}}],"properties":{"windows_remote_intrusion_detection_and_prevention":{"type":"object","title":"The windows_remote_intrusion_detection_and_prevention schema","default":{},"examples":[{"product_name":"Windows Remote Intrusion Detection and Prevention","plugin_version":"1.2.0.21"}],"properties":{"product_name":{"type":"string","title":"The product_name schema","default":"","examples":["Windows Remote Intrusion Detection and Prevention"]},"plugin_version":{"type":"string","title":"The plugin_version schema","default":"","examples":["1.2.0.21"]}},"additionalProperties":true},"endpoint_protection":{"type":"object","title":"The endpoint_protection schema","default":{},"examples":[{"sdk_version":"4.2.1.90","product_name":"Endpoint Protection","plugin_version":"1.2.0.844","update_package_version":"1.0.31870","component_package_version":"1.0.1085","reboot_reasons":0}],"properties":{"sdk_version":{"type":"string","title":"The sdk_version schema","default":"","examples":["4.2.1.90"]},"product_name":{"type":"string","title":"The product_name schema","default":"","examples":["Endpoint Protection"]},"plugin_version":{"type":"string","title":"The plugin_version schema","default":"","examples":["1.2.0.844"]},"update_package_version":{"type":"string","title":"The update_package_version schema","default":"","examples":["1.0.31870"]},"component_package_version":{"type":"string","title":"The component_package_version schema","default":"","examples":["1.0.1085"]},"reboot_reasons":{"type":"integer","title":"The reboot_reasons schema","default":0,"examples":[0]}},"additionalProperties":true},"asset_manager":{"type":"object","title":"The asset_manager schema","default":{},"examples":[{"product_name":"Asset Manager","plugin_version":"1.2.0.330","reboot_reasons":0}],"properties":{"product_name":{"type":"string","title":"The product_name schema","default":"","examples":["Asset Manager"]},"plugin_version":{"type":"string","title":"The plugin_version schema","default":"","examples":["1.2.0.330"]},"reboot_reasons":{"type":"integer","title":"The reboot_reasons schema","default":0,"examples":[0]}},"additionalProperties":true},"endpoint_detection_and_response":{"type":"object","title":"The endpoint_detection_and_response schema","default":{},"examples":[{"product_name":"Endpoint Detection and Response","plugin_version":"1.2.0.297","reboot_reasons":0}],"properties":{"product_name":{"type":"string","title":"The product_name schema","default":"","examples":["Endpoint Detection and Response"]},"plugin_version":{"type":"string","title":"The plugin_version schema","default":"","examples":["1.2.0.297"]},"reboot_reasons":{"type":"integer","title":"The reboot_reasons schema","default":0,"examples":[0]}},"additionalProperties":true}},"additionalProperties":true},"engine_version":{"type":"string","title":"The engine_version schema","default":"","examples":["1.2.0.821"]},"policy_etag":{"type":"string","title":"The policy_etag schema","default":"","examples":["c6ea44914b72c92cba939ac3bd369dc4"]},"last_user":{"type":"string","title":"The last_user schema","default":"","examples":["SAHAMEDW8-1X86\\Administrator"]},"host_name":{"type":"string","title":"The host_name schema","default":"","examples":["sahamedw8-1x86"]},"machine_id":{"type":"string","title":"The machine_id schema","default":"","examples":["f2bcafe1-cb2b-4833-b6c9-6148b9511c8f"]},"machine_ip":{"type":"string","title":"The machine_ip schema","default":"","examples":["216.75.233.210"]},"object_guid":{"type":"string","title":"The object_guid schema","default":""}}},{"title":"Agent information. Included if the request includes populate 'endpoint'"}]},"machine_location":{"allOf":[{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"The root schema","description":"The root schema comprises the entire JSON document.","default":{},"examples":[{"city":"Santa Clara","continent":"North America","subdivisions":["California"],"country":"United States","country_iso":"US","accuracy_radius":10,"point":{"lat":37.3417,"lon":-121.9753},"postal_code":"95051","anonymous_proxy":false,"time_zone":"America/Los_Angeles"}],"properties":{"city":{"type":"string","title":"The city schema","default":"","examples":["Santa Clara"]},"continent":{"type":"string","title":"The continent schema","default":"","examples":["North America"]},"subdivisions":{"type":"array","title":"The subdivisions schema","default":[],"examples":[["California"]],"items":{"anyOf":[{"type":"string","title":"The first anyOf schema","default":"","examples":["California"]}]}},"country":{"type":"string","title":"The country schema","default":"","examples":["United States"]},"country_iso":{"type":"string","title":"The country_iso schema","default":"","examples":["United States"]},"accuracy_radius":{"type":"integer","title":"The accuracy_radius schema","default":0,"examples":[10]},"point":{"type":"object","title":"The point schema","default":{},"examples":[{"lat":37.3417,"lon":-121.9753}],"properties":{"lat":{"allOf":[{"bignumber":true},{"type":"number","title":"The latitude","default":0,"examples":[37.3417]}]},"lon":{"allOf":[{"bignumber":true},{"type":"number","title":"The longitude","default":0,"examples":[-121.9753]}]}}},"postal_code":{"type":"string","title":"The postal_code schema","default":"","examples":["95051"]},"anonymous_proxy":{"type":"boolean","title":"The anonymous_proxy schema","default":false,"examples":[false]},"time_zone":{"type":"string","title":"The time_zone schema","default":"","examples":["America/Los_Angeles"]}}},{"title":"Machine location. Included if the request includes populate 'endpoint'"}]},"source_location":{"allOf":[{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"The root schema","description":"The root schema comprises the entire JSON document.","default":{},"examples":[{"city":"Santa Clara","continent":"North America","subdivisions":["California"],"country":"United States","country_iso":"US","accuracy_radius":10,"point":{"lat":37.3417,"lon":-121.9753},"postal_code":"95051","anonymous_proxy":false,"time_zone":"America/Los_Angeles"}],"properties":{"city":{"type":"string","title":"The city schema","default":"","examples":["Santa Clara"]},"continent":{"type":"string","title":"The continent schema","default":"","examples":["North America"]},"subdivisions":{"type":"array","title":"The subdivisions schema","default":[],"examples":[["California"]],"items":{"anyOf":[{"type":"string","title":"The first anyOf schema","default":"","examples":["California"]}]}},"country":{"type":"string","title":"The country schema","default":"","examples":["United States"]},"country_iso":{"type":"string","title":"The country_iso schema","default":"","examples":["United States"]},"accuracy_radius":{"type":"integer","title":"The accuracy_radius schema","default":0,"examples":[10]},"point":{"type":"object","title":"The point schema","default":{},"examples":[{"lat":37.3417,"lon":-121.9753}],"properties":{"lat":{"allOf":[{"bignumber":true},{"type":"number","title":"The latitude","default":0,"examples":[37.3417]}]},"lon":{"allOf":[{"bignumber":true},{"type":"number","title":"The longitude","default":0,"examples":[-121.9753]}]}}},"postal_code":{"type":"string","title":"The postal_code schema","default":"","examples":["95051"]},"anonymous_proxy":{"type":"boolean","title":"The anonymous_proxy schema","default":false,"examples":[false]},"time_zone":{"type":"string","title":"The time_zone schema","default":"","examples":["America/Los_Angeles"]}}},{"title":"Source location for RID category"}]},"destination_location":{"allOf":[{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"The root schema","description":"The root schema comprises the entire JSON document.","default":{},"examples":[{"city":"Santa Clara","continent":"North America","subdivisions":["California"],"country":"United States","country_iso":"US","accuracy_radius":10,"point":{"lat":37.3417,"lon":-121.9753},"postal_code":"95051","anonymous_proxy":false,"time_zone":"America/Los_Angeles"}],"properties":{"city":{"type":"string","title":"The city schema","default":"","examples":["Santa Clara"]},"continent":{"type":"string","title":"The continent schema","default":"","examples":["North America"]},"subdivisions":{"type":"array","title":"The subdivisions schema","default":[],"examples":[["California"]],"items":{"anyOf":[{"type":"string","title":"The first anyOf schema","default":"","examples":["California"]}]}},"country":{"type":"string","title":"The country schema","default":"","examples":["United States"]},"country_iso":{"type":"string","title":"The country_iso schema","default":"","examples":["United States"]},"accuracy_radius":{"type":"integer","title":"The accuracy_radius schema","default":0,"examples":[10]},"point":{"type":"object","title":"The point schema","default":{},"examples":[{"lat":37.3417,"lon":-121.9753}],"properties":{"lat":{"allOf":[{"bignumber":true},{"type":"number","title":"The latitude","default":0,"examples":[37.3417]}]},"lon":{"allOf":[{"bignumber":true},{"type":"number","title":"The longitude","default":0,"examples":[-121.9753]}]}}},"postal_code":{"type":"string","title":"The postal_code schema","default":"","examples":["95051"]},"anonymous_proxy":{"type":"boolean","title":"The anonymous_proxy schema","default":false,"examples":[false]},"time_zone":{"type":"string","title":"The time_zone schema","default":"","examples":["America/Los_Angeles"]}}},{"title":"Destination location for RID category"}]},"account":{"parent":{"title":"Parent account ID","type":"string"},"name":{"title":"Account name","type":"string"},"deleted":{"title":"Account deleted","type":"boolean"},"options":{"type":"object","properties":{"msp":{"type":"object","properties":{"name":{"type":"string"}}}}}},"device_control":{"title":"Device Control. Included if the detection is a device control event.","type":"object","properties":{"timestamp":{"type":"string"},"physical_disk_name":{"type":"string"},"device_id":{"type":"string"},"disk_interface":{"type":"string"},"manufacturer":{"type":"string"},"serial_number":{"type":"string"},"drive_compressed":{"type":"boolean"},"file_system":{"type":"string"},"volume_name":{"type":"string"},"volume_serial":{"type":"string"},"volume_device_path":{"type":"string"},"block_status":{"type":"string"},"drive_metadata":{"type":"object","additionalProperties":true},"path":{"type":"string"},"type":{"type":"array"},"status":{"type":"string"},"exclusion_id":{"type":"string"},"access":{"type":"string"}}}}}},"aggregations":{"type":"object","title":"Aggregations","additionalProperties":true},"total_count":{"type":"integer","title":"Total count of found detections"},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}}}}},"tags":["Device Control"],"operationId":"api.v2.rmm.search.devicecontrol"}},"/oneview/v1/devicecontrol/exclusions":{"post":{"description":"Search device control exclusions.","summary":"Search device control exclusions","security":[{"client_credentials":["read"]},{"user_permissions":["deviceControl.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Get exclusions for multiple account ids","required":["account_ids"],"properties":{"account_ids":{"type":"array","minItems":1,"title":"The account ids","items":{"type":"string","title":"Account id items","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}},"include_parent":{"title":"Include parent account's exclusions","description":"if true, the result will include the exclusions in the parent accounts, but only the exclusions that affect at least one of the account specified in account_ids (i.e. excluding the exclusions related only with policies of child accounts not specified in account_ids)","type":"boolean","default":false},"populate_risk":{"title":"Add the exclusion risk evaluation","description":"if true, add the risk evaluation for each exclusion.","type":"boolean","default":false},"sort_by":{"type":"string","title":"The field to sort by","enum":["created_at","updated_at"]},"sort_order":{"type":"string","title":"The order to sort by","enum":["asc","desc"]},"page_size":{"type":"number","title":"The size of the page","minimum":1,"default":100,"maximum":2000},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"title":"Get exclusions by account","type":"object","required":["exclusions","total_count","next_cursor"],"properties":{"exclusions":{"type":"array","title":"Exclusions","items":{"title":"Exclusion from server","type":"object","additionalProperties":true,"properties":{"id":{"type":"string","title":"UUID of the exclusion (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"etag":{"type":"string","title":"Etag","description":"etags are identifiers that change on every update. Their use is to prevent race conditions when multiple clients are modifying the same resource. Supply this tag empty when creating a exclusion. When updating, you need to fetch the latest value by GETting an exclusion. You should always get the current etag before trying to modify a resource that has an etag property.","examples":["c87998228b2f7511bb1616f686d06bae"]},"type":{"type":"integer","title":"1: Exclusion for file path, 2: Exclusion for folder path, 3: Exclusion for wildcard path, 4: Exclusion for registry, 5: Exclusion for file extensions, 6: Exclusion for web domain, 7: Exclusion for web IP, 8: Exclusion for Web Monitoring, 13: Exclusion for hash, 14: Exclusion for command line","examples":[1,2,3,4,5,6,7,13,14,17]},"value":{"type":"string","title":"String value","examples":["%PROGRAMDATA%"]},"enabled":{"type":"boolean","title":"Enable"},"comment":{"type":"string","title":"Comment"},"created_at":{"type":"string","title":"Created at"},"updated_at":{"type":"string","title":"Updated at"},"created_by":{"type":"string","title":"Created by"},"updated_by":{"type":"string","title":"Updated by"},"exclude_from":{"type":"object","title":"Exclusion applied to","properties":{"exploit_protection":{"type":["boolean","null"],"title":"Uses multiple protection layers to guard against attempted exploits of vulnerabilities in legitimate applications"},"malware_protection":{"type":["boolean","null"],"title":"Protects against malware infections and zero-day threats"},"ransomware_protection":{"type":["boolean","null"],"title":"Detects and blocks ransomware threats using advanced behavior analysis"},"suspicious_activity":{"type":["boolean","null"],"title":"Uses advanced machine learning to identify suspicious processes that require additional review"},"website_protection":{"type":["boolean","null"],"title":"Blocks network traffic from malicious websites and IP addresses"},"bruteforce_protection":{"type":["boolean","null"],"title":"Bruteforce attack protection on RDP, IMAP and so on."}}},"friendly_name":{"type":"string","title":"Friendly name","examples":["File by MD5 hash"]},"account_level":{"type":"boolean","title":"Account level"},"policies":{"type":"array","title":"Policies","items":{"type":"object","title":"Policy","properties":{"id":{"type":"string","title":"ID of policy (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","additionalProperties":true,"pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["20da4613-5fa5-4460-9016-963d2c4f6753"]},"name":{"type":"string","title":"Name of policy"}}}}}}},"total_count":{"type":"integer","title":"Total Count","description":"Total count of results."},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}}}}},"tags":["Device Control"],"operationId":"api.rmm.search.device.exclusions"}},"/oneview/v1/devicecontrol/search-groupby":{"post":{"description":"Group device control events across all your managed accounts. The search will be scoped to the account_ids you specify in the request body.","summary":"Group device control events across accounts","security":[{"client_credentials":["read"]},{"user_permissions":["deviceControl.view"]}],"status":{"outage":["auth","search_stateless"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"The Post Device Control Search GroupBy Request Schema","required":["group_by","page_size"],"additionalProperties":true,"allOf":[{"type":"object","title":"Search device control request. Leading wildcards are not supported for constraint fields without '.keyword' suffix.","allOf":[{"type":"object","required":["account_ids"],"properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}},{"type":"object","title":"Search device control request. Leading wildcards are not supported for constraint fields without '.keyword' suffix.","required":[],"properties":{"protection_status":{"type":"string","title":"Protection status of the endpoint(s)","pattern":"(^$|protected|scan_only|unprotected|unknown|pending|mobile_protection)"},"scan_type":{"type":"string","title":"Type of the scan"},"schedule_id":{"type":"string","title":"ID of the schedule"},"schedule_etag":{"type":"string","title":"ETAG of the schedule"},"job_id":{"type":"string","title":"ID of the job originating this detection"},"domain_name":{"type":"string","title":"Filter the search to the endpoints with specified domain name"},"engine_version":{"type":"string","title":"Filter the search to the endpoints with specified engine version"},"last_user":{"type":"string","title":"Last user that logged into the machine"},"last_user.keyword":{"type":"string","title":"Last user that logged into the machine (exact match). This 'contains' type search will look for the exact match anywhere in the field."},"plugins.siem.reboot_reason":{"type":"string","title":"Filter the search to the endpoints with specified reboot reason, as reported by the SIEM plugin"},"plugins.siem.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified SIEM plugin version"},"plugins.browser_phishing_protection.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified Browser Phishing Protection plugin version"},"plugins.incident_response.reboot_reason":{"type":"string","title":"Filter the search to the endpoints with specified reboot reason, as reported by IR plugin"},"plugins.incident_response.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified IR plugin version"},"plugins.endpoint_detection_response.reboot_reason":{"type":"string","title":"Filter the search to the endpoints with specified reboot reason, as reported by EDR plugin"},"plugins.endpoint_detection_response.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified EDR plugin version"},"plugins.endpoint_protection.reboot_reason":{"type":"string","title":"Filter the search to the endpoints with specified reboot reason, as reported by EP plugin"},"plugins.endpoint_protection.update_package_version":{"type":"string","title":"Filter the search to the endpoints with specified EP update package version"},"plugins.endpoint_protection.component_package_version":{"type":"string","title":"Filter the search to the endpoints with specified EP component package version"},"plugins.endpoint_protection.sdk_version":{"type":"string","title":"Filter the search to the endpoints with specified EP SDK version"},"plugins.endpoint_protection.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified EP plugin version"},"plugins.asset_manager.reboot_reason":{"type":"string","title":"Filter the search to the endpoints with specified reboot reason, as reported by asset manager plugin"},"plugins.asset_manager.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified asset manager plugin version"},"fully_qualified_host_name":{"type":"string","title":"Filter the search to the endpoints with specified, fully qualified host name"},"host_name":{"type":"string","title":"Filter the search to the endpoints with specified host name"},"os_info.os_release_name":{"type":"string","title":"Filter the search to the endpoints with specified release name of OS"},"os_info.os_architecture":{"type":"string","title":"Filter the search to the endpoints with specified OS architecture"},"os_info.os_platform":{"type":"string","title":"Filter the search to the endpoints with specified OS"},"os_info.os_version":{"type":"string","title":"Filter the search to the endpoints with specified OS version"},"os_info.os_type":{"type":"string","title":"Filter the search to the endpoints with specified OS type"},"nics.description":{"type":"string","title":"Filter the search to the endpoints with specified NICS description"},"nics.mac_address":{"type":"string","title":"Filter the search to the endpoints with specified NICS MAC address"},"nics.ips":{"type":"string","format":"ipv4","title":"Filter the search to the endpoints with specified ips"},"host_name.keyword":{"type":"string","title":"Filter the search to the endpoints that have the specified host's name. This 'contains' type search will look for the exact match anywhere in the field."},"fully_qualified_host_name.keyword":{"type":"string","title":"Filter the search to the endpoints that have the specified, fully_qualified_host's name. This 'contains' type search will look for the exact match anywhere in the field."},"engine_version.keyword":{"type":"string","title":"Filter the search by engine version. This 'contains' type search will look for the exact match anywhere in the field."},"domain_name.keyword":{"type":"string","title":"Filter the search by domain name. This 'contains' type search will look for the exact match anywhere in the field."},"at_after":{"type":"string","title":"At after cursor (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"at_before":{"type":"string","title":"At before cursor (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"machine_name.keyword":{"type":"string","title":"The name of the machine. This 'contains' type search will look for the exact match anywhere in the field."},"machine_name":{"type":"string","title":"The name of the machine"},"process_name.keyword":{"type":"string","title":"The name of the process that originated this detection. This 'contains' type search will look for the exact match anywhere in the field."},"process_name":{"type":"string","title":"The name of the process that originated this detection"},"affected_application.keyword":{"type":"string","title":"The application affected by this detection. This 'contains' type search will look for the exact match anywhere in the field."},"affected_application":{"type":"string","title":"The application affected by this detection"},"category":{"type":"string","title":"The category of this detection"},"md5":{"type":"string","title":"The md5 hash of this detection"},"sha256":{"type":"string","title":"The sha256 hash of this detection"},"path.keyword":{"type":"string","title":"The path where this detection happened. This 'contains' type search will look for the exact match anywhere in the field."},"path":{"type":"string","title":"The path where this detection happened"},"type":{"type":"string","title":"The type of the detection"},"threat_name.keyword":{"type":"string","title":"The name of the threat. This 'contains' type search will look for the exact match anywhere in the field."},"threat_name":{"type":"string","title":"The name of the threat"},"status":{"type":"string","title":"The status of the detection"},"correlation_hash":{"type":"string","title":"The hash"},"group_id":{"type":"string","title":"The ID of the group to which the endpoint is assigned (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"group_name":{"type":"string","title":"The name of the group to which the endpoint is assigned"},"machine_id":{"type":"string","title":"The ID of the endpoint (machine) where this detection originated (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"detection_id":{"type":"string","title":"The ID of the detection (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"parent_detection_id":{"type":"string","title":"The ID of the parent detection (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"scan_id":{"type":"string","title":"The ID of the scan (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"trace_id":{"type":"string","title":"The ID of the parent trace (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"start_date":{"type":"string","title":"Get results after this date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"end_date":{"type":"string","title":"Get results before this date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"scanned_at_after":{"type":"string","title":"Get results generated by a scan happening after this date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"scanned_at_before":{"type":"string","title":"Get results generated by a scan happening before this date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"reported_at_after":{"type":"string","title":"Get results reported after this date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"reported_at_before":{"type":"string","title":"Get results reported before this date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"cleaned_at_after":{"type":"string","title":"Get results cleaned after this date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"cleaned_at_before":{"type":"string","title":"Get results cleaned before this date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"is_root_detection":{"type":"boolean","title":"Whether this detection is the root detection"},"is_rtp_stream_event":{"type":"boolean","title":"Whether this is a Real-Time Protection event"},"object_guid":{"type":"string","title":"object_guid filter"},"device_control.physical_disk_name":{"type":"string","title":"Filter the search by device_control.physical_disk_name. Search for an exact match"},"device_control.physical_disk_name.keyword":{"type":"string","title":"Filter the search by device_control.physical_disk_name.keyword. Search for the matches that contain the value"},"not.device_control.physical_disk_name":{"type":"string","title":"Filter the search by not.device_control.physical_disk_name. Search for the matches that are not equal to the value"},"not.device_control.physical_disk_name.keyword":{"type":"string","title":"Filter the search by not.device_control.physical_disk_name.keyword. Search for the matches that doesnt contain the value"},"device_control.pnp_device_id":{"type":"string","title":"Filter the search by device_control.pnp_device_id. Search for an exact match"},"device_control.pnp_device_id.keyword":{"type":"string","title":"Filter the search by device_control.pnp_device_id.keyword. Search for the matches that contain the value"},"not.device_control.pnp_device_id":{"type":"string","title":"Filter the search by not.device_control.pnp_device_id. Search for the matches that are not equal to the value"},"not.device_control.pnp_device_id.keyword":{"type":"string","title":"Filter the search by not.device_control.pnp_device_id.keyword. Search for the matches that doesnt contain the value"},"device_control.device_id":{"type":"string","title":"Filter the search by device_control.device_id. Search for an exact match"},"device_control.device_id.keyword":{"type":"string","title":"Filter the search by device_control.device_id.keyword. Search for the matches that contain the value"},"not.device_control.device_id":{"type":"string","title":"Filter the search by not.device_control.device_id. Search for the matches that are not equal to the value"},"not.device_control.device_id.keyword":{"type":"string","title":"Filter the search by not.device_control.device_id.keyword. Search for the matches that doesnt contain the value"},"device_control.disk_interface":{"type":"string","title":"Filter the search by device_control.disk_interface. Search for an exact match"},"device_control.disk_interface.keyword":{"type":"string","title":"Filter the search by device_control.disk_interface.keyword. Search for the matches that contain the value"},"not.device_control.disk_interface":{"type":"string","title":"Filter the search by not.device_control.disk_interface. Search for the matches that are not equal to the value"},"not.device_control.disk_interface.keyword":{"type":"string","title":"Filter the search by not.device_control.disk_interface.keyword. Search for the matches that doesnt contain the value"},"device_control.manufacturer":{"type":"string","title":"Filter the search by device_control.manufacturer. Search for an exact match"},"device_control.manufacturer.keyword":{"type":"string","title":"Filter the search by device_control.manufacturer.keyword. Search for the matches that contain the value"},"not.device_control.manufacturer":{"type":"string","title":"Filter the search by not.device_control.manufacturer. Search for the matches that are not equal to the value"},"not.device_control.manufacturer.keyword":{"type":"string","title":"Filter the search by not.device_control.manufacturer.keyword. Search for the matches that doesnt contain the value"},"device_control.serial_number":{"type":"string","title":"Filter the search by device_control.serial_number. Search for an exact match"},"device_control.serial_number.keyword":{"type":"string","title":"Filter the search by device_control.serial_number.keyword. Search for the matches that contain the value"},"not.device_control.serial_number":{"type":"string","title":"Filter the search by not.device_control.serial_number. Search for the matches that are not equal to the value"},"not.device_control.serial_number.keyword":{"type":"string","title":"Filter the search by not.device_control.serial_number.keyword. Search for the matches that doesnt contain the value"},"device_control.file_system":{"type":"string","title":"Filter the search by device_control.file_system. Search for an exact match"},"device_control.file_system.keyword":{"type":"string","title":"Filter the search by device_control.file_system.keyword. Search for the matches that contain the value"},"not.device_control.file_system":{"type":"string","title":"Filter the search by not.device_control.file_system. Search for the matches that are not equal to the value"},"not.device_control.file_system.keyword":{"type":"string","title":"Filter the search by not.device_control.file_system.keyword. Search for the matches that doesnt contain the value"},"device_control.volume_name":{"type":"string","title":"Filter the search by device_control.volume_name. Search for an exact match"},"device_control.volume_name.keyword":{"type":"string","title":"Filter the search by device_control.volume_name.keyword. Search for the matches that contain the value"},"not.device_control.volume_name":{"type":"string","title":"Filter the search by not.device_control.volume_name. Search for the matches that are not equal to the value"},"not.device_control.volume_name.keyword":{"type":"string","title":"Filter the search by not.device_control.volume_name.keyword. Search for the matches that doesnt contain the value"},"device_control.volume_serial":{"type":"string","title":"Filter the search by device_control.volume_serial. Search for an exact match"},"device_control.volume_serial.keyword":{"type":"string","title":"Filter the search by device_control.volume_serial.keyword. Search for the matches that contain the value"},"not.device_control.volume_serial":{"type":"string","title":"Filter the search by not.device_control.volume_serial. Search for the matches that are not equal to the value"},"not.device_control.volume_serial.keyword":{"type":"string","title":"Filter the search by not.device_control.volume_serial.keyword. Search for the matches that doesnt contain the value"},"device_control.volume_device_path":{"type":"string","title":"Filter the search by device_control.volume_device_path. Search for an exact match"},"device_control.volume_device_path.keyword":{"type":"string","title":"Filter the search by device_control.volume_device_path.keyword. Search for the matches that contain the value"},"not.device_control.volume_device_path":{"type":"string","title":"Filter the search by not.device_control.volume_device_path. Search for the matches that are not equal to the value"},"not.device_control.volume_device_path.keyword":{"type":"string","title":"Filter the search by not.device_control.volume_device_path.keyword. Search for the matches that doesnt contain the value"},"device_control.block_status":{"type":"string","title":"Filter the search by device_control.block_status. Search for an exact match"},"device_control.block_status.keyword":{"type":"string","title":"Filter the search by device_control.block_status.keyword. Search for the matches that contain the value"},"not.device_control.block_status":{"type":"string","title":"Filter the search by not.device_control.block_status. Search for the matches that are not equal to the value"},"not.device_control.block_status.keyword":{"type":"string","title":"Filter the search by not.device_control.block_status.keyword. Search for the matches that doesnt contain the value"},"device_control.drive_compressed":{"type":"boolean","title":"Filter the search by device_control.drive_compressed. Search for an exact match"},"device_control.timestamp_before":{"type":"string","format":"date-time","title":"Results include device control events that have been occured before the specified date"},"device_control.timestamp_after":{"type":"string","format":"date-time","title":"Results include device control events that have been occured after the specified date"},"device_control.access":{"type":"string","title":"Access"},"action_taken":{"type":"string","title":"Filter the search by action_taken. Search for an exact match"},"action_taken.keyword":{"type":"string","title":"Filter the search by action_taken.keyword. Search for the matches that contain the value"},"not.action_taken":{"type":"string","title":"Filter the search by not.action_taken. Search for the matches that are not equal to the value"},"not.action_taken.keyword":{"type":"string","title":"Filter the search by not.action_taken.keyword. Search for the matches that doesnt contain the value"},"sort_field":{"type":"string","title":"If the sort field is used, then sort_order is required.","enum":["trace_id","scan_id","machine_id","group_id","group_name","account_id","detection_id","parent_detection_id","correlation_hash","status","threat_name.keyword","type","path.keyword","category","md5","sha256","affected_application.keyword","process_name.keyword","machine_name.keyword","scanned_at","reported_at","cleaned_at","is_root_detection","is_rtp_stream_event","object_guid","device_control.physical_disk_name","device_control.pnp_device_id","device_control.device_id","device_control.disk_interface","device_control.manufacturer","device_control.serial_number","device_control.file_system","device_control.volume_name","device_control.volume_serial","device_control.volume_device_path","device_control.block_status","device_control.drive_compressed","device_control.timestamp","active_directory.user.display_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.machine.display_name","active_directory.machine.sam_account_name","active_directory.machine.ou"]},"sort_order":{"type":"string","title":"Sorting direction","enum":["asc","desc"]},"page_size":{"type":"number","title":"The size of the page. If you only need aggregations, set it to 0","minimum":0,"maximum":2000},"aggregations":{"type":"array","title":"The Aggregations Schema","items":{"type":"string","title":"Aggregations","default":[],"enum":["trace_id","scan_id","machine_id","group_id","account_id","detection_id","parent_detection_id","correlation_hash","status","threat_name.keyword","type","path.keyword","category","md5","affected_application.keyword","process_name.keyword","machine_name.keyword","daily_detections_by_category","protection_status","os_info.os_release_name.keyword","nics.ips","nics.mac_address","nics.description.keyword","os_info.os_type","os_info.os_version.keyword","os_info.os_platform","os_info.os_architecture","host_name.keyword","fully_qualified_host_name.keyword","plugins.asset_manager.plugin_version.keyword","plugins.asset_manager.reboot_reason","plugins.endpoint_protection.plugin_version.keyword","plugins.endpoint_protection.sdk_version.keyword","plugins.endpoint_protection.component_package_version.keyword","plugins.endpoint_protection.update_package_version.keyword","plugins.endpoint_protection.reboot_reason","plugins.endpoint_detection_response.plugin_version.keyword","plugins.endpoint_detection_response.reboot_reason","plugins.endpoint_detection_and_response.plugin_version.keyword","plugins.endpoint_detection_and_response.reboot_reason","plugins.incident_response.plugin_version.keyword","plugins.incident_response.reboot_reason","plugins.siem.plugin_version.keyword","plugins.siem.reboot_reason","engine_version.keyword","domain_name.keyword","policy_etag","last_user.keyword","object_guid","device_control.physical_disk_name","device_control.pnp_device_id","device_control.device_id","device_control.disk_interface","device_control.manufacturer","device_control.serial_number","device_control.file_system","device_control.volume_name","device_control.volume_serial","device_control.volume_device_path","device_control.block_status","device_control.drive_compressed","device_control.timestamp"]}},"populate":{"type":"object","title":"The populate object Schema","properties":{"group":{"type":"boolean","title":"Populate with the group data"},"endpoint":{"type":"boolean","title":"Populate with the endpoint data (agent, machine_location)"},"scan_result":{"type":"boolean","title":"Populate with the scan_result data"}}},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]},"aggregate_by_account":{"type":"boolean"}},"allOf":[{"type":"object","title":"Active Directory Search Filters","properties":{"active_directory.user.display_name":{"type":"string","title":"Filter the search by active_directory.user.display_name. Search for the matches that are equal to the value"},"active_directory.user.display_name.keyword":{"type":"string","title":"Filter the search by active_directory.user.display_name.keyword. Search for the matches that contain the value"},"active_directory.user.ou":{"type":"string","title":"Filter the search by active_directory.user.ou. Search for the matches that are equal to the value"},"active_directory.user.ou.keyword":{"type":"string","title":"Filter the search by active_directory.user.ou.keyword. Search for the matches that contain the value"},"active_directory.user.ou.path":{"type":"string","title":"Filter the search by active_directory.user.ou.path. Search for the matches that are equal to the value"},"active_directory.user.ou.path.keyword":{"type":"string","title":"Filter the search by active_directory.user.ou.path.keyword. Search for the matches that contain the value"},"active_directory.user.sam_account_name":{"type":"string","title":"Filter the search by active_directory.user.sam_account_name. Search for the matches that are equal to the value"},"active_directory.user.sam_account_name.keyword":{"type":"string","title":"Filter the search by active_directory.user.sam_account_name.keyword. Search for the matches that contain the value"},"active_directory.machine.display_name":{"type":"string","title":"Filter the search by active_directory.machine.display_name. Search for the matches that are equal to the value"},"active_directory.machine.display_name.keyword":{"type":"string","title":"Filter the search by active_directory.machine.display_name.keyword. Search for the matches that contain the value"},"active_directory.machine.ou":{"type":"string","title":"Filter the search by active_directory.machine.ou. Search for the matches that are equal to the value"},"active_directory.machine.ou.keyword":{"type":"string","title":"Filter the search by active_directory.machine.ou.keyword. Search for the matches that contain the value"},"active_directory.machine.ou.path":{"type":"string","title":"Filter the search by active_directory.machine.ou.path. Search for the matches that are equal to the value"},"active_directory.machine.ou.path.keyword":{"type":"string","title":"Filter the search by active_directory.machine.ou.path.keyword. Search for the matches that contain the value"},"active_directory.machine.sam_account_name":{"type":"string","title":"Filter the search by active_directory.machine.sam_account_name. Search for the matches that are equal to the value"},"active_directory.machine.sam_account_name.keyword":{"type":"string","title":"Filter the search by active_directory.machine.sam_account_name.keyword. Search for the matches that contain the value"}}}]}]}],"properties":{"group_by":{"type":"string","title":"The sort field Schema","enum":["account_id","group_id","machine_id","type","status","category","action_taken","affected_application.keyword","threat_name.keyword","process_name.keyword","os_info.os_type","os_info.os_platform","object_guid","device_control.serial_number","device_control.physical_disk_name","device_control.manufacturer","device_control.volume_serial","device_control.volume_name","active_directory.user.display_name","active_directory.user.ou","active_directory.machine.display_name","active_directory.machine.ou"]},"page_size":{"type":"number","title":"The page_size Schema","minimum":50,"maximum":2000},"next_cursor":{"type":"string","title":"The Next_cursor Schema"}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"The Post Endpoints Search GroupBy Response Schema","required":["results","next_cursor"],"properties":{"results":{"type":"array","title":"The Results Schema","default":[],"items":{"type":"object","title":"The Items Schema","required":["value","total"],"properties":{"value":{"type":"string","title":"The Value Schema"},"total":{"type":"integer","title":"The Total Schema"},"name":{"type":"string","title":"The Total Schema"},"tags":{"type":"object","additionalProperties":true,"title":"The Total Schema"},"account_name":{"type":"string","title":"The Total Schema"}}}},"next_cursor":{"type":"string","title":"The Next_cursor Schema"}}}}}}},"tags":["Device Control"],"operationId":"api.v2.rmm.search.devicecontrol.group"}},"/oneview/v1/os-patches/export":{"post":{"description":"Export OS Patch data. You can export across multiple accounts. Specify your interested fields and the output format.\n\nSupported output formats: csv, xlsx, json.\n\n## Settings\n\n| Name | Description |\n|------|-------------|\n| groups | List of queries. The constraints accepted are the same accepted by the search os patches route. Refer to [Search OS Patches API](#operation/api.v2.rmm.search.os-patches) for more information about the constraints accepted. |\n| download | If set to true, the server will set the `Content-Disposition` header using the `filename` and `format` |\n| select | Which fields to select, and which field name to map to. See request schema for allowed values |\n| type | Output encoding (for `csv` and `json` format) |\n| filename | Name of the file to be set in `Content-Disposition` header if `download` = true |\n\n## Examples\n\n### Download HTML file\n\nA request with this body sent by a browser will download a file called `nameofthefile.html`, displaying a table with columns: `KB Id`, `Category`, `Description` for all detections on `windows` endpoints:\n\n```json\n\t{\n\t\t\"groups\": [{\n\t\t\t\"os_info.os_platform\": \"Windows\"\n\t\t}],\n\t\t\"format\": \"html\",\n\t\t\"type\": \"string\",\n\t\t\"filename\": \"nameofthefile\",\n\t\t\"download\": true,\n\t\t\"select\": [\n {\"field\": \"patch_id\", \"newField\": \"KB Id\"},\n {\"field\": \"category\", \"newField\": \"Category\"},\n {\"field\": \"description\", \"newField\": \"Description\"}\n ]\n\t}\n```\n\n\n","summary":"Export OS Patches","security":[{"client_credentials":["execute"]},{"user_permissions":["patchManagement.view"]}],"status":{"outage":["auth","search_stateless"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Export request","allOf":[{"type":"object","title":"Export request","required":["groups","select","format"],"properties":{"format":{"type":"string","title":"The output file","enum":["csv","xlsx","html","ods","txt","rtf","json"]},"download":{"type":"boolean","title":"Whether to instruct the client to download the response as a file. Only clients like browsers are supported"},"type":{"type":"string","title":"The encoding of the output","enum":["string","base64","binary"],"default":"string"},"select":{"type":"array","title":"Which fields to select from the response","items":{"type":"object","title":"Field","required":["field","newField"],"properties":{"newField":{"type":"string","title":"the new value"},"field":{"type":"string","title":"The response field to map to a new value","enum":["account_id","account_name","parent_account_id","machine_id","group_id","root_group_id","group_name","object_guid","host_name","fully_qualified_host_name","domain_name","display_name","vendor","product","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","severity","title","description","category","security_update_id","patch_id","kb_id","created_at","released_at","reboot_required","preview_patch","size","group.name","group.policy_id","group.policy_name","endpoint.last_day_seen","endpoint.last_user","alias","ignored_until","ignore_rule_ids","active_directory.user.display_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.machine.display_name","active_directory.machine.sam_account_name","active_directory.machine.ou"]}}}},"groups":{"type":"array","title":"List of queries","items":{"type":"object","title":"Query to fetch endpoints","allOf":[{"type":"object","title":"Search assets software request. Leading wildcards are not supported for constraint fields without '.keyword' suffix.","properties":{"machine_id":{"type":"string","title":"Filter the search by machine_id. Search for an exact match"},"machine_id.keyword":{"type":"string","title":"Filter the search by machine_id.keyword. Search for the matches that contain the value"},"not.machine_id":{"type":"string","title":"Filter the search by not.machine_id. Search for the matches that are not equal to the value"},"not.machine_id.keyword":{"type":"string","title":"Filter the search by not.machine_id.keyword. Search for the matches that do not contain the value"},"group_id":{"type":"string","title":"Filter the search by group_id. Search for an exact match"},"group_id.keyword":{"type":"string","title":"Filter the search by group_id.keyword. Search for the matches that contain the value"},"not.group_id":{"type":"string","title":"Filter the search by not.group_id. Search for the matches that are not equal to the value"},"not.group_id.keyword":{"type":"string","title":"Filter the search by not.group_id.keyword. Search for the matches that do not contain the value"},"root_group_id":{"type":"string","title":"Filter the search by root_group_id. Search for an exact match"},"root_group_id.keyword":{"type":"string","title":"Filter the search by root_group_id.keyword. Search for the matches that contain the value"},"not.root_group_id":{"type":"string","title":"Filter the search by not.root_group_id. Search for the matches that are not equal to the value"},"not.root_group_id.keyword":{"type":"string","title":"Filter the search by not.root_group_id.keyword. Search for the matches that do not contain the value"},"group_name":{"type":"string","title":"Filter the search by group_name. Search for an exact match"},"group_name.keyword":{"type":"string","title":"Filter the search by group_name.keyword. Search for the matches that contain the value"},"not.group_name":{"type":"string","title":"Filter the search by not.group_name. Search for the matches that are not equal to the value"},"not.group_name.keyword":{"type":"string","title":"Filter the search by not.group_name.keyword. Search for the matches that do not contain the value"},"object_guid":{"type":"string","title":"Filter the search by object_guid. Search for an exact match"},"object_guid.keyword":{"type":"string","title":"Filter the search by object_guid.keyword. Search for the matches that contain the value"},"not.object_guid":{"type":"string","title":"Filter the search by not.object_guid. Search for the matches that are not equal to the value"},"not.object_guid.keyword":{"type":"string","title":"Filter the search by not.object_guid.keyword. Search for the matches that do not contain the value"},"host_name":{"type":"string","title":"Filter the search by host_name. Search for an exact match"},"host_name.keyword":{"type":"string","title":"Filter the search by host_name.keyword. Search for the matches that contain the value"},"not.host_name":{"type":"string","title":"Filter the search by not.host_name. Search for the matches that are not equal to the value"},"not.host_name.keyword":{"type":"string","title":"Filter the search by not.host_name.keyword. Search for the matches that do not contain the value"},"fully_qualified_host_name":{"type":"string","title":"Filter the search by fully_qualified_host_name. Search for an exact match"},"fully_qualified_host_name.keyword":{"type":"string","title":"Filter the search by fully_qualified_host_name.keyword. Search for the matches that contain the value"},"not.fully_qualified_host_name":{"type":"string","title":"Filter the search by not.fully_qualified_host_name. Search for the matches that are not equal to the value"},"not.fully_qualified_host_name.keyword":{"type":"string","title":"Filter the search by not.fully_qualified_host_name.keyword. Search for the matches that do not contain the value"},"domain_name":{"type":"string","title":"Filter the search by domain_name. Search for an exact match"},"domain_name.keyword":{"type":"string","title":"Filter the search by domain_name.keyword. Search for the matches that contain the value"},"not.domain_name":{"type":"string","title":"Filter the search by not.domain_name. Search for the matches that are not equal to the value"},"not.domain_name.keyword":{"type":"string","title":"Filter the search by not.domain_name.keyword. Search for the matches that do not contain the value"},"display_name":{"type":"string","title":"Filter the search by display_name. Search for an exact match"},"display_name.keyword":{"type":"string","title":"Filter the search by display_name.keyword. Search for the matches that contain the value"},"not.display_name":{"type":"string","title":"Filter the search by not.display_name. Search for the matches that are not equal to the value"},"not.display_name.keyword":{"type":"string","title":"Filter the search by not.display_name.keyword. Search for the matches that do not contain the value"},"vendor":{"type":"string","title":"Filter the search by vendor. Search for an exact match"},"vendor.keyword":{"type":"string","title":"Filter the search by vendor.keyword. Search for the matches that contain the value"},"not.vendor":{"type":"string","title":"Filter the search by not.vendor. Search for the matches that are not equal to the value"},"not.vendor.keyword":{"type":"string","title":"Filter the search by not.vendor.keyword. Search for the matches that do not contain the value"},"product":{"type":"string","title":"Filter the search by product. Search for an exact match"},"product.keyword":{"type":"string","title":"Filter the search by product.keyword. Search for the matches that contain the value"},"not.product":{"type":"string","title":"Filter the search by not.product. Search for the matches that are not equal to the value"},"not.product.keyword":{"type":"string","title":"Filter the search by not.product.keyword. Search for the matches that do not contain the value"},"os_info.os_type":{"type":"string","title":"Filter the search by os_info.os_type. Search for an exact match"},"os_info.os_type.keyword":{"type":"string","title":"Filter the search by os_info.os_type.keyword. Search for the matches that contain the value"},"not.os_info.os_type":{"type":"string","title":"Filter the search by not.os_info.os_type. Search for the matches that are not equal to the value"},"not.os_info.os_type.keyword":{"type":"string","title":"Filter the search by not.os_info.os_type.keyword. Search for the matches that do not contain the value"},"os_info.os_version":{"type":"string","title":"Filter the search by os_info.os_version. Search for an exact match"},"os_info.os_version.keyword":{"type":"string","title":"Filter the search by os_info.os_version.keyword. Search for the matches that contain the value"},"not.os_info.os_version":{"type":"string","title":"Filter the search by not.os_info.os_version. Search for the matches that are not equal to the value"},"not.os_info.os_version.keyword":{"type":"string","title":"Filter the search by not.os_info.os_version.keyword. Search for the matches that do not contain the value"},"os_info.os_platform":{"type":"string","title":"Filter the search by os_info.os_platform. Search for an exact match"},"os_info.os_platform.keyword":{"type":"string","title":"Filter the search by os_info.os_platform.keyword. Search for the matches that contain the value"},"not.os_info.os_platform":{"type":"string","title":"Filter the search by not.os_info.os_platform. Search for the matches that are not equal to the value"},"not.os_info.os_platform.keyword":{"type":"string","title":"Filter the search by not.os_info.os_platform.keyword. Search for the matches that do not contain the value"},"os_info.os_architecture":{"type":"string","title":"Filter the search by os_info.os_architecture. Search for an exact match"},"os_info.os_architecture.keyword":{"type":"string","title":"Filter the search by os_info.os_architecture.keyword. Search for the matches that contain the value"},"not.os_info.os_architecture":{"type":"string","title":"Filter the search by not.os_info.os_architecture. Search for the matches that are not equal to the value"},"not.os_info.os_architecture.keyword":{"type":"string","title":"Filter the search by not.os_info.os_architecture.keyword. Search for the matches that do not contain the value"},"os_info.os_release_name":{"type":"string","title":"Filter the search by os_info.os_release_name. Search for an exact match"},"os_info.os_release_name.keyword":{"type":"string","title":"Filter the search by os_info.os_release_name.keyword. Search for the matches that contain the value"},"not.os_info.os_release_name":{"type":"string","title":"Filter the search by not.os_info.os_release_name. Search for the matches that are not equal to the value"},"not.os_info.os_release_name.keyword":{"type":"string","title":"Filter the search by not.os_info.os_release_name.keyword. Search for the matches that do not contain the value"},"severity":{"type":"string","title":"Filter the search by severity. Search for an exact match"},"severity.keyword":{"type":"string","title":"Filter the search by severity.keyword. Search for the matches that contain the value"},"not.severity":{"type":"string","title":"Filter the search by not.severity. Search for the matches that are not equal to the value"},"not.severity.keyword":{"type":"string","title":"Filter the search by not.severity.keyword. Search for the matches that do not contain the value"},"title":{"type":"string","title":"Filter the search by title. Search for an exact match"},"title.keyword":{"type":"string","title":"Filter the search by title.keyword. Search for the matches that contain the value"},"not.title":{"type":"string","title":"Filter the search by not.title. Search for the matches that are not equal to the value"},"not.title.keyword":{"type":"string","title":"Filter the search by not.title.keyword. Search for the matches that do not contain the value"},"description":{"type":"string","title":"Filter the search by description. Search for an exact match"},"description.keyword":{"type":"string","title":"Filter the search by description.keyword. Search for the matches that contain the value"},"not.description":{"type":"string","title":"Filter the search by not.description. Search for the matches that are not equal to the value"},"not.description.keyword":{"type":"string","title":"Filter the search by not.description.keyword. Search for the matches that do not contain the value"},"category":{"type":"string","title":"Filter the search by category. Search for an exact match"},"category.keyword":{"type":"string","title":"Filter the search by category.keyword. Search for the matches that contain the value"},"not.category":{"type":"string","title":"Filter the search by not.category. Search for the matches that are not equal to the value"},"not.category.keyword":{"type":"string","title":"Filter the search by not.category.keyword. Search for the matches that do not contain the value"},"security_update_id":{"type":"string","title":"Filter the search by security_update_id. Search for an exact match"},"security_update_id.keyword":{"type":"string","title":"Filter the search by security_update_id.keyword. Search for the matches that contain the value"},"not.security_update_id":{"type":"string","title":"Filter the search by not.security_update_id. Search for the matches that are not equal to the value"},"not.security_update_id.keyword":{"type":"string","title":"Filter the search by not.security_update_id.keyword. Search for the matches that do not contain the value"},"patch_id":{"type":"string","title":"Filter the search by patch_id. Search for an exact match"},"patch_id.keyword":{"type":"string","title":"Filter the search by patch_id.keyword. Search for the matches that contain the value"},"not.patch_id":{"type":"string","title":"Filter the search by not.patch_id. Search for the matches that are not equal to the value"},"not.patch_id.keyword":{"type":"string","title":"Filter the search by not.patch_id.keyword. Search for the matches that do not contain the value"},"kb_id":{"type":"string","title":"Filter the search by kb_id. Search for an exact match"},"kb_id.keyword":{"type":"string","title":"Filter the search by kb_id.keyword. Search for the matches that contain the value"},"not.kb_id":{"type":"string","title":"Filter the search by not.kb_id. Search for the matches that are not equal to the value"},"not.kb_id.keyword":{"type":"string","title":"Filter the search by not.kb_id.keyword. Search for the matches that do not contain the value"},"reboot_required":{"type":"boolean","title":"Filter the search by reboot_required"},"preview_patch":{"type":"boolean","title":"Filter the search by preview_patch"},"not.preview_patch":{"type":"boolean","title":"Filter the search by not.preview_patch"},"size":{"type":"integer","title":"Filter the search by exact size"},"size_lt":{"type":"integer","title":"Filter the search by size_lt. Search for the documents that are less than the value"},"size_lte":{"type":"integer","title":"Filter the search by size_lte. Search for the documents that are less than the value"},"size_gt":{"type":"integer","title":"Filter the search by size_gt. Search for the documents that are greater than the value"},"size_gte":{"type":"integer","title":"Filter the search by size_gte. Search for the documents that are greater than the value"},"created_at_after":{"type":"string","title":"Filter search with created_at_after ISO date string (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-02-01T17:23:17.860482Z"]},"created_at_before":{"type":"string","title":"Filter search with created_at_before ISO date string (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"released_at_after":{"type":"string","title":"Filter search with released_at_after ISO date string (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"released_at_before":{"type":"string","title":"Filter search with released_at_before ISO date string (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"update_ignored":{"type":"boolean","title":"Filter the search by update_ignored os patches"},"exists":{"type":"array","title":"Filter the results for records that have these fields","items":{"type":"string","enum":["domain_name","product_signature"]}},"not.exists":{"type":"array","title":"Filter the results for records that do not have these fields","items":{"type":"string","enum":["domain_name","product_signature"]}},"sort_field":{"type":"string","title":"Sort field","enum":["account_id","account_name","parent_account_id","machine_id","group_id","root_group_id","object_guid","host_name","fully_qualified_host_name","display_name","vendor","product","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","severity","title","description","category","security_update_id","patch_id","kb_id","created_at","released_at","reboot_required","preview_patch","size","domain_name","active_directory.user.display_name","active_directory.machine.display_name","active_directory.user.ou","active_directory.machine.ou","active_directory.user.sam_account_name","active_directory.machine.sam_account_name","ignored_until"]},"sort_order":{"type":"string","title":"Sorting direction","default":"asc","enum":["asc","desc"]},"populate":{"type":"object","title":"The populate object Schema","properties":{"group":{"type":"boolean","title":"Populates group data (group name, policy name, policy id)"},"endpoint":{"type":"boolean","title":"Populate with the endpoint data (last day seen, last user)"}}},"page_size":{"type":"number","title":"The size of the page. If you only need aggregations, set it to 0","minimum":0,"default":50,"maximum":2000},"aggregations":{"type":"array","title":"The Aggregations Schema","items":{"type":"string","title":"Aggregations","default":[],"enum":["account_id","account_name","parent_account_id","machine_id","group_id","root_group_id","object_guid","host_name","fully_qualified_host_name","display_name","vendor","product","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","severity","title","description","category","security_update_id","patch_id","kb_id","created_at","released_at","reboot_required","preview_patch","size"]}},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}},"allOf":[{"type":"object","title":"Active Directory Search Filters","properties":{"active_directory.user.display_name":{"type":"string","title":"Filter the search by active_directory.user.display_name. Search for the matches that are equal to the value"},"active_directory.user.display_name.keyword":{"type":"string","title":"Filter the search by active_directory.user.display_name.keyword. Search for the matches that contain the value"},"active_directory.user.ou":{"type":"string","title":"Filter the search by active_directory.user.ou. Search for the matches that are equal to the value"},"active_directory.user.ou.keyword":{"type":"string","title":"Filter the search by active_directory.user.ou.keyword. Search for the matches that contain the value"},"active_directory.user.ou.path":{"type":"string","title":"Filter the search by active_directory.user.ou.path. Search for the matches that are equal to the value"},"active_directory.user.ou.path.keyword":{"type":"string","title":"Filter the search by active_directory.user.ou.path.keyword. Search for the matches that contain the value"},"active_directory.user.sam_account_name":{"type":"string","title":"Filter the search by active_directory.user.sam_account_name. Search for the matches that are equal to the value"},"active_directory.user.sam_account_name.keyword":{"type":"string","title":"Filter the search by active_directory.user.sam_account_name.keyword. Search for the matches that contain the value"},"active_directory.machine.display_name":{"type":"string","title":"Filter the search by active_directory.machine.display_name. Search for the matches that are equal to the value"},"active_directory.machine.display_name.keyword":{"type":"string","title":"Filter the search by active_directory.machine.display_name.keyword. Search for the matches that contain the value"},"active_directory.machine.ou":{"type":"string","title":"Filter the search by active_directory.machine.ou. Search for the matches that are equal to the value"},"active_directory.machine.ou.keyword":{"type":"string","title":"Filter the search by active_directory.machine.ou.keyword. Search for the matches that contain the value"},"active_directory.machine.ou.path":{"type":"string","title":"Filter the search by active_directory.machine.ou.path. Search for the matches that are equal to the value"},"active_directory.machine.ou.path.keyword":{"type":"string","title":"Filter the search by active_directory.machine.ou.path.keyword. Search for the matches that contain the value"},"active_directory.machine.sam_account_name":{"type":"string","title":"Filter the search by active_directory.machine.sam_account_name. Search for the matches that are equal to the value"},"active_directory.machine.sam_account_name.keyword":{"type":"string","title":"Filter the search by active_directory.machine.sam_account_name.keyword. Search for the matches that contain the value"}}}]}]}}}},{"properties":{"groups":{"type":"array","title":"List of search queries","items":{"type":"object","title":"Search assets CVE request. Leading wildcards are not supported for constraint fields without '.keyword' suffix.","allOf":[{"type":"object","title":"Search assets software request. Leading wildcards are not supported for constraint fields without '.keyword' suffix.","properties":{"machine_id":{"type":"string","title":"Filter the search by machine_id. Search for an exact match"},"machine_id.keyword":{"type":"string","title":"Filter the search by machine_id.keyword. Search for the matches that contain the value"},"not.machine_id":{"type":"string","title":"Filter the search by not.machine_id. Search for the matches that are not equal to the value"},"not.machine_id.keyword":{"type":"string","title":"Filter the search by not.machine_id.keyword. Search for the matches that do not contain the value"},"group_id":{"type":"string","title":"Filter the search by group_id. Search for an exact match"},"group_id.keyword":{"type":"string","title":"Filter the search by group_id.keyword. Search for the matches that contain the value"},"not.group_id":{"type":"string","title":"Filter the search by not.group_id. Search for the matches that are not equal to the value"},"not.group_id.keyword":{"type":"string","title":"Filter the search by not.group_id.keyword. Search for the matches that do not contain the value"},"root_group_id":{"type":"string","title":"Filter the search by root_group_id. Search for an exact match"},"root_group_id.keyword":{"type":"string","title":"Filter the search by root_group_id.keyword. Search for the matches that contain the value"},"not.root_group_id":{"type":"string","title":"Filter the search by not.root_group_id. Search for the matches that are not equal to the value"},"not.root_group_id.keyword":{"type":"string","title":"Filter the search by not.root_group_id.keyword. Search for the matches that do not contain the value"},"group_name":{"type":"string","title":"Filter the search by group_name. Search for an exact match"},"group_name.keyword":{"type":"string","title":"Filter the search by group_name.keyword. Search for the matches that contain the value"},"not.group_name":{"type":"string","title":"Filter the search by not.group_name. Search for the matches that are not equal to the value"},"not.group_name.keyword":{"type":"string","title":"Filter the search by not.group_name.keyword. Search for the matches that do not contain the value"},"object_guid":{"type":"string","title":"Filter the search by object_guid. Search for an exact match"},"object_guid.keyword":{"type":"string","title":"Filter the search by object_guid.keyword. Search for the matches that contain the value"},"not.object_guid":{"type":"string","title":"Filter the search by not.object_guid. Search for the matches that are not equal to the value"},"not.object_guid.keyword":{"type":"string","title":"Filter the search by not.object_guid.keyword. Search for the matches that do not contain the value"},"host_name":{"type":"string","title":"Filter the search by host_name. Search for an exact match"},"host_name.keyword":{"type":"string","title":"Filter the search by host_name.keyword. Search for the matches that contain the value"},"not.host_name":{"type":"string","title":"Filter the search by not.host_name. Search for the matches that are not equal to the value"},"not.host_name.keyword":{"type":"string","title":"Filter the search by not.host_name.keyword. Search for the matches that do not contain the value"},"fully_qualified_host_name":{"type":"string","title":"Filter the search by fully_qualified_host_name. Search for an exact match"},"fully_qualified_host_name.keyword":{"type":"string","title":"Filter the search by fully_qualified_host_name.keyword. Search for the matches that contain the value"},"not.fully_qualified_host_name":{"type":"string","title":"Filter the search by not.fully_qualified_host_name. Search for the matches that are not equal to the value"},"not.fully_qualified_host_name.keyword":{"type":"string","title":"Filter the search by not.fully_qualified_host_name.keyword. Search for the matches that do not contain the value"},"domain_name":{"type":"string","title":"Filter the search by domain_name. Search for an exact match"},"domain_name.keyword":{"type":"string","title":"Filter the search by domain_name.keyword. Search for the matches that contain the value"},"not.domain_name":{"type":"string","title":"Filter the search by not.domain_name. Search for the matches that are not equal to the value"},"not.domain_name.keyword":{"type":"string","title":"Filter the search by not.domain_name.keyword. Search for the matches that do not contain the value"},"display_name":{"type":"string","title":"Filter the search by display_name. Search for an exact match"},"display_name.keyword":{"type":"string","title":"Filter the search by display_name.keyword. Search for the matches that contain the value"},"not.display_name":{"type":"string","title":"Filter the search by not.display_name. Search for the matches that are not equal to the value"},"not.display_name.keyword":{"type":"string","title":"Filter the search by not.display_name.keyword. Search for the matches that do not contain the value"},"vendor":{"type":"string","title":"Filter the search by vendor. Search for an exact match"},"vendor.keyword":{"type":"string","title":"Filter the search by vendor.keyword. Search for the matches that contain the value"},"not.vendor":{"type":"string","title":"Filter the search by not.vendor. Search for the matches that are not equal to the value"},"not.vendor.keyword":{"type":"string","title":"Filter the search by not.vendor.keyword. Search for the matches that do not contain the value"},"product":{"type":"string","title":"Filter the search by product. Search for an exact match"},"product.keyword":{"type":"string","title":"Filter the search by product.keyword. Search for the matches that contain the value"},"not.product":{"type":"string","title":"Filter the search by not.product. Search for the matches that are not equal to the value"},"not.product.keyword":{"type":"string","title":"Filter the search by not.product.keyword. Search for the matches that do not contain the value"},"os_info.os_type":{"type":"string","title":"Filter the search by os_info.os_type. Search for an exact match"},"os_info.os_type.keyword":{"type":"string","title":"Filter the search by os_info.os_type.keyword. Search for the matches that contain the value"},"not.os_info.os_type":{"type":"string","title":"Filter the search by not.os_info.os_type. Search for the matches that are not equal to the value"},"not.os_info.os_type.keyword":{"type":"string","title":"Filter the search by not.os_info.os_type.keyword. Search for the matches that do not contain the value"},"os_info.os_version":{"type":"string","title":"Filter the search by os_info.os_version. Search for an exact match"},"os_info.os_version.keyword":{"type":"string","title":"Filter the search by os_info.os_version.keyword. Search for the matches that contain the value"},"not.os_info.os_version":{"type":"string","title":"Filter the search by not.os_info.os_version. Search for the matches that are not equal to the value"},"not.os_info.os_version.keyword":{"type":"string","title":"Filter the search by not.os_info.os_version.keyword. Search for the matches that do not contain the value"},"os_info.os_platform":{"type":"string","title":"Filter the search by os_info.os_platform. Search for an exact match"},"os_info.os_platform.keyword":{"type":"string","title":"Filter the search by os_info.os_platform.keyword. Search for the matches that contain the value"},"not.os_info.os_platform":{"type":"string","title":"Filter the search by not.os_info.os_platform. Search for the matches that are not equal to the value"},"not.os_info.os_platform.keyword":{"type":"string","title":"Filter the search by not.os_info.os_platform.keyword. Search for the matches that do not contain the value"},"os_info.os_architecture":{"type":"string","title":"Filter the search by os_info.os_architecture. Search for an exact match"},"os_info.os_architecture.keyword":{"type":"string","title":"Filter the search by os_info.os_architecture.keyword. Search for the matches that contain the value"},"not.os_info.os_architecture":{"type":"string","title":"Filter the search by not.os_info.os_architecture. Search for the matches that are not equal to the value"},"not.os_info.os_architecture.keyword":{"type":"string","title":"Filter the search by not.os_info.os_architecture.keyword. Search for the matches that do not contain the value"},"os_info.os_release_name":{"type":"string","title":"Filter the search by os_info.os_release_name. Search for an exact match"},"os_info.os_release_name.keyword":{"type":"string","title":"Filter the search by os_info.os_release_name.keyword. Search for the matches that contain the value"},"not.os_info.os_release_name":{"type":"string","title":"Filter the search by not.os_info.os_release_name. Search for the matches that are not equal to the value"},"not.os_info.os_release_name.keyword":{"type":"string","title":"Filter the search by not.os_info.os_release_name.keyword. Search for the matches that do not contain the value"},"severity":{"type":"string","title":"Filter the search by severity. Search for an exact match"},"severity.keyword":{"type":"string","title":"Filter the search by severity.keyword. Search for the matches that contain the value"},"not.severity":{"type":"string","title":"Filter the search by not.severity. Search for the matches that are not equal to the value"},"not.severity.keyword":{"type":"string","title":"Filter the search by not.severity.keyword. Search for the matches that do not contain the value"},"title":{"type":"string","title":"Filter the search by title. Search for an exact match"},"title.keyword":{"type":"string","title":"Filter the search by title.keyword. Search for the matches that contain the value"},"not.title":{"type":"string","title":"Filter the search by not.title. Search for the matches that are not equal to the value"},"not.title.keyword":{"type":"string","title":"Filter the search by not.title.keyword. Search for the matches that do not contain the value"},"description":{"type":"string","title":"Filter the search by description. Search for an exact match"},"description.keyword":{"type":"string","title":"Filter the search by description.keyword. Search for the matches that contain the value"},"not.description":{"type":"string","title":"Filter the search by not.description. Search for the matches that are not equal to the value"},"not.description.keyword":{"type":"string","title":"Filter the search by not.description.keyword. Search for the matches that do not contain the value"},"category":{"type":"string","title":"Filter the search by category. Search for an exact match"},"category.keyword":{"type":"string","title":"Filter the search by category.keyword. Search for the matches that contain the value"},"not.category":{"type":"string","title":"Filter the search by not.category. Search for the matches that are not equal to the value"},"not.category.keyword":{"type":"string","title":"Filter the search by not.category.keyword. Search for the matches that do not contain the value"},"security_update_id":{"type":"string","title":"Filter the search by security_update_id. Search for an exact match"},"security_update_id.keyword":{"type":"string","title":"Filter the search by security_update_id.keyword. Search for the matches that contain the value"},"not.security_update_id":{"type":"string","title":"Filter the search by not.security_update_id. Search for the matches that are not equal to the value"},"not.security_update_id.keyword":{"type":"string","title":"Filter the search by not.security_update_id.keyword. Search for the matches that do not contain the value"},"patch_id":{"type":"string","title":"Filter the search by patch_id. Search for an exact match"},"patch_id.keyword":{"type":"string","title":"Filter the search by patch_id.keyword. Search for the matches that contain the value"},"not.patch_id":{"type":"string","title":"Filter the search by not.patch_id. Search for the matches that are not equal to the value"},"not.patch_id.keyword":{"type":"string","title":"Filter the search by not.patch_id.keyword. Search for the matches that do not contain the value"},"kb_id":{"type":"string","title":"Filter the search by kb_id. Search for an exact match"},"kb_id.keyword":{"type":"string","title":"Filter the search by kb_id.keyword. Search for the matches that contain the value"},"not.kb_id":{"type":"string","title":"Filter the search by not.kb_id. Search for the matches that are not equal to the value"},"not.kb_id.keyword":{"type":"string","title":"Filter the search by not.kb_id.keyword. Search for the matches that do not contain the value"},"reboot_required":{"type":"boolean","title":"Filter the search by reboot_required"},"preview_patch":{"type":"boolean","title":"Filter the search by preview_patch"},"not.preview_patch":{"type":"boolean","title":"Filter the search by not.preview_patch"},"size":{"type":"integer","title":"Filter the search by exact size"},"size_lt":{"type":"integer","title":"Filter the search by size_lt. Search for the documents that are less than the value"},"size_lte":{"type":"integer","title":"Filter the search by size_lte. Search for the documents that are less than the value"},"size_gt":{"type":"integer","title":"Filter the search by size_gt. Search for the documents that are greater than the value"},"size_gte":{"type":"integer","title":"Filter the search by size_gte. Search for the documents that are greater than the value"},"created_at_after":{"type":"string","title":"Filter search with created_at_after ISO date string (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-02-01T17:23:17.860482Z"]},"created_at_before":{"type":"string","title":"Filter search with created_at_before ISO date string (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"released_at_after":{"type":"string","title":"Filter search with released_at_after ISO date string (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"released_at_before":{"type":"string","title":"Filter search with released_at_before ISO date string (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"update_ignored":{"type":"boolean","title":"Filter the search by update_ignored os patches"},"exists":{"type":"array","title":"Filter the results for records that have these fields","items":{"type":"string","enum":["domain_name","product_signature"]}},"not.exists":{"type":"array","title":"Filter the results for records that do not have these fields","items":{"type":"string","enum":["domain_name","product_signature"]}},"sort_field":{"type":"string","title":"Sort field","enum":["account_id","account_name","parent_account_id","machine_id","group_id","root_group_id","object_guid","host_name","fully_qualified_host_name","display_name","vendor","product","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","severity","title","description","category","security_update_id","patch_id","kb_id","created_at","released_at","reboot_required","preview_patch","size","domain_name","active_directory.user.display_name","active_directory.machine.display_name","active_directory.user.ou","active_directory.machine.ou","active_directory.user.sam_account_name","active_directory.machine.sam_account_name","ignored_until"]},"sort_order":{"type":"string","title":"Sorting direction","default":"asc","enum":["asc","desc"]},"populate":{"type":"object","title":"The populate object Schema","properties":{"group":{"type":"boolean","title":"Populates group data (group name, policy name, policy id)"},"endpoint":{"type":"boolean","title":"Populate with the endpoint data (last day seen, last user)"}}},"page_size":{"type":"number","title":"The size of the page. If you only need aggregations, set it to 0","minimum":0,"default":50,"maximum":2000},"aggregations":{"type":"array","title":"The Aggregations Schema","items":{"type":"string","title":"Aggregations","default":[],"enum":["account_id","account_name","parent_account_id","machine_id","group_id","root_group_id","object_guid","host_name","fully_qualified_host_name","display_name","vendor","product","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","severity","title","description","category","security_update_id","patch_id","kb_id","created_at","released_at","reboot_required","preview_patch","size"]}},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}},"allOf":[{"type":"object","title":"Active Directory Search Filters","properties":{"active_directory.user.display_name":{"type":"string","title":"Filter the search by active_directory.user.display_name. Search for the matches that are equal to the value"},"active_directory.user.display_name.keyword":{"type":"string","title":"Filter the search by active_directory.user.display_name.keyword. Search for the matches that contain the value"},"active_directory.user.ou":{"type":"string","title":"Filter the search by active_directory.user.ou. Search for the matches that are equal to the value"},"active_directory.user.ou.keyword":{"type":"string","title":"Filter the search by active_directory.user.ou.keyword. Search for the matches that contain the value"},"active_directory.user.ou.path":{"type":"string","title":"Filter the search by active_directory.user.ou.path. Search for the matches that are equal to the value"},"active_directory.user.ou.path.keyword":{"type":"string","title":"Filter the search by active_directory.user.ou.path.keyword. Search for the matches that contain the value"},"active_directory.user.sam_account_name":{"type":"string","title":"Filter the search by active_directory.user.sam_account_name. Search for the matches that are equal to the value"},"active_directory.user.sam_account_name.keyword":{"type":"string","title":"Filter the search by active_directory.user.sam_account_name.keyword. Search for the matches that contain the value"},"active_directory.machine.display_name":{"type":"string","title":"Filter the search by active_directory.machine.display_name. Search for the matches that are equal to the value"},"active_directory.machine.display_name.keyword":{"type":"string","title":"Filter the search by active_directory.machine.display_name.keyword. Search for the matches that contain the value"},"active_directory.machine.ou":{"type":"string","title":"Filter the search by active_directory.machine.ou. Search for the matches that are equal to the value"},"active_directory.machine.ou.keyword":{"type":"string","title":"Filter the search by active_directory.machine.ou.keyword. Search for the matches that contain the value"},"active_directory.machine.ou.path":{"type":"string","title":"Filter the search by active_directory.machine.ou.path. Search for the matches that are equal to the value"},"active_directory.machine.ou.path.keyword":{"type":"string","title":"Filter the search by active_directory.machine.ou.path.keyword. Search for the matches that contain the value"},"active_directory.machine.sam_account_name":{"type":"string","title":"Filter the search by active_directory.machine.sam_account_name. Search for the matches that are equal to the value"},"active_directory.machine.sam_account_name.keyword":{"type":"string","title":"Filter the search by active_directory.machine.sam_account_name.keyword. Search for the matches that contain the value"}}}]},{"type":"object","required":["account_ids"],"properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}},{"type":"object","properties":{"account_name":{"type":"string","title":"Filter the search by account_name. Search for an exact match"},"account_name.keyword":{"type":"string","title":"Filter the search by account_name.keyword. Search for the matches that contain the value"},"not.account_name":{"type":"string","title":"Filter the search by not.account_name. Search for the matches that are not equal to the value"},"not.account_name.keyword":{"type":"string","title":"Filter the search by not.account_name.keyword. Search for the matches that do not contain the value"},"parent_account_id":{"type":"string","title":"Filter the search by parent_account_id. Search for an exact match"},"parent_account_id.keyword":{"type":"string","title":"Filter the search by parent_account_id.keyword. Search for the matches that contain the value"},"not.parent_account_id":{"type":"string","title":"Filter the search by not.parent_account_id. Search for the matches that are not equal to the value"},"not.parent_account_id.keyword":{"type":"string","title":"Filter the search by not.parent_account_id.keyword. Search for the matches that do not contain the value"}}},{"type":"object","title":"Active Directory Search Filters","properties":{"active_directory.user.display_name":{"type":"string","title":"Filter the search by active_directory.user.display_name. Search for the matches that are equal to the value"},"active_directory.user.display_name.keyword":{"type":"string","title":"Filter the search by active_directory.user.display_name.keyword. Search for the matches that contain the value"},"active_directory.user.ou":{"type":"string","title":"Filter the search by active_directory.user.ou. Search for the matches that are equal to the value"},"active_directory.user.ou.keyword":{"type":"string","title":"Filter the search by active_directory.user.ou.keyword. Search for the matches that contain the value"},"active_directory.user.ou.path":{"type":"string","title":"Filter the search by active_directory.user.ou.path. Search for the matches that are equal to the value"},"active_directory.user.ou.path.keyword":{"type":"string","title":"Filter the search by active_directory.user.ou.path.keyword. Search for the matches that contain the value"},"active_directory.user.sam_account_name":{"type":"string","title":"Filter the search by active_directory.user.sam_account_name. Search for the matches that are equal to the value"},"active_directory.user.sam_account_name.keyword":{"type":"string","title":"Filter the search by active_directory.user.sam_account_name.keyword. Search for the matches that contain the value"},"active_directory.machine.display_name":{"type":"string","title":"Filter the search by active_directory.machine.display_name. Search for the matches that are equal to the value"},"active_directory.machine.display_name.keyword":{"type":"string","title":"Filter the search by active_directory.machine.display_name.keyword. Search for the matches that contain the value"},"active_directory.machine.ou":{"type":"string","title":"Filter the search by active_directory.machine.ou. Search for the matches that are equal to the value"},"active_directory.machine.ou.keyword":{"type":"string","title":"Filter the search by active_directory.machine.ou.keyword. Search for the matches that contain the value"},"active_directory.machine.ou.path":{"type":"string","title":"Filter the search by active_directory.machine.ou.path. Search for the matches that are equal to the value"},"active_directory.machine.ou.path.keyword":{"type":"string","title":"Filter the search by active_directory.machine.ou.path.keyword. Search for the matches that contain the value"},"active_directory.machine.sam_account_name":{"type":"string","title":"Filter the search by active_directory.machine.sam_account_name. Search for the matches that are equal to the value"},"active_directory.machine.sam_account_name.keyword":{"type":"string","title":"Filter the search by active_directory.machine.sam_account_name.keyword. Search for the matches that contain the value"}}}]}}}}]}}}},"responses":{"200":{"description":"Successful response"}},"tags":["OS Patches"],"operationId":"api.v2.rmm.post.export.os-patches"}},"/oneview/v1/os-patches/export/async":{"post":{"description":"Export OS Patches asynchronously","summary":"Export OS Patches asynchronously","security":[{"client_credentials":["execute"]},{"user_permissions":["patchManagement.view"]}],"status":{"outage":["auth","search_stateless"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Export request","allOf":[{"type":"object","title":"Export request","required":["groups","select","format"],"properties":{"format":{"type":"string","title":"The output file","enum":["csv","xlsx","html","ods","txt","rtf","json"]},"download":{"type":"boolean","title":"Whether to instruct the client to download the response as a file. Only clients like browsers are supported"},"type":{"type":"string","title":"The encoding of the output","enum":["string","base64","binary"],"default":"string"},"select":{"type":"array","title":"Which fields to select from the response","items":{"type":"object","title":"Field","required":["field","newField"],"properties":{"newField":{"type":"string","title":"the new value"},"field":{"type":"string","title":"The response field to map to a new value","enum":["account_id","account_name","parent_account_id","machine_id","group_id","root_group_id","group_name","object_guid","host_name","fully_qualified_host_name","domain_name","display_name","vendor","product","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","severity","title","description","category","security_update_id","patch_id","kb_id","created_at","released_at","reboot_required","preview_patch","size","group.name","group.policy_id","group.policy_name","endpoint.last_day_seen","endpoint.last_user","alias","ignored_until","ignore_rule_ids","active_directory.user.display_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.machine.display_name","active_directory.machine.sam_account_name","active_directory.machine.ou"]}}}},"groups":{"type":"array","title":"List of queries","items":{"type":"object","title":"Query to fetch endpoints","allOf":[{"type":"object","title":"Search assets software request. Leading wildcards are not supported for constraint fields without '.keyword' suffix.","properties":{"machine_id":{"type":"string","title":"Filter the search by machine_id. Search for an exact match"},"machine_id.keyword":{"type":"string","title":"Filter the search by machine_id.keyword. Search for the matches that contain the value"},"not.machine_id":{"type":"string","title":"Filter the search by not.machine_id. Search for the matches that are not equal to the value"},"not.machine_id.keyword":{"type":"string","title":"Filter the search by not.machine_id.keyword. Search for the matches that do not contain the value"},"group_id":{"type":"string","title":"Filter the search by group_id. Search for an exact match"},"group_id.keyword":{"type":"string","title":"Filter the search by group_id.keyword. Search for the matches that contain the value"},"not.group_id":{"type":"string","title":"Filter the search by not.group_id. Search for the matches that are not equal to the value"},"not.group_id.keyword":{"type":"string","title":"Filter the search by not.group_id.keyword. Search for the matches that do not contain the value"},"root_group_id":{"type":"string","title":"Filter the search by root_group_id. Search for an exact match"},"root_group_id.keyword":{"type":"string","title":"Filter the search by root_group_id.keyword. Search for the matches that contain the value"},"not.root_group_id":{"type":"string","title":"Filter the search by not.root_group_id. Search for the matches that are not equal to the value"},"not.root_group_id.keyword":{"type":"string","title":"Filter the search by not.root_group_id.keyword. Search for the matches that do not contain the value"},"group_name":{"type":"string","title":"Filter the search by group_name. Search for an exact match"},"group_name.keyword":{"type":"string","title":"Filter the search by group_name.keyword. Search for the matches that contain the value"},"not.group_name":{"type":"string","title":"Filter the search by not.group_name. Search for the matches that are not equal to the value"},"not.group_name.keyword":{"type":"string","title":"Filter the search by not.group_name.keyword. Search for the matches that do not contain the value"},"object_guid":{"type":"string","title":"Filter the search by object_guid. Search for an exact match"},"object_guid.keyword":{"type":"string","title":"Filter the search by object_guid.keyword. Search for the matches that contain the value"},"not.object_guid":{"type":"string","title":"Filter the search by not.object_guid. Search for the matches that are not equal to the value"},"not.object_guid.keyword":{"type":"string","title":"Filter the search by not.object_guid.keyword. Search for the matches that do not contain the value"},"host_name":{"type":"string","title":"Filter the search by host_name. Search for an exact match"},"host_name.keyword":{"type":"string","title":"Filter the search by host_name.keyword. Search for the matches that contain the value"},"not.host_name":{"type":"string","title":"Filter the search by not.host_name. Search for the matches that are not equal to the value"},"not.host_name.keyword":{"type":"string","title":"Filter the search by not.host_name.keyword. Search for the matches that do not contain the value"},"fully_qualified_host_name":{"type":"string","title":"Filter the search by fully_qualified_host_name. Search for an exact match"},"fully_qualified_host_name.keyword":{"type":"string","title":"Filter the search by fully_qualified_host_name.keyword. Search for the matches that contain the value"},"not.fully_qualified_host_name":{"type":"string","title":"Filter the search by not.fully_qualified_host_name. Search for the matches that are not equal to the value"},"not.fully_qualified_host_name.keyword":{"type":"string","title":"Filter the search by not.fully_qualified_host_name.keyword. Search for the matches that do not contain the value"},"domain_name":{"type":"string","title":"Filter the search by domain_name. Search for an exact match"},"domain_name.keyword":{"type":"string","title":"Filter the search by domain_name.keyword. Search for the matches that contain the value"},"not.domain_name":{"type":"string","title":"Filter the search by not.domain_name. Search for the matches that are not equal to the value"},"not.domain_name.keyword":{"type":"string","title":"Filter the search by not.domain_name.keyword. Search for the matches that do not contain the value"},"display_name":{"type":"string","title":"Filter the search by display_name. Search for an exact match"},"display_name.keyword":{"type":"string","title":"Filter the search by display_name.keyword. Search for the matches that contain the value"},"not.display_name":{"type":"string","title":"Filter the search by not.display_name. Search for the matches that are not equal to the value"},"not.display_name.keyword":{"type":"string","title":"Filter the search by not.display_name.keyword. Search for the matches that do not contain the value"},"vendor":{"type":"string","title":"Filter the search by vendor. Search for an exact match"},"vendor.keyword":{"type":"string","title":"Filter the search by vendor.keyword. Search for the matches that contain the value"},"not.vendor":{"type":"string","title":"Filter the search by not.vendor. Search for the matches that are not equal to the value"},"not.vendor.keyword":{"type":"string","title":"Filter the search by not.vendor.keyword. Search for the matches that do not contain the value"},"product":{"type":"string","title":"Filter the search by product. Search for an exact match"},"product.keyword":{"type":"string","title":"Filter the search by product.keyword. Search for the matches that contain the value"},"not.product":{"type":"string","title":"Filter the search by not.product. Search for the matches that are not equal to the value"},"not.product.keyword":{"type":"string","title":"Filter the search by not.product.keyword. Search for the matches that do not contain the value"},"os_info.os_type":{"type":"string","title":"Filter the search by os_info.os_type. Search for an exact match"},"os_info.os_type.keyword":{"type":"string","title":"Filter the search by os_info.os_type.keyword. Search for the matches that contain the value"},"not.os_info.os_type":{"type":"string","title":"Filter the search by not.os_info.os_type. Search for the matches that are not equal to the value"},"not.os_info.os_type.keyword":{"type":"string","title":"Filter the search by not.os_info.os_type.keyword. Search for the matches that do not contain the value"},"os_info.os_version":{"type":"string","title":"Filter the search by os_info.os_version. Search for an exact match"},"os_info.os_version.keyword":{"type":"string","title":"Filter the search by os_info.os_version.keyword. Search for the matches that contain the value"},"not.os_info.os_version":{"type":"string","title":"Filter the search by not.os_info.os_version. Search for the matches that are not equal to the value"},"not.os_info.os_version.keyword":{"type":"string","title":"Filter the search by not.os_info.os_version.keyword. Search for the matches that do not contain the value"},"os_info.os_platform":{"type":"string","title":"Filter the search by os_info.os_platform. Search for an exact match"},"os_info.os_platform.keyword":{"type":"string","title":"Filter the search by os_info.os_platform.keyword. Search for the matches that contain the value"},"not.os_info.os_platform":{"type":"string","title":"Filter the search by not.os_info.os_platform. Search for the matches that are not equal to the value"},"not.os_info.os_platform.keyword":{"type":"string","title":"Filter the search by not.os_info.os_platform.keyword. Search for the matches that do not contain the value"},"os_info.os_architecture":{"type":"string","title":"Filter the search by os_info.os_architecture. Search for an exact match"},"os_info.os_architecture.keyword":{"type":"string","title":"Filter the search by os_info.os_architecture.keyword. Search for the matches that contain the value"},"not.os_info.os_architecture":{"type":"string","title":"Filter the search by not.os_info.os_architecture. Search for the matches that are not equal to the value"},"not.os_info.os_architecture.keyword":{"type":"string","title":"Filter the search by not.os_info.os_architecture.keyword. Search for the matches that do not contain the value"},"os_info.os_release_name":{"type":"string","title":"Filter the search by os_info.os_release_name. Search for an exact match"},"os_info.os_release_name.keyword":{"type":"string","title":"Filter the search by os_info.os_release_name.keyword. Search for the matches that contain the value"},"not.os_info.os_release_name":{"type":"string","title":"Filter the search by not.os_info.os_release_name. Search for the matches that are not equal to the value"},"not.os_info.os_release_name.keyword":{"type":"string","title":"Filter the search by not.os_info.os_release_name.keyword. Search for the matches that do not contain the value"},"severity":{"type":"string","title":"Filter the search by severity. Search for an exact match"},"severity.keyword":{"type":"string","title":"Filter the search by severity.keyword. Search for the matches that contain the value"},"not.severity":{"type":"string","title":"Filter the search by not.severity. Search for the matches that are not equal to the value"},"not.severity.keyword":{"type":"string","title":"Filter the search by not.severity.keyword. Search for the matches that do not contain the value"},"title":{"type":"string","title":"Filter the search by title. Search for an exact match"},"title.keyword":{"type":"string","title":"Filter the search by title.keyword. Search for the matches that contain the value"},"not.title":{"type":"string","title":"Filter the search by not.title. Search for the matches that are not equal to the value"},"not.title.keyword":{"type":"string","title":"Filter the search by not.title.keyword. Search for the matches that do not contain the value"},"description":{"type":"string","title":"Filter the search by description. Search for an exact match"},"description.keyword":{"type":"string","title":"Filter the search by description.keyword. Search for the matches that contain the value"},"not.description":{"type":"string","title":"Filter the search by not.description. Search for the matches that are not equal to the value"},"not.description.keyword":{"type":"string","title":"Filter the search by not.description.keyword. Search for the matches that do not contain the value"},"category":{"type":"string","title":"Filter the search by category. Search for an exact match"},"category.keyword":{"type":"string","title":"Filter the search by category.keyword. Search for the matches that contain the value"},"not.category":{"type":"string","title":"Filter the search by not.category. Search for the matches that are not equal to the value"},"not.category.keyword":{"type":"string","title":"Filter the search by not.category.keyword. Search for the matches that do not contain the value"},"security_update_id":{"type":"string","title":"Filter the search by security_update_id. Search for an exact match"},"security_update_id.keyword":{"type":"string","title":"Filter the search by security_update_id.keyword. Search for the matches that contain the value"},"not.security_update_id":{"type":"string","title":"Filter the search by not.security_update_id. Search for the matches that are not equal to the value"},"not.security_update_id.keyword":{"type":"string","title":"Filter the search by not.security_update_id.keyword. Search for the matches that do not contain the value"},"patch_id":{"type":"string","title":"Filter the search by patch_id. Search for an exact match"},"patch_id.keyword":{"type":"string","title":"Filter the search by patch_id.keyword. Search for the matches that contain the value"},"not.patch_id":{"type":"string","title":"Filter the search by not.patch_id. Search for the matches that are not equal to the value"},"not.patch_id.keyword":{"type":"string","title":"Filter the search by not.patch_id.keyword. Search for the matches that do not contain the value"},"kb_id":{"type":"string","title":"Filter the search by kb_id. Search for an exact match"},"kb_id.keyword":{"type":"string","title":"Filter the search by kb_id.keyword. Search for the matches that contain the value"},"not.kb_id":{"type":"string","title":"Filter the search by not.kb_id. Search for the matches that are not equal to the value"},"not.kb_id.keyword":{"type":"string","title":"Filter the search by not.kb_id.keyword. Search for the matches that do not contain the value"},"reboot_required":{"type":"boolean","title":"Filter the search by reboot_required"},"preview_patch":{"type":"boolean","title":"Filter the search by preview_patch"},"not.preview_patch":{"type":"boolean","title":"Filter the search by not.preview_patch"},"size":{"type":"integer","title":"Filter the search by exact size"},"size_lt":{"type":"integer","title":"Filter the search by size_lt. Search for the documents that are less than the value"},"size_lte":{"type":"integer","title":"Filter the search by size_lte. Search for the documents that are less than the value"},"size_gt":{"type":"integer","title":"Filter the search by size_gt. Search for the documents that are greater than the value"},"size_gte":{"type":"integer","title":"Filter the search by size_gte. Search for the documents that are greater than the value"},"created_at_after":{"type":"string","title":"Filter search with created_at_after ISO date string (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-02-01T17:23:17.860482Z"]},"created_at_before":{"type":"string","title":"Filter search with created_at_before ISO date string (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"released_at_after":{"type":"string","title":"Filter search with released_at_after ISO date string (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"released_at_before":{"type":"string","title":"Filter search with released_at_before ISO date string (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"update_ignored":{"type":"boolean","title":"Filter the search by update_ignored os patches"},"exists":{"type":"array","title":"Filter the results for records that have these fields","items":{"type":"string","enum":["domain_name","product_signature"]}},"not.exists":{"type":"array","title":"Filter the results for records that do not have these fields","items":{"type":"string","enum":["domain_name","product_signature"]}},"sort_field":{"type":"string","title":"Sort field","enum":["account_id","account_name","parent_account_id","machine_id","group_id","root_group_id","object_guid","host_name","fully_qualified_host_name","display_name","vendor","product","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","severity","title","description","category","security_update_id","patch_id","kb_id","created_at","released_at","reboot_required","preview_patch","size","domain_name","active_directory.user.display_name","active_directory.machine.display_name","active_directory.user.ou","active_directory.machine.ou","active_directory.user.sam_account_name","active_directory.machine.sam_account_name","ignored_until"]},"sort_order":{"type":"string","title":"Sorting direction","default":"asc","enum":["asc","desc"]},"populate":{"type":"object","title":"The populate object Schema","properties":{"group":{"type":"boolean","title":"Populates group data (group name, policy name, policy id)"},"endpoint":{"type":"boolean","title":"Populate with the endpoint data (last day seen, last user)"}}},"page_size":{"type":"number","title":"The size of the page. If you only need aggregations, set it to 0","minimum":0,"default":50,"maximum":2000},"aggregations":{"type":"array","title":"The Aggregations Schema","items":{"type":"string","title":"Aggregations","default":[],"enum":["account_id","account_name","parent_account_id","machine_id","group_id","root_group_id","object_guid","host_name","fully_qualified_host_name","display_name","vendor","product","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","severity","title","description","category","security_update_id","patch_id","kb_id","created_at","released_at","reboot_required","preview_patch","size"]}},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}},"allOf":[{"type":"object","title":"Active Directory Search Filters","properties":{"active_directory.user.display_name":{"type":"string","title":"Filter the search by active_directory.user.display_name. Search for the matches that are equal to the value"},"active_directory.user.display_name.keyword":{"type":"string","title":"Filter the search by active_directory.user.display_name.keyword. Search for the matches that contain the value"},"active_directory.user.ou":{"type":"string","title":"Filter the search by active_directory.user.ou. Search for the matches that are equal to the value"},"active_directory.user.ou.keyword":{"type":"string","title":"Filter the search by active_directory.user.ou.keyword. Search for the matches that contain the value"},"active_directory.user.ou.path":{"type":"string","title":"Filter the search by active_directory.user.ou.path. Search for the matches that are equal to the value"},"active_directory.user.ou.path.keyword":{"type":"string","title":"Filter the search by active_directory.user.ou.path.keyword. Search for the matches that contain the value"},"active_directory.user.sam_account_name":{"type":"string","title":"Filter the search by active_directory.user.sam_account_name. Search for the matches that are equal to the value"},"active_directory.user.sam_account_name.keyword":{"type":"string","title":"Filter the search by active_directory.user.sam_account_name.keyword. Search for the matches that contain the value"},"active_directory.machine.display_name":{"type":"string","title":"Filter the search by active_directory.machine.display_name. Search for the matches that are equal to the value"},"active_directory.machine.display_name.keyword":{"type":"string","title":"Filter the search by active_directory.machine.display_name.keyword. Search for the matches that contain the value"},"active_directory.machine.ou":{"type":"string","title":"Filter the search by active_directory.machine.ou. Search for the matches that are equal to the value"},"active_directory.machine.ou.keyword":{"type":"string","title":"Filter the search by active_directory.machine.ou.keyword. Search for the matches that contain the value"},"active_directory.machine.ou.path":{"type":"string","title":"Filter the search by active_directory.machine.ou.path. Search for the matches that are equal to the value"},"active_directory.machine.ou.path.keyword":{"type":"string","title":"Filter the search by active_directory.machine.ou.path.keyword. Search for the matches that contain the value"},"active_directory.machine.sam_account_name":{"type":"string","title":"Filter the search by active_directory.machine.sam_account_name. Search for the matches that are equal to the value"},"active_directory.machine.sam_account_name.keyword":{"type":"string","title":"Filter the search by active_directory.machine.sam_account_name.keyword. Search for the matches that contain the value"}}}]}]}}}},{"properties":{"groups":{"type":"array","title":"List of search queries","items":{"type":"object","title":"Search assets CVE request. Leading wildcards are not supported for constraint fields without '.keyword' suffix.","allOf":[{"type":"object","title":"Search assets software request. Leading wildcards are not supported for constraint fields without '.keyword' suffix.","properties":{"machine_id":{"type":"string","title":"Filter the search by machine_id. Search for an exact match"},"machine_id.keyword":{"type":"string","title":"Filter the search by machine_id.keyword. Search for the matches that contain the value"},"not.machine_id":{"type":"string","title":"Filter the search by not.machine_id. Search for the matches that are not equal to the value"},"not.machine_id.keyword":{"type":"string","title":"Filter the search by not.machine_id.keyword. Search for the matches that do not contain the value"},"group_id":{"type":"string","title":"Filter the search by group_id. Search for an exact match"},"group_id.keyword":{"type":"string","title":"Filter the search by group_id.keyword. Search for the matches that contain the value"},"not.group_id":{"type":"string","title":"Filter the search by not.group_id. Search for the matches that are not equal to the value"},"not.group_id.keyword":{"type":"string","title":"Filter the search by not.group_id.keyword. Search for the matches that do not contain the value"},"root_group_id":{"type":"string","title":"Filter the search by root_group_id. Search for an exact match"},"root_group_id.keyword":{"type":"string","title":"Filter the search by root_group_id.keyword. Search for the matches that contain the value"},"not.root_group_id":{"type":"string","title":"Filter the search by not.root_group_id. Search for the matches that are not equal to the value"},"not.root_group_id.keyword":{"type":"string","title":"Filter the search by not.root_group_id.keyword. Search for the matches that do not contain the value"},"group_name":{"type":"string","title":"Filter the search by group_name. Search for an exact match"},"group_name.keyword":{"type":"string","title":"Filter the search by group_name.keyword. Search for the matches that contain the value"},"not.group_name":{"type":"string","title":"Filter the search by not.group_name. Search for the matches that are not equal to the value"},"not.group_name.keyword":{"type":"string","title":"Filter the search by not.group_name.keyword. Search for the matches that do not contain the value"},"object_guid":{"type":"string","title":"Filter the search by object_guid. Search for an exact match"},"object_guid.keyword":{"type":"string","title":"Filter the search by object_guid.keyword. Search for the matches that contain the value"},"not.object_guid":{"type":"string","title":"Filter the search by not.object_guid. Search for the matches that are not equal to the value"},"not.object_guid.keyword":{"type":"string","title":"Filter the search by not.object_guid.keyword. Search for the matches that do not contain the value"},"host_name":{"type":"string","title":"Filter the search by host_name. Search for an exact match"},"host_name.keyword":{"type":"string","title":"Filter the search by host_name.keyword. Search for the matches that contain the value"},"not.host_name":{"type":"string","title":"Filter the search by not.host_name. Search for the matches that are not equal to the value"},"not.host_name.keyword":{"type":"string","title":"Filter the search by not.host_name.keyword. Search for the matches that do not contain the value"},"fully_qualified_host_name":{"type":"string","title":"Filter the search by fully_qualified_host_name. Search for an exact match"},"fully_qualified_host_name.keyword":{"type":"string","title":"Filter the search by fully_qualified_host_name.keyword. Search for the matches that contain the value"},"not.fully_qualified_host_name":{"type":"string","title":"Filter the search by not.fully_qualified_host_name. Search for the matches that are not equal to the value"},"not.fully_qualified_host_name.keyword":{"type":"string","title":"Filter the search by not.fully_qualified_host_name.keyword. Search for the matches that do not contain the value"},"domain_name":{"type":"string","title":"Filter the search by domain_name. Search for an exact match"},"domain_name.keyword":{"type":"string","title":"Filter the search by domain_name.keyword. Search for the matches that contain the value"},"not.domain_name":{"type":"string","title":"Filter the search by not.domain_name. Search for the matches that are not equal to the value"},"not.domain_name.keyword":{"type":"string","title":"Filter the search by not.domain_name.keyword. Search for the matches that do not contain the value"},"display_name":{"type":"string","title":"Filter the search by display_name. Search for an exact match"},"display_name.keyword":{"type":"string","title":"Filter the search by display_name.keyword. Search for the matches that contain the value"},"not.display_name":{"type":"string","title":"Filter the search by not.display_name. Search for the matches that are not equal to the value"},"not.display_name.keyword":{"type":"string","title":"Filter the search by not.display_name.keyword. Search for the matches that do not contain the value"},"vendor":{"type":"string","title":"Filter the search by vendor. Search for an exact match"},"vendor.keyword":{"type":"string","title":"Filter the search by vendor.keyword. Search for the matches that contain the value"},"not.vendor":{"type":"string","title":"Filter the search by not.vendor. Search for the matches that are not equal to the value"},"not.vendor.keyword":{"type":"string","title":"Filter the search by not.vendor.keyword. Search for the matches that do not contain the value"},"product":{"type":"string","title":"Filter the search by product. Search for an exact match"},"product.keyword":{"type":"string","title":"Filter the search by product.keyword. Search for the matches that contain the value"},"not.product":{"type":"string","title":"Filter the search by not.product. Search for the matches that are not equal to the value"},"not.product.keyword":{"type":"string","title":"Filter the search by not.product.keyword. Search for the matches that do not contain the value"},"os_info.os_type":{"type":"string","title":"Filter the search by os_info.os_type. Search for an exact match"},"os_info.os_type.keyword":{"type":"string","title":"Filter the search by os_info.os_type.keyword. Search for the matches that contain the value"},"not.os_info.os_type":{"type":"string","title":"Filter the search by not.os_info.os_type. Search for the matches that are not equal to the value"},"not.os_info.os_type.keyword":{"type":"string","title":"Filter the search by not.os_info.os_type.keyword. Search for the matches that do not contain the value"},"os_info.os_version":{"type":"string","title":"Filter the search by os_info.os_version. Search for an exact match"},"os_info.os_version.keyword":{"type":"string","title":"Filter the search by os_info.os_version.keyword. Search for the matches that contain the value"},"not.os_info.os_version":{"type":"string","title":"Filter the search by not.os_info.os_version. Search for the matches that are not equal to the value"},"not.os_info.os_version.keyword":{"type":"string","title":"Filter the search by not.os_info.os_version.keyword. Search for the matches that do not contain the value"},"os_info.os_platform":{"type":"string","title":"Filter the search by os_info.os_platform. Search for an exact match"},"os_info.os_platform.keyword":{"type":"string","title":"Filter the search by os_info.os_platform.keyword. Search for the matches that contain the value"},"not.os_info.os_platform":{"type":"string","title":"Filter the search by not.os_info.os_platform. Search for the matches that are not equal to the value"},"not.os_info.os_platform.keyword":{"type":"string","title":"Filter the search by not.os_info.os_platform.keyword. Search for the matches that do not contain the value"},"os_info.os_architecture":{"type":"string","title":"Filter the search by os_info.os_architecture. Search for an exact match"},"os_info.os_architecture.keyword":{"type":"string","title":"Filter the search by os_info.os_architecture.keyword. Search for the matches that contain the value"},"not.os_info.os_architecture":{"type":"string","title":"Filter the search by not.os_info.os_architecture. Search for the matches that are not equal to the value"},"not.os_info.os_architecture.keyword":{"type":"string","title":"Filter the search by not.os_info.os_architecture.keyword. Search for the matches that do not contain the value"},"os_info.os_release_name":{"type":"string","title":"Filter the search by os_info.os_release_name. Search for an exact match"},"os_info.os_release_name.keyword":{"type":"string","title":"Filter the search by os_info.os_release_name.keyword. Search for the matches that contain the value"},"not.os_info.os_release_name":{"type":"string","title":"Filter the search by not.os_info.os_release_name. Search for the matches that are not equal to the value"},"not.os_info.os_release_name.keyword":{"type":"string","title":"Filter the search by not.os_info.os_release_name.keyword. Search for the matches that do not contain the value"},"severity":{"type":"string","title":"Filter the search by severity. Search for an exact match"},"severity.keyword":{"type":"string","title":"Filter the search by severity.keyword. Search for the matches that contain the value"},"not.severity":{"type":"string","title":"Filter the search by not.severity. Search for the matches that are not equal to the value"},"not.severity.keyword":{"type":"string","title":"Filter the search by not.severity.keyword. Search for the matches that do not contain the value"},"title":{"type":"string","title":"Filter the search by title. Search for an exact match"},"title.keyword":{"type":"string","title":"Filter the search by title.keyword. Search for the matches that contain the value"},"not.title":{"type":"string","title":"Filter the search by not.title. Search for the matches that are not equal to the value"},"not.title.keyword":{"type":"string","title":"Filter the search by not.title.keyword. Search for the matches that do not contain the value"},"description":{"type":"string","title":"Filter the search by description. Search for an exact match"},"description.keyword":{"type":"string","title":"Filter the search by description.keyword. Search for the matches that contain the value"},"not.description":{"type":"string","title":"Filter the search by not.description. Search for the matches that are not equal to the value"},"not.description.keyword":{"type":"string","title":"Filter the search by not.description.keyword. Search for the matches that do not contain the value"},"category":{"type":"string","title":"Filter the search by category. Search for an exact match"},"category.keyword":{"type":"string","title":"Filter the search by category.keyword. Search for the matches that contain the value"},"not.category":{"type":"string","title":"Filter the search by not.category. Search for the matches that are not equal to the value"},"not.category.keyword":{"type":"string","title":"Filter the search by not.category.keyword. Search for the matches that do not contain the value"},"security_update_id":{"type":"string","title":"Filter the search by security_update_id. Search for an exact match"},"security_update_id.keyword":{"type":"string","title":"Filter the search by security_update_id.keyword. Search for the matches that contain the value"},"not.security_update_id":{"type":"string","title":"Filter the search by not.security_update_id. Search for the matches that are not equal to the value"},"not.security_update_id.keyword":{"type":"string","title":"Filter the search by not.security_update_id.keyword. Search for the matches that do not contain the value"},"patch_id":{"type":"string","title":"Filter the search by patch_id. Search for an exact match"},"patch_id.keyword":{"type":"string","title":"Filter the search by patch_id.keyword. Search for the matches that contain the value"},"not.patch_id":{"type":"string","title":"Filter the search by not.patch_id. Search for the matches that are not equal to the value"},"not.patch_id.keyword":{"type":"string","title":"Filter the search by not.patch_id.keyword. Search for the matches that do not contain the value"},"kb_id":{"type":"string","title":"Filter the search by kb_id. Search for an exact match"},"kb_id.keyword":{"type":"string","title":"Filter the search by kb_id.keyword. Search for the matches that contain the value"},"not.kb_id":{"type":"string","title":"Filter the search by not.kb_id. Search for the matches that are not equal to the value"},"not.kb_id.keyword":{"type":"string","title":"Filter the search by not.kb_id.keyword. Search for the matches that do not contain the value"},"reboot_required":{"type":"boolean","title":"Filter the search by reboot_required"},"preview_patch":{"type":"boolean","title":"Filter the search by preview_patch"},"not.preview_patch":{"type":"boolean","title":"Filter the search by not.preview_patch"},"size":{"type":"integer","title":"Filter the search by exact size"},"size_lt":{"type":"integer","title":"Filter the search by size_lt. Search for the documents that are less than the value"},"size_lte":{"type":"integer","title":"Filter the search by size_lte. Search for the documents that are less than the value"},"size_gt":{"type":"integer","title":"Filter the search by size_gt. Search for the documents that are greater than the value"},"size_gte":{"type":"integer","title":"Filter the search by size_gte. Search for the documents that are greater than the value"},"created_at_after":{"type":"string","title":"Filter search with created_at_after ISO date string (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-02-01T17:23:17.860482Z"]},"created_at_before":{"type":"string","title":"Filter search with created_at_before ISO date string (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"released_at_after":{"type":"string","title":"Filter search with released_at_after ISO date string (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"released_at_before":{"type":"string","title":"Filter search with released_at_before ISO date string (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"update_ignored":{"type":"boolean","title":"Filter the search by update_ignored os patches"},"exists":{"type":"array","title":"Filter the results for records that have these fields","items":{"type":"string","enum":["domain_name","product_signature"]}},"not.exists":{"type":"array","title":"Filter the results for records that do not have these fields","items":{"type":"string","enum":["domain_name","product_signature"]}},"sort_field":{"type":"string","title":"Sort field","enum":["account_id","account_name","parent_account_id","machine_id","group_id","root_group_id","object_guid","host_name","fully_qualified_host_name","display_name","vendor","product","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","severity","title","description","category","security_update_id","patch_id","kb_id","created_at","released_at","reboot_required","preview_patch","size","domain_name","active_directory.user.display_name","active_directory.machine.display_name","active_directory.user.ou","active_directory.machine.ou","active_directory.user.sam_account_name","active_directory.machine.sam_account_name","ignored_until"]},"sort_order":{"type":"string","title":"Sorting direction","default":"asc","enum":["asc","desc"]},"populate":{"type":"object","title":"The populate object Schema","properties":{"group":{"type":"boolean","title":"Populates group data (group name, policy name, policy id)"},"endpoint":{"type":"boolean","title":"Populate with the endpoint data (last day seen, last user)"}}},"page_size":{"type":"number","title":"The size of the page. If you only need aggregations, set it to 0","minimum":0,"default":50,"maximum":2000},"aggregations":{"type":"array","title":"The Aggregations Schema","items":{"type":"string","title":"Aggregations","default":[],"enum":["account_id","account_name","parent_account_id","machine_id","group_id","root_group_id","object_guid","host_name","fully_qualified_host_name","display_name","vendor","product","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","severity","title","description","category","security_update_id","patch_id","kb_id","created_at","released_at","reboot_required","preview_patch","size"]}},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}},"allOf":[{"type":"object","title":"Active Directory Search Filters","properties":{"active_directory.user.display_name":{"type":"string","title":"Filter the search by active_directory.user.display_name. Search for the matches that are equal to the value"},"active_directory.user.display_name.keyword":{"type":"string","title":"Filter the search by active_directory.user.display_name.keyword. Search for the matches that contain the value"},"active_directory.user.ou":{"type":"string","title":"Filter the search by active_directory.user.ou. Search for the matches that are equal to the value"},"active_directory.user.ou.keyword":{"type":"string","title":"Filter the search by active_directory.user.ou.keyword. Search for the matches that contain the value"},"active_directory.user.ou.path":{"type":"string","title":"Filter the search by active_directory.user.ou.path. Search for the matches that are equal to the value"},"active_directory.user.ou.path.keyword":{"type":"string","title":"Filter the search by active_directory.user.ou.path.keyword. Search for the matches that contain the value"},"active_directory.user.sam_account_name":{"type":"string","title":"Filter the search by active_directory.user.sam_account_name. Search for the matches that are equal to the value"},"active_directory.user.sam_account_name.keyword":{"type":"string","title":"Filter the search by active_directory.user.sam_account_name.keyword. Search for the matches that contain the value"},"active_directory.machine.display_name":{"type":"string","title":"Filter the search by active_directory.machine.display_name. Search for the matches that are equal to the value"},"active_directory.machine.display_name.keyword":{"type":"string","title":"Filter the search by active_directory.machine.display_name.keyword. Search for the matches that contain the value"},"active_directory.machine.ou":{"type":"string","title":"Filter the search by active_directory.machine.ou. Search for the matches that are equal to the value"},"active_directory.machine.ou.keyword":{"type":"string","title":"Filter the search by active_directory.machine.ou.keyword. Search for the matches that contain the value"},"active_directory.machine.ou.path":{"type":"string","title":"Filter the search by active_directory.machine.ou.path. Search for the matches that are equal to the value"},"active_directory.machine.ou.path.keyword":{"type":"string","title":"Filter the search by active_directory.machine.ou.path.keyword. Search for the matches that contain the value"},"active_directory.machine.sam_account_name":{"type":"string","title":"Filter the search by active_directory.machine.sam_account_name. Search for the matches that are equal to the value"},"active_directory.machine.sam_account_name.keyword":{"type":"string","title":"Filter the search by active_directory.machine.sam_account_name.keyword. Search for the matches that contain the value"}}}]},{"type":"object","required":["account_ids"],"properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}},{"type":"object","properties":{"account_name":{"type":"string","title":"Filter the search by account_name. Search for an exact match"},"account_name.keyword":{"type":"string","title":"Filter the search by account_name.keyword. Search for the matches that contain the value"},"not.account_name":{"type":"string","title":"Filter the search by not.account_name. Search for the matches that are not equal to the value"},"not.account_name.keyword":{"type":"string","title":"Filter the search by not.account_name.keyword. Search for the matches that do not contain the value"},"parent_account_id":{"type":"string","title":"Filter the search by parent_account_id. Search for an exact match"},"parent_account_id.keyword":{"type":"string","title":"Filter the search by parent_account_id.keyword. Search for the matches that contain the value"},"not.parent_account_id":{"type":"string","title":"Filter the search by not.parent_account_id. Search for the matches that are not equal to the value"},"not.parent_account_id.keyword":{"type":"string","title":"Filter the search by not.parent_account_id.keyword. Search for the matches that do not contain the value"}}},{"type":"object","title":"Active Directory Search Filters","properties":{"active_directory.user.display_name":{"type":"string","title":"Filter the search by active_directory.user.display_name. Search for the matches that are equal to the value"},"active_directory.user.display_name.keyword":{"type":"string","title":"Filter the search by active_directory.user.display_name.keyword. Search for the matches that contain the value"},"active_directory.user.ou":{"type":"string","title":"Filter the search by active_directory.user.ou. Search for the matches that are equal to the value"},"active_directory.user.ou.keyword":{"type":"string","title":"Filter the search by active_directory.user.ou.keyword. Search for the matches that contain the value"},"active_directory.user.ou.path":{"type":"string","title":"Filter the search by active_directory.user.ou.path. Search for the matches that are equal to the value"},"active_directory.user.ou.path.keyword":{"type":"string","title":"Filter the search by active_directory.user.ou.path.keyword. Search for the matches that contain the value"},"active_directory.user.sam_account_name":{"type":"string","title":"Filter the search by active_directory.user.sam_account_name. Search for the matches that are equal to the value"},"active_directory.user.sam_account_name.keyword":{"type":"string","title":"Filter the search by active_directory.user.sam_account_name.keyword. Search for the matches that contain the value"},"active_directory.machine.display_name":{"type":"string","title":"Filter the search by active_directory.machine.display_name. Search for the matches that are equal to the value"},"active_directory.machine.display_name.keyword":{"type":"string","title":"Filter the search by active_directory.machine.display_name.keyword. Search for the matches that contain the value"},"active_directory.machine.ou":{"type":"string","title":"Filter the search by active_directory.machine.ou. Search for the matches that are equal to the value"},"active_directory.machine.ou.keyword":{"type":"string","title":"Filter the search by active_directory.machine.ou.keyword. Search for the matches that contain the value"},"active_directory.machine.ou.path":{"type":"string","title":"Filter the search by active_directory.machine.ou.path. Search for the matches that are equal to the value"},"active_directory.machine.ou.path.keyword":{"type":"string","title":"Filter the search by active_directory.machine.ou.path.keyword. Search for the matches that contain the value"},"active_directory.machine.sam_account_name":{"type":"string","title":"Filter the search by active_directory.machine.sam_account_name. Search for the matches that are equal to the value"},"active_directory.machine.sam_account_name.keyword":{"type":"string","title":"Filter the search by active_directory.machine.sam_account_name.keyword. Search for the matches that contain the value"}}}]}}}}]}}}},"responses":{"200":{"description":"Successful response"}},"tags":["OS Patches"],"operationId":"api.v2.rmm.post.export.os-patches.async"}},"/oneview/v1/os-patches":{"post":{"description":"Search OS Patches.","summary":"Search OS Patches","security":[{"client_credentials":["read"]},{"user_permissions":["patchManagement.view"]}],"status":{"outage":["auth","search_stateless"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Search assets CVE request. Leading wildcards are not supported for constraint fields without '.keyword' suffix.","allOf":[{"type":"object","title":"Search assets software request. Leading wildcards are not supported for constraint fields without '.keyword' suffix.","properties":{"machine_id":{"type":"string","title":"Filter the search by machine_id. Search for an exact match"},"machine_id.keyword":{"type":"string","title":"Filter the search by machine_id.keyword. Search for the matches that contain the value"},"not.machine_id":{"type":"string","title":"Filter the search by not.machine_id. Search for the matches that are not equal to the value"},"not.machine_id.keyword":{"type":"string","title":"Filter the search by not.machine_id.keyword. Search for the matches that do not contain the value"},"group_id":{"type":"string","title":"Filter the search by group_id. Search for an exact match"},"group_id.keyword":{"type":"string","title":"Filter the search by group_id.keyword. Search for the matches that contain the value"},"not.group_id":{"type":"string","title":"Filter the search by not.group_id. Search for the matches that are not equal to the value"},"not.group_id.keyword":{"type":"string","title":"Filter the search by not.group_id.keyword. Search for the matches that do not contain the value"},"root_group_id":{"type":"string","title":"Filter the search by root_group_id. Search for an exact match"},"root_group_id.keyword":{"type":"string","title":"Filter the search by root_group_id.keyword. Search for the matches that contain the value"},"not.root_group_id":{"type":"string","title":"Filter the search by not.root_group_id. Search for the matches that are not equal to the value"},"not.root_group_id.keyword":{"type":"string","title":"Filter the search by not.root_group_id.keyword. Search for the matches that do not contain the value"},"group_name":{"type":"string","title":"Filter the search by group_name. Search for an exact match"},"group_name.keyword":{"type":"string","title":"Filter the search by group_name.keyword. Search for the matches that contain the value"},"not.group_name":{"type":"string","title":"Filter the search by not.group_name. Search for the matches that are not equal to the value"},"not.group_name.keyword":{"type":"string","title":"Filter the search by not.group_name.keyword. Search for the matches that do not contain the value"},"object_guid":{"type":"string","title":"Filter the search by object_guid. Search for an exact match"},"object_guid.keyword":{"type":"string","title":"Filter the search by object_guid.keyword. Search for the matches that contain the value"},"not.object_guid":{"type":"string","title":"Filter the search by not.object_guid. Search for the matches that are not equal to the value"},"not.object_guid.keyword":{"type":"string","title":"Filter the search by not.object_guid.keyword. Search for the matches that do not contain the value"},"host_name":{"type":"string","title":"Filter the search by host_name. Search for an exact match"},"host_name.keyword":{"type":"string","title":"Filter the search by host_name.keyword. Search for the matches that contain the value"},"not.host_name":{"type":"string","title":"Filter the search by not.host_name. Search for the matches that are not equal to the value"},"not.host_name.keyword":{"type":"string","title":"Filter the search by not.host_name.keyword. Search for the matches that do not contain the value"},"fully_qualified_host_name":{"type":"string","title":"Filter the search by fully_qualified_host_name. Search for an exact match"},"fully_qualified_host_name.keyword":{"type":"string","title":"Filter the search by fully_qualified_host_name.keyword. Search for the matches that contain the value"},"not.fully_qualified_host_name":{"type":"string","title":"Filter the search by not.fully_qualified_host_name. Search for the matches that are not equal to the value"},"not.fully_qualified_host_name.keyword":{"type":"string","title":"Filter the search by not.fully_qualified_host_name.keyword. Search for the matches that do not contain the value"},"domain_name":{"type":"string","title":"Filter the search by domain_name. Search for an exact match"},"domain_name.keyword":{"type":"string","title":"Filter the search by domain_name.keyword. Search for the matches that contain the value"},"not.domain_name":{"type":"string","title":"Filter the search by not.domain_name. Search for the matches that are not equal to the value"},"not.domain_name.keyword":{"type":"string","title":"Filter the search by not.domain_name.keyword. Search for the matches that do not contain the value"},"display_name":{"type":"string","title":"Filter the search by display_name. Search for an exact match"},"display_name.keyword":{"type":"string","title":"Filter the search by display_name.keyword. Search for the matches that contain the value"},"not.display_name":{"type":"string","title":"Filter the search by not.display_name. Search for the matches that are not equal to the value"},"not.display_name.keyword":{"type":"string","title":"Filter the search by not.display_name.keyword. Search for the matches that do not contain the value"},"vendor":{"type":"string","title":"Filter the search by vendor. Search for an exact match"},"vendor.keyword":{"type":"string","title":"Filter the search by vendor.keyword. Search for the matches that contain the value"},"not.vendor":{"type":"string","title":"Filter the search by not.vendor. Search for the matches that are not equal to the value"},"not.vendor.keyword":{"type":"string","title":"Filter the search by not.vendor.keyword. Search for the matches that do not contain the value"},"product":{"type":"string","title":"Filter the search by product. Search for an exact match"},"product.keyword":{"type":"string","title":"Filter the search by product.keyword. Search for the matches that contain the value"},"not.product":{"type":"string","title":"Filter the search by not.product. Search for the matches that are not equal to the value"},"not.product.keyword":{"type":"string","title":"Filter the search by not.product.keyword. Search for the matches that do not contain the value"},"os_info.os_type":{"type":"string","title":"Filter the search by os_info.os_type. Search for an exact match"},"os_info.os_type.keyword":{"type":"string","title":"Filter the search by os_info.os_type.keyword. Search for the matches that contain the value"},"not.os_info.os_type":{"type":"string","title":"Filter the search by not.os_info.os_type. Search for the matches that are not equal to the value"},"not.os_info.os_type.keyword":{"type":"string","title":"Filter the search by not.os_info.os_type.keyword. Search for the matches that do not contain the value"},"os_info.os_version":{"type":"string","title":"Filter the search by os_info.os_version. Search for an exact match"},"os_info.os_version.keyword":{"type":"string","title":"Filter the search by os_info.os_version.keyword. Search for the matches that contain the value"},"not.os_info.os_version":{"type":"string","title":"Filter the search by not.os_info.os_version. Search for the matches that are not equal to the value"},"not.os_info.os_version.keyword":{"type":"string","title":"Filter the search by not.os_info.os_version.keyword. Search for the matches that do not contain the value"},"os_info.os_platform":{"type":"string","title":"Filter the search by os_info.os_platform. Search for an exact match"},"os_info.os_platform.keyword":{"type":"string","title":"Filter the search by os_info.os_platform.keyword. Search for the matches that contain the value"},"not.os_info.os_platform":{"type":"string","title":"Filter the search by not.os_info.os_platform. Search for the matches that are not equal to the value"},"not.os_info.os_platform.keyword":{"type":"string","title":"Filter the search by not.os_info.os_platform.keyword. Search for the matches that do not contain the value"},"os_info.os_architecture":{"type":"string","title":"Filter the search by os_info.os_architecture. Search for an exact match"},"os_info.os_architecture.keyword":{"type":"string","title":"Filter the search by os_info.os_architecture.keyword. Search for the matches that contain the value"},"not.os_info.os_architecture":{"type":"string","title":"Filter the search by not.os_info.os_architecture. Search for the matches that are not equal to the value"},"not.os_info.os_architecture.keyword":{"type":"string","title":"Filter the search by not.os_info.os_architecture.keyword. Search for the matches that do not contain the value"},"os_info.os_release_name":{"type":"string","title":"Filter the search by os_info.os_release_name. Search for an exact match"},"os_info.os_release_name.keyword":{"type":"string","title":"Filter the search by os_info.os_release_name.keyword. Search for the matches that contain the value"},"not.os_info.os_release_name":{"type":"string","title":"Filter the search by not.os_info.os_release_name. Search for the matches that are not equal to the value"},"not.os_info.os_release_name.keyword":{"type":"string","title":"Filter the search by not.os_info.os_release_name.keyword. Search for the matches that do not contain the value"},"severity":{"type":"string","title":"Filter the search by severity. Search for an exact match"},"severity.keyword":{"type":"string","title":"Filter the search by severity.keyword. Search for the matches that contain the value"},"not.severity":{"type":"string","title":"Filter the search by not.severity. Search for the matches that are not equal to the value"},"not.severity.keyword":{"type":"string","title":"Filter the search by not.severity.keyword. Search for the matches that do not contain the value"},"title":{"type":"string","title":"Filter the search by title. Search for an exact match"},"title.keyword":{"type":"string","title":"Filter the search by title.keyword. Search for the matches that contain the value"},"not.title":{"type":"string","title":"Filter the search by not.title. Search for the matches that are not equal to the value"},"not.title.keyword":{"type":"string","title":"Filter the search by not.title.keyword. Search for the matches that do not contain the value"},"description":{"type":"string","title":"Filter the search by description. Search for an exact match"},"description.keyword":{"type":"string","title":"Filter the search by description.keyword. Search for the matches that contain the value"},"not.description":{"type":"string","title":"Filter the search by not.description. Search for the matches that are not equal to the value"},"not.description.keyword":{"type":"string","title":"Filter the search by not.description.keyword. Search for the matches that do not contain the value"},"category":{"type":"string","title":"Filter the search by category. Search for an exact match"},"category.keyword":{"type":"string","title":"Filter the search by category.keyword. Search for the matches that contain the value"},"not.category":{"type":"string","title":"Filter the search by not.category. Search for the matches that are not equal to the value"},"not.category.keyword":{"type":"string","title":"Filter the search by not.category.keyword. Search for the matches that do not contain the value"},"security_update_id":{"type":"string","title":"Filter the search by security_update_id. Search for an exact match"},"security_update_id.keyword":{"type":"string","title":"Filter the search by security_update_id.keyword. Search for the matches that contain the value"},"not.security_update_id":{"type":"string","title":"Filter the search by not.security_update_id. Search for the matches that are not equal to the value"},"not.security_update_id.keyword":{"type":"string","title":"Filter the search by not.security_update_id.keyword. Search for the matches that do not contain the value"},"patch_id":{"type":"string","title":"Filter the search by patch_id. Search for an exact match"},"patch_id.keyword":{"type":"string","title":"Filter the search by patch_id.keyword. Search for the matches that contain the value"},"not.patch_id":{"type":"string","title":"Filter the search by not.patch_id. Search for the matches that are not equal to the value"},"not.patch_id.keyword":{"type":"string","title":"Filter the search by not.patch_id.keyword. Search for the matches that do not contain the value"},"kb_id":{"type":"string","title":"Filter the search by kb_id. Search for an exact match"},"kb_id.keyword":{"type":"string","title":"Filter the search by kb_id.keyword. Search for the matches that contain the value"},"not.kb_id":{"type":"string","title":"Filter the search by not.kb_id. Search for the matches that are not equal to the value"},"not.kb_id.keyword":{"type":"string","title":"Filter the search by not.kb_id.keyword. Search for the matches that do not contain the value"},"reboot_required":{"type":"boolean","title":"Filter the search by reboot_required"},"preview_patch":{"type":"boolean","title":"Filter the search by preview_patch"},"not.preview_patch":{"type":"boolean","title":"Filter the search by not.preview_patch"},"size":{"type":"integer","title":"Filter the search by exact size"},"size_lt":{"type":"integer","title":"Filter the search by size_lt. Search for the documents that are less than the value"},"size_lte":{"type":"integer","title":"Filter the search by size_lte. Search for the documents that are less than the value"},"size_gt":{"type":"integer","title":"Filter the search by size_gt. Search for the documents that are greater than the value"},"size_gte":{"type":"integer","title":"Filter the search by size_gte. Search for the documents that are greater than the value"},"created_at_after":{"type":"string","title":"Filter search with created_at_after ISO date string (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-02-01T17:23:17.860482Z"]},"created_at_before":{"type":"string","title":"Filter search with created_at_before ISO date string (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"released_at_after":{"type":"string","title":"Filter search with released_at_after ISO date string (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"released_at_before":{"type":"string","title":"Filter search with released_at_before ISO date string (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"update_ignored":{"type":"boolean","title":"Filter the search by update_ignored os patches"},"exists":{"type":"array","title":"Filter the results for records that have these fields","items":{"type":"string","enum":["domain_name","product_signature"]}},"not.exists":{"type":"array","title":"Filter the results for records that do not have these fields","items":{"type":"string","enum":["domain_name","product_signature"]}},"sort_field":{"type":"string","title":"Sort field","enum":["account_id","account_name","parent_account_id","machine_id","group_id","root_group_id","object_guid","host_name","fully_qualified_host_name","display_name","vendor","product","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","severity","title","description","category","security_update_id","patch_id","kb_id","created_at","released_at","reboot_required","preview_patch","size","domain_name","active_directory.user.display_name","active_directory.machine.display_name","active_directory.user.ou","active_directory.machine.ou","active_directory.user.sam_account_name","active_directory.machine.sam_account_name","ignored_until"]},"sort_order":{"type":"string","title":"Sorting direction","default":"asc","enum":["asc","desc"]},"populate":{"type":"object","title":"The populate object Schema","properties":{"group":{"type":"boolean","title":"Populates group data (group name, policy name, policy id)"},"endpoint":{"type":"boolean","title":"Populate with the endpoint data (last day seen, last user)"}}},"page_size":{"type":"number","title":"The size of the page. If you only need aggregations, set it to 0","minimum":0,"default":50,"maximum":2000},"aggregations":{"type":"array","title":"The Aggregations Schema","items":{"type":"string","title":"Aggregations","default":[],"enum":["account_id","account_name","parent_account_id","machine_id","group_id","root_group_id","object_guid","host_name","fully_qualified_host_name","display_name","vendor","product","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","severity","title","description","category","security_update_id","patch_id","kb_id","created_at","released_at","reboot_required","preview_patch","size"]}},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}},"allOf":[{"type":"object","title":"Active Directory Search Filters","properties":{"active_directory.user.display_name":{"type":"string","title":"Filter the search by active_directory.user.display_name. Search for the matches that are equal to the value"},"active_directory.user.display_name.keyword":{"type":"string","title":"Filter the search by active_directory.user.display_name.keyword. Search for the matches that contain the value"},"active_directory.user.ou":{"type":"string","title":"Filter the search by active_directory.user.ou. Search for the matches that are equal to the value"},"active_directory.user.ou.keyword":{"type":"string","title":"Filter the search by active_directory.user.ou.keyword. Search for the matches that contain the value"},"active_directory.user.ou.path":{"type":"string","title":"Filter the search by active_directory.user.ou.path. Search for the matches that are equal to the value"},"active_directory.user.ou.path.keyword":{"type":"string","title":"Filter the search by active_directory.user.ou.path.keyword. Search for the matches that contain the value"},"active_directory.user.sam_account_name":{"type":"string","title":"Filter the search by active_directory.user.sam_account_name. Search for the matches that are equal to the value"},"active_directory.user.sam_account_name.keyword":{"type":"string","title":"Filter the search by active_directory.user.sam_account_name.keyword. Search for the matches that contain the value"},"active_directory.machine.display_name":{"type":"string","title":"Filter the search by active_directory.machine.display_name. Search for the matches that are equal to the value"},"active_directory.machine.display_name.keyword":{"type":"string","title":"Filter the search by active_directory.machine.display_name.keyword. Search for the matches that contain the value"},"active_directory.machine.ou":{"type":"string","title":"Filter the search by active_directory.machine.ou. Search for the matches that are equal to the value"},"active_directory.machine.ou.keyword":{"type":"string","title":"Filter the search by active_directory.machine.ou.keyword. Search for the matches that contain the value"},"active_directory.machine.ou.path":{"type":"string","title":"Filter the search by active_directory.machine.ou.path. Search for the matches that are equal to the value"},"active_directory.machine.ou.path.keyword":{"type":"string","title":"Filter the search by active_directory.machine.ou.path.keyword. Search for the matches that contain the value"},"active_directory.machine.sam_account_name":{"type":"string","title":"Filter the search by active_directory.machine.sam_account_name. Search for the matches that are equal to the value"},"active_directory.machine.sam_account_name.keyword":{"type":"string","title":"Filter the search by active_directory.machine.sam_account_name.keyword. Search for the matches that contain the value"}}}]},{"type":"object","required":["account_ids"],"properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}},{"type":"object","properties":{"account_name":{"type":"string","title":"Filter the search by account_name. Search for an exact match"},"account_name.keyword":{"type":"string","title":"Filter the search by account_name.keyword. Search for the matches that contain the value"},"not.account_name":{"type":"string","title":"Filter the search by not.account_name. Search for the matches that are not equal to the value"},"not.account_name.keyword":{"type":"string","title":"Filter the search by not.account_name.keyword. Search for the matches that do not contain the value"},"parent_account_id":{"type":"string","title":"Filter the search by parent_account_id. Search for an exact match"},"parent_account_id.keyword":{"type":"string","title":"Filter the search by parent_account_id.keyword. Search for the matches that contain the value"},"not.parent_account_id":{"type":"string","title":"Filter the search by not.parent_account_id. Search for the matches that are not equal to the value"},"not.parent_account_id.keyword":{"type":"string","title":"Filter the search by not.parent_account_id.keyword. Search for the matches that do not contain the value"}}},{"type":"object","title":"Active Directory Search Filters","properties":{"active_directory.user.display_name":{"type":"string","title":"Filter the search by active_directory.user.display_name. Search for the matches that are equal to the value"},"active_directory.user.display_name.keyword":{"type":"string","title":"Filter the search by active_directory.user.display_name.keyword. Search for the matches that contain the value"},"active_directory.user.ou":{"type":"string","title":"Filter the search by active_directory.user.ou. Search for the matches that are equal to the value"},"active_directory.user.ou.keyword":{"type":"string","title":"Filter the search by active_directory.user.ou.keyword. Search for the matches that contain the value"},"active_directory.user.ou.path":{"type":"string","title":"Filter the search by active_directory.user.ou.path. Search for the matches that are equal to the value"},"active_directory.user.ou.path.keyword":{"type":"string","title":"Filter the search by active_directory.user.ou.path.keyword. Search for the matches that contain the value"},"active_directory.user.sam_account_name":{"type":"string","title":"Filter the search by active_directory.user.sam_account_name. Search for the matches that are equal to the value"},"active_directory.user.sam_account_name.keyword":{"type":"string","title":"Filter the search by active_directory.user.sam_account_name.keyword. Search for the matches that contain the value"},"active_directory.machine.display_name":{"type":"string","title":"Filter the search by active_directory.machine.display_name. Search for the matches that are equal to the value"},"active_directory.machine.display_name.keyword":{"type":"string","title":"Filter the search by active_directory.machine.display_name.keyword. Search for the matches that contain the value"},"active_directory.machine.ou":{"type":"string","title":"Filter the search by active_directory.machine.ou. Search for the matches that are equal to the value"},"active_directory.machine.ou.keyword":{"type":"string","title":"Filter the search by active_directory.machine.ou.keyword. Search for the matches that contain the value"},"active_directory.machine.ou.path":{"type":"string","title":"Filter the search by active_directory.machine.ou.path. Search for the matches that are equal to the value"},"active_directory.machine.ou.path.keyword":{"type":"string","title":"Filter the search by active_directory.machine.ou.path.keyword. Search for the matches that contain the value"},"active_directory.machine.sam_account_name":{"type":"string","title":"Filter the search by active_directory.machine.sam_account_name. Search for the matches that are equal to the value"},"active_directory.machine.sam_account_name.keyword":{"type":"string","title":"Filter the search by active_directory.machine.sam_account_name.keyword. Search for the matches that contain the value"}}}]}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Search OS Patches result","properties":{"results":{"type":"array","items":{"properties":{"account_id":{"type":"string"},"parent_account_id":{"type":"string"},"group_id":{"type":"string"},"root_group_id":{"type":"string"},"group_name":{"type":"string"},"machine_id":{"type":"string"},"vendor":{"type":"string"},"product":{"type":"string"},"host_name":{"type":"string"},"fully_qualified_host_name":{"type":"string"},"display_name":{"type":"string"},"domain_name":{"type":"string"},"created_at":{"type":"string"},"object_guid":{"type":"string"},"title":{"type":"string"},"description":{"type":"string"},"severity":{"type":"string"},"category":{"type":"string"},"security_update_id":{"type":"string"},"patch_id":{"type":"string"},"released_at":{"type":"string"},"size":{"type":"number"},"reboot_required":{"type":"boolean"},"preview_patch":{"type":"boolean"},"os_info":{"properties":{"os_type":{"type":"string"},"os_version":{"type":"string"},"os_platform":{"type":"string"},"os_architecture":{"type":"string"},"os_release_name":{"type":"string"}}},"endpoint":{"properties":{"last_user":{"type":"string"},"last_day_seen":{"type":"string","examples":["2020-06-01T09:52:10.579Z"]}}},"group":{"properties":{"name":{"type":"string"},"policy_id":{"type":"string"},"policy_name":{"type":"string"}}},"ignored_until":{"type":"string","format":"date-time"},"ignore_rule_ids":{"type":"array","items":{"type":"string","format":"uuid"}},"active_directory":{"type":"object","patternProperties":{"^(user|machine)$":{"type":"object","properties":{"display_name":{"type":"string"},"distinguished_name":{"type":"string"},"sam_account_name":{"type":"string"},"ou":{"type":"string"}}}}}}}},"aggregations":{"type":"object","title":"Aggregations","additionalProperties":true},"total_count":{"type":"integer","title":"Total count of found detections"},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}},"required":["results","total_count"]}}}}},"tags":["OS Patches"],"operationId":"api.v2.rmm.search.os-patches"}},"/oneview/v1/os-patches/search-groupby":{"post":{"description":"Search OS Patches grouped by a specific field.","summary":"Search OS Patches groupBy","security":[{"client_credentials":["read"]},{"user_permissions":["patchManagement.view"]}],"status":{"incident":["read_nebula_data"],"outage":["auth","search_stateful"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"The Post Assets Search GroupBy Request Schema","required":["group_by"],"allOf":[{"type":"object","title":"Search assets CVE request. Leading wildcards are not supported for constraint fields without '.keyword' suffix.","allOf":[{"type":"object","title":"Search assets software request. Leading wildcards are not supported for constraint fields without '.keyword' suffix.","properties":{"machine_id":{"type":"string","title":"Filter the search by machine_id. Search for an exact match"},"machine_id.keyword":{"type":"string","title":"Filter the search by machine_id.keyword. Search for the matches that contain the value"},"not.machine_id":{"type":"string","title":"Filter the search by not.machine_id. Search for the matches that are not equal to the value"},"not.machine_id.keyword":{"type":"string","title":"Filter the search by not.machine_id.keyword. Search for the matches that do not contain the value"},"group_id":{"type":"string","title":"Filter the search by group_id. Search for an exact match"},"group_id.keyword":{"type":"string","title":"Filter the search by group_id.keyword. Search for the matches that contain the value"},"not.group_id":{"type":"string","title":"Filter the search by not.group_id. Search for the matches that are not equal to the value"},"not.group_id.keyword":{"type":"string","title":"Filter the search by not.group_id.keyword. Search for the matches that do not contain the value"},"root_group_id":{"type":"string","title":"Filter the search by root_group_id. Search for an exact match"},"root_group_id.keyword":{"type":"string","title":"Filter the search by root_group_id.keyword. Search for the matches that contain the value"},"not.root_group_id":{"type":"string","title":"Filter the search by not.root_group_id. Search for the matches that are not equal to the value"},"not.root_group_id.keyword":{"type":"string","title":"Filter the search by not.root_group_id.keyword. Search for the matches that do not contain the value"},"group_name":{"type":"string","title":"Filter the search by group_name. Search for an exact match"},"group_name.keyword":{"type":"string","title":"Filter the search by group_name.keyword. Search for the matches that contain the value"},"not.group_name":{"type":"string","title":"Filter the search by not.group_name. Search for the matches that are not equal to the value"},"not.group_name.keyword":{"type":"string","title":"Filter the search by not.group_name.keyword. Search for the matches that do not contain the value"},"object_guid":{"type":"string","title":"Filter the search by object_guid. Search for an exact match"},"object_guid.keyword":{"type":"string","title":"Filter the search by object_guid.keyword. Search for the matches that contain the value"},"not.object_guid":{"type":"string","title":"Filter the search by not.object_guid. Search for the matches that are not equal to the value"},"not.object_guid.keyword":{"type":"string","title":"Filter the search by not.object_guid.keyword. Search for the matches that do not contain the value"},"host_name":{"type":"string","title":"Filter the search by host_name. Search for an exact match"},"host_name.keyword":{"type":"string","title":"Filter the search by host_name.keyword. Search for the matches that contain the value"},"not.host_name":{"type":"string","title":"Filter the search by not.host_name. Search for the matches that are not equal to the value"},"not.host_name.keyword":{"type":"string","title":"Filter the search by not.host_name.keyword. Search for the matches that do not contain the value"},"fully_qualified_host_name":{"type":"string","title":"Filter the search by fully_qualified_host_name. Search for an exact match"},"fully_qualified_host_name.keyword":{"type":"string","title":"Filter the search by fully_qualified_host_name.keyword. Search for the matches that contain the value"},"not.fully_qualified_host_name":{"type":"string","title":"Filter the search by not.fully_qualified_host_name. Search for the matches that are not equal to the value"},"not.fully_qualified_host_name.keyword":{"type":"string","title":"Filter the search by not.fully_qualified_host_name.keyword. Search for the matches that do not contain the value"},"domain_name":{"type":"string","title":"Filter the search by domain_name. Search for an exact match"},"domain_name.keyword":{"type":"string","title":"Filter the search by domain_name.keyword. Search for the matches that contain the value"},"not.domain_name":{"type":"string","title":"Filter the search by not.domain_name. Search for the matches that are not equal to the value"},"not.domain_name.keyword":{"type":"string","title":"Filter the search by not.domain_name.keyword. Search for the matches that do not contain the value"},"display_name":{"type":"string","title":"Filter the search by display_name. Search for an exact match"},"display_name.keyword":{"type":"string","title":"Filter the search by display_name.keyword. Search for the matches that contain the value"},"not.display_name":{"type":"string","title":"Filter the search by not.display_name. Search for the matches that are not equal to the value"},"not.display_name.keyword":{"type":"string","title":"Filter the search by not.display_name.keyword. Search for the matches that do not contain the value"},"vendor":{"type":"string","title":"Filter the search by vendor. Search for an exact match"},"vendor.keyword":{"type":"string","title":"Filter the search by vendor.keyword. Search for the matches that contain the value"},"not.vendor":{"type":"string","title":"Filter the search by not.vendor. Search for the matches that are not equal to the value"},"not.vendor.keyword":{"type":"string","title":"Filter the search by not.vendor.keyword. Search for the matches that do not contain the value"},"product":{"type":"string","title":"Filter the search by product. Search for an exact match"},"product.keyword":{"type":"string","title":"Filter the search by product.keyword. Search for the matches that contain the value"},"not.product":{"type":"string","title":"Filter the search by not.product. Search for the matches that are not equal to the value"},"not.product.keyword":{"type":"string","title":"Filter the search by not.product.keyword. Search for the matches that do not contain the value"},"os_info.os_type":{"type":"string","title":"Filter the search by os_info.os_type. Search for an exact match"},"os_info.os_type.keyword":{"type":"string","title":"Filter the search by os_info.os_type.keyword. Search for the matches that contain the value"},"not.os_info.os_type":{"type":"string","title":"Filter the search by not.os_info.os_type. Search for the matches that are not equal to the value"},"not.os_info.os_type.keyword":{"type":"string","title":"Filter the search by not.os_info.os_type.keyword. Search for the matches that do not contain the value"},"os_info.os_version":{"type":"string","title":"Filter the search by os_info.os_version. Search for an exact match"},"os_info.os_version.keyword":{"type":"string","title":"Filter the search by os_info.os_version.keyword. Search for the matches that contain the value"},"not.os_info.os_version":{"type":"string","title":"Filter the search by not.os_info.os_version. Search for the matches that are not equal to the value"},"not.os_info.os_version.keyword":{"type":"string","title":"Filter the search by not.os_info.os_version.keyword. Search for the matches that do not contain the value"},"os_info.os_platform":{"type":"string","title":"Filter the search by os_info.os_platform. Search for an exact match"},"os_info.os_platform.keyword":{"type":"string","title":"Filter the search by os_info.os_platform.keyword. Search for the matches that contain the value"},"not.os_info.os_platform":{"type":"string","title":"Filter the search by not.os_info.os_platform. Search for the matches that are not equal to the value"},"not.os_info.os_platform.keyword":{"type":"string","title":"Filter the search by not.os_info.os_platform.keyword. Search for the matches that do not contain the value"},"os_info.os_architecture":{"type":"string","title":"Filter the search by os_info.os_architecture. Search for an exact match"},"os_info.os_architecture.keyword":{"type":"string","title":"Filter the search by os_info.os_architecture.keyword. Search for the matches that contain the value"},"not.os_info.os_architecture":{"type":"string","title":"Filter the search by not.os_info.os_architecture. Search for the matches that are not equal to the value"},"not.os_info.os_architecture.keyword":{"type":"string","title":"Filter the search by not.os_info.os_architecture.keyword. Search for the matches that do not contain the value"},"os_info.os_release_name":{"type":"string","title":"Filter the search by os_info.os_release_name. Search for an exact match"},"os_info.os_release_name.keyword":{"type":"string","title":"Filter the search by os_info.os_release_name.keyword. Search for the matches that contain the value"},"not.os_info.os_release_name":{"type":"string","title":"Filter the search by not.os_info.os_release_name. Search for the matches that are not equal to the value"},"not.os_info.os_release_name.keyword":{"type":"string","title":"Filter the search by not.os_info.os_release_name.keyword. Search for the matches that do not contain the value"},"severity":{"type":"string","title":"Filter the search by severity. Search for an exact match"},"severity.keyword":{"type":"string","title":"Filter the search by severity.keyword. Search for the matches that contain the value"},"not.severity":{"type":"string","title":"Filter the search by not.severity. Search for the matches that are not equal to the value"},"not.severity.keyword":{"type":"string","title":"Filter the search by not.severity.keyword. Search for the matches that do not contain the value"},"title":{"type":"string","title":"Filter the search by title. Search for an exact match"},"title.keyword":{"type":"string","title":"Filter the search by title.keyword. Search for the matches that contain the value"},"not.title":{"type":"string","title":"Filter the search by not.title. Search for the matches that are not equal to the value"},"not.title.keyword":{"type":"string","title":"Filter the search by not.title.keyword. Search for the matches that do not contain the value"},"description":{"type":"string","title":"Filter the search by description. Search for an exact match"},"description.keyword":{"type":"string","title":"Filter the search by description.keyword. Search for the matches that contain the value"},"not.description":{"type":"string","title":"Filter the search by not.description. Search for the matches that are not equal to the value"},"not.description.keyword":{"type":"string","title":"Filter the search by not.description.keyword. Search for the matches that do not contain the value"},"category":{"type":"string","title":"Filter the search by category. Search for an exact match"},"category.keyword":{"type":"string","title":"Filter the search by category.keyword. Search for the matches that contain the value"},"not.category":{"type":"string","title":"Filter the search by not.category. Search for the matches that are not equal to the value"},"not.category.keyword":{"type":"string","title":"Filter the search by not.category.keyword. Search for the matches that do not contain the value"},"security_update_id":{"type":"string","title":"Filter the search by security_update_id. Search for an exact match"},"security_update_id.keyword":{"type":"string","title":"Filter the search by security_update_id.keyword. Search for the matches that contain the value"},"not.security_update_id":{"type":"string","title":"Filter the search by not.security_update_id. Search for the matches that are not equal to the value"},"not.security_update_id.keyword":{"type":"string","title":"Filter the search by not.security_update_id.keyword. Search for the matches that do not contain the value"},"patch_id":{"type":"string","title":"Filter the search by patch_id. Search for an exact match"},"patch_id.keyword":{"type":"string","title":"Filter the search by patch_id.keyword. Search for the matches that contain the value"},"not.patch_id":{"type":"string","title":"Filter the search by not.patch_id. Search for the matches that are not equal to the value"},"not.patch_id.keyword":{"type":"string","title":"Filter the search by not.patch_id.keyword. Search for the matches that do not contain the value"},"kb_id":{"type":"string","title":"Filter the search by kb_id. Search for an exact match"},"kb_id.keyword":{"type":"string","title":"Filter the search by kb_id.keyword. Search for the matches that contain the value"},"not.kb_id":{"type":"string","title":"Filter the search by not.kb_id. Search for the matches that are not equal to the value"},"not.kb_id.keyword":{"type":"string","title":"Filter the search by not.kb_id.keyword. Search for the matches that do not contain the value"},"reboot_required":{"type":"boolean","title":"Filter the search by reboot_required"},"preview_patch":{"type":"boolean","title":"Filter the search by preview_patch"},"not.preview_patch":{"type":"boolean","title":"Filter the search by not.preview_patch"},"size":{"type":"integer","title":"Filter the search by exact size"},"size_lt":{"type":"integer","title":"Filter the search by size_lt. Search for the documents that are less than the value"},"size_lte":{"type":"integer","title":"Filter the search by size_lte. Search for the documents that are less than the value"},"size_gt":{"type":"integer","title":"Filter the search by size_gt. Search for the documents that are greater than the value"},"size_gte":{"type":"integer","title":"Filter the search by size_gte. Search for the documents that are greater than the value"},"created_at_after":{"type":"string","title":"Filter search with created_at_after ISO date string (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-02-01T17:23:17.860482Z"]},"created_at_before":{"type":"string","title":"Filter search with created_at_before ISO date string (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"released_at_after":{"type":"string","title":"Filter search with released_at_after ISO date string (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"released_at_before":{"type":"string","title":"Filter search with released_at_before ISO date string (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"update_ignored":{"type":"boolean","title":"Filter the search by update_ignored os patches"},"exists":{"type":"array","title":"Filter the results for records that have these fields","items":{"type":"string","enum":["domain_name","product_signature"]}},"not.exists":{"type":"array","title":"Filter the results for records that do not have these fields","items":{"type":"string","enum":["domain_name","product_signature"]}},"sort_field":{"type":"string","title":"Sort field","enum":["account_id","account_name","parent_account_id","machine_id","group_id","root_group_id","object_guid","host_name","fully_qualified_host_name","display_name","vendor","product","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","severity","title","description","category","security_update_id","patch_id","kb_id","created_at","released_at","reboot_required","preview_patch","size","domain_name","active_directory.user.display_name","active_directory.machine.display_name","active_directory.user.ou","active_directory.machine.ou","active_directory.user.sam_account_name","active_directory.machine.sam_account_name","ignored_until"]},"sort_order":{"type":"string","title":"Sorting direction","default":"asc","enum":["asc","desc"]},"populate":{"type":"object","title":"The populate object Schema","properties":{"group":{"type":"boolean","title":"Populates group data (group name, policy name, policy id)"},"endpoint":{"type":"boolean","title":"Populate with the endpoint data (last day seen, last user)"}}},"page_size":{"type":"number","title":"The size of the page. If you only need aggregations, set it to 0","minimum":0,"default":50,"maximum":2000},"aggregations":{"type":"array","title":"The Aggregations Schema","items":{"type":"string","title":"Aggregations","default":[],"enum":["account_id","account_name","parent_account_id","machine_id","group_id","root_group_id","object_guid","host_name","fully_qualified_host_name","display_name","vendor","product","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","severity","title","description","category","security_update_id","patch_id","kb_id","created_at","released_at","reboot_required","preview_patch","size"]}},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}},"allOf":[{"type":"object","title":"Active Directory Search Filters","properties":{"active_directory.user.display_name":{"type":"string","title":"Filter the search by active_directory.user.display_name. Search for the matches that are equal to the value"},"active_directory.user.display_name.keyword":{"type":"string","title":"Filter the search by active_directory.user.display_name.keyword. Search for the matches that contain the value"},"active_directory.user.ou":{"type":"string","title":"Filter the search by active_directory.user.ou. Search for the matches that are equal to the value"},"active_directory.user.ou.keyword":{"type":"string","title":"Filter the search by active_directory.user.ou.keyword. Search for the matches that contain the value"},"active_directory.user.ou.path":{"type":"string","title":"Filter the search by active_directory.user.ou.path. Search for the matches that are equal to the value"},"active_directory.user.ou.path.keyword":{"type":"string","title":"Filter the search by active_directory.user.ou.path.keyword. Search for the matches that contain the value"},"active_directory.user.sam_account_name":{"type":"string","title":"Filter the search by active_directory.user.sam_account_name. Search for the matches that are equal to the value"},"active_directory.user.sam_account_name.keyword":{"type":"string","title":"Filter the search by active_directory.user.sam_account_name.keyword. Search for the matches that contain the value"},"active_directory.machine.display_name":{"type":"string","title":"Filter the search by active_directory.machine.display_name. Search for the matches that are equal to the value"},"active_directory.machine.display_name.keyword":{"type":"string","title":"Filter the search by active_directory.machine.display_name.keyword. Search for the matches that contain the value"},"active_directory.machine.ou":{"type":"string","title":"Filter the search by active_directory.machine.ou. Search for the matches that are equal to the value"},"active_directory.machine.ou.keyword":{"type":"string","title":"Filter the search by active_directory.machine.ou.keyword. Search for the matches that contain the value"},"active_directory.machine.ou.path":{"type":"string","title":"Filter the search by active_directory.machine.ou.path. Search for the matches that are equal to the value"},"active_directory.machine.ou.path.keyword":{"type":"string","title":"Filter the search by active_directory.machine.ou.path.keyword. Search for the matches that contain the value"},"active_directory.machine.sam_account_name":{"type":"string","title":"Filter the search by active_directory.machine.sam_account_name. Search for the matches that are equal to the value"},"active_directory.machine.sam_account_name.keyword":{"type":"string","title":"Filter the search by active_directory.machine.sam_account_name.keyword. Search for the matches that contain the value"}}}]},{"type":"object","required":["account_ids"],"properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}},{"type":"object","properties":{"account_name":{"type":"string","title":"Filter the search by account_name. Search for an exact match"},"account_name.keyword":{"type":"string","title":"Filter the search by account_name.keyword. Search for the matches that contain the value"},"not.account_name":{"type":"string","title":"Filter the search by not.account_name. Search for the matches that are not equal to the value"},"not.account_name.keyword":{"type":"string","title":"Filter the search by not.account_name.keyword. Search for the matches that do not contain the value"},"parent_account_id":{"type":"string","title":"Filter the search by parent_account_id. Search for an exact match"},"parent_account_id.keyword":{"type":"string","title":"Filter the search by parent_account_id.keyword. Search for the matches that contain the value"},"not.parent_account_id":{"type":"string","title":"Filter the search by not.parent_account_id. Search for the matches that are not equal to the value"},"not.parent_account_id.keyword":{"type":"string","title":"Filter the search by not.parent_account_id.keyword. Search for the matches that do not contain the value"}}},{"type":"object","title":"Active Directory Search Filters","properties":{"active_directory.user.display_name":{"type":"string","title":"Filter the search by active_directory.user.display_name. Search for the matches that are equal to the value"},"active_directory.user.display_name.keyword":{"type":"string","title":"Filter the search by active_directory.user.display_name.keyword. Search for the matches that contain the value"},"active_directory.user.ou":{"type":"string","title":"Filter the search by active_directory.user.ou. Search for the matches that are equal to the value"},"active_directory.user.ou.keyword":{"type":"string","title":"Filter the search by active_directory.user.ou.keyword. Search for the matches that contain the value"},"active_directory.user.ou.path":{"type":"string","title":"Filter the search by active_directory.user.ou.path. Search for the matches that are equal to the value"},"active_directory.user.ou.path.keyword":{"type":"string","title":"Filter the search by active_directory.user.ou.path.keyword. Search for the matches that contain the value"},"active_directory.user.sam_account_name":{"type":"string","title":"Filter the search by active_directory.user.sam_account_name. Search for the matches that are equal to the value"},"active_directory.user.sam_account_name.keyword":{"type":"string","title":"Filter the search by active_directory.user.sam_account_name.keyword. Search for the matches that contain the value"},"active_directory.machine.display_name":{"type":"string","title":"Filter the search by active_directory.machine.display_name. Search for the matches that are equal to the value"},"active_directory.machine.display_name.keyword":{"type":"string","title":"Filter the search by active_directory.machine.display_name.keyword. Search for the matches that contain the value"},"active_directory.machine.ou":{"type":"string","title":"Filter the search by active_directory.machine.ou. Search for the matches that are equal to the value"},"active_directory.machine.ou.keyword":{"type":"string","title":"Filter the search by active_directory.machine.ou.keyword. Search for the matches that contain the value"},"active_directory.machine.ou.path":{"type":"string","title":"Filter the search by active_directory.machine.ou.path. Search for the matches that are equal to the value"},"active_directory.machine.ou.path.keyword":{"type":"string","title":"Filter the search by active_directory.machine.ou.path.keyword. Search for the matches that contain the value"},"active_directory.machine.sam_account_name":{"type":"string","title":"Filter the search by active_directory.machine.sam_account_name. Search for the matches that are equal to the value"},"active_directory.machine.sam_account_name.keyword":{"type":"string","title":"Filter the search by active_directory.machine.sam_account_name.keyword. Search for the matches that contain the value"}}}]}],"properties":{"group_by":{"type":"string","title":"The sort field Schema","enum":["account_id","account_name","parent_account_id","machine_id","group_id","root_group_id","object_guid","host_name","fully_qualified_host_name","display_name","vendor","product","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","severity","title","description","category","security_update_id","patch_id","kb_id","created_at","released_at","reboot_required","preview_patch","size","domain_name","active_directory.user.display_name","active_directory.user.ou","active_directory.machine.display_name","active_directory.machine.ou"]}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"The Post Assets Search GroupBy Response Schema","required":["results","next_cursor"],"properties":{"results":{"type":"array","title":"The Results Schema","default":[],"items":{"type":"object","title":"The Items Schema","required":["value","total"],"properties":{"value":{"type":["string","boolean"],"title":"The Value Schema"},"total":{"type":"integer","title":"The Total Schema"},"host_name":{"type":"string","title":"The host name Schema (only for machine_id aggregation)"},"fully_qualified_host_name":{"type":"string","title":"The host name Schema (only for machine_id aggregation)"},"tags":{"type":"object","additionalProperties":true,"title":"The tags Schema (only for machine_id aggregation)"},"account_id":{"type":"string","title":"The account_id Schema (only for machine_id aggregation)"},"group_name":{"type":"string","title":"The group name Schema (only for group_id aggregation)"},"account_name":{"type":"string","title":"The account_name Schema (only for group_id and account_id aggregation)"},"title":{"type":"string","title":"The title schema (only for patch_id aggregation)"}}}},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}}}}},"tags":["OS Patches"],"operationId":"api.v2.rmm.search.os-patches.group"}},"/oneview/v1/dns/export":{"post":{"description":"Export DNS data. You can export across multiple accounts. Specify your interested fields and the output format.\n\nSupported output formats: csv, xlsx, json.\n\n## Settings\n\n| Name | Description |\n|------|-------------|\n| groups | List of queries. The constraints accepted are the same accepted by the search assets software route. Refer to [Search DNS API](#operation/api.nebula.search.dns) for more information about the constraints accepted. |\n| download | If set to true, the server will set the `Content-Disposition` header using the `filename` and `format` |\n| select | Which fields to select, and which field name to map to. See request schema for allowed values |\n| type | Output encoding (for `csv` and `json` format) |\n| filename | Name of the file to be set in `Content-Disposition` header if `download` = true |\n\n## Examples\n\n### Download CSV file\n\nA request with this body sent by a browser will download a file called `nameofthefile.cvs`, displaying a table with columns: `accountId`, `groupId`, `groupName`, `Domain`, `IP_address` for all the dns logs of machine_id `1514cd0a-2ef3-4db3-b8a4-c89894d9aa34`:\n\n```json\n{\n \"groups\": [\n { \"machine_id\": \"1514cd0a-2ef3-4db3-b8a4-c89894d9aa34\" }\n ],\n \"format\": \"csv\",\n \"type\": \"string\",\n \"filename\": \"nameofthefile\",\n \"download\": true,\n \"select\": [\n {\"field\": \"account_id\", \"newField\": \"accountId\"},\n {\"field\": \"group_id\", \"newField\": \"groupId\"},\n {\"field\": \"group_name\", \"newField\": \"groupName\"},\n {\"field\": \"log.query_name\", \"newField\": \"Domain\"},\n {\"field\": \"log.dst_ip\", \"newField\": \"IP_address\"}\n ]\n}\n```\n","summary":"Export DNS data","security":[{"client_credentials":["execute"]},{"user_permissions":["dnsFiltering.view"]}],"status":{"outage":["auth","search_stateless"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Export request","allOf":[{"type":"object","title":"Export request","required":["groups","select","format"],"properties":{"format":{"type":"string","title":"The output file","enum":["csv","xlsx","html","ods","txt","rtf","json"]},"download":{"type":"boolean","title":"Whether to instruct the client to download the response as a file. Only clients like browsers are supported"},"type":{"type":"string","title":"The encoding of the output","enum":["string","base64","binary"],"default":"string"},"select":{"type":"array","title":"Which fields to select from the response","items":{"type":"object","title":"Field","required":["field","newField"],"properties":{"newField":{"type":"string","title":"the new value"},"field":{"type":"string","title":"The response field to map to a new value","enum":["rule_id","rule_name","resolved_ips","machine_id","group_id","group_name","account_name","machine_name","policy_id","policy_name","account_id","parent_account_id","action","log.policy_id","log.policy","log.protocol","log.query_name","log.query_name_reversed","log.resolver_decision","log.user_id","log.colo_id","log.dst_port","log.query_category_ids","log.query_size","log.query_type","log.src_port","log.dst_ip","log.src_ip","timestamp","log.datetime","agent.at","agent.last_user","agent.fully_qualified_host_name","agent.started_at_local","agent.started_at_offset","agent.os_info.os_type","agent.os_info.os_version","agent.os_info.os_platform","agent.os_info.os_architecture","agent.os_info.os_release_name","agent.domain_name","agent.engine_version","agent.policy_etag","agent.host_name","agent.nics.ips","agent.nics.mac_address","machine.tags.alias","agent.has_alerts","agent.machine_ip","agent.object_guid","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.source_location.city","agent.source_location.country","agent.source_location.country_iso","agent.source_location.continent","agent.source_location.time_zone","agent.source_location.postal_code","agent.source_location.subdivisions","agent.source_location.anonymous_proxy","agent.serial_number","active_directory.user.display_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.machine.display_name","active_directory.machine.sam_account_name","active_directory.machine.ou"]}}}},"groups":{"type":"array","title":"List of queries","items":{"type":"object","title":"Query to fetch DNS Logs","allOf":[{"type":"object","title":"Search DNS Logs request. Leading wildcards are not supported for constraint fields without '.keyword' suffix.","allOf":[{"type":"object","title":"Agent constraints","description":"The Agents constraints.","properties":{"nics.mac_address":{"type":"string","title":"nics.mac_address"},"not.nics.mac_address":{"type":"string","title":"not.nics.mac_address"},"nics.mac_address.keyword":{"type":"string","title":"nics.mac_address.keyword"},"not.nics.mac_address.keyword":{"type":"string","title":"not.nics.mac_address.keyword"},"nics.description":{"type":"string","title":"nics.description"},"not.nics.description":{"type":"string","title":"not.nics.description"},"nics.description.keyword":{"type":"string","title":"nics.description.keyword"},"not.nics.description.keyword":{"type":"string","title":"not.nics.description.keyword"},"os_info.os_type":{"type":"string","title":"os_info.os_type"},"not.os_info.os_type":{"type":"string","title":"not.os_info.os_type"},"os_info.os_type.keyword":{"type":"string","title":"os_info.os_type.keyword"},"not.os_info.os_type.keyword":{"type":"string","title":"not.os_info.os_type.keyword"},"os_info.os_version":{"type":"string","title":"os_info.os_version"},"not.os_info.os_version":{"type":"string","title":"not.os_info.os_version"},"os_info.os_version.keyword":{"type":"string","title":"os_info.os_version.keyword"},"not.os_info.os_version.keyword":{"type":"string","title":"not.os_info.os_version.keyword"},"os_info.os_platform":{"type":"string","title":"os_info.os_platform"},"not.os_info.os_platform":{"type":"string","title":"not.os_info.os_platform"},"os_info.os_platform.keyword":{"type":"string","title":"os_info.os_platform.keyword"},"not.os_info.os_platform.keyword":{"type":"string","title":"not.os_info.os_platform.keyword"},"os_info.os_architecture":{"type":"string","title":"os_info.os_architecture"},"not.os_info.os_architecture":{"type":"string","title":"not.os_info.os_architecture"},"os_info.os_architecture.keyword":{"type":"string","title":"os_info.os_architecture.keyword"},"not.os_info.os_architecture.keyword":{"type":"string","title":"not.os_info.os_architecture.keyword"},"os_info.os_release_name":{"type":"string","title":"os_info.os_release_name"},"not.os_info.os_release_name":{"type":"string","title":"not.os_info.os_release_name"},"os_info.os_release_name.keyword":{"type":"string","title":"os_info.os_release_name.keyword"},"not.os_info.os_release_name.keyword":{"type":"string","title":"not.os_info.os_release_name.keyword"},"host_name":{"type":"string","title":"host_name"},"not.host_name":{"type":"string","title":"not.host_name"},"host_name.keyword":{"type":"string","title":"host_name.keyword"},"not.host_name.keyword":{"type":"string","title":"not.host_name.keyword"},"fully_qualified_host_name":{"type":"string","title":"fully_qualified_host_name"},"not.fully_qualified_host_name":{"type":"string","title":"not.fully_qualified_host_name"},"fully_qualified_host_name.keyword":{"type":"string","title":"fully_qualified_host_name.keyword"},"not.fully_qualified_host_name.keyword":{"type":"string","title":"not.fully_qualified_host_name.keyword"},"plugins.asset_manager.plugin_version":{"type":"string","title":"plugins.asset_manager.plugin_version"},"not.plugins.asset_manager.plugin_version":{"type":"string","title":"not.plugins.asset_manager.plugin_version"},"plugins.asset_manager.plugin_version.keyword":{"type":"string","title":"plugins.asset_manager.plugin_version.keyword"},"not.plugins.asset_manager.plugin_version.keyword":{"type":"string","title":"not.plugins.asset_manager.plugin_version.keyword"},"plugins.asset_manager.reboot_reasons":{"type":"string","title":"plugins.asset_manager.reboot_reasons"},"not.plugins.asset_manager.reboot_reasons":{"type":"string","title":"not.plugins.asset_manager.reboot_reasons"},"plugins.asset_manager.reboot_reasons.keyword":{"type":"string","title":"plugins.asset_manager.reboot_reasons.keyword"},"not.plugins.asset_manager.reboot_reasons.keyword":{"type":"string","title":"not.plugins.asset_manager.reboot_reasons.keyword"},"plugins.endpoint_protection.plugin_version":{"type":"string","title":"plugins.endpoint_protection.plugin_version"},"not.plugins.endpoint_protection.plugin_version":{"type":"string","title":"not.plugins.endpoint_protection.plugin_version"},"plugins.endpoint_protection.plugin_version.keyword":{"type":"string","title":"plugins.endpoint_protection.plugin_version.keyword"},"not.plugins.endpoint_protection.plugin_version.keyword":{"type":"string","title":"not.plugins.endpoint_protection.plugin_version.keyword"},"plugins.endpoint_protection.sdk_version":{"type":"string","title":"plugins.endpoint_protection.sdk_version"},"not.plugins.endpoint_protection.sdk_version":{"type":"string","title":"not.plugins.endpoint_protection.sdk_version"},"plugins.endpoint_protection.sdk_version.keyword":{"type":"string","title":"plugins.endpoint_protection.sdk_version.keyword"},"not.plugins.endpoint_protection.sdk_version.keyword":{"type":"string","title":"not.plugins.endpoint_protection.sdk_version.keyword"},"plugins.endpoint_protection.component_package_version":{"type":"string","title":"plugins.endpoint_protection.component_package_version"},"not.plugins.endpoint_protection.component_package_version":{"type":"string","title":"not.plugins.endpoint_protection.component_package_version"},"plugins.endpoint_protection.component_package_version.keyword":{"type":"string","title":"plugins.endpoint_protection.component_package_version.keyword"},"not.plugins.endpoint_protection.component_package_version.keyword":{"type":"string","title":"not.plugins.endpoint_protection.component_package_version.keyword"},"plugins.endpoint_protection.update_package_version":{"type":"string","title":"plugins.endpoint_protection.update_package_version"},"not.plugins.endpoint_protection.update_package_version":{"type":"string","title":"not.plugins.endpoint_protection.update_package_version"},"plugins.endpoint_protection.update_package_version.keyword":{"type":"string","title":"plugins.endpoint_protection.update_package_version.keyword"},"not.plugins.endpoint_protection.update_package_version.keyword":{"type":"string","title":"not.plugins.endpoint_protection.update_package_version.keyword"},"plugins.endpoint_protection.reboot_reasons":{"type":"string","title":"plugins.endpoint_protection.reboot_reasons"},"not.plugins.endpoint_protection.reboot_reasons":{"type":"string","title":"not.plugins.endpoint_protection.reboot_reasons"},"plugins.endpoint_protection.reboot_reasons.keyword":{"type":"string","title":"plugins.endpoint_protection.reboot_reasons.keyword"},"not.plugins.endpoint_protection.reboot_reasons.keyword":{"type":"string","title":"not.plugins.endpoint_protection.reboot_reasons.keyword"},"plugins.endpoint_detection_and_response.plugin_version":{"type":"string","title":"plugins.endpoint_detection_and_response.plugin_version"},"not.plugins.endpoint_detection_and_response.plugin_version":{"type":"string","title":"not.plugins.endpoint_detection_and_response.plugin_version"},"plugins.endpoint_detection_and_response.plugin_version.keyword":{"type":"string","title":"plugins.endpoint_detection_and_response.plugin_version.keyword"},"not.plugins.endpoint_detection_and_response.plugin_version.keyword":{"type":"string","title":"not.plugins.endpoint_detection_and_response.plugin_version.keyword"},"plugins.endpoint_detection_and_response.reboot_reasons":{"type":"string","title":"plugins.endpoint_detection_and_response.reboot_reasons"},"not.plugins.endpoint_detection_and_response.reboot_reasons":{"type":"string","title":"not.plugins.endpoint_detection_and_response.reboot_reasons"},"plugins.endpoint_detection_and_response.reboot_reasons.keyword":{"type":"string","title":"plugins.endpoint_detection_and_response.reboot_reasons.keyword"},"not.plugins.endpoint_detection_and_response.reboot_reasons.keyword":{"type":"string","title":"not.plugins.endpoint_detection_and_response.reboot_reasons.keyword"},"plugins.incident_response.plugin_version":{"type":"string","title":"plugins.incident_response.plugin_version"},"not.plugins.incident_response.plugin_version":{"type":"string","title":"not.plugins.incident_response.plugin_version"},"plugins.incident_response.plugin_version.keyword":{"type":"string","title":"plugins.incident_response.plugin_version.keyword"},"not.plugins.incident_response.plugin_version.keyword":{"type":"string","title":"not.plugins.incident_response.plugin_version.keyword"},"plugins.incident_response.reboot_reasons":{"type":"string","title":"plugins.incident_response.reboot_reasons"},"not.plugins.incident_response.reboot_reasons":{"type":"string","title":"not.plugins.incident_response.reboot_reasons"},"plugins.incident_response.reboot_reasons.keyword":{"type":"string","title":"plugins.incident_response.reboot_reasons.keyword"},"not.plugins.incident_response.reboot_reasons.keyword":{"type":"string","title":"not.plugins.incident_response.reboot_reasons.keyword"},"plugins.siem.plugin_version":{"type":"string","title":"plugins.siem.plugin_version"},"not.plugins.siem.plugin_version":{"type":"string","title":"not.plugins.siem.plugin_version"},"plugins.siem.plugin_version.keyword":{"type":"string","title":"plugins.siem.plugin_version.keyword"},"not.plugins.siem.plugin_version.keyword":{"type":"string","title":"not.plugins.siem.plugin_version.keyword"},"plugins.browser_phishing_protection.plugin_version":{"type":"string","title":"plugins.browser_phishing_protection.plugin_version"},"not.plugins.browser_phishing_protection.plugin_version":{"type":"string","title":"not.plugins.browser_phishing_protection.plugin_version"},"plugins.browser_phishing_protection.plugin_version.keyword":{"type":"string","title":"plugins.browser_phishing_protection.plugin_version.keyword"},"not.plugins.browser_phishing_protection.plugin_version.keyword":{"type":"string","title":"not.plugins.browser_phishing_protection.plugin_version.keyword"},"plugins.browser_phishing_protection.reboot_reasons":{"type":"string","title":"plugins.browser_phishing_protection.reboot_reasons"},"not.plugins.browser_phishing_protection.reboot_reasons":{"type":"string","title":"not.plugins.browser_phishing_protection.reboot_reasons"},"plugins.browser_phishing_protection.reboot_reasons.keyword":{"type":"string","title":"plugins.browser_phishing_protection.reboot_reasons.keyword"},"not.plugins.browser_phishing_protection.reboot_reasons.keyword":{"type":"string","title":"not.plugins.browser_phishing_protection.reboot_reasons.keyword"},"plugins.siem.reboot_reasons":{"type":"string","title":"plugins.siem.reboot_reasons"},"not.plugins.siem.reboot_reasons":{"type":"string","title":"not.plugins.siem.reboot_reasons"},"plugins.siem.reboot_reasons.keyword":{"type":"string","title":"plugins.siem.reboot_reasons.keyword"},"not.plugins.siem.reboot_reasons.keyword":{"type":"string","title":"not.plugins.siem.reboot_reasons.keyword"},"engine_version":{"type":"string","title":"engine_version"},"not.engine_version":{"type":"string","title":"not.engine_version"},"engine_version.keyword":{"type":"string","title":"engine_version.keyword"},"not.engine_version.keyword":{"type":"string","title":"not.engine_version.keyword"},"domain_name":{"type":"string","title":"domain_name"},"not.domain_name":{"type":"string","title":"not.domain_name"},"domain_name.keyword":{"type":"string","title":"domain_name.keyword"},"not.domain_name.keyword":{"type":"string","title":"not.domain_name.keyword"},"policy_etag":{"type":"string","title":"policy_etag"},"not.policy_etag":{"type":"string","title":"not.policy_etag"},"policy_etag.keyword":{"type":"string","title":"policy_etag.keyword"},"not.policy_etag.keyword":{"type":"string","title":"not.policy_etag.keyword"},"last_user":{"type":"string","title":"last_user"},"not.last_user":{"type":"string","title":"not.last_user"},"last_user.keyword":{"type":"string","title":"last_user.keyword"},"not.last_user.keyword":{"type":"string","title":"not.last_user.keyword"},"serial_number":{"type":"string","title":"serial_number"},"not.serial_number":{"type":"string","title":"not.serial_number"},"serial_number.keyword":{"type":"string","title":"serial_number.keyword"},"not.serial_number.keyword":{"type":"string","title":"not.serial_number.keyword"}}},{"type":"object","title":"Active Directory Search Filters","properties":{"active_directory.user.display_name":{"type":"string","title":"Filter the search by active_directory.user.display_name. Search for the matches that are equal to the value"},"active_directory.user.display_name.keyword":{"type":"string","title":"Filter the search by active_directory.user.display_name.keyword. Search for the matches that contain the value"},"active_directory.user.ou":{"type":"string","title":"Filter the search by active_directory.user.ou. Search for the matches that are equal to the value"},"active_directory.user.ou.keyword":{"type":"string","title":"Filter the search by active_directory.user.ou.keyword. Search for the matches that contain the value"},"active_directory.user.ou.path":{"type":"string","title":"Filter the search by active_directory.user.ou.path. Search for the matches that are equal to the value"},"active_directory.user.ou.path.keyword":{"type":"string","title":"Filter the search by active_directory.user.ou.path.keyword. Search for the matches that contain the value"},"active_directory.user.sam_account_name":{"type":"string","title":"Filter the search by active_directory.user.sam_account_name. Search for the matches that are equal to the value"},"active_directory.user.sam_account_name.keyword":{"type":"string","title":"Filter the search by active_directory.user.sam_account_name.keyword. Search for the matches that contain the value"},"active_directory.machine.display_name":{"type":"string","title":"Filter the search by active_directory.machine.display_name. Search for the matches that are equal to the value"},"active_directory.machine.display_name.keyword":{"type":"string","title":"Filter the search by active_directory.machine.display_name.keyword. Search for the matches that contain the value"},"active_directory.machine.ou":{"type":"string","title":"Filter the search by active_directory.machine.ou. Search for the matches that are equal to the value"},"active_directory.machine.ou.keyword":{"type":"string","title":"Filter the search by active_directory.machine.ou.keyword. Search for the matches that contain the value"},"active_directory.machine.ou.path":{"type":"string","title":"Filter the search by active_directory.machine.ou.path. Search for the matches that are equal to the value"},"active_directory.machine.ou.path.keyword":{"type":"string","title":"Filter the search by active_directory.machine.ou.path.keyword. Search for the matches that contain the value"},"active_directory.machine.sam_account_name":{"type":"string","title":"Filter the search by active_directory.machine.sam_account_name. Search for the matches that are equal to the value"},"active_directory.machine.sam_account_name.keyword":{"type":"string","title":"Filter the search by active_directory.machine.sam_account_name.keyword. Search for the matches that contain the value"}}}],"properties":{"id":{"type":"string","title":"Filter the search by DNS event id. Search for an exact match"},"not.id":{"type":"string","title":"Filter the search by not.id. Search for the matches that are not equal to the value"},"machine_id":{"type":"string","title":"Filter the search by machine_id. Search for an exact match"},"machine_id.keyword":{"type":"string","title":"Filter the search by machine_id.keyword. Search for the matches that contain the value"},"not.machine_id":{"type":"string","title":"Filter the search by not.machine_id. Search for the matches that are not equal to the value"},"not.machine_id.keyword":{"type":"string","title":"Filter the search by not.machine_id.keyword. Search for the matches that doesnt contain the value"},"group_id":{"type":"string","title":"Filter the search by group_id. Search for an exact match"},"group_id.keyword":{"type":"string","title":"Filter the search by group_id.keyword. Search for the matches that contain the value"},"not.group_id":{"type":"string","title":"Filter the search by not.group_id. Search for the matches that are not equal to the value"},"not.group_id.keyword":{"type":"string","title":"Filter the search by not.group_id.keyword. Search for the matches that doesnt contain the value"},"group_name":{"type":"string","title":"Filter the search by group_name. Search for an exact match"},"group_name.keyword":{"type":"string","title":"Filter the search by group_name.keyword. Search for the matches that contain the value"},"not.group_name":{"type":"string","title":"Filter the search by not.group_name. Search for the matches that are not equal to the value"},"not.group_name.keyword":{"type":"string","title":"Filter the search by not.group_name.keyword. Search for the matches that doesnt contain the value"},"rule_id":{"type":"string","title":"Filter the search by rule_id. Search for an exact match"},"rule_id.keyword":{"type":"string","title":"Filter the search by rule_id.keyword. Search for the matches that contain the value"},"not.rule_id":{"type":"string","title":"Filter the search by not.rule_id. Search for the matches that are not equal to the value"},"not.rule_id.keyword":{"type":"string","title":"Filter the search by not.rule_id.keyword. Search for the matches that doesnt contain the value"},"rule_name":{"type":"string","title":"Filter the search by rule_name. Search for an exact match"},"rule_name.keyword":{"type":"string","title":"Filter the search by rule_name.keyword. Search for the matches that contain the value"},"not.rule_name":{"type":"string","title":"Filter the search by not.rule_name. Search for the matches that are not equal to the value"},"not.rule_name.keyword":{"type":"string","title":"Filter the search by not.rule_name.keyword. Search for the matches that doesnt contain the value"},"policy_id":{"type":"string","title":"Filter the search by policy_id. Search for an exact match"},"policy_id.keyword":{"type":"string","title":"Filter the search by policy_id.keyword. Search for the matches that contain the value"},"not.policy_id":{"type":"string","title":"Filter the search by not.policy_id. Search for the matches that are not equal to the value"},"not.policy_id.keyword":{"type":"string","title":"Filter the search by not.policy_id.keyword. Search for the matches that doesnt contain the value"},"policy_name":{"type":"string","title":"Filter the search by policy_name. Search for an exact match"},"policy_name.keyword":{"type":"string","title":"Filter the search by policy_name.keyword. Search for the matches that contain the value"},"not.policy_name":{"type":"string","title":"Filter the search by not.policy_name. Search for the matches that are not equal to the value"},"not.policy_name.keyword":{"type":"string","title":"Filter the search by not.policy_name.keyword. Search for the matches that doesnt contain the value"},"account_id":{"type":"string","title":"Filter the search by account_id. Search for an exact match"},"account_id.keyword":{"type":"string","title":"Filter the search by account_id.keyword. Search for the matches that contain the value"},"not.account_id":{"type":"string","title":"Filter the search by not.account_id. Search for the matches that are not equal to the value"},"not.account_id.keyword":{"type":"string","title":"Filter the search by not.account_id.keyword. Search for the matches that doesnt contain the value"},"parent_account_id":{"type":"string","title":"Filter the search by parent_account_id. Search for an exact match"},"parent_account_id.keyword":{"type":"string","title":"Filter the search by parent_account_id.keyword. Search for the matches that contain the value"},"not.parent_account_id":{"type":"string","title":"Filter the search by not.parent_account_id. Search for the matches that are not equal to the value"},"not.parent_account_id.keyword":{"type":"string","title":"Filter the search by not.parent_account_id.keyword. Search for the matches that doesnt contain the value"},"action":{"type":"string","title":"Filter the search by action. Search for an exact match"},"action.keyword":{"type":"string","title":"Filter the search by action.keyword. Search for the matches that contain the value"},"not.action":{"type":"string","title":"Filter the search by not.action. Search for the matches that are not equal to the value"},"not.action.keyword":{"type":"string","title":"Filter the search by not.action.keyword. Search for the matches that doesnt contain the value"},"log.policy_id":{"type":"string","title":"Filter the search by log.policy_id. Search for an exact match"},"log.policy_id.keyword":{"type":"string","title":"Filter the search by log.policy_id.keyword. Search for the matches that contain the value"},"not.log.policy_id":{"type":"string","title":"Filter the search by not.log.policy_id. Search for the matches that are not equal to the value"},"not.log.policy_id.keyword":{"type":"string","title":"Filter the search by not.log.policy_id.keyword. Search for the matches that doesnt contain the value"},"log.policy":{"type":"string","title":"Filter the search by log.policy. Search for an exact match"},"log.policy.keyword":{"type":"string","title":"Filter the search by log.policy.keyword. Search for the matches that contain the value"},"not.log.policy":{"type":"string","title":"Filter the search by not.log.policy. Search for the matches that are not equal to the value"},"not.log.policy.keyword":{"type":"string","title":"Filter the search by not.log.policy.keyword. Search for the matches that doesnt contain the value"},"log.protocol":{"type":"string","title":"Filter the search by log.protocol. Search for an exact match"},"log.protocol.keyword":{"type":"string","title":"Filter the search by log.protocol.keyword. Search for the matches that contain the value"},"not.log.protocol":{"type":"string","title":"Filter the search by not.log.protocol. Search for the matches that are not equal to the value"},"not.log.protocol.keyword":{"type":"string","title":"Filter the search by not.log.protocol.keyword. Search for the matches that doesnt contain the value"},"log.query_name":{"type":"string","title":"Filter the search by log.query_name. Search for an exact match"},"log.query_name.keyword":{"type":"string","title":"Filter the search by log.query_name.keyword. Search for the matches that contain the value"},"not.log.query_name":{"type":"string","title":"Filter the search by not.log.query_name. Search for the matches that are not equal to the value"},"not.log.query_name.keyword":{"type":"string","title":"Filter the search by not.log.query_name.keyword. Search for the matches that doesnt contain the value"},"log.query_name_reversed":{"type":"string","title":"Filter the search by log.query_name_reversed. Search for an exact match"},"log.query_name_reversed.keyword":{"type":"string","title":"Filter the search by log.query_name_reversed.keyword. Search for the matches that contain the value"},"not.log.query_name_reversed":{"type":"string","title":"Filter the search by not.log.query_name_reversed. Search for the matches that are not equal to the value"},"not.log.query_name_reversed.keyword":{"type":"string","title":"Filter the search by not.log.query_name_reversed.keyword. Search for the matches that doesnt contain the value"},"log.resolver_decision":{"type":"string","title":"Filter the search by log.resolver_decision. Search for an exact match"},"log.resolver_decision.keyword":{"type":"string","title":"Filter the search by log.resolver_decision.keyword. Search for the matches that contain the value"},"not.log.resolver_decision":{"type":"string","title":"Filter the search by not.log.resolver_decision. Search for the matches that are not equal to the value"},"not.log.resolver_decision.keyword":{"type":"string","title":"Filter the search by not.log.resolver_decision.keyword. Search for the matches that doesnt contain the value"},"log.user_id":{"type":"string","title":"Filter the search by log.user_id. Search for an exact match"},"log.user_id.keyword":{"type":"string","title":"Filter the search by log.user_id.keyword. Search for the matches that contain the value"},"not.log.user_id":{"type":"string","title":"Filter the search by not.log.user_id. Search for the matches that are not equal to the value"},"not.log.user_id.keyword":{"type":"string","title":"Filter the search by not.log.user_id.keyword. Search for the matches that doesnt contain the value"},"log.colo_id":{"type":"number","title":"Filter the search by log.colo_id. Search for an exact match of the integer value"},"log.colo_id_lt":{"type":"number","title":"Filter the search by log.colo_id_lt. Search for the documents that are less than the value"},"log.colo_id_lte":{"type":"number","title":"Filter the search by log.colo_id_lte. Search for the documents that are less or equal than the value"},"log.colo_id_gt":{"type":"number","title":"Filter the search by log.colo_id_gt. Search for the documents that are greater than the value"},"log.colo_id_gte":{"type":"number","title":"Filter the search by log.colo_id_gte. Search for the documents that are greater or equal than the value"},"log.dst_port":{"type":"number","title":"Filter the search by log.dst_port. Search for an exact match of the integer value"},"log.dst_port_lt":{"type":"number","title":"Filter the search by log.dst_port_lt. Search for the documents that are less than the value"},"log.dst_port_lte":{"type":"number","title":"Filter the search by log.dst_port_lte. Search for the documents that are less or equal than the value"},"log.dst_port_gt":{"type":"number","title":"Filter the search by log.dst_port_gt. Search for the documents that are greater than the value"},"log.dst_port_gte":{"type":"number","title":"Filter the search by log.dst_port_gte. Search for the documents that are greater or equal than the value"},"log.query_category_ids":{"type":"array","items":{"type":"number"},"title":"Filter the search by log.query_category_ids. Search for an exact match of the integer value"},"log.query_size":{"type":"number","title":"Filter the search by log.query_size. Search for an exact match of the integer value"},"log.query_size_lt":{"type":"number","title":"Filter the search by log.query_size_lt. Search for the documents that are less than the value"},"log.query_size_lte":{"type":"number","title":"Filter the search by log.query_size_lte. Search for the documents that are less or equal than the value"},"log.query_size_gt":{"type":"number","title":"Filter the search by log.query_size_gt. Search for the documents that are greater than the value"},"log.query_size_gte":{"type":"number","title":"Filter the search by log.query_size_gte. Search for the documents that are greater or equal than the value"},"log.query_type":{"type":"number","title":"Filter the search by log.query_type. Search for an exact match of the integer value"},"log.query_type_lt":{"type":"number","title":"Filter the search by log.query_type_lt. Search for the documents that are less than the value"},"log.query_type_lte":{"type":"number","title":"Filter the search by log.query_type_lte. Search for the documents that are less or equal than the value"},"log.query_type_gt":{"type":"number","title":"Filter the search by log.query_type_gt. Search for the documents that are greater than the value"},"log.query_type_gte":{"type":"number","title":"Filter the search by log.query_type_gte. Search for the documents that are greater or equal than the value"},"log.src_port":{"type":"number","title":"Filter the search by log.src_port. Search for an exact match of the integer value"},"log.src_port_lt":{"type":"number","title":"Filter the search by log.src_port_lt. Search for the documents that are less than the value"},"log.src_port_lte":{"type":"number","title":"Filter the search by log.src_port_lte. Search for the documents that are less or equal than the value"},"log.src_port_gt":{"type":"number","title":"Filter the search by log.src_port_gt. Search for the documents that are greater than the value"},"log.src_port_gte":{"type":"number","title":"Filter the search by log.src_port_gte. Search for the documents that are greater or equal than the value"},"log.datetime_before":{"type":"string","format":"date-time","title":"Filter the search by log.datetime_before. Search for the documents that are after the given timestamp"},"log.datetime_after":{"type":"string","format":"date-time","title":"Filter the search by log.datetime_after. "},"timestamp_before":{"type":"string","format":"date-time","title":"Filter the search by timestamp_before. Search for the documents that are after the given timestamp"},"timestamp_after":{"type":"string","format":"date-time","title":"Filter the search by timestamp_after. "},"log.dst_ip":{"type":"string","format":"ipv4","title":"Filter the search by log.dst_ip. Search for an exact match"},"not.log.dst_ip":{"type":"string","format":"ipv4","title":"Filter the search by not.log.dst_ip. Search for the matches that are not equal to the value"},"log.src_ip":{"type":"string","format":"ipv4","title":"Filter the search by log.src_ip. Search for an exact match"},"not.log.src_ip":{"type":"string","format":"ipv4","title":"Filter the search by not.log.src_ip. Search for the matches that are not equal to the value"},"resolved_ips":{"type":"string","title":"Filter the search by resolved_ips. Search for an exact match"},"not.resolved_ips":{"type":"string","title":"Filter the search by not.resolved_ips. Search for the matches that are not equal to the value"},"sort_field":{"type":"string","title":"Sort field","enum":["machine_id","group_id","group_name","rule_id","rule_name","resolved_ips","policy_id","policy_name","account_id","parent_account_id","action","log.policy_id","log.policy","log.protocol","log.query_name","log.query_name_reversed","log.resolver_decision","log.user_id","log.colo_id","log.dst_port","log.query_category_ids","log.query_size","log.query_type","log.src_port","log.dst_ip","log.src_ip","timestamp","log.datetime","agent.at","agent.last_user","agent.fully_qualified_host_name","agent.started_at_local","agent.started_at_offset","agent.os_info.os_type","agent.os_info.os_version","agent.os_info.os_platform","agent.os_info.os_architecture","agent.os_info.os_release_name","agent.domain_name","agent.engine_version","agent.policy_etag","agent.host_name","agent.nics.ips","agent.nics.mac_address","machine.tags.alias","agent.has_alerts","agent.machine_ip","agent.object_guid","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.source_location.city","agent.source_location.country","agent.source_location.country_iso","agent.source_location.continent","agent.source_location.time_zone","agent.source_location.postal_code","agent.source_location.subdivisions","agent.source_location.anonymous_proxy","agent.serial_number","active_directory.user.display_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.machine.display_name","active_directory.machine.sam_account_name","active_directory.machine.ou"]},"populate":{"type":"object","title":"Populate object schema","properties":{"group":{"type":"boolean","title":"Populates group data (group name, policy name, policy id)"},"endpoint":{"type":"boolean","title":"Populate with the endpoint data (last day seen, last user)"}}},"sort_order":{"type":"string","title":"Sorting direction","default":"asc","enum":["asc","desc"]},"page_size":{"type":"number","title":"The size of the page. If you only need aggregations, set it to 0","minimum":0,"default":50,"maximum":2000},"aggregations":{"type":"array","title":"The Aggregations Schema","items":{"type":"string","title":"Aggregations","default":[],"enum":["machine_id","group_id","rule_id","rule_name","resolved_ips","group_name","policy_id","policy_name","account_id","parent_account_id","action","log.policy_id","log.policy","log.protocol","log.query_name","log.query_name_reversed","log.resolver_decision","log.user_id","log.colo_id","log.dst_port","log.query_category_ids","log.query_size","log.query_type","log.src_port","log.dst_ip","log.src_ip","timestamp","log.datetime","agent.at","agent.last_user","agent.fully_qualified_host_name","agent.started_at_local","agent.started_at_offset","agent.os_info.os_type","agent.os_info.os_version","agent.os_info.os_platform","agent.os_info.os_architecture","agent.os_info.os_release_name","agent.domain_name","agent.engine_version","agent.policy_etag","agent.host_name","agent.nics.ips","agent.nics.mac_address","machine.tags.alias","agent.has_alerts","agent.machine_ip","agent.object_guid","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.source_location.city","agent.source_location.country","agent.source_location.country_iso","agent.source_location.continent","agent.source_location.time_zone","agent.source_location.postal_code","agent.source_location.subdivisions","agent.source_location.anonymous_proxy","agent.serial_number","daily_logs"]}},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}]}}}}],"properties":{"groups":{"type":"array","title":"List of search queries","items":{"type":"object","required":["account_ids"],"allOf":[{"type":"object","title":"Search DNS Logs request. Leading wildcards are not supported for constraint fields without '.keyword' suffix.","allOf":[{"type":"object","title":"Agent constraints","description":"The Agents constraints.","properties":{"nics.mac_address":{"type":"string","title":"nics.mac_address"},"not.nics.mac_address":{"type":"string","title":"not.nics.mac_address"},"nics.mac_address.keyword":{"type":"string","title":"nics.mac_address.keyword"},"not.nics.mac_address.keyword":{"type":"string","title":"not.nics.mac_address.keyword"},"nics.description":{"type":"string","title":"nics.description"},"not.nics.description":{"type":"string","title":"not.nics.description"},"nics.description.keyword":{"type":"string","title":"nics.description.keyword"},"not.nics.description.keyword":{"type":"string","title":"not.nics.description.keyword"},"os_info.os_type":{"type":"string","title":"os_info.os_type"},"not.os_info.os_type":{"type":"string","title":"not.os_info.os_type"},"os_info.os_type.keyword":{"type":"string","title":"os_info.os_type.keyword"},"not.os_info.os_type.keyword":{"type":"string","title":"not.os_info.os_type.keyword"},"os_info.os_version":{"type":"string","title":"os_info.os_version"},"not.os_info.os_version":{"type":"string","title":"not.os_info.os_version"},"os_info.os_version.keyword":{"type":"string","title":"os_info.os_version.keyword"},"not.os_info.os_version.keyword":{"type":"string","title":"not.os_info.os_version.keyword"},"os_info.os_platform":{"type":"string","title":"os_info.os_platform"},"not.os_info.os_platform":{"type":"string","title":"not.os_info.os_platform"},"os_info.os_platform.keyword":{"type":"string","title":"os_info.os_platform.keyword"},"not.os_info.os_platform.keyword":{"type":"string","title":"not.os_info.os_platform.keyword"},"os_info.os_architecture":{"type":"string","title":"os_info.os_architecture"},"not.os_info.os_architecture":{"type":"string","title":"not.os_info.os_architecture"},"os_info.os_architecture.keyword":{"type":"string","title":"os_info.os_architecture.keyword"},"not.os_info.os_architecture.keyword":{"type":"string","title":"not.os_info.os_architecture.keyword"},"os_info.os_release_name":{"type":"string","title":"os_info.os_release_name"},"not.os_info.os_release_name":{"type":"string","title":"not.os_info.os_release_name"},"os_info.os_release_name.keyword":{"type":"string","title":"os_info.os_release_name.keyword"},"not.os_info.os_release_name.keyword":{"type":"string","title":"not.os_info.os_release_name.keyword"},"host_name":{"type":"string","title":"host_name"},"not.host_name":{"type":"string","title":"not.host_name"},"host_name.keyword":{"type":"string","title":"host_name.keyword"},"not.host_name.keyword":{"type":"string","title":"not.host_name.keyword"},"fully_qualified_host_name":{"type":"string","title":"fully_qualified_host_name"},"not.fully_qualified_host_name":{"type":"string","title":"not.fully_qualified_host_name"},"fully_qualified_host_name.keyword":{"type":"string","title":"fully_qualified_host_name.keyword"},"not.fully_qualified_host_name.keyword":{"type":"string","title":"not.fully_qualified_host_name.keyword"},"plugins.asset_manager.plugin_version":{"type":"string","title":"plugins.asset_manager.plugin_version"},"not.plugins.asset_manager.plugin_version":{"type":"string","title":"not.plugins.asset_manager.plugin_version"},"plugins.asset_manager.plugin_version.keyword":{"type":"string","title":"plugins.asset_manager.plugin_version.keyword"},"not.plugins.asset_manager.plugin_version.keyword":{"type":"string","title":"not.plugins.asset_manager.plugin_version.keyword"},"plugins.asset_manager.reboot_reasons":{"type":"string","title":"plugins.asset_manager.reboot_reasons"},"not.plugins.asset_manager.reboot_reasons":{"type":"string","title":"not.plugins.asset_manager.reboot_reasons"},"plugins.asset_manager.reboot_reasons.keyword":{"type":"string","title":"plugins.asset_manager.reboot_reasons.keyword"},"not.plugins.asset_manager.reboot_reasons.keyword":{"type":"string","title":"not.plugins.asset_manager.reboot_reasons.keyword"},"plugins.endpoint_protection.plugin_version":{"type":"string","title":"plugins.endpoint_protection.plugin_version"},"not.plugins.endpoint_protection.plugin_version":{"type":"string","title":"not.plugins.endpoint_protection.plugin_version"},"plugins.endpoint_protection.plugin_version.keyword":{"type":"string","title":"plugins.endpoint_protection.plugin_version.keyword"},"not.plugins.endpoint_protection.plugin_version.keyword":{"type":"string","title":"not.plugins.endpoint_protection.plugin_version.keyword"},"plugins.endpoint_protection.sdk_version":{"type":"string","title":"plugins.endpoint_protection.sdk_version"},"not.plugins.endpoint_protection.sdk_version":{"type":"string","title":"not.plugins.endpoint_protection.sdk_version"},"plugins.endpoint_protection.sdk_version.keyword":{"type":"string","title":"plugins.endpoint_protection.sdk_version.keyword"},"not.plugins.endpoint_protection.sdk_version.keyword":{"type":"string","title":"not.plugins.endpoint_protection.sdk_version.keyword"},"plugins.endpoint_protection.component_package_version":{"type":"string","title":"plugins.endpoint_protection.component_package_version"},"not.plugins.endpoint_protection.component_package_version":{"type":"string","title":"not.plugins.endpoint_protection.component_package_version"},"plugins.endpoint_protection.component_package_version.keyword":{"type":"string","title":"plugins.endpoint_protection.component_package_version.keyword"},"not.plugins.endpoint_protection.component_package_version.keyword":{"type":"string","title":"not.plugins.endpoint_protection.component_package_version.keyword"},"plugins.endpoint_protection.update_package_version":{"type":"string","title":"plugins.endpoint_protection.update_package_version"},"not.plugins.endpoint_protection.update_package_version":{"type":"string","title":"not.plugins.endpoint_protection.update_package_version"},"plugins.endpoint_protection.update_package_version.keyword":{"type":"string","title":"plugins.endpoint_protection.update_package_version.keyword"},"not.plugins.endpoint_protection.update_package_version.keyword":{"type":"string","title":"not.plugins.endpoint_protection.update_package_version.keyword"},"plugins.endpoint_protection.reboot_reasons":{"type":"string","title":"plugins.endpoint_protection.reboot_reasons"},"not.plugins.endpoint_protection.reboot_reasons":{"type":"string","title":"not.plugins.endpoint_protection.reboot_reasons"},"plugins.endpoint_protection.reboot_reasons.keyword":{"type":"string","title":"plugins.endpoint_protection.reboot_reasons.keyword"},"not.plugins.endpoint_protection.reboot_reasons.keyword":{"type":"string","title":"not.plugins.endpoint_protection.reboot_reasons.keyword"},"plugins.endpoint_detection_and_response.plugin_version":{"type":"string","title":"plugins.endpoint_detection_and_response.plugin_version"},"not.plugins.endpoint_detection_and_response.plugin_version":{"type":"string","title":"not.plugins.endpoint_detection_and_response.plugin_version"},"plugins.endpoint_detection_and_response.plugin_version.keyword":{"type":"string","title":"plugins.endpoint_detection_and_response.plugin_version.keyword"},"not.plugins.endpoint_detection_and_response.plugin_version.keyword":{"type":"string","title":"not.plugins.endpoint_detection_and_response.plugin_version.keyword"},"plugins.endpoint_detection_and_response.reboot_reasons":{"type":"string","title":"plugins.endpoint_detection_and_response.reboot_reasons"},"not.plugins.endpoint_detection_and_response.reboot_reasons":{"type":"string","title":"not.plugins.endpoint_detection_and_response.reboot_reasons"},"plugins.endpoint_detection_and_response.reboot_reasons.keyword":{"type":"string","title":"plugins.endpoint_detection_and_response.reboot_reasons.keyword"},"not.plugins.endpoint_detection_and_response.reboot_reasons.keyword":{"type":"string","title":"not.plugins.endpoint_detection_and_response.reboot_reasons.keyword"},"plugins.incident_response.plugin_version":{"type":"string","title":"plugins.incident_response.plugin_version"},"not.plugins.incident_response.plugin_version":{"type":"string","title":"not.plugins.incident_response.plugin_version"},"plugins.incident_response.plugin_version.keyword":{"type":"string","title":"plugins.incident_response.plugin_version.keyword"},"not.plugins.incident_response.plugin_version.keyword":{"type":"string","title":"not.plugins.incident_response.plugin_version.keyword"},"plugins.incident_response.reboot_reasons":{"type":"string","title":"plugins.incident_response.reboot_reasons"},"not.plugins.incident_response.reboot_reasons":{"type":"string","title":"not.plugins.incident_response.reboot_reasons"},"plugins.incident_response.reboot_reasons.keyword":{"type":"string","title":"plugins.incident_response.reboot_reasons.keyword"},"not.plugins.incident_response.reboot_reasons.keyword":{"type":"string","title":"not.plugins.incident_response.reboot_reasons.keyword"},"plugins.siem.plugin_version":{"type":"string","title":"plugins.siem.plugin_version"},"not.plugins.siem.plugin_version":{"type":"string","title":"not.plugins.siem.plugin_version"},"plugins.siem.plugin_version.keyword":{"type":"string","title":"plugins.siem.plugin_version.keyword"},"not.plugins.siem.plugin_version.keyword":{"type":"string","title":"not.plugins.siem.plugin_version.keyword"},"plugins.browser_phishing_protection.plugin_version":{"type":"string","title":"plugins.browser_phishing_protection.plugin_version"},"not.plugins.browser_phishing_protection.plugin_version":{"type":"string","title":"not.plugins.browser_phishing_protection.plugin_version"},"plugins.browser_phishing_protection.plugin_version.keyword":{"type":"string","title":"plugins.browser_phishing_protection.plugin_version.keyword"},"not.plugins.browser_phishing_protection.plugin_version.keyword":{"type":"string","title":"not.plugins.browser_phishing_protection.plugin_version.keyword"},"plugins.browser_phishing_protection.reboot_reasons":{"type":"string","title":"plugins.browser_phishing_protection.reboot_reasons"},"not.plugins.browser_phishing_protection.reboot_reasons":{"type":"string","title":"not.plugins.browser_phishing_protection.reboot_reasons"},"plugins.browser_phishing_protection.reboot_reasons.keyword":{"type":"string","title":"plugins.browser_phishing_protection.reboot_reasons.keyword"},"not.plugins.browser_phishing_protection.reboot_reasons.keyword":{"type":"string","title":"not.plugins.browser_phishing_protection.reboot_reasons.keyword"},"plugins.siem.reboot_reasons":{"type":"string","title":"plugins.siem.reboot_reasons"},"not.plugins.siem.reboot_reasons":{"type":"string","title":"not.plugins.siem.reboot_reasons"},"plugins.siem.reboot_reasons.keyword":{"type":"string","title":"plugins.siem.reboot_reasons.keyword"},"not.plugins.siem.reboot_reasons.keyword":{"type":"string","title":"not.plugins.siem.reboot_reasons.keyword"},"engine_version":{"type":"string","title":"engine_version"},"not.engine_version":{"type":"string","title":"not.engine_version"},"engine_version.keyword":{"type":"string","title":"engine_version.keyword"},"not.engine_version.keyword":{"type":"string","title":"not.engine_version.keyword"},"domain_name":{"type":"string","title":"domain_name"},"not.domain_name":{"type":"string","title":"not.domain_name"},"domain_name.keyword":{"type":"string","title":"domain_name.keyword"},"not.domain_name.keyword":{"type":"string","title":"not.domain_name.keyword"},"policy_etag":{"type":"string","title":"policy_etag"},"not.policy_etag":{"type":"string","title":"not.policy_etag"},"policy_etag.keyword":{"type":"string","title":"policy_etag.keyword"},"not.policy_etag.keyword":{"type":"string","title":"not.policy_etag.keyword"},"last_user":{"type":"string","title":"last_user"},"not.last_user":{"type":"string","title":"not.last_user"},"last_user.keyword":{"type":"string","title":"last_user.keyword"},"not.last_user.keyword":{"type":"string","title":"not.last_user.keyword"},"serial_number":{"type":"string","title":"serial_number"},"not.serial_number":{"type":"string","title":"not.serial_number"},"serial_number.keyword":{"type":"string","title":"serial_number.keyword"},"not.serial_number.keyword":{"type":"string","title":"not.serial_number.keyword"}}},{"type":"object","title":"Active Directory Search Filters","properties":{"active_directory.user.display_name":{"type":"string","title":"Filter the search by active_directory.user.display_name. Search for the matches that are equal to the value"},"active_directory.user.display_name.keyword":{"type":"string","title":"Filter the search by active_directory.user.display_name.keyword. Search for the matches that contain the value"},"active_directory.user.ou":{"type":"string","title":"Filter the search by active_directory.user.ou. Search for the matches that are equal to the value"},"active_directory.user.ou.keyword":{"type":"string","title":"Filter the search by active_directory.user.ou.keyword. Search for the matches that contain the value"},"active_directory.user.ou.path":{"type":"string","title":"Filter the search by active_directory.user.ou.path. Search for the matches that are equal to the value"},"active_directory.user.ou.path.keyword":{"type":"string","title":"Filter the search by active_directory.user.ou.path.keyword. Search for the matches that contain the value"},"active_directory.user.sam_account_name":{"type":"string","title":"Filter the search by active_directory.user.sam_account_name. Search for the matches that are equal to the value"},"active_directory.user.sam_account_name.keyword":{"type":"string","title":"Filter the search by active_directory.user.sam_account_name.keyword. Search for the matches that contain the value"},"active_directory.machine.display_name":{"type":"string","title":"Filter the search by active_directory.machine.display_name. Search for the matches that are equal to the value"},"active_directory.machine.display_name.keyword":{"type":"string","title":"Filter the search by active_directory.machine.display_name.keyword. Search for the matches that contain the value"},"active_directory.machine.ou":{"type":"string","title":"Filter the search by active_directory.machine.ou. Search for the matches that are equal to the value"},"active_directory.machine.ou.keyword":{"type":"string","title":"Filter the search by active_directory.machine.ou.keyword. Search for the matches that contain the value"},"active_directory.machine.ou.path":{"type":"string","title":"Filter the search by active_directory.machine.ou.path. Search for the matches that are equal to the value"},"active_directory.machine.ou.path.keyword":{"type":"string","title":"Filter the search by active_directory.machine.ou.path.keyword. Search for the matches that contain the value"},"active_directory.machine.sam_account_name":{"type":"string","title":"Filter the search by active_directory.machine.sam_account_name. Search for the matches that are equal to the value"},"active_directory.machine.sam_account_name.keyword":{"type":"string","title":"Filter the search by active_directory.machine.sam_account_name.keyword. Search for the matches that contain the value"}}}],"properties":{"id":{"type":"string","title":"Filter the search by DNS event id. Search for an exact match"},"not.id":{"type":"string","title":"Filter the search by not.id. Search for the matches that are not equal to the value"},"machine_id":{"type":"string","title":"Filter the search by machine_id. Search for an exact match"},"machine_id.keyword":{"type":"string","title":"Filter the search by machine_id.keyword. Search for the matches that contain the value"},"not.machine_id":{"type":"string","title":"Filter the search by not.machine_id. Search for the matches that are not equal to the value"},"not.machine_id.keyword":{"type":"string","title":"Filter the search by not.machine_id.keyword. Search for the matches that doesnt contain the value"},"group_id":{"type":"string","title":"Filter the search by group_id. Search for an exact match"},"group_id.keyword":{"type":"string","title":"Filter the search by group_id.keyword. Search for the matches that contain the value"},"not.group_id":{"type":"string","title":"Filter the search by not.group_id. Search for the matches that are not equal to the value"},"not.group_id.keyword":{"type":"string","title":"Filter the search by not.group_id.keyword. Search for the matches that doesnt contain the value"},"group_name":{"type":"string","title":"Filter the search by group_name. Search for an exact match"},"group_name.keyword":{"type":"string","title":"Filter the search by group_name.keyword. Search for the matches that contain the value"},"not.group_name":{"type":"string","title":"Filter the search by not.group_name. Search for the matches that are not equal to the value"},"not.group_name.keyword":{"type":"string","title":"Filter the search by not.group_name.keyword. Search for the matches that doesnt contain the value"},"rule_id":{"type":"string","title":"Filter the search by rule_id. Search for an exact match"},"rule_id.keyword":{"type":"string","title":"Filter the search by rule_id.keyword. Search for the matches that contain the value"},"not.rule_id":{"type":"string","title":"Filter the search by not.rule_id. Search for the matches that are not equal to the value"},"not.rule_id.keyword":{"type":"string","title":"Filter the search by not.rule_id.keyword. Search for the matches that doesnt contain the value"},"rule_name":{"type":"string","title":"Filter the search by rule_name. Search for an exact match"},"rule_name.keyword":{"type":"string","title":"Filter the search by rule_name.keyword. Search for the matches that contain the value"},"not.rule_name":{"type":"string","title":"Filter the search by not.rule_name. Search for the matches that are not equal to the value"},"not.rule_name.keyword":{"type":"string","title":"Filter the search by not.rule_name.keyword. Search for the matches that doesnt contain the value"},"policy_id":{"type":"string","title":"Filter the search by policy_id. Search for an exact match"},"policy_id.keyword":{"type":"string","title":"Filter the search by policy_id.keyword. Search for the matches that contain the value"},"not.policy_id":{"type":"string","title":"Filter the search by not.policy_id. Search for the matches that are not equal to the value"},"not.policy_id.keyword":{"type":"string","title":"Filter the search by not.policy_id.keyword. Search for the matches that doesnt contain the value"},"policy_name":{"type":"string","title":"Filter the search by policy_name. Search for an exact match"},"policy_name.keyword":{"type":"string","title":"Filter the search by policy_name.keyword. Search for the matches that contain the value"},"not.policy_name":{"type":"string","title":"Filter the search by not.policy_name. Search for the matches that are not equal to the value"},"not.policy_name.keyword":{"type":"string","title":"Filter the search by not.policy_name.keyword. Search for the matches that doesnt contain the value"},"account_id":{"type":"string","title":"Filter the search by account_id. Search for an exact match"},"account_id.keyword":{"type":"string","title":"Filter the search by account_id.keyword. Search for the matches that contain the value"},"not.account_id":{"type":"string","title":"Filter the search by not.account_id. Search for the matches that are not equal to the value"},"not.account_id.keyword":{"type":"string","title":"Filter the search by not.account_id.keyword. Search for the matches that doesnt contain the value"},"parent_account_id":{"type":"string","title":"Filter the search by parent_account_id. Search for an exact match"},"parent_account_id.keyword":{"type":"string","title":"Filter the search by parent_account_id.keyword. Search for the matches that contain the value"},"not.parent_account_id":{"type":"string","title":"Filter the search by not.parent_account_id. Search for the matches that are not equal to the value"},"not.parent_account_id.keyword":{"type":"string","title":"Filter the search by not.parent_account_id.keyword. Search for the matches that doesnt contain the value"},"action":{"type":"string","title":"Filter the search by action. Search for an exact match"},"action.keyword":{"type":"string","title":"Filter the search by action.keyword. Search for the matches that contain the value"},"not.action":{"type":"string","title":"Filter the search by not.action. Search for the matches that are not equal to the value"},"not.action.keyword":{"type":"string","title":"Filter the search by not.action.keyword. Search for the matches that doesnt contain the value"},"log.policy_id":{"type":"string","title":"Filter the search by log.policy_id. Search for an exact match"},"log.policy_id.keyword":{"type":"string","title":"Filter the search by log.policy_id.keyword. Search for the matches that contain the value"},"not.log.policy_id":{"type":"string","title":"Filter the search by not.log.policy_id. Search for the matches that are not equal to the value"},"not.log.policy_id.keyword":{"type":"string","title":"Filter the search by not.log.policy_id.keyword. Search for the matches that doesnt contain the value"},"log.policy":{"type":"string","title":"Filter the search by log.policy. Search for an exact match"},"log.policy.keyword":{"type":"string","title":"Filter the search by log.policy.keyword. Search for the matches that contain the value"},"not.log.policy":{"type":"string","title":"Filter the search by not.log.policy. Search for the matches that are not equal to the value"},"not.log.policy.keyword":{"type":"string","title":"Filter the search by not.log.policy.keyword. Search for the matches that doesnt contain the value"},"log.protocol":{"type":"string","title":"Filter the search by log.protocol. Search for an exact match"},"log.protocol.keyword":{"type":"string","title":"Filter the search by log.protocol.keyword. Search for the matches that contain the value"},"not.log.protocol":{"type":"string","title":"Filter the search by not.log.protocol. Search for the matches that are not equal to the value"},"not.log.protocol.keyword":{"type":"string","title":"Filter the search by not.log.protocol.keyword. Search for the matches that doesnt contain the value"},"log.query_name":{"type":"string","title":"Filter the search by log.query_name. Search for an exact match"},"log.query_name.keyword":{"type":"string","title":"Filter the search by log.query_name.keyword. Search for the matches that contain the value"},"not.log.query_name":{"type":"string","title":"Filter the search by not.log.query_name. Search for the matches that are not equal to the value"},"not.log.query_name.keyword":{"type":"string","title":"Filter the search by not.log.query_name.keyword. Search for the matches that doesnt contain the value"},"log.query_name_reversed":{"type":"string","title":"Filter the search by log.query_name_reversed. Search for an exact match"},"log.query_name_reversed.keyword":{"type":"string","title":"Filter the search by log.query_name_reversed.keyword. Search for the matches that contain the value"},"not.log.query_name_reversed":{"type":"string","title":"Filter the search by not.log.query_name_reversed. Search for the matches that are not equal to the value"},"not.log.query_name_reversed.keyword":{"type":"string","title":"Filter the search by not.log.query_name_reversed.keyword. Search for the matches that doesnt contain the value"},"log.resolver_decision":{"type":"string","title":"Filter the search by log.resolver_decision. Search for an exact match"},"log.resolver_decision.keyword":{"type":"string","title":"Filter the search by log.resolver_decision.keyword. Search for the matches that contain the value"},"not.log.resolver_decision":{"type":"string","title":"Filter the search by not.log.resolver_decision. Search for the matches that are not equal to the value"},"not.log.resolver_decision.keyword":{"type":"string","title":"Filter the search by not.log.resolver_decision.keyword. Search for the matches that doesnt contain the value"},"log.user_id":{"type":"string","title":"Filter the search by log.user_id. Search for an exact match"},"log.user_id.keyword":{"type":"string","title":"Filter the search by log.user_id.keyword. Search for the matches that contain the value"},"not.log.user_id":{"type":"string","title":"Filter the search by not.log.user_id. Search for the matches that are not equal to the value"},"not.log.user_id.keyword":{"type":"string","title":"Filter the search by not.log.user_id.keyword. Search for the matches that doesnt contain the value"},"log.colo_id":{"type":"number","title":"Filter the search by log.colo_id. Search for an exact match of the integer value"},"log.colo_id_lt":{"type":"number","title":"Filter the search by log.colo_id_lt. Search for the documents that are less than the value"},"log.colo_id_lte":{"type":"number","title":"Filter the search by log.colo_id_lte. Search for the documents that are less or equal than the value"},"log.colo_id_gt":{"type":"number","title":"Filter the search by log.colo_id_gt. Search for the documents that are greater than the value"},"log.colo_id_gte":{"type":"number","title":"Filter the search by log.colo_id_gte. Search for the documents that are greater or equal than the value"},"log.dst_port":{"type":"number","title":"Filter the search by log.dst_port. Search for an exact match of the integer value"},"log.dst_port_lt":{"type":"number","title":"Filter the search by log.dst_port_lt. Search for the documents that are less than the value"},"log.dst_port_lte":{"type":"number","title":"Filter the search by log.dst_port_lte. Search for the documents that are less or equal than the value"},"log.dst_port_gt":{"type":"number","title":"Filter the search by log.dst_port_gt. Search for the documents that are greater than the value"},"log.dst_port_gte":{"type":"number","title":"Filter the search by log.dst_port_gte. Search for the documents that are greater or equal than the value"},"log.query_category_ids":{"type":"array","items":{"type":"number"},"title":"Filter the search by log.query_category_ids. Search for an exact match of the integer value"},"log.query_size":{"type":"number","title":"Filter the search by log.query_size. Search for an exact match of the integer value"},"log.query_size_lt":{"type":"number","title":"Filter the search by log.query_size_lt. Search for the documents that are less than the value"},"log.query_size_lte":{"type":"number","title":"Filter the search by log.query_size_lte. Search for the documents that are less or equal than the value"},"log.query_size_gt":{"type":"number","title":"Filter the search by log.query_size_gt. Search for the documents that are greater than the value"},"log.query_size_gte":{"type":"number","title":"Filter the search by log.query_size_gte. Search for the documents that are greater or equal than the value"},"log.query_type":{"type":"number","title":"Filter the search by log.query_type. Search for an exact match of the integer value"},"log.query_type_lt":{"type":"number","title":"Filter the search by log.query_type_lt. Search for the documents that are less than the value"},"log.query_type_lte":{"type":"number","title":"Filter the search by log.query_type_lte. Search for the documents that are less or equal than the value"},"log.query_type_gt":{"type":"number","title":"Filter the search by log.query_type_gt. Search for the documents that are greater than the value"},"log.query_type_gte":{"type":"number","title":"Filter the search by log.query_type_gte. Search for the documents that are greater or equal than the value"},"log.src_port":{"type":"number","title":"Filter the search by log.src_port. Search for an exact match of the integer value"},"log.src_port_lt":{"type":"number","title":"Filter the search by log.src_port_lt. Search for the documents that are less than the value"},"log.src_port_lte":{"type":"number","title":"Filter the search by log.src_port_lte. Search for the documents that are less or equal than the value"},"log.src_port_gt":{"type":"number","title":"Filter the search by log.src_port_gt. Search for the documents that are greater than the value"},"log.src_port_gte":{"type":"number","title":"Filter the search by log.src_port_gte. Search for the documents that are greater or equal than the value"},"log.datetime_before":{"type":"string","format":"date-time","title":"Filter the search by log.datetime_before. Search for the documents that are after the given timestamp"},"log.datetime_after":{"type":"string","format":"date-time","title":"Filter the search by log.datetime_after. "},"timestamp_before":{"type":"string","format":"date-time","title":"Filter the search by timestamp_before. Search for the documents that are after the given timestamp"},"timestamp_after":{"type":"string","format":"date-time","title":"Filter the search by timestamp_after. "},"log.dst_ip":{"type":"string","format":"ipv4","title":"Filter the search by log.dst_ip. Search for an exact match"},"not.log.dst_ip":{"type":"string","format":"ipv4","title":"Filter the search by not.log.dst_ip. Search for the matches that are not equal to the value"},"log.src_ip":{"type":"string","format":"ipv4","title":"Filter the search by log.src_ip. Search for an exact match"},"not.log.src_ip":{"type":"string","format":"ipv4","title":"Filter the search by not.log.src_ip. Search for the matches that are not equal to the value"},"resolved_ips":{"type":"string","title":"Filter the search by resolved_ips. Search for an exact match"},"not.resolved_ips":{"type":"string","title":"Filter the search by not.resolved_ips. Search for the matches that are not equal to the value"},"sort_field":{"type":"string","title":"Sort field","enum":["machine_id","group_id","group_name","rule_id","rule_name","resolved_ips","policy_id","policy_name","account_id","parent_account_id","action","log.policy_id","log.policy","log.protocol","log.query_name","log.query_name_reversed","log.resolver_decision","log.user_id","log.colo_id","log.dst_port","log.query_category_ids","log.query_size","log.query_type","log.src_port","log.dst_ip","log.src_ip","timestamp","log.datetime","agent.at","agent.last_user","agent.fully_qualified_host_name","agent.started_at_local","agent.started_at_offset","agent.os_info.os_type","agent.os_info.os_version","agent.os_info.os_platform","agent.os_info.os_architecture","agent.os_info.os_release_name","agent.domain_name","agent.engine_version","agent.policy_etag","agent.host_name","agent.nics.ips","agent.nics.mac_address","machine.tags.alias","agent.has_alerts","agent.machine_ip","agent.object_guid","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.source_location.city","agent.source_location.country","agent.source_location.country_iso","agent.source_location.continent","agent.source_location.time_zone","agent.source_location.postal_code","agent.source_location.subdivisions","agent.source_location.anonymous_proxy","agent.serial_number","active_directory.user.display_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.machine.display_name","active_directory.machine.sam_account_name","active_directory.machine.ou"]},"populate":{"type":"object","title":"Populate object schema","properties":{"group":{"type":"boolean","title":"Populates group data (group name, policy name, policy id)"},"endpoint":{"type":"boolean","title":"Populate with the endpoint data (last day seen, last user)"}}},"sort_order":{"type":"string","title":"Sorting direction","default":"asc","enum":["asc","desc"]},"page_size":{"type":"number","title":"The size of the page. If you only need aggregations, set it to 0","minimum":0,"default":50,"maximum":2000},"aggregations":{"type":"array","title":"The Aggregations Schema","items":{"type":"string","title":"Aggregations","default":[],"enum":["machine_id","group_id","rule_id","rule_name","resolved_ips","group_name","policy_id","policy_name","account_id","parent_account_id","action","log.policy_id","log.policy","log.protocol","log.query_name","log.query_name_reversed","log.resolver_decision","log.user_id","log.colo_id","log.dst_port","log.query_category_ids","log.query_size","log.query_type","log.src_port","log.dst_ip","log.src_ip","timestamp","log.datetime","agent.at","agent.last_user","agent.fully_qualified_host_name","agent.started_at_local","agent.started_at_offset","agent.os_info.os_type","agent.os_info.os_version","agent.os_info.os_platform","agent.os_info.os_architecture","agent.os_info.os_release_name","agent.domain_name","agent.engine_version","agent.policy_etag","agent.host_name","agent.nics.ips","agent.nics.mac_address","machine.tags.alias","agent.has_alerts","agent.machine_ip","agent.object_guid","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.source_location.city","agent.source_location.country","agent.source_location.country_iso","agent.source_location.continent","agent.source_location.time_zone","agent.source_location.postal_code","agent.source_location.subdivisions","agent.source_location.anonymous_proxy","agent.serial_number","daily_logs"]}},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}},{"type":"object","required":["account_ids"],"properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]}}}}}}},"responses":{"200":{"description":"Successful response"}},"tags":["DNS"],"operationId":"api.v2.rmm.post.export.dns"}},"/oneview/v1/dns/export/async":{"post":{"description":"Export DNS Logs asynchronously","summary":"Export DNS Logs asynchronously","security":[{"client_credentials":["execute"]},{"user_permissions":["dnsFiltering.view"]}],"status":{"outage":["auth","search_stateless"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Export request","allOf":[{"type":"object","title":"Export request","required":["groups","select","format"],"properties":{"format":{"type":"string","title":"The output file","enum":["csv","xlsx","html","ods","txt","rtf","json"]},"download":{"type":"boolean","title":"Whether to instruct the client to download the response as a file. Only clients like browsers are supported"},"type":{"type":"string","title":"The encoding of the output","enum":["string","base64","binary"],"default":"string"},"select":{"type":"array","title":"Which fields to select from the response","items":{"type":"object","title":"Field","required":["field","newField"],"properties":{"newField":{"type":"string","title":"the new value"},"field":{"type":"string","title":"The response field to map to a new value","enum":["rule_id","rule_name","resolved_ips","machine_id","group_id","group_name","account_name","machine_name","policy_id","policy_name","account_id","parent_account_id","action","log.policy_id","log.policy","log.protocol","log.query_name","log.query_name_reversed","log.resolver_decision","log.user_id","log.colo_id","log.dst_port","log.query_category_ids","log.query_size","log.query_type","log.src_port","log.dst_ip","log.src_ip","timestamp","log.datetime","agent.at","agent.last_user","agent.fully_qualified_host_name","agent.started_at_local","agent.started_at_offset","agent.os_info.os_type","agent.os_info.os_version","agent.os_info.os_platform","agent.os_info.os_architecture","agent.os_info.os_release_name","agent.domain_name","agent.engine_version","agent.policy_etag","agent.host_name","agent.nics.ips","agent.nics.mac_address","machine.tags.alias","agent.has_alerts","agent.machine_ip","agent.object_guid","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.source_location.city","agent.source_location.country","agent.source_location.country_iso","agent.source_location.continent","agent.source_location.time_zone","agent.source_location.postal_code","agent.source_location.subdivisions","agent.source_location.anonymous_proxy","agent.serial_number","active_directory.user.display_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.machine.display_name","active_directory.machine.sam_account_name","active_directory.machine.ou"]}}}},"groups":{"type":"array","title":"List of queries","items":{"type":"object","title":"Query to fetch DNS Logs","allOf":[{"type":"object","title":"Search DNS Logs request. Leading wildcards are not supported for constraint fields without '.keyword' suffix.","allOf":[{"type":"object","title":"Agent constraints","description":"The Agents constraints.","properties":{"nics.mac_address":{"type":"string","title":"nics.mac_address"},"not.nics.mac_address":{"type":"string","title":"not.nics.mac_address"},"nics.mac_address.keyword":{"type":"string","title":"nics.mac_address.keyword"},"not.nics.mac_address.keyword":{"type":"string","title":"not.nics.mac_address.keyword"},"nics.description":{"type":"string","title":"nics.description"},"not.nics.description":{"type":"string","title":"not.nics.description"},"nics.description.keyword":{"type":"string","title":"nics.description.keyword"},"not.nics.description.keyword":{"type":"string","title":"not.nics.description.keyword"},"os_info.os_type":{"type":"string","title":"os_info.os_type"},"not.os_info.os_type":{"type":"string","title":"not.os_info.os_type"},"os_info.os_type.keyword":{"type":"string","title":"os_info.os_type.keyword"},"not.os_info.os_type.keyword":{"type":"string","title":"not.os_info.os_type.keyword"},"os_info.os_version":{"type":"string","title":"os_info.os_version"},"not.os_info.os_version":{"type":"string","title":"not.os_info.os_version"},"os_info.os_version.keyword":{"type":"string","title":"os_info.os_version.keyword"},"not.os_info.os_version.keyword":{"type":"string","title":"not.os_info.os_version.keyword"},"os_info.os_platform":{"type":"string","title":"os_info.os_platform"},"not.os_info.os_platform":{"type":"string","title":"not.os_info.os_platform"},"os_info.os_platform.keyword":{"type":"string","title":"os_info.os_platform.keyword"},"not.os_info.os_platform.keyword":{"type":"string","title":"not.os_info.os_platform.keyword"},"os_info.os_architecture":{"type":"string","title":"os_info.os_architecture"},"not.os_info.os_architecture":{"type":"string","title":"not.os_info.os_architecture"},"os_info.os_architecture.keyword":{"type":"string","title":"os_info.os_architecture.keyword"},"not.os_info.os_architecture.keyword":{"type":"string","title":"not.os_info.os_architecture.keyword"},"os_info.os_release_name":{"type":"string","title":"os_info.os_release_name"},"not.os_info.os_release_name":{"type":"string","title":"not.os_info.os_release_name"},"os_info.os_release_name.keyword":{"type":"string","title":"os_info.os_release_name.keyword"},"not.os_info.os_release_name.keyword":{"type":"string","title":"not.os_info.os_release_name.keyword"},"host_name":{"type":"string","title":"host_name"},"not.host_name":{"type":"string","title":"not.host_name"},"host_name.keyword":{"type":"string","title":"host_name.keyword"},"not.host_name.keyword":{"type":"string","title":"not.host_name.keyword"},"fully_qualified_host_name":{"type":"string","title":"fully_qualified_host_name"},"not.fully_qualified_host_name":{"type":"string","title":"not.fully_qualified_host_name"},"fully_qualified_host_name.keyword":{"type":"string","title":"fully_qualified_host_name.keyword"},"not.fully_qualified_host_name.keyword":{"type":"string","title":"not.fully_qualified_host_name.keyword"},"plugins.asset_manager.plugin_version":{"type":"string","title":"plugins.asset_manager.plugin_version"},"not.plugins.asset_manager.plugin_version":{"type":"string","title":"not.plugins.asset_manager.plugin_version"},"plugins.asset_manager.plugin_version.keyword":{"type":"string","title":"plugins.asset_manager.plugin_version.keyword"},"not.plugins.asset_manager.plugin_version.keyword":{"type":"string","title":"not.plugins.asset_manager.plugin_version.keyword"},"plugins.asset_manager.reboot_reasons":{"type":"string","title":"plugins.asset_manager.reboot_reasons"},"not.plugins.asset_manager.reboot_reasons":{"type":"string","title":"not.plugins.asset_manager.reboot_reasons"},"plugins.asset_manager.reboot_reasons.keyword":{"type":"string","title":"plugins.asset_manager.reboot_reasons.keyword"},"not.plugins.asset_manager.reboot_reasons.keyword":{"type":"string","title":"not.plugins.asset_manager.reboot_reasons.keyword"},"plugins.endpoint_protection.plugin_version":{"type":"string","title":"plugins.endpoint_protection.plugin_version"},"not.plugins.endpoint_protection.plugin_version":{"type":"string","title":"not.plugins.endpoint_protection.plugin_version"},"plugins.endpoint_protection.plugin_version.keyword":{"type":"string","title":"plugins.endpoint_protection.plugin_version.keyword"},"not.plugins.endpoint_protection.plugin_version.keyword":{"type":"string","title":"not.plugins.endpoint_protection.plugin_version.keyword"},"plugins.endpoint_protection.sdk_version":{"type":"string","title":"plugins.endpoint_protection.sdk_version"},"not.plugins.endpoint_protection.sdk_version":{"type":"string","title":"not.plugins.endpoint_protection.sdk_version"},"plugins.endpoint_protection.sdk_version.keyword":{"type":"string","title":"plugins.endpoint_protection.sdk_version.keyword"},"not.plugins.endpoint_protection.sdk_version.keyword":{"type":"string","title":"not.plugins.endpoint_protection.sdk_version.keyword"},"plugins.endpoint_protection.component_package_version":{"type":"string","title":"plugins.endpoint_protection.component_package_version"},"not.plugins.endpoint_protection.component_package_version":{"type":"string","title":"not.plugins.endpoint_protection.component_package_version"},"plugins.endpoint_protection.component_package_version.keyword":{"type":"string","title":"plugins.endpoint_protection.component_package_version.keyword"},"not.plugins.endpoint_protection.component_package_version.keyword":{"type":"string","title":"not.plugins.endpoint_protection.component_package_version.keyword"},"plugins.endpoint_protection.update_package_version":{"type":"string","title":"plugins.endpoint_protection.update_package_version"},"not.plugins.endpoint_protection.update_package_version":{"type":"string","title":"not.plugins.endpoint_protection.update_package_version"},"plugins.endpoint_protection.update_package_version.keyword":{"type":"string","title":"plugins.endpoint_protection.update_package_version.keyword"},"not.plugins.endpoint_protection.update_package_version.keyword":{"type":"string","title":"not.plugins.endpoint_protection.update_package_version.keyword"},"plugins.endpoint_protection.reboot_reasons":{"type":"string","title":"plugins.endpoint_protection.reboot_reasons"},"not.plugins.endpoint_protection.reboot_reasons":{"type":"string","title":"not.plugins.endpoint_protection.reboot_reasons"},"plugins.endpoint_protection.reboot_reasons.keyword":{"type":"string","title":"plugins.endpoint_protection.reboot_reasons.keyword"},"not.plugins.endpoint_protection.reboot_reasons.keyword":{"type":"string","title":"not.plugins.endpoint_protection.reboot_reasons.keyword"},"plugins.endpoint_detection_and_response.plugin_version":{"type":"string","title":"plugins.endpoint_detection_and_response.plugin_version"},"not.plugins.endpoint_detection_and_response.plugin_version":{"type":"string","title":"not.plugins.endpoint_detection_and_response.plugin_version"},"plugins.endpoint_detection_and_response.plugin_version.keyword":{"type":"string","title":"plugins.endpoint_detection_and_response.plugin_version.keyword"},"not.plugins.endpoint_detection_and_response.plugin_version.keyword":{"type":"string","title":"not.plugins.endpoint_detection_and_response.plugin_version.keyword"},"plugins.endpoint_detection_and_response.reboot_reasons":{"type":"string","title":"plugins.endpoint_detection_and_response.reboot_reasons"},"not.plugins.endpoint_detection_and_response.reboot_reasons":{"type":"string","title":"not.plugins.endpoint_detection_and_response.reboot_reasons"},"plugins.endpoint_detection_and_response.reboot_reasons.keyword":{"type":"string","title":"plugins.endpoint_detection_and_response.reboot_reasons.keyword"},"not.plugins.endpoint_detection_and_response.reboot_reasons.keyword":{"type":"string","title":"not.plugins.endpoint_detection_and_response.reboot_reasons.keyword"},"plugins.incident_response.plugin_version":{"type":"string","title":"plugins.incident_response.plugin_version"},"not.plugins.incident_response.plugin_version":{"type":"string","title":"not.plugins.incident_response.plugin_version"},"plugins.incident_response.plugin_version.keyword":{"type":"string","title":"plugins.incident_response.plugin_version.keyword"},"not.plugins.incident_response.plugin_version.keyword":{"type":"string","title":"not.plugins.incident_response.plugin_version.keyword"},"plugins.incident_response.reboot_reasons":{"type":"string","title":"plugins.incident_response.reboot_reasons"},"not.plugins.incident_response.reboot_reasons":{"type":"string","title":"not.plugins.incident_response.reboot_reasons"},"plugins.incident_response.reboot_reasons.keyword":{"type":"string","title":"plugins.incident_response.reboot_reasons.keyword"},"not.plugins.incident_response.reboot_reasons.keyword":{"type":"string","title":"not.plugins.incident_response.reboot_reasons.keyword"},"plugins.siem.plugin_version":{"type":"string","title":"plugins.siem.plugin_version"},"not.plugins.siem.plugin_version":{"type":"string","title":"not.plugins.siem.plugin_version"},"plugins.siem.plugin_version.keyword":{"type":"string","title":"plugins.siem.plugin_version.keyword"},"not.plugins.siem.plugin_version.keyword":{"type":"string","title":"not.plugins.siem.plugin_version.keyword"},"plugins.browser_phishing_protection.plugin_version":{"type":"string","title":"plugins.browser_phishing_protection.plugin_version"},"not.plugins.browser_phishing_protection.plugin_version":{"type":"string","title":"not.plugins.browser_phishing_protection.plugin_version"},"plugins.browser_phishing_protection.plugin_version.keyword":{"type":"string","title":"plugins.browser_phishing_protection.plugin_version.keyword"},"not.plugins.browser_phishing_protection.plugin_version.keyword":{"type":"string","title":"not.plugins.browser_phishing_protection.plugin_version.keyword"},"plugins.browser_phishing_protection.reboot_reasons":{"type":"string","title":"plugins.browser_phishing_protection.reboot_reasons"},"not.plugins.browser_phishing_protection.reboot_reasons":{"type":"string","title":"not.plugins.browser_phishing_protection.reboot_reasons"},"plugins.browser_phishing_protection.reboot_reasons.keyword":{"type":"string","title":"plugins.browser_phishing_protection.reboot_reasons.keyword"},"not.plugins.browser_phishing_protection.reboot_reasons.keyword":{"type":"string","title":"not.plugins.browser_phishing_protection.reboot_reasons.keyword"},"plugins.siem.reboot_reasons":{"type":"string","title":"plugins.siem.reboot_reasons"},"not.plugins.siem.reboot_reasons":{"type":"string","title":"not.plugins.siem.reboot_reasons"},"plugins.siem.reboot_reasons.keyword":{"type":"string","title":"plugins.siem.reboot_reasons.keyword"},"not.plugins.siem.reboot_reasons.keyword":{"type":"string","title":"not.plugins.siem.reboot_reasons.keyword"},"engine_version":{"type":"string","title":"engine_version"},"not.engine_version":{"type":"string","title":"not.engine_version"},"engine_version.keyword":{"type":"string","title":"engine_version.keyword"},"not.engine_version.keyword":{"type":"string","title":"not.engine_version.keyword"},"domain_name":{"type":"string","title":"domain_name"},"not.domain_name":{"type":"string","title":"not.domain_name"},"domain_name.keyword":{"type":"string","title":"domain_name.keyword"},"not.domain_name.keyword":{"type":"string","title":"not.domain_name.keyword"},"policy_etag":{"type":"string","title":"policy_etag"},"not.policy_etag":{"type":"string","title":"not.policy_etag"},"policy_etag.keyword":{"type":"string","title":"policy_etag.keyword"},"not.policy_etag.keyword":{"type":"string","title":"not.policy_etag.keyword"},"last_user":{"type":"string","title":"last_user"},"not.last_user":{"type":"string","title":"not.last_user"},"last_user.keyword":{"type":"string","title":"last_user.keyword"},"not.last_user.keyword":{"type":"string","title":"not.last_user.keyword"},"serial_number":{"type":"string","title":"serial_number"},"not.serial_number":{"type":"string","title":"not.serial_number"},"serial_number.keyword":{"type":"string","title":"serial_number.keyword"},"not.serial_number.keyword":{"type":"string","title":"not.serial_number.keyword"}}},{"type":"object","title":"Active Directory Search Filters","properties":{"active_directory.user.display_name":{"type":"string","title":"Filter the search by active_directory.user.display_name. Search for the matches that are equal to the value"},"active_directory.user.display_name.keyword":{"type":"string","title":"Filter the search by active_directory.user.display_name.keyword. Search for the matches that contain the value"},"active_directory.user.ou":{"type":"string","title":"Filter the search by active_directory.user.ou. Search for the matches that are equal to the value"},"active_directory.user.ou.keyword":{"type":"string","title":"Filter the search by active_directory.user.ou.keyword. Search for the matches that contain the value"},"active_directory.user.ou.path":{"type":"string","title":"Filter the search by active_directory.user.ou.path. Search for the matches that are equal to the value"},"active_directory.user.ou.path.keyword":{"type":"string","title":"Filter the search by active_directory.user.ou.path.keyword. Search for the matches that contain the value"},"active_directory.user.sam_account_name":{"type":"string","title":"Filter the search by active_directory.user.sam_account_name. Search for the matches that are equal to the value"},"active_directory.user.sam_account_name.keyword":{"type":"string","title":"Filter the search by active_directory.user.sam_account_name.keyword. Search for the matches that contain the value"},"active_directory.machine.display_name":{"type":"string","title":"Filter the search by active_directory.machine.display_name. Search for the matches that are equal to the value"},"active_directory.machine.display_name.keyword":{"type":"string","title":"Filter the search by active_directory.machine.display_name.keyword. Search for the matches that contain the value"},"active_directory.machine.ou":{"type":"string","title":"Filter the search by active_directory.machine.ou. Search for the matches that are equal to the value"},"active_directory.machine.ou.keyword":{"type":"string","title":"Filter the search by active_directory.machine.ou.keyword. Search for the matches that contain the value"},"active_directory.machine.ou.path":{"type":"string","title":"Filter the search by active_directory.machine.ou.path. Search for the matches that are equal to the value"},"active_directory.machine.ou.path.keyword":{"type":"string","title":"Filter the search by active_directory.machine.ou.path.keyword. Search for the matches that contain the value"},"active_directory.machine.sam_account_name":{"type":"string","title":"Filter the search by active_directory.machine.sam_account_name. Search for the matches that are equal to the value"},"active_directory.machine.sam_account_name.keyword":{"type":"string","title":"Filter the search by active_directory.machine.sam_account_name.keyword. Search for the matches that contain the value"}}}],"properties":{"id":{"type":"string","title":"Filter the search by DNS event id. Search for an exact match"},"not.id":{"type":"string","title":"Filter the search by not.id. Search for the matches that are not equal to the value"},"machine_id":{"type":"string","title":"Filter the search by machine_id. Search for an exact match"},"machine_id.keyword":{"type":"string","title":"Filter the search by machine_id.keyword. Search for the matches that contain the value"},"not.machine_id":{"type":"string","title":"Filter the search by not.machine_id. Search for the matches that are not equal to the value"},"not.machine_id.keyword":{"type":"string","title":"Filter the search by not.machine_id.keyword. Search for the matches that doesnt contain the value"},"group_id":{"type":"string","title":"Filter the search by group_id. Search for an exact match"},"group_id.keyword":{"type":"string","title":"Filter the search by group_id.keyword. Search for the matches that contain the value"},"not.group_id":{"type":"string","title":"Filter the search by not.group_id. Search for the matches that are not equal to the value"},"not.group_id.keyword":{"type":"string","title":"Filter the search by not.group_id.keyword. Search for the matches that doesnt contain the value"},"group_name":{"type":"string","title":"Filter the search by group_name. Search for an exact match"},"group_name.keyword":{"type":"string","title":"Filter the search by group_name.keyword. Search for the matches that contain the value"},"not.group_name":{"type":"string","title":"Filter the search by not.group_name. Search for the matches that are not equal to the value"},"not.group_name.keyword":{"type":"string","title":"Filter the search by not.group_name.keyword. Search for the matches that doesnt contain the value"},"rule_id":{"type":"string","title":"Filter the search by rule_id. Search for an exact match"},"rule_id.keyword":{"type":"string","title":"Filter the search by rule_id.keyword. Search for the matches that contain the value"},"not.rule_id":{"type":"string","title":"Filter the search by not.rule_id. Search for the matches that are not equal to the value"},"not.rule_id.keyword":{"type":"string","title":"Filter the search by not.rule_id.keyword. Search for the matches that doesnt contain the value"},"rule_name":{"type":"string","title":"Filter the search by rule_name. Search for an exact match"},"rule_name.keyword":{"type":"string","title":"Filter the search by rule_name.keyword. Search for the matches that contain the value"},"not.rule_name":{"type":"string","title":"Filter the search by not.rule_name. Search for the matches that are not equal to the value"},"not.rule_name.keyword":{"type":"string","title":"Filter the search by not.rule_name.keyword. Search for the matches that doesnt contain the value"},"policy_id":{"type":"string","title":"Filter the search by policy_id. Search for an exact match"},"policy_id.keyword":{"type":"string","title":"Filter the search by policy_id.keyword. Search for the matches that contain the value"},"not.policy_id":{"type":"string","title":"Filter the search by not.policy_id. Search for the matches that are not equal to the value"},"not.policy_id.keyword":{"type":"string","title":"Filter the search by not.policy_id.keyword. Search for the matches that doesnt contain the value"},"policy_name":{"type":"string","title":"Filter the search by policy_name. Search for an exact match"},"policy_name.keyword":{"type":"string","title":"Filter the search by policy_name.keyword. Search for the matches that contain the value"},"not.policy_name":{"type":"string","title":"Filter the search by not.policy_name. Search for the matches that are not equal to the value"},"not.policy_name.keyword":{"type":"string","title":"Filter the search by not.policy_name.keyword. Search for the matches that doesnt contain the value"},"account_id":{"type":"string","title":"Filter the search by account_id. Search for an exact match"},"account_id.keyword":{"type":"string","title":"Filter the search by account_id.keyword. Search for the matches that contain the value"},"not.account_id":{"type":"string","title":"Filter the search by not.account_id. Search for the matches that are not equal to the value"},"not.account_id.keyword":{"type":"string","title":"Filter the search by not.account_id.keyword. Search for the matches that doesnt contain the value"},"parent_account_id":{"type":"string","title":"Filter the search by parent_account_id. Search for an exact match"},"parent_account_id.keyword":{"type":"string","title":"Filter the search by parent_account_id.keyword. Search for the matches that contain the value"},"not.parent_account_id":{"type":"string","title":"Filter the search by not.parent_account_id. Search for the matches that are not equal to the value"},"not.parent_account_id.keyword":{"type":"string","title":"Filter the search by not.parent_account_id.keyword. Search for the matches that doesnt contain the value"},"action":{"type":"string","title":"Filter the search by action. Search for an exact match"},"action.keyword":{"type":"string","title":"Filter the search by action.keyword. Search for the matches that contain the value"},"not.action":{"type":"string","title":"Filter the search by not.action. Search for the matches that are not equal to the value"},"not.action.keyword":{"type":"string","title":"Filter the search by not.action.keyword. Search for the matches that doesnt contain the value"},"log.policy_id":{"type":"string","title":"Filter the search by log.policy_id. Search for an exact match"},"log.policy_id.keyword":{"type":"string","title":"Filter the search by log.policy_id.keyword. Search for the matches that contain the value"},"not.log.policy_id":{"type":"string","title":"Filter the search by not.log.policy_id. Search for the matches that are not equal to the value"},"not.log.policy_id.keyword":{"type":"string","title":"Filter the search by not.log.policy_id.keyword. Search for the matches that doesnt contain the value"},"log.policy":{"type":"string","title":"Filter the search by log.policy. Search for an exact match"},"log.policy.keyword":{"type":"string","title":"Filter the search by log.policy.keyword. Search for the matches that contain the value"},"not.log.policy":{"type":"string","title":"Filter the search by not.log.policy. Search for the matches that are not equal to the value"},"not.log.policy.keyword":{"type":"string","title":"Filter the search by not.log.policy.keyword. Search for the matches that doesnt contain the value"},"log.protocol":{"type":"string","title":"Filter the search by log.protocol. Search for an exact match"},"log.protocol.keyword":{"type":"string","title":"Filter the search by log.protocol.keyword. Search for the matches that contain the value"},"not.log.protocol":{"type":"string","title":"Filter the search by not.log.protocol. Search for the matches that are not equal to the value"},"not.log.protocol.keyword":{"type":"string","title":"Filter the search by not.log.protocol.keyword. Search for the matches that doesnt contain the value"},"log.query_name":{"type":"string","title":"Filter the search by log.query_name. Search for an exact match"},"log.query_name.keyword":{"type":"string","title":"Filter the search by log.query_name.keyword. Search for the matches that contain the value"},"not.log.query_name":{"type":"string","title":"Filter the search by not.log.query_name. Search for the matches that are not equal to the value"},"not.log.query_name.keyword":{"type":"string","title":"Filter the search by not.log.query_name.keyword. Search for the matches that doesnt contain the value"},"log.query_name_reversed":{"type":"string","title":"Filter the search by log.query_name_reversed. Search for an exact match"},"log.query_name_reversed.keyword":{"type":"string","title":"Filter the search by log.query_name_reversed.keyword. Search for the matches that contain the value"},"not.log.query_name_reversed":{"type":"string","title":"Filter the search by not.log.query_name_reversed. Search for the matches that are not equal to the value"},"not.log.query_name_reversed.keyword":{"type":"string","title":"Filter the search by not.log.query_name_reversed.keyword. Search for the matches that doesnt contain the value"},"log.resolver_decision":{"type":"string","title":"Filter the search by log.resolver_decision. Search for an exact match"},"log.resolver_decision.keyword":{"type":"string","title":"Filter the search by log.resolver_decision.keyword. Search for the matches that contain the value"},"not.log.resolver_decision":{"type":"string","title":"Filter the search by not.log.resolver_decision. Search for the matches that are not equal to the value"},"not.log.resolver_decision.keyword":{"type":"string","title":"Filter the search by not.log.resolver_decision.keyword. Search for the matches that doesnt contain the value"},"log.user_id":{"type":"string","title":"Filter the search by log.user_id. Search for an exact match"},"log.user_id.keyword":{"type":"string","title":"Filter the search by log.user_id.keyword. Search for the matches that contain the value"},"not.log.user_id":{"type":"string","title":"Filter the search by not.log.user_id. Search for the matches that are not equal to the value"},"not.log.user_id.keyword":{"type":"string","title":"Filter the search by not.log.user_id.keyword. Search for the matches that doesnt contain the value"},"log.colo_id":{"type":"number","title":"Filter the search by log.colo_id. Search for an exact match of the integer value"},"log.colo_id_lt":{"type":"number","title":"Filter the search by log.colo_id_lt. Search for the documents that are less than the value"},"log.colo_id_lte":{"type":"number","title":"Filter the search by log.colo_id_lte. Search for the documents that are less or equal than the value"},"log.colo_id_gt":{"type":"number","title":"Filter the search by log.colo_id_gt. Search for the documents that are greater than the value"},"log.colo_id_gte":{"type":"number","title":"Filter the search by log.colo_id_gte. Search for the documents that are greater or equal than the value"},"log.dst_port":{"type":"number","title":"Filter the search by log.dst_port. Search for an exact match of the integer value"},"log.dst_port_lt":{"type":"number","title":"Filter the search by log.dst_port_lt. Search for the documents that are less than the value"},"log.dst_port_lte":{"type":"number","title":"Filter the search by log.dst_port_lte. Search for the documents that are less or equal than the value"},"log.dst_port_gt":{"type":"number","title":"Filter the search by log.dst_port_gt. Search for the documents that are greater than the value"},"log.dst_port_gte":{"type":"number","title":"Filter the search by log.dst_port_gte. Search for the documents that are greater or equal than the value"},"log.query_category_ids":{"type":"array","items":{"type":"number"},"title":"Filter the search by log.query_category_ids. Search for an exact match of the integer value"},"log.query_size":{"type":"number","title":"Filter the search by log.query_size. Search for an exact match of the integer value"},"log.query_size_lt":{"type":"number","title":"Filter the search by log.query_size_lt. Search for the documents that are less than the value"},"log.query_size_lte":{"type":"number","title":"Filter the search by log.query_size_lte. Search for the documents that are less or equal than the value"},"log.query_size_gt":{"type":"number","title":"Filter the search by log.query_size_gt. Search for the documents that are greater than the value"},"log.query_size_gte":{"type":"number","title":"Filter the search by log.query_size_gte. Search for the documents that are greater or equal than the value"},"log.query_type":{"type":"number","title":"Filter the search by log.query_type. Search for an exact match of the integer value"},"log.query_type_lt":{"type":"number","title":"Filter the search by log.query_type_lt. Search for the documents that are less than the value"},"log.query_type_lte":{"type":"number","title":"Filter the search by log.query_type_lte. Search for the documents that are less or equal than the value"},"log.query_type_gt":{"type":"number","title":"Filter the search by log.query_type_gt. Search for the documents that are greater than the value"},"log.query_type_gte":{"type":"number","title":"Filter the search by log.query_type_gte. Search for the documents that are greater or equal than the value"},"log.src_port":{"type":"number","title":"Filter the search by log.src_port. Search for an exact match of the integer value"},"log.src_port_lt":{"type":"number","title":"Filter the search by log.src_port_lt. Search for the documents that are less than the value"},"log.src_port_lte":{"type":"number","title":"Filter the search by log.src_port_lte. Search for the documents that are less or equal than the value"},"log.src_port_gt":{"type":"number","title":"Filter the search by log.src_port_gt. Search for the documents that are greater than the value"},"log.src_port_gte":{"type":"number","title":"Filter the search by log.src_port_gte. Search for the documents that are greater or equal than the value"},"log.datetime_before":{"type":"string","format":"date-time","title":"Filter the search by log.datetime_before. Search for the documents that are after the given timestamp"},"log.datetime_after":{"type":"string","format":"date-time","title":"Filter the search by log.datetime_after. "},"timestamp_before":{"type":"string","format":"date-time","title":"Filter the search by timestamp_before. Search for the documents that are after the given timestamp"},"timestamp_after":{"type":"string","format":"date-time","title":"Filter the search by timestamp_after. "},"log.dst_ip":{"type":"string","format":"ipv4","title":"Filter the search by log.dst_ip. Search for an exact match"},"not.log.dst_ip":{"type":"string","format":"ipv4","title":"Filter the search by not.log.dst_ip. Search for the matches that are not equal to the value"},"log.src_ip":{"type":"string","format":"ipv4","title":"Filter the search by log.src_ip. Search for an exact match"},"not.log.src_ip":{"type":"string","format":"ipv4","title":"Filter the search by not.log.src_ip. Search for the matches that are not equal to the value"},"resolved_ips":{"type":"string","title":"Filter the search by resolved_ips. Search for an exact match"},"not.resolved_ips":{"type":"string","title":"Filter the search by not.resolved_ips. Search for the matches that are not equal to the value"},"sort_field":{"type":"string","title":"Sort field","enum":["machine_id","group_id","group_name","rule_id","rule_name","resolved_ips","policy_id","policy_name","account_id","parent_account_id","action","log.policy_id","log.policy","log.protocol","log.query_name","log.query_name_reversed","log.resolver_decision","log.user_id","log.colo_id","log.dst_port","log.query_category_ids","log.query_size","log.query_type","log.src_port","log.dst_ip","log.src_ip","timestamp","log.datetime","agent.at","agent.last_user","agent.fully_qualified_host_name","agent.started_at_local","agent.started_at_offset","agent.os_info.os_type","agent.os_info.os_version","agent.os_info.os_platform","agent.os_info.os_architecture","agent.os_info.os_release_name","agent.domain_name","agent.engine_version","agent.policy_etag","agent.host_name","agent.nics.ips","agent.nics.mac_address","machine.tags.alias","agent.has_alerts","agent.machine_ip","agent.object_guid","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.source_location.city","agent.source_location.country","agent.source_location.country_iso","agent.source_location.continent","agent.source_location.time_zone","agent.source_location.postal_code","agent.source_location.subdivisions","agent.source_location.anonymous_proxy","agent.serial_number","active_directory.user.display_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.machine.display_name","active_directory.machine.sam_account_name","active_directory.machine.ou"]},"populate":{"type":"object","title":"Populate object schema","properties":{"group":{"type":"boolean","title":"Populates group data (group name, policy name, policy id)"},"endpoint":{"type":"boolean","title":"Populate with the endpoint data (last day seen, last user)"}}},"sort_order":{"type":"string","title":"Sorting direction","default":"asc","enum":["asc","desc"]},"page_size":{"type":"number","title":"The size of the page. If you only need aggregations, set it to 0","minimum":0,"default":50,"maximum":2000},"aggregations":{"type":"array","title":"The Aggregations Schema","items":{"type":"string","title":"Aggregations","default":[],"enum":["machine_id","group_id","rule_id","rule_name","resolved_ips","group_name","policy_id","policy_name","account_id","parent_account_id","action","log.policy_id","log.policy","log.protocol","log.query_name","log.query_name_reversed","log.resolver_decision","log.user_id","log.colo_id","log.dst_port","log.query_category_ids","log.query_size","log.query_type","log.src_port","log.dst_ip","log.src_ip","timestamp","log.datetime","agent.at","agent.last_user","agent.fully_qualified_host_name","agent.started_at_local","agent.started_at_offset","agent.os_info.os_type","agent.os_info.os_version","agent.os_info.os_platform","agent.os_info.os_architecture","agent.os_info.os_release_name","agent.domain_name","agent.engine_version","agent.policy_etag","agent.host_name","agent.nics.ips","agent.nics.mac_address","machine.tags.alias","agent.has_alerts","agent.machine_ip","agent.object_guid","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.source_location.city","agent.source_location.country","agent.source_location.country_iso","agent.source_location.continent","agent.source_location.time_zone","agent.source_location.postal_code","agent.source_location.subdivisions","agent.source_location.anonymous_proxy","agent.serial_number","daily_logs"]}},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}]}}}}],"properties":{"groups":{"type":"array","title":"List of search queries","items":{"type":"object","required":["account_ids"],"allOf":[{"type":"object","title":"Search DNS Logs request. Leading wildcards are not supported for constraint fields without '.keyword' suffix.","allOf":[{"type":"object","title":"Agent constraints","description":"The Agents constraints.","properties":{"nics.mac_address":{"type":"string","title":"nics.mac_address"},"not.nics.mac_address":{"type":"string","title":"not.nics.mac_address"},"nics.mac_address.keyword":{"type":"string","title":"nics.mac_address.keyword"},"not.nics.mac_address.keyword":{"type":"string","title":"not.nics.mac_address.keyword"},"nics.description":{"type":"string","title":"nics.description"},"not.nics.description":{"type":"string","title":"not.nics.description"},"nics.description.keyword":{"type":"string","title":"nics.description.keyword"},"not.nics.description.keyword":{"type":"string","title":"not.nics.description.keyword"},"os_info.os_type":{"type":"string","title":"os_info.os_type"},"not.os_info.os_type":{"type":"string","title":"not.os_info.os_type"},"os_info.os_type.keyword":{"type":"string","title":"os_info.os_type.keyword"},"not.os_info.os_type.keyword":{"type":"string","title":"not.os_info.os_type.keyword"},"os_info.os_version":{"type":"string","title":"os_info.os_version"},"not.os_info.os_version":{"type":"string","title":"not.os_info.os_version"},"os_info.os_version.keyword":{"type":"string","title":"os_info.os_version.keyword"},"not.os_info.os_version.keyword":{"type":"string","title":"not.os_info.os_version.keyword"},"os_info.os_platform":{"type":"string","title":"os_info.os_platform"},"not.os_info.os_platform":{"type":"string","title":"not.os_info.os_platform"},"os_info.os_platform.keyword":{"type":"string","title":"os_info.os_platform.keyword"},"not.os_info.os_platform.keyword":{"type":"string","title":"not.os_info.os_platform.keyword"},"os_info.os_architecture":{"type":"string","title":"os_info.os_architecture"},"not.os_info.os_architecture":{"type":"string","title":"not.os_info.os_architecture"},"os_info.os_architecture.keyword":{"type":"string","title":"os_info.os_architecture.keyword"},"not.os_info.os_architecture.keyword":{"type":"string","title":"not.os_info.os_architecture.keyword"},"os_info.os_release_name":{"type":"string","title":"os_info.os_release_name"},"not.os_info.os_release_name":{"type":"string","title":"not.os_info.os_release_name"},"os_info.os_release_name.keyword":{"type":"string","title":"os_info.os_release_name.keyword"},"not.os_info.os_release_name.keyword":{"type":"string","title":"not.os_info.os_release_name.keyword"},"host_name":{"type":"string","title":"host_name"},"not.host_name":{"type":"string","title":"not.host_name"},"host_name.keyword":{"type":"string","title":"host_name.keyword"},"not.host_name.keyword":{"type":"string","title":"not.host_name.keyword"},"fully_qualified_host_name":{"type":"string","title":"fully_qualified_host_name"},"not.fully_qualified_host_name":{"type":"string","title":"not.fully_qualified_host_name"},"fully_qualified_host_name.keyword":{"type":"string","title":"fully_qualified_host_name.keyword"},"not.fully_qualified_host_name.keyword":{"type":"string","title":"not.fully_qualified_host_name.keyword"},"plugins.asset_manager.plugin_version":{"type":"string","title":"plugins.asset_manager.plugin_version"},"not.plugins.asset_manager.plugin_version":{"type":"string","title":"not.plugins.asset_manager.plugin_version"},"plugins.asset_manager.plugin_version.keyword":{"type":"string","title":"plugins.asset_manager.plugin_version.keyword"},"not.plugins.asset_manager.plugin_version.keyword":{"type":"string","title":"not.plugins.asset_manager.plugin_version.keyword"},"plugins.asset_manager.reboot_reasons":{"type":"string","title":"plugins.asset_manager.reboot_reasons"},"not.plugins.asset_manager.reboot_reasons":{"type":"string","title":"not.plugins.asset_manager.reboot_reasons"},"plugins.asset_manager.reboot_reasons.keyword":{"type":"string","title":"plugins.asset_manager.reboot_reasons.keyword"},"not.plugins.asset_manager.reboot_reasons.keyword":{"type":"string","title":"not.plugins.asset_manager.reboot_reasons.keyword"},"plugins.endpoint_protection.plugin_version":{"type":"string","title":"plugins.endpoint_protection.plugin_version"},"not.plugins.endpoint_protection.plugin_version":{"type":"string","title":"not.plugins.endpoint_protection.plugin_version"},"plugins.endpoint_protection.plugin_version.keyword":{"type":"string","title":"plugins.endpoint_protection.plugin_version.keyword"},"not.plugins.endpoint_protection.plugin_version.keyword":{"type":"string","title":"not.plugins.endpoint_protection.plugin_version.keyword"},"plugins.endpoint_protection.sdk_version":{"type":"string","title":"plugins.endpoint_protection.sdk_version"},"not.plugins.endpoint_protection.sdk_version":{"type":"string","title":"not.plugins.endpoint_protection.sdk_version"},"plugins.endpoint_protection.sdk_version.keyword":{"type":"string","title":"plugins.endpoint_protection.sdk_version.keyword"},"not.plugins.endpoint_protection.sdk_version.keyword":{"type":"string","title":"not.plugins.endpoint_protection.sdk_version.keyword"},"plugins.endpoint_protection.component_package_version":{"type":"string","title":"plugins.endpoint_protection.component_package_version"},"not.plugins.endpoint_protection.component_package_version":{"type":"string","title":"not.plugins.endpoint_protection.component_package_version"},"plugins.endpoint_protection.component_package_version.keyword":{"type":"string","title":"plugins.endpoint_protection.component_package_version.keyword"},"not.plugins.endpoint_protection.component_package_version.keyword":{"type":"string","title":"not.plugins.endpoint_protection.component_package_version.keyword"},"plugins.endpoint_protection.update_package_version":{"type":"string","title":"plugins.endpoint_protection.update_package_version"},"not.plugins.endpoint_protection.update_package_version":{"type":"string","title":"not.plugins.endpoint_protection.update_package_version"},"plugins.endpoint_protection.update_package_version.keyword":{"type":"string","title":"plugins.endpoint_protection.update_package_version.keyword"},"not.plugins.endpoint_protection.update_package_version.keyword":{"type":"string","title":"not.plugins.endpoint_protection.update_package_version.keyword"},"plugins.endpoint_protection.reboot_reasons":{"type":"string","title":"plugins.endpoint_protection.reboot_reasons"},"not.plugins.endpoint_protection.reboot_reasons":{"type":"string","title":"not.plugins.endpoint_protection.reboot_reasons"},"plugins.endpoint_protection.reboot_reasons.keyword":{"type":"string","title":"plugins.endpoint_protection.reboot_reasons.keyword"},"not.plugins.endpoint_protection.reboot_reasons.keyword":{"type":"string","title":"not.plugins.endpoint_protection.reboot_reasons.keyword"},"plugins.endpoint_detection_and_response.plugin_version":{"type":"string","title":"plugins.endpoint_detection_and_response.plugin_version"},"not.plugins.endpoint_detection_and_response.plugin_version":{"type":"string","title":"not.plugins.endpoint_detection_and_response.plugin_version"},"plugins.endpoint_detection_and_response.plugin_version.keyword":{"type":"string","title":"plugins.endpoint_detection_and_response.plugin_version.keyword"},"not.plugins.endpoint_detection_and_response.plugin_version.keyword":{"type":"string","title":"not.plugins.endpoint_detection_and_response.plugin_version.keyword"},"plugins.endpoint_detection_and_response.reboot_reasons":{"type":"string","title":"plugins.endpoint_detection_and_response.reboot_reasons"},"not.plugins.endpoint_detection_and_response.reboot_reasons":{"type":"string","title":"not.plugins.endpoint_detection_and_response.reboot_reasons"},"plugins.endpoint_detection_and_response.reboot_reasons.keyword":{"type":"string","title":"plugins.endpoint_detection_and_response.reboot_reasons.keyword"},"not.plugins.endpoint_detection_and_response.reboot_reasons.keyword":{"type":"string","title":"not.plugins.endpoint_detection_and_response.reboot_reasons.keyword"},"plugins.incident_response.plugin_version":{"type":"string","title":"plugins.incident_response.plugin_version"},"not.plugins.incident_response.plugin_version":{"type":"string","title":"not.plugins.incident_response.plugin_version"},"plugins.incident_response.plugin_version.keyword":{"type":"string","title":"plugins.incident_response.plugin_version.keyword"},"not.plugins.incident_response.plugin_version.keyword":{"type":"string","title":"not.plugins.incident_response.plugin_version.keyword"},"plugins.incident_response.reboot_reasons":{"type":"string","title":"plugins.incident_response.reboot_reasons"},"not.plugins.incident_response.reboot_reasons":{"type":"string","title":"not.plugins.incident_response.reboot_reasons"},"plugins.incident_response.reboot_reasons.keyword":{"type":"string","title":"plugins.incident_response.reboot_reasons.keyword"},"not.plugins.incident_response.reboot_reasons.keyword":{"type":"string","title":"not.plugins.incident_response.reboot_reasons.keyword"},"plugins.siem.plugin_version":{"type":"string","title":"plugins.siem.plugin_version"},"not.plugins.siem.plugin_version":{"type":"string","title":"not.plugins.siem.plugin_version"},"plugins.siem.plugin_version.keyword":{"type":"string","title":"plugins.siem.plugin_version.keyword"},"not.plugins.siem.plugin_version.keyword":{"type":"string","title":"not.plugins.siem.plugin_version.keyword"},"plugins.browser_phishing_protection.plugin_version":{"type":"string","title":"plugins.browser_phishing_protection.plugin_version"},"not.plugins.browser_phishing_protection.plugin_version":{"type":"string","title":"not.plugins.browser_phishing_protection.plugin_version"},"plugins.browser_phishing_protection.plugin_version.keyword":{"type":"string","title":"plugins.browser_phishing_protection.plugin_version.keyword"},"not.plugins.browser_phishing_protection.plugin_version.keyword":{"type":"string","title":"not.plugins.browser_phishing_protection.plugin_version.keyword"},"plugins.browser_phishing_protection.reboot_reasons":{"type":"string","title":"plugins.browser_phishing_protection.reboot_reasons"},"not.plugins.browser_phishing_protection.reboot_reasons":{"type":"string","title":"not.plugins.browser_phishing_protection.reboot_reasons"},"plugins.browser_phishing_protection.reboot_reasons.keyword":{"type":"string","title":"plugins.browser_phishing_protection.reboot_reasons.keyword"},"not.plugins.browser_phishing_protection.reboot_reasons.keyword":{"type":"string","title":"not.plugins.browser_phishing_protection.reboot_reasons.keyword"},"plugins.siem.reboot_reasons":{"type":"string","title":"plugins.siem.reboot_reasons"},"not.plugins.siem.reboot_reasons":{"type":"string","title":"not.plugins.siem.reboot_reasons"},"plugins.siem.reboot_reasons.keyword":{"type":"string","title":"plugins.siem.reboot_reasons.keyword"},"not.plugins.siem.reboot_reasons.keyword":{"type":"string","title":"not.plugins.siem.reboot_reasons.keyword"},"engine_version":{"type":"string","title":"engine_version"},"not.engine_version":{"type":"string","title":"not.engine_version"},"engine_version.keyword":{"type":"string","title":"engine_version.keyword"},"not.engine_version.keyword":{"type":"string","title":"not.engine_version.keyword"},"domain_name":{"type":"string","title":"domain_name"},"not.domain_name":{"type":"string","title":"not.domain_name"},"domain_name.keyword":{"type":"string","title":"domain_name.keyword"},"not.domain_name.keyword":{"type":"string","title":"not.domain_name.keyword"},"policy_etag":{"type":"string","title":"policy_etag"},"not.policy_etag":{"type":"string","title":"not.policy_etag"},"policy_etag.keyword":{"type":"string","title":"policy_etag.keyword"},"not.policy_etag.keyword":{"type":"string","title":"not.policy_etag.keyword"},"last_user":{"type":"string","title":"last_user"},"not.last_user":{"type":"string","title":"not.last_user"},"last_user.keyword":{"type":"string","title":"last_user.keyword"},"not.last_user.keyword":{"type":"string","title":"not.last_user.keyword"},"serial_number":{"type":"string","title":"serial_number"},"not.serial_number":{"type":"string","title":"not.serial_number"},"serial_number.keyword":{"type":"string","title":"serial_number.keyword"},"not.serial_number.keyword":{"type":"string","title":"not.serial_number.keyword"}}},{"type":"object","title":"Active Directory Search Filters","properties":{"active_directory.user.display_name":{"type":"string","title":"Filter the search by active_directory.user.display_name. Search for the matches that are equal to the value"},"active_directory.user.display_name.keyword":{"type":"string","title":"Filter the search by active_directory.user.display_name.keyword. Search for the matches that contain the value"},"active_directory.user.ou":{"type":"string","title":"Filter the search by active_directory.user.ou. Search for the matches that are equal to the value"},"active_directory.user.ou.keyword":{"type":"string","title":"Filter the search by active_directory.user.ou.keyword. Search for the matches that contain the value"},"active_directory.user.ou.path":{"type":"string","title":"Filter the search by active_directory.user.ou.path. Search for the matches that are equal to the value"},"active_directory.user.ou.path.keyword":{"type":"string","title":"Filter the search by active_directory.user.ou.path.keyword. Search for the matches that contain the value"},"active_directory.user.sam_account_name":{"type":"string","title":"Filter the search by active_directory.user.sam_account_name. Search for the matches that are equal to the value"},"active_directory.user.sam_account_name.keyword":{"type":"string","title":"Filter the search by active_directory.user.sam_account_name.keyword. Search for the matches that contain the value"},"active_directory.machine.display_name":{"type":"string","title":"Filter the search by active_directory.machine.display_name. Search for the matches that are equal to the value"},"active_directory.machine.display_name.keyword":{"type":"string","title":"Filter the search by active_directory.machine.display_name.keyword. Search for the matches that contain the value"},"active_directory.machine.ou":{"type":"string","title":"Filter the search by active_directory.machine.ou. Search for the matches that are equal to the value"},"active_directory.machine.ou.keyword":{"type":"string","title":"Filter the search by active_directory.machine.ou.keyword. Search for the matches that contain the value"},"active_directory.machine.ou.path":{"type":"string","title":"Filter the search by active_directory.machine.ou.path. Search for the matches that are equal to the value"},"active_directory.machine.ou.path.keyword":{"type":"string","title":"Filter the search by active_directory.machine.ou.path.keyword. Search for the matches that contain the value"},"active_directory.machine.sam_account_name":{"type":"string","title":"Filter the search by active_directory.machine.sam_account_name. Search for the matches that are equal to the value"},"active_directory.machine.sam_account_name.keyword":{"type":"string","title":"Filter the search by active_directory.machine.sam_account_name.keyword. Search for the matches that contain the value"}}}],"properties":{"id":{"type":"string","title":"Filter the search by DNS event id. Search for an exact match"},"not.id":{"type":"string","title":"Filter the search by not.id. Search for the matches that are not equal to the value"},"machine_id":{"type":"string","title":"Filter the search by machine_id. Search for an exact match"},"machine_id.keyword":{"type":"string","title":"Filter the search by machine_id.keyword. Search for the matches that contain the value"},"not.machine_id":{"type":"string","title":"Filter the search by not.machine_id. Search for the matches that are not equal to the value"},"not.machine_id.keyword":{"type":"string","title":"Filter the search by not.machine_id.keyword. Search for the matches that doesnt contain the value"},"group_id":{"type":"string","title":"Filter the search by group_id. Search for an exact match"},"group_id.keyword":{"type":"string","title":"Filter the search by group_id.keyword. Search for the matches that contain the value"},"not.group_id":{"type":"string","title":"Filter the search by not.group_id. Search for the matches that are not equal to the value"},"not.group_id.keyword":{"type":"string","title":"Filter the search by not.group_id.keyword. Search for the matches that doesnt contain the value"},"group_name":{"type":"string","title":"Filter the search by group_name. Search for an exact match"},"group_name.keyword":{"type":"string","title":"Filter the search by group_name.keyword. Search for the matches that contain the value"},"not.group_name":{"type":"string","title":"Filter the search by not.group_name. Search for the matches that are not equal to the value"},"not.group_name.keyword":{"type":"string","title":"Filter the search by not.group_name.keyword. Search for the matches that doesnt contain the value"},"rule_id":{"type":"string","title":"Filter the search by rule_id. Search for an exact match"},"rule_id.keyword":{"type":"string","title":"Filter the search by rule_id.keyword. Search for the matches that contain the value"},"not.rule_id":{"type":"string","title":"Filter the search by not.rule_id. Search for the matches that are not equal to the value"},"not.rule_id.keyword":{"type":"string","title":"Filter the search by not.rule_id.keyword. Search for the matches that doesnt contain the value"},"rule_name":{"type":"string","title":"Filter the search by rule_name. Search for an exact match"},"rule_name.keyword":{"type":"string","title":"Filter the search by rule_name.keyword. Search for the matches that contain the value"},"not.rule_name":{"type":"string","title":"Filter the search by not.rule_name. Search for the matches that are not equal to the value"},"not.rule_name.keyword":{"type":"string","title":"Filter the search by not.rule_name.keyword. Search for the matches that doesnt contain the value"},"policy_id":{"type":"string","title":"Filter the search by policy_id. Search for an exact match"},"policy_id.keyword":{"type":"string","title":"Filter the search by policy_id.keyword. Search for the matches that contain the value"},"not.policy_id":{"type":"string","title":"Filter the search by not.policy_id. Search for the matches that are not equal to the value"},"not.policy_id.keyword":{"type":"string","title":"Filter the search by not.policy_id.keyword. Search for the matches that doesnt contain the value"},"policy_name":{"type":"string","title":"Filter the search by policy_name. Search for an exact match"},"policy_name.keyword":{"type":"string","title":"Filter the search by policy_name.keyword. Search for the matches that contain the value"},"not.policy_name":{"type":"string","title":"Filter the search by not.policy_name. Search for the matches that are not equal to the value"},"not.policy_name.keyword":{"type":"string","title":"Filter the search by not.policy_name.keyword. Search for the matches that doesnt contain the value"},"account_id":{"type":"string","title":"Filter the search by account_id. Search for an exact match"},"account_id.keyword":{"type":"string","title":"Filter the search by account_id.keyword. Search for the matches that contain the value"},"not.account_id":{"type":"string","title":"Filter the search by not.account_id. Search for the matches that are not equal to the value"},"not.account_id.keyword":{"type":"string","title":"Filter the search by not.account_id.keyword. Search for the matches that doesnt contain the value"},"parent_account_id":{"type":"string","title":"Filter the search by parent_account_id. Search for an exact match"},"parent_account_id.keyword":{"type":"string","title":"Filter the search by parent_account_id.keyword. Search for the matches that contain the value"},"not.parent_account_id":{"type":"string","title":"Filter the search by not.parent_account_id. Search for the matches that are not equal to the value"},"not.parent_account_id.keyword":{"type":"string","title":"Filter the search by not.parent_account_id.keyword. Search for the matches that doesnt contain the value"},"action":{"type":"string","title":"Filter the search by action. Search for an exact match"},"action.keyword":{"type":"string","title":"Filter the search by action.keyword. Search for the matches that contain the value"},"not.action":{"type":"string","title":"Filter the search by not.action. Search for the matches that are not equal to the value"},"not.action.keyword":{"type":"string","title":"Filter the search by not.action.keyword. Search for the matches that doesnt contain the value"},"log.policy_id":{"type":"string","title":"Filter the search by log.policy_id. Search for an exact match"},"log.policy_id.keyword":{"type":"string","title":"Filter the search by log.policy_id.keyword. Search for the matches that contain the value"},"not.log.policy_id":{"type":"string","title":"Filter the search by not.log.policy_id. Search for the matches that are not equal to the value"},"not.log.policy_id.keyword":{"type":"string","title":"Filter the search by not.log.policy_id.keyword. Search for the matches that doesnt contain the value"},"log.policy":{"type":"string","title":"Filter the search by log.policy. Search for an exact match"},"log.policy.keyword":{"type":"string","title":"Filter the search by log.policy.keyword. Search for the matches that contain the value"},"not.log.policy":{"type":"string","title":"Filter the search by not.log.policy. Search for the matches that are not equal to the value"},"not.log.policy.keyword":{"type":"string","title":"Filter the search by not.log.policy.keyword. Search for the matches that doesnt contain the value"},"log.protocol":{"type":"string","title":"Filter the search by log.protocol. Search for an exact match"},"log.protocol.keyword":{"type":"string","title":"Filter the search by log.protocol.keyword. Search for the matches that contain the value"},"not.log.protocol":{"type":"string","title":"Filter the search by not.log.protocol. Search for the matches that are not equal to the value"},"not.log.protocol.keyword":{"type":"string","title":"Filter the search by not.log.protocol.keyword. Search for the matches that doesnt contain the value"},"log.query_name":{"type":"string","title":"Filter the search by log.query_name. Search for an exact match"},"log.query_name.keyword":{"type":"string","title":"Filter the search by log.query_name.keyword. Search for the matches that contain the value"},"not.log.query_name":{"type":"string","title":"Filter the search by not.log.query_name. Search for the matches that are not equal to the value"},"not.log.query_name.keyword":{"type":"string","title":"Filter the search by not.log.query_name.keyword. Search for the matches that doesnt contain the value"},"log.query_name_reversed":{"type":"string","title":"Filter the search by log.query_name_reversed. Search for an exact match"},"log.query_name_reversed.keyword":{"type":"string","title":"Filter the search by log.query_name_reversed.keyword. Search for the matches that contain the value"},"not.log.query_name_reversed":{"type":"string","title":"Filter the search by not.log.query_name_reversed. Search for the matches that are not equal to the value"},"not.log.query_name_reversed.keyword":{"type":"string","title":"Filter the search by not.log.query_name_reversed.keyword. Search for the matches that doesnt contain the value"},"log.resolver_decision":{"type":"string","title":"Filter the search by log.resolver_decision. Search for an exact match"},"log.resolver_decision.keyword":{"type":"string","title":"Filter the search by log.resolver_decision.keyword. Search for the matches that contain the value"},"not.log.resolver_decision":{"type":"string","title":"Filter the search by not.log.resolver_decision. Search for the matches that are not equal to the value"},"not.log.resolver_decision.keyword":{"type":"string","title":"Filter the search by not.log.resolver_decision.keyword. Search for the matches that doesnt contain the value"},"log.user_id":{"type":"string","title":"Filter the search by log.user_id. Search for an exact match"},"log.user_id.keyword":{"type":"string","title":"Filter the search by log.user_id.keyword. Search for the matches that contain the value"},"not.log.user_id":{"type":"string","title":"Filter the search by not.log.user_id. Search for the matches that are not equal to the value"},"not.log.user_id.keyword":{"type":"string","title":"Filter the search by not.log.user_id.keyword. Search for the matches that doesnt contain the value"},"log.colo_id":{"type":"number","title":"Filter the search by log.colo_id. Search for an exact match of the integer value"},"log.colo_id_lt":{"type":"number","title":"Filter the search by log.colo_id_lt. Search for the documents that are less than the value"},"log.colo_id_lte":{"type":"number","title":"Filter the search by log.colo_id_lte. Search for the documents that are less or equal than the value"},"log.colo_id_gt":{"type":"number","title":"Filter the search by log.colo_id_gt. Search for the documents that are greater than the value"},"log.colo_id_gte":{"type":"number","title":"Filter the search by log.colo_id_gte. Search for the documents that are greater or equal than the value"},"log.dst_port":{"type":"number","title":"Filter the search by log.dst_port. Search for an exact match of the integer value"},"log.dst_port_lt":{"type":"number","title":"Filter the search by log.dst_port_lt. Search for the documents that are less than the value"},"log.dst_port_lte":{"type":"number","title":"Filter the search by log.dst_port_lte. Search for the documents that are less or equal than the value"},"log.dst_port_gt":{"type":"number","title":"Filter the search by log.dst_port_gt. Search for the documents that are greater than the value"},"log.dst_port_gte":{"type":"number","title":"Filter the search by log.dst_port_gte. Search for the documents that are greater or equal than the value"},"log.query_category_ids":{"type":"array","items":{"type":"number"},"title":"Filter the search by log.query_category_ids. Search for an exact match of the integer value"},"log.query_size":{"type":"number","title":"Filter the search by log.query_size. Search for an exact match of the integer value"},"log.query_size_lt":{"type":"number","title":"Filter the search by log.query_size_lt. Search for the documents that are less than the value"},"log.query_size_lte":{"type":"number","title":"Filter the search by log.query_size_lte. Search for the documents that are less or equal than the value"},"log.query_size_gt":{"type":"number","title":"Filter the search by log.query_size_gt. Search for the documents that are greater than the value"},"log.query_size_gte":{"type":"number","title":"Filter the search by log.query_size_gte. Search for the documents that are greater or equal than the value"},"log.query_type":{"type":"number","title":"Filter the search by log.query_type. Search for an exact match of the integer value"},"log.query_type_lt":{"type":"number","title":"Filter the search by log.query_type_lt. Search for the documents that are less than the value"},"log.query_type_lte":{"type":"number","title":"Filter the search by log.query_type_lte. Search for the documents that are less or equal than the value"},"log.query_type_gt":{"type":"number","title":"Filter the search by log.query_type_gt. Search for the documents that are greater than the value"},"log.query_type_gte":{"type":"number","title":"Filter the search by log.query_type_gte. Search for the documents that are greater or equal than the value"},"log.src_port":{"type":"number","title":"Filter the search by log.src_port. Search for an exact match of the integer value"},"log.src_port_lt":{"type":"number","title":"Filter the search by log.src_port_lt. Search for the documents that are less than the value"},"log.src_port_lte":{"type":"number","title":"Filter the search by log.src_port_lte. Search for the documents that are less or equal than the value"},"log.src_port_gt":{"type":"number","title":"Filter the search by log.src_port_gt. Search for the documents that are greater than the value"},"log.src_port_gte":{"type":"number","title":"Filter the search by log.src_port_gte. Search for the documents that are greater or equal than the value"},"log.datetime_before":{"type":"string","format":"date-time","title":"Filter the search by log.datetime_before. Search for the documents that are after the given timestamp"},"log.datetime_after":{"type":"string","format":"date-time","title":"Filter the search by log.datetime_after. "},"timestamp_before":{"type":"string","format":"date-time","title":"Filter the search by timestamp_before. Search for the documents that are after the given timestamp"},"timestamp_after":{"type":"string","format":"date-time","title":"Filter the search by timestamp_after. "},"log.dst_ip":{"type":"string","format":"ipv4","title":"Filter the search by log.dst_ip. Search for an exact match"},"not.log.dst_ip":{"type":"string","format":"ipv4","title":"Filter the search by not.log.dst_ip. Search for the matches that are not equal to the value"},"log.src_ip":{"type":"string","format":"ipv4","title":"Filter the search by log.src_ip. Search for an exact match"},"not.log.src_ip":{"type":"string","format":"ipv4","title":"Filter the search by not.log.src_ip. Search for the matches that are not equal to the value"},"resolved_ips":{"type":"string","title":"Filter the search by resolved_ips. Search for an exact match"},"not.resolved_ips":{"type":"string","title":"Filter the search by not.resolved_ips. Search for the matches that are not equal to the value"},"sort_field":{"type":"string","title":"Sort field","enum":["machine_id","group_id","group_name","rule_id","rule_name","resolved_ips","policy_id","policy_name","account_id","parent_account_id","action","log.policy_id","log.policy","log.protocol","log.query_name","log.query_name_reversed","log.resolver_decision","log.user_id","log.colo_id","log.dst_port","log.query_category_ids","log.query_size","log.query_type","log.src_port","log.dst_ip","log.src_ip","timestamp","log.datetime","agent.at","agent.last_user","agent.fully_qualified_host_name","agent.started_at_local","agent.started_at_offset","agent.os_info.os_type","agent.os_info.os_version","agent.os_info.os_platform","agent.os_info.os_architecture","agent.os_info.os_release_name","agent.domain_name","agent.engine_version","agent.policy_etag","agent.host_name","agent.nics.ips","agent.nics.mac_address","machine.tags.alias","agent.has_alerts","agent.machine_ip","agent.object_guid","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.source_location.city","agent.source_location.country","agent.source_location.country_iso","agent.source_location.continent","agent.source_location.time_zone","agent.source_location.postal_code","agent.source_location.subdivisions","agent.source_location.anonymous_proxy","agent.serial_number","active_directory.user.display_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.machine.display_name","active_directory.machine.sam_account_name","active_directory.machine.ou"]},"populate":{"type":"object","title":"Populate object schema","properties":{"group":{"type":"boolean","title":"Populates group data (group name, policy name, policy id)"},"endpoint":{"type":"boolean","title":"Populate with the endpoint data (last day seen, last user)"}}},"sort_order":{"type":"string","title":"Sorting direction","default":"asc","enum":["asc","desc"]},"page_size":{"type":"number","title":"The size of the page. If you only need aggregations, set it to 0","minimum":0,"default":50,"maximum":2000},"aggregations":{"type":"array","title":"The Aggregations Schema","items":{"type":"string","title":"Aggregations","default":[],"enum":["machine_id","group_id","rule_id","rule_name","resolved_ips","group_name","policy_id","policy_name","account_id","parent_account_id","action","log.policy_id","log.policy","log.protocol","log.query_name","log.query_name_reversed","log.resolver_decision","log.user_id","log.colo_id","log.dst_port","log.query_category_ids","log.query_size","log.query_type","log.src_port","log.dst_ip","log.src_ip","timestamp","log.datetime","agent.at","agent.last_user","agent.fully_qualified_host_name","agent.started_at_local","agent.started_at_offset","agent.os_info.os_type","agent.os_info.os_version","agent.os_info.os_platform","agent.os_info.os_architecture","agent.os_info.os_release_name","agent.domain_name","agent.engine_version","agent.policy_etag","agent.host_name","agent.nics.ips","agent.nics.mac_address","machine.tags.alias","agent.has_alerts","agent.machine_ip","agent.object_guid","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.source_location.city","agent.source_location.country","agent.source_location.country_iso","agent.source_location.continent","agent.source_location.time_zone","agent.source_location.postal_code","agent.source_location.subdivisions","agent.source_location.anonymous_proxy","agent.serial_number","daily_logs"]}},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}},{"type":"object","required":["account_ids"],"properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]}}}}}}},"responses":{"200":{"description":"Successful response"}},"tags":["DNS"],"operationId":"api.v2.rmm.post.export.dns.async"}},"/oneview/v1/dns":{"post":{"description":"Search DNS Logs across all your managed accounts. The search will be scoped to the account_ids you specify in the request body.","summary":"Search DNS Logs","security":[{"client_credentials":["read"]},{"user_permissions":["dnsFiltering.view"]}],"status":{"outage":["auth","search_stateless"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"allOf":[{"type":"object","title":"Search DNS Logs request. Leading wildcards are not supported for constraint fields without '.keyword' suffix.","allOf":[{"type":"object","title":"Agent constraints","description":"The Agents constraints.","properties":{"nics.mac_address":{"type":"string","title":"nics.mac_address"},"not.nics.mac_address":{"type":"string","title":"not.nics.mac_address"},"nics.mac_address.keyword":{"type":"string","title":"nics.mac_address.keyword"},"not.nics.mac_address.keyword":{"type":"string","title":"not.nics.mac_address.keyword"},"nics.description":{"type":"string","title":"nics.description"},"not.nics.description":{"type":"string","title":"not.nics.description"},"nics.description.keyword":{"type":"string","title":"nics.description.keyword"},"not.nics.description.keyword":{"type":"string","title":"not.nics.description.keyword"},"os_info.os_type":{"type":"string","title":"os_info.os_type"},"not.os_info.os_type":{"type":"string","title":"not.os_info.os_type"},"os_info.os_type.keyword":{"type":"string","title":"os_info.os_type.keyword"},"not.os_info.os_type.keyword":{"type":"string","title":"not.os_info.os_type.keyword"},"os_info.os_version":{"type":"string","title":"os_info.os_version"},"not.os_info.os_version":{"type":"string","title":"not.os_info.os_version"},"os_info.os_version.keyword":{"type":"string","title":"os_info.os_version.keyword"},"not.os_info.os_version.keyword":{"type":"string","title":"not.os_info.os_version.keyword"},"os_info.os_platform":{"type":"string","title":"os_info.os_platform"},"not.os_info.os_platform":{"type":"string","title":"not.os_info.os_platform"},"os_info.os_platform.keyword":{"type":"string","title":"os_info.os_platform.keyword"},"not.os_info.os_platform.keyword":{"type":"string","title":"not.os_info.os_platform.keyword"},"os_info.os_architecture":{"type":"string","title":"os_info.os_architecture"},"not.os_info.os_architecture":{"type":"string","title":"not.os_info.os_architecture"},"os_info.os_architecture.keyword":{"type":"string","title":"os_info.os_architecture.keyword"},"not.os_info.os_architecture.keyword":{"type":"string","title":"not.os_info.os_architecture.keyword"},"os_info.os_release_name":{"type":"string","title":"os_info.os_release_name"},"not.os_info.os_release_name":{"type":"string","title":"not.os_info.os_release_name"},"os_info.os_release_name.keyword":{"type":"string","title":"os_info.os_release_name.keyword"},"not.os_info.os_release_name.keyword":{"type":"string","title":"not.os_info.os_release_name.keyword"},"host_name":{"type":"string","title":"host_name"},"not.host_name":{"type":"string","title":"not.host_name"},"host_name.keyword":{"type":"string","title":"host_name.keyword"},"not.host_name.keyword":{"type":"string","title":"not.host_name.keyword"},"fully_qualified_host_name":{"type":"string","title":"fully_qualified_host_name"},"not.fully_qualified_host_name":{"type":"string","title":"not.fully_qualified_host_name"},"fully_qualified_host_name.keyword":{"type":"string","title":"fully_qualified_host_name.keyword"},"not.fully_qualified_host_name.keyword":{"type":"string","title":"not.fully_qualified_host_name.keyword"},"plugins.asset_manager.plugin_version":{"type":"string","title":"plugins.asset_manager.plugin_version"},"not.plugins.asset_manager.plugin_version":{"type":"string","title":"not.plugins.asset_manager.plugin_version"},"plugins.asset_manager.plugin_version.keyword":{"type":"string","title":"plugins.asset_manager.plugin_version.keyword"},"not.plugins.asset_manager.plugin_version.keyword":{"type":"string","title":"not.plugins.asset_manager.plugin_version.keyword"},"plugins.asset_manager.reboot_reasons":{"type":"string","title":"plugins.asset_manager.reboot_reasons"},"not.plugins.asset_manager.reboot_reasons":{"type":"string","title":"not.plugins.asset_manager.reboot_reasons"},"plugins.asset_manager.reboot_reasons.keyword":{"type":"string","title":"plugins.asset_manager.reboot_reasons.keyword"},"not.plugins.asset_manager.reboot_reasons.keyword":{"type":"string","title":"not.plugins.asset_manager.reboot_reasons.keyword"},"plugins.endpoint_protection.plugin_version":{"type":"string","title":"plugins.endpoint_protection.plugin_version"},"not.plugins.endpoint_protection.plugin_version":{"type":"string","title":"not.plugins.endpoint_protection.plugin_version"},"plugins.endpoint_protection.plugin_version.keyword":{"type":"string","title":"plugins.endpoint_protection.plugin_version.keyword"},"not.plugins.endpoint_protection.plugin_version.keyword":{"type":"string","title":"not.plugins.endpoint_protection.plugin_version.keyword"},"plugins.endpoint_protection.sdk_version":{"type":"string","title":"plugins.endpoint_protection.sdk_version"},"not.plugins.endpoint_protection.sdk_version":{"type":"string","title":"not.plugins.endpoint_protection.sdk_version"},"plugins.endpoint_protection.sdk_version.keyword":{"type":"string","title":"plugins.endpoint_protection.sdk_version.keyword"},"not.plugins.endpoint_protection.sdk_version.keyword":{"type":"string","title":"not.plugins.endpoint_protection.sdk_version.keyword"},"plugins.endpoint_protection.component_package_version":{"type":"string","title":"plugins.endpoint_protection.component_package_version"},"not.plugins.endpoint_protection.component_package_version":{"type":"string","title":"not.plugins.endpoint_protection.component_package_version"},"plugins.endpoint_protection.component_package_version.keyword":{"type":"string","title":"plugins.endpoint_protection.component_package_version.keyword"},"not.plugins.endpoint_protection.component_package_version.keyword":{"type":"string","title":"not.plugins.endpoint_protection.component_package_version.keyword"},"plugins.endpoint_protection.update_package_version":{"type":"string","title":"plugins.endpoint_protection.update_package_version"},"not.plugins.endpoint_protection.update_package_version":{"type":"string","title":"not.plugins.endpoint_protection.update_package_version"},"plugins.endpoint_protection.update_package_version.keyword":{"type":"string","title":"plugins.endpoint_protection.update_package_version.keyword"},"not.plugins.endpoint_protection.update_package_version.keyword":{"type":"string","title":"not.plugins.endpoint_protection.update_package_version.keyword"},"plugins.endpoint_protection.reboot_reasons":{"type":"string","title":"plugins.endpoint_protection.reboot_reasons"},"not.plugins.endpoint_protection.reboot_reasons":{"type":"string","title":"not.plugins.endpoint_protection.reboot_reasons"},"plugins.endpoint_protection.reboot_reasons.keyword":{"type":"string","title":"plugins.endpoint_protection.reboot_reasons.keyword"},"not.plugins.endpoint_protection.reboot_reasons.keyword":{"type":"string","title":"not.plugins.endpoint_protection.reboot_reasons.keyword"},"plugins.endpoint_detection_and_response.plugin_version":{"type":"string","title":"plugins.endpoint_detection_and_response.plugin_version"},"not.plugins.endpoint_detection_and_response.plugin_version":{"type":"string","title":"not.plugins.endpoint_detection_and_response.plugin_version"},"plugins.endpoint_detection_and_response.plugin_version.keyword":{"type":"string","title":"plugins.endpoint_detection_and_response.plugin_version.keyword"},"not.plugins.endpoint_detection_and_response.plugin_version.keyword":{"type":"string","title":"not.plugins.endpoint_detection_and_response.plugin_version.keyword"},"plugins.endpoint_detection_and_response.reboot_reasons":{"type":"string","title":"plugins.endpoint_detection_and_response.reboot_reasons"},"not.plugins.endpoint_detection_and_response.reboot_reasons":{"type":"string","title":"not.plugins.endpoint_detection_and_response.reboot_reasons"},"plugins.endpoint_detection_and_response.reboot_reasons.keyword":{"type":"string","title":"plugins.endpoint_detection_and_response.reboot_reasons.keyword"},"not.plugins.endpoint_detection_and_response.reboot_reasons.keyword":{"type":"string","title":"not.plugins.endpoint_detection_and_response.reboot_reasons.keyword"},"plugins.incident_response.plugin_version":{"type":"string","title":"plugins.incident_response.plugin_version"},"not.plugins.incident_response.plugin_version":{"type":"string","title":"not.plugins.incident_response.plugin_version"},"plugins.incident_response.plugin_version.keyword":{"type":"string","title":"plugins.incident_response.plugin_version.keyword"},"not.plugins.incident_response.plugin_version.keyword":{"type":"string","title":"not.plugins.incident_response.plugin_version.keyword"},"plugins.incident_response.reboot_reasons":{"type":"string","title":"plugins.incident_response.reboot_reasons"},"not.plugins.incident_response.reboot_reasons":{"type":"string","title":"not.plugins.incident_response.reboot_reasons"},"plugins.incident_response.reboot_reasons.keyword":{"type":"string","title":"plugins.incident_response.reboot_reasons.keyword"},"not.plugins.incident_response.reboot_reasons.keyword":{"type":"string","title":"not.plugins.incident_response.reboot_reasons.keyword"},"plugins.siem.plugin_version":{"type":"string","title":"plugins.siem.plugin_version"},"not.plugins.siem.plugin_version":{"type":"string","title":"not.plugins.siem.plugin_version"},"plugins.siem.plugin_version.keyword":{"type":"string","title":"plugins.siem.plugin_version.keyword"},"not.plugins.siem.plugin_version.keyword":{"type":"string","title":"not.plugins.siem.plugin_version.keyword"},"plugins.browser_phishing_protection.plugin_version":{"type":"string","title":"plugins.browser_phishing_protection.plugin_version"},"not.plugins.browser_phishing_protection.plugin_version":{"type":"string","title":"not.plugins.browser_phishing_protection.plugin_version"},"plugins.browser_phishing_protection.plugin_version.keyword":{"type":"string","title":"plugins.browser_phishing_protection.plugin_version.keyword"},"not.plugins.browser_phishing_protection.plugin_version.keyword":{"type":"string","title":"not.plugins.browser_phishing_protection.plugin_version.keyword"},"plugins.browser_phishing_protection.reboot_reasons":{"type":"string","title":"plugins.browser_phishing_protection.reboot_reasons"},"not.plugins.browser_phishing_protection.reboot_reasons":{"type":"string","title":"not.plugins.browser_phishing_protection.reboot_reasons"},"plugins.browser_phishing_protection.reboot_reasons.keyword":{"type":"string","title":"plugins.browser_phishing_protection.reboot_reasons.keyword"},"not.plugins.browser_phishing_protection.reboot_reasons.keyword":{"type":"string","title":"not.plugins.browser_phishing_protection.reboot_reasons.keyword"},"plugins.siem.reboot_reasons":{"type":"string","title":"plugins.siem.reboot_reasons"},"not.plugins.siem.reboot_reasons":{"type":"string","title":"not.plugins.siem.reboot_reasons"},"plugins.siem.reboot_reasons.keyword":{"type":"string","title":"plugins.siem.reboot_reasons.keyword"},"not.plugins.siem.reboot_reasons.keyword":{"type":"string","title":"not.plugins.siem.reboot_reasons.keyword"},"engine_version":{"type":"string","title":"engine_version"},"not.engine_version":{"type":"string","title":"not.engine_version"},"engine_version.keyword":{"type":"string","title":"engine_version.keyword"},"not.engine_version.keyword":{"type":"string","title":"not.engine_version.keyword"},"domain_name":{"type":"string","title":"domain_name"},"not.domain_name":{"type":"string","title":"not.domain_name"},"domain_name.keyword":{"type":"string","title":"domain_name.keyword"},"not.domain_name.keyword":{"type":"string","title":"not.domain_name.keyword"},"policy_etag":{"type":"string","title":"policy_etag"},"not.policy_etag":{"type":"string","title":"not.policy_etag"},"policy_etag.keyword":{"type":"string","title":"policy_etag.keyword"},"not.policy_etag.keyword":{"type":"string","title":"not.policy_etag.keyword"},"last_user":{"type":"string","title":"last_user"},"not.last_user":{"type":"string","title":"not.last_user"},"last_user.keyword":{"type":"string","title":"last_user.keyword"},"not.last_user.keyword":{"type":"string","title":"not.last_user.keyword"},"serial_number":{"type":"string","title":"serial_number"},"not.serial_number":{"type":"string","title":"not.serial_number"},"serial_number.keyword":{"type":"string","title":"serial_number.keyword"},"not.serial_number.keyword":{"type":"string","title":"not.serial_number.keyword"}}},{"type":"object","title":"Active Directory Search Filters","properties":{"active_directory.user.display_name":{"type":"string","title":"Filter the search by active_directory.user.display_name. Search for the matches that are equal to the value"},"active_directory.user.display_name.keyword":{"type":"string","title":"Filter the search by active_directory.user.display_name.keyword. Search for the matches that contain the value"},"active_directory.user.ou":{"type":"string","title":"Filter the search by active_directory.user.ou. Search for the matches that are equal to the value"},"active_directory.user.ou.keyword":{"type":"string","title":"Filter the search by active_directory.user.ou.keyword. Search for the matches that contain the value"},"active_directory.user.ou.path":{"type":"string","title":"Filter the search by active_directory.user.ou.path. Search for the matches that are equal to the value"},"active_directory.user.ou.path.keyword":{"type":"string","title":"Filter the search by active_directory.user.ou.path.keyword. Search for the matches that contain the value"},"active_directory.user.sam_account_name":{"type":"string","title":"Filter the search by active_directory.user.sam_account_name. Search for the matches that are equal to the value"},"active_directory.user.sam_account_name.keyword":{"type":"string","title":"Filter the search by active_directory.user.sam_account_name.keyword. Search for the matches that contain the value"},"active_directory.machine.display_name":{"type":"string","title":"Filter the search by active_directory.machine.display_name. Search for the matches that are equal to the value"},"active_directory.machine.display_name.keyword":{"type":"string","title":"Filter the search by active_directory.machine.display_name.keyword. Search for the matches that contain the value"},"active_directory.machine.ou":{"type":"string","title":"Filter the search by active_directory.machine.ou. Search for the matches that are equal to the value"},"active_directory.machine.ou.keyword":{"type":"string","title":"Filter the search by active_directory.machine.ou.keyword. Search for the matches that contain the value"},"active_directory.machine.ou.path":{"type":"string","title":"Filter the search by active_directory.machine.ou.path. Search for the matches that are equal to the value"},"active_directory.machine.ou.path.keyword":{"type":"string","title":"Filter the search by active_directory.machine.ou.path.keyword. Search for the matches that contain the value"},"active_directory.machine.sam_account_name":{"type":"string","title":"Filter the search by active_directory.machine.sam_account_name. Search for the matches that are equal to the value"},"active_directory.machine.sam_account_name.keyword":{"type":"string","title":"Filter the search by active_directory.machine.sam_account_name.keyword. Search for the matches that contain the value"}}}],"properties":{"id":{"type":"string","title":"Filter the search by DNS event id. Search for an exact match"},"not.id":{"type":"string","title":"Filter the search by not.id. Search for the matches that are not equal to the value"},"machine_id":{"type":"string","title":"Filter the search by machine_id. Search for an exact match"},"machine_id.keyword":{"type":"string","title":"Filter the search by machine_id.keyword. Search for the matches that contain the value"},"not.machine_id":{"type":"string","title":"Filter the search by not.machine_id. Search for the matches that are not equal to the value"},"not.machine_id.keyword":{"type":"string","title":"Filter the search by not.machine_id.keyword. Search for the matches that doesnt contain the value"},"group_id":{"type":"string","title":"Filter the search by group_id. Search for an exact match"},"group_id.keyword":{"type":"string","title":"Filter the search by group_id.keyword. Search for the matches that contain the value"},"not.group_id":{"type":"string","title":"Filter the search by not.group_id. Search for the matches that are not equal to the value"},"not.group_id.keyword":{"type":"string","title":"Filter the search by not.group_id.keyword. Search for the matches that doesnt contain the value"},"group_name":{"type":"string","title":"Filter the search by group_name. Search for an exact match"},"group_name.keyword":{"type":"string","title":"Filter the search by group_name.keyword. Search for the matches that contain the value"},"not.group_name":{"type":"string","title":"Filter the search by not.group_name. Search for the matches that are not equal to the value"},"not.group_name.keyword":{"type":"string","title":"Filter the search by not.group_name.keyword. Search for the matches that doesnt contain the value"},"rule_id":{"type":"string","title":"Filter the search by rule_id. Search for an exact match"},"rule_id.keyword":{"type":"string","title":"Filter the search by rule_id.keyword. Search for the matches that contain the value"},"not.rule_id":{"type":"string","title":"Filter the search by not.rule_id. Search for the matches that are not equal to the value"},"not.rule_id.keyword":{"type":"string","title":"Filter the search by not.rule_id.keyword. Search for the matches that doesnt contain the value"},"rule_name":{"type":"string","title":"Filter the search by rule_name. Search for an exact match"},"rule_name.keyword":{"type":"string","title":"Filter the search by rule_name.keyword. Search for the matches that contain the value"},"not.rule_name":{"type":"string","title":"Filter the search by not.rule_name. Search for the matches that are not equal to the value"},"not.rule_name.keyword":{"type":"string","title":"Filter the search by not.rule_name.keyword. Search for the matches that doesnt contain the value"},"policy_id":{"type":"string","title":"Filter the search by policy_id. Search for an exact match"},"policy_id.keyword":{"type":"string","title":"Filter the search by policy_id.keyword. Search for the matches that contain the value"},"not.policy_id":{"type":"string","title":"Filter the search by not.policy_id. Search for the matches that are not equal to the value"},"not.policy_id.keyword":{"type":"string","title":"Filter the search by not.policy_id.keyword. Search for the matches that doesnt contain the value"},"policy_name":{"type":"string","title":"Filter the search by policy_name. Search for an exact match"},"policy_name.keyword":{"type":"string","title":"Filter the search by policy_name.keyword. Search for the matches that contain the value"},"not.policy_name":{"type":"string","title":"Filter the search by not.policy_name. Search for the matches that are not equal to the value"},"not.policy_name.keyword":{"type":"string","title":"Filter the search by not.policy_name.keyword. Search for the matches that doesnt contain the value"},"account_id":{"type":"string","title":"Filter the search by account_id. Search for an exact match"},"account_id.keyword":{"type":"string","title":"Filter the search by account_id.keyword. Search for the matches that contain the value"},"not.account_id":{"type":"string","title":"Filter the search by not.account_id. Search for the matches that are not equal to the value"},"not.account_id.keyword":{"type":"string","title":"Filter the search by not.account_id.keyword. Search for the matches that doesnt contain the value"},"parent_account_id":{"type":"string","title":"Filter the search by parent_account_id. Search for an exact match"},"parent_account_id.keyword":{"type":"string","title":"Filter the search by parent_account_id.keyword. Search for the matches that contain the value"},"not.parent_account_id":{"type":"string","title":"Filter the search by not.parent_account_id. Search for the matches that are not equal to the value"},"not.parent_account_id.keyword":{"type":"string","title":"Filter the search by not.parent_account_id.keyword. Search for the matches that doesnt contain the value"},"action":{"type":"string","title":"Filter the search by action. Search for an exact match"},"action.keyword":{"type":"string","title":"Filter the search by action.keyword. Search for the matches that contain the value"},"not.action":{"type":"string","title":"Filter the search by not.action. Search for the matches that are not equal to the value"},"not.action.keyword":{"type":"string","title":"Filter the search by not.action.keyword. Search for the matches that doesnt contain the value"},"log.policy_id":{"type":"string","title":"Filter the search by log.policy_id. Search for an exact match"},"log.policy_id.keyword":{"type":"string","title":"Filter the search by log.policy_id.keyword. Search for the matches that contain the value"},"not.log.policy_id":{"type":"string","title":"Filter the search by not.log.policy_id. Search for the matches that are not equal to the value"},"not.log.policy_id.keyword":{"type":"string","title":"Filter the search by not.log.policy_id.keyword. Search for the matches that doesnt contain the value"},"log.policy":{"type":"string","title":"Filter the search by log.policy. Search for an exact match"},"log.policy.keyword":{"type":"string","title":"Filter the search by log.policy.keyword. Search for the matches that contain the value"},"not.log.policy":{"type":"string","title":"Filter the search by not.log.policy. Search for the matches that are not equal to the value"},"not.log.policy.keyword":{"type":"string","title":"Filter the search by not.log.policy.keyword. Search for the matches that doesnt contain the value"},"log.protocol":{"type":"string","title":"Filter the search by log.protocol. Search for an exact match"},"log.protocol.keyword":{"type":"string","title":"Filter the search by log.protocol.keyword. Search for the matches that contain the value"},"not.log.protocol":{"type":"string","title":"Filter the search by not.log.protocol. Search for the matches that are not equal to the value"},"not.log.protocol.keyword":{"type":"string","title":"Filter the search by not.log.protocol.keyword. Search for the matches that doesnt contain the value"},"log.query_name":{"type":"string","title":"Filter the search by log.query_name. Search for an exact match"},"log.query_name.keyword":{"type":"string","title":"Filter the search by log.query_name.keyword. Search for the matches that contain the value"},"not.log.query_name":{"type":"string","title":"Filter the search by not.log.query_name. Search for the matches that are not equal to the value"},"not.log.query_name.keyword":{"type":"string","title":"Filter the search by not.log.query_name.keyword. Search for the matches that doesnt contain the value"},"log.query_name_reversed":{"type":"string","title":"Filter the search by log.query_name_reversed. Search for an exact match"},"log.query_name_reversed.keyword":{"type":"string","title":"Filter the search by log.query_name_reversed.keyword. Search for the matches that contain the value"},"not.log.query_name_reversed":{"type":"string","title":"Filter the search by not.log.query_name_reversed. Search for the matches that are not equal to the value"},"not.log.query_name_reversed.keyword":{"type":"string","title":"Filter the search by not.log.query_name_reversed.keyword. Search for the matches that doesnt contain the value"},"log.resolver_decision":{"type":"string","title":"Filter the search by log.resolver_decision. Search for an exact match"},"log.resolver_decision.keyword":{"type":"string","title":"Filter the search by log.resolver_decision.keyword. Search for the matches that contain the value"},"not.log.resolver_decision":{"type":"string","title":"Filter the search by not.log.resolver_decision. Search for the matches that are not equal to the value"},"not.log.resolver_decision.keyword":{"type":"string","title":"Filter the search by not.log.resolver_decision.keyword. Search for the matches that doesnt contain the value"},"log.user_id":{"type":"string","title":"Filter the search by log.user_id. Search for an exact match"},"log.user_id.keyword":{"type":"string","title":"Filter the search by log.user_id.keyword. Search for the matches that contain the value"},"not.log.user_id":{"type":"string","title":"Filter the search by not.log.user_id. Search for the matches that are not equal to the value"},"not.log.user_id.keyword":{"type":"string","title":"Filter the search by not.log.user_id.keyword. Search for the matches that doesnt contain the value"},"log.colo_id":{"type":"number","title":"Filter the search by log.colo_id. Search for an exact match of the integer value"},"log.colo_id_lt":{"type":"number","title":"Filter the search by log.colo_id_lt. Search for the documents that are less than the value"},"log.colo_id_lte":{"type":"number","title":"Filter the search by log.colo_id_lte. Search for the documents that are less or equal than the value"},"log.colo_id_gt":{"type":"number","title":"Filter the search by log.colo_id_gt. Search for the documents that are greater than the value"},"log.colo_id_gte":{"type":"number","title":"Filter the search by log.colo_id_gte. Search for the documents that are greater or equal than the value"},"log.dst_port":{"type":"number","title":"Filter the search by log.dst_port. Search for an exact match of the integer value"},"log.dst_port_lt":{"type":"number","title":"Filter the search by log.dst_port_lt. Search for the documents that are less than the value"},"log.dst_port_lte":{"type":"number","title":"Filter the search by log.dst_port_lte. Search for the documents that are less or equal than the value"},"log.dst_port_gt":{"type":"number","title":"Filter the search by log.dst_port_gt. Search for the documents that are greater than the value"},"log.dst_port_gte":{"type":"number","title":"Filter the search by log.dst_port_gte. Search for the documents that are greater or equal than the value"},"log.query_category_ids":{"type":"array","items":{"type":"number"},"title":"Filter the search by log.query_category_ids. Search for an exact match of the integer value"},"log.query_size":{"type":"number","title":"Filter the search by log.query_size. Search for an exact match of the integer value"},"log.query_size_lt":{"type":"number","title":"Filter the search by log.query_size_lt. Search for the documents that are less than the value"},"log.query_size_lte":{"type":"number","title":"Filter the search by log.query_size_lte. Search for the documents that are less or equal than the value"},"log.query_size_gt":{"type":"number","title":"Filter the search by log.query_size_gt. Search for the documents that are greater than the value"},"log.query_size_gte":{"type":"number","title":"Filter the search by log.query_size_gte. Search for the documents that are greater or equal than the value"},"log.query_type":{"type":"number","title":"Filter the search by log.query_type. Search for an exact match of the integer value"},"log.query_type_lt":{"type":"number","title":"Filter the search by log.query_type_lt. Search for the documents that are less than the value"},"log.query_type_lte":{"type":"number","title":"Filter the search by log.query_type_lte. Search for the documents that are less or equal than the value"},"log.query_type_gt":{"type":"number","title":"Filter the search by log.query_type_gt. Search for the documents that are greater than the value"},"log.query_type_gte":{"type":"number","title":"Filter the search by log.query_type_gte. Search for the documents that are greater or equal than the value"},"log.src_port":{"type":"number","title":"Filter the search by log.src_port. Search for an exact match of the integer value"},"log.src_port_lt":{"type":"number","title":"Filter the search by log.src_port_lt. Search for the documents that are less than the value"},"log.src_port_lte":{"type":"number","title":"Filter the search by log.src_port_lte. Search for the documents that are less or equal than the value"},"log.src_port_gt":{"type":"number","title":"Filter the search by log.src_port_gt. Search for the documents that are greater than the value"},"log.src_port_gte":{"type":"number","title":"Filter the search by log.src_port_gte. Search for the documents that are greater or equal than the value"},"log.datetime_before":{"type":"string","format":"date-time","title":"Filter the search by log.datetime_before. Search for the documents that are after the given timestamp"},"log.datetime_after":{"type":"string","format":"date-time","title":"Filter the search by log.datetime_after. "},"timestamp_before":{"type":"string","format":"date-time","title":"Filter the search by timestamp_before. Search for the documents that are after the given timestamp"},"timestamp_after":{"type":"string","format":"date-time","title":"Filter the search by timestamp_after. "},"log.dst_ip":{"type":"string","format":"ipv4","title":"Filter the search by log.dst_ip. Search for an exact match"},"not.log.dst_ip":{"type":"string","format":"ipv4","title":"Filter the search by not.log.dst_ip. Search for the matches that are not equal to the value"},"log.src_ip":{"type":"string","format":"ipv4","title":"Filter the search by log.src_ip. Search for an exact match"},"not.log.src_ip":{"type":"string","format":"ipv4","title":"Filter the search by not.log.src_ip. Search for the matches that are not equal to the value"},"resolved_ips":{"type":"string","title":"Filter the search by resolved_ips. Search for an exact match"},"not.resolved_ips":{"type":"string","title":"Filter the search by not.resolved_ips. Search for the matches that are not equal to the value"},"sort_field":{"type":"string","title":"Sort field","enum":["machine_id","group_id","group_name","rule_id","rule_name","resolved_ips","policy_id","policy_name","account_id","parent_account_id","action","log.policy_id","log.policy","log.protocol","log.query_name","log.query_name_reversed","log.resolver_decision","log.user_id","log.colo_id","log.dst_port","log.query_category_ids","log.query_size","log.query_type","log.src_port","log.dst_ip","log.src_ip","timestamp","log.datetime","agent.at","agent.last_user","agent.fully_qualified_host_name","agent.started_at_local","agent.started_at_offset","agent.os_info.os_type","agent.os_info.os_version","agent.os_info.os_platform","agent.os_info.os_architecture","agent.os_info.os_release_name","agent.domain_name","agent.engine_version","agent.policy_etag","agent.host_name","agent.nics.ips","agent.nics.mac_address","machine.tags.alias","agent.has_alerts","agent.machine_ip","agent.object_guid","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.source_location.city","agent.source_location.country","agent.source_location.country_iso","agent.source_location.continent","agent.source_location.time_zone","agent.source_location.postal_code","agent.source_location.subdivisions","agent.source_location.anonymous_proxy","agent.serial_number","active_directory.user.display_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.machine.display_name","active_directory.machine.sam_account_name","active_directory.machine.ou"]},"populate":{"type":"object","title":"Populate object schema","properties":{"group":{"type":"boolean","title":"Populates group data (group name, policy name, policy id)"},"endpoint":{"type":"boolean","title":"Populate with the endpoint data (last day seen, last user)"}}},"sort_order":{"type":"string","title":"Sorting direction","default":"asc","enum":["asc","desc"]},"page_size":{"type":"number","title":"The size of the page. If you only need aggregations, set it to 0","minimum":0,"default":50,"maximum":2000},"aggregations":{"type":"array","title":"The Aggregations Schema","items":{"type":"string","title":"Aggregations","default":[],"enum":["machine_id","group_id","rule_id","rule_name","resolved_ips","group_name","policy_id","policy_name","account_id","parent_account_id","action","log.policy_id","log.policy","log.protocol","log.query_name","log.query_name_reversed","log.resolver_decision","log.user_id","log.colo_id","log.dst_port","log.query_category_ids","log.query_size","log.query_type","log.src_port","log.dst_ip","log.src_ip","timestamp","log.datetime","agent.at","agent.last_user","agent.fully_qualified_host_name","agent.started_at_local","agent.started_at_offset","agent.os_info.os_type","agent.os_info.os_version","agent.os_info.os_platform","agent.os_info.os_architecture","agent.os_info.os_release_name","agent.domain_name","agent.engine_version","agent.policy_etag","agent.host_name","agent.nics.ips","agent.nics.mac_address","machine.tags.alias","agent.has_alerts","agent.machine_ip","agent.object_guid","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.source_location.city","agent.source_location.country","agent.source_location.country_iso","agent.source_location.continent","agent.source_location.time_zone","agent.source_location.postal_code","agent.source_location.subdivisions","agent.source_location.anonymous_proxy","agent.serial_number","daily_logs"]}},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}},{"type":"object","required":["account_ids"],"properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Search DNS Logs result","properties":{"results":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"@timestamp":{"type":"string"},"machine_id":{"type":"string"},"group_id":{"type":"string"},"group_name":{"type":"string"},"account_id":{"type":"string"},"policy_id":{"type":"string"},"policy_name":{"type":"string"},"parent_account_id":{"type":"string"},"action":{"type":"string"},"log":{"properties":{"colo_id":{"type":"number"},"datetime":{"type":"string"},"device_id":{"type":"string"},"dst_ip":{"type":"string"},"dst_port":{"type":"integer"},"email":{"type":"string"},"location":{"type":"string"},"policy":{"type":"string"},"policy_id":{"type":"string"},"protocol":{"type":"string"},"query_category_ids":{"type":"array"},"query_name":{"type":"string"},"query_name_reversed":{"type":"string"},"query_size":{"type":"number"},"query_type":{"type":"integer"},"resolver_decision":{"type":"string"},"src_ip":{"type":"string"},"src_port":{"type":"integer"},"user_id":{"type":"string"}}},"rule_id":{"type":"string","description":"Content filtering rule id"},"rule_name":{"type":"string","description":"Content filtering rule name"}}}},"aggregations":{"type":"object","title":"Aggregations","additionalProperties":true},"total_count":{"type":"integer","title":"Total count of found detections"},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}},"required":["results","total_count"]}}}}},"tags":["DNS"],"operationId":"api.v2.rmm.search.dns"}},"/oneview/v1/dns/search-groupby":{"post":{"description":"Search DNS Logs grouped by a specific field across all your managed accounts.","summary":"Search DNS Logs groupBy","security":[{"client_credentials":["read"]},{"user_permissions":["dnsFiltering.view"]}],"status":{"incident":["read_nebula_data"],"outage":["auth","search_stateful"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"allOf":[{"type":"object","title":"The Post DNS Search GroupBy Request Schema","required":["group_by","page_size"],"allOf":[{"type":"object","title":"Search DNS Logs request. Leading wildcards are not supported for constraint fields without '.keyword' suffix.","allOf":[{"type":"object","title":"Agent constraints","description":"The Agents constraints.","properties":{"nics.mac_address":{"type":"string","title":"nics.mac_address"},"not.nics.mac_address":{"type":"string","title":"not.nics.mac_address"},"nics.mac_address.keyword":{"type":"string","title":"nics.mac_address.keyword"},"not.nics.mac_address.keyword":{"type":"string","title":"not.nics.mac_address.keyword"},"nics.description":{"type":"string","title":"nics.description"},"not.nics.description":{"type":"string","title":"not.nics.description"},"nics.description.keyword":{"type":"string","title":"nics.description.keyword"},"not.nics.description.keyword":{"type":"string","title":"not.nics.description.keyword"},"os_info.os_type":{"type":"string","title":"os_info.os_type"},"not.os_info.os_type":{"type":"string","title":"not.os_info.os_type"},"os_info.os_type.keyword":{"type":"string","title":"os_info.os_type.keyword"},"not.os_info.os_type.keyword":{"type":"string","title":"not.os_info.os_type.keyword"},"os_info.os_version":{"type":"string","title":"os_info.os_version"},"not.os_info.os_version":{"type":"string","title":"not.os_info.os_version"},"os_info.os_version.keyword":{"type":"string","title":"os_info.os_version.keyword"},"not.os_info.os_version.keyword":{"type":"string","title":"not.os_info.os_version.keyword"},"os_info.os_platform":{"type":"string","title":"os_info.os_platform"},"not.os_info.os_platform":{"type":"string","title":"not.os_info.os_platform"},"os_info.os_platform.keyword":{"type":"string","title":"os_info.os_platform.keyword"},"not.os_info.os_platform.keyword":{"type":"string","title":"not.os_info.os_platform.keyword"},"os_info.os_architecture":{"type":"string","title":"os_info.os_architecture"},"not.os_info.os_architecture":{"type":"string","title":"not.os_info.os_architecture"},"os_info.os_architecture.keyword":{"type":"string","title":"os_info.os_architecture.keyword"},"not.os_info.os_architecture.keyword":{"type":"string","title":"not.os_info.os_architecture.keyword"},"os_info.os_release_name":{"type":"string","title":"os_info.os_release_name"},"not.os_info.os_release_name":{"type":"string","title":"not.os_info.os_release_name"},"os_info.os_release_name.keyword":{"type":"string","title":"os_info.os_release_name.keyword"},"not.os_info.os_release_name.keyword":{"type":"string","title":"not.os_info.os_release_name.keyword"},"host_name":{"type":"string","title":"host_name"},"not.host_name":{"type":"string","title":"not.host_name"},"host_name.keyword":{"type":"string","title":"host_name.keyword"},"not.host_name.keyword":{"type":"string","title":"not.host_name.keyword"},"fully_qualified_host_name":{"type":"string","title":"fully_qualified_host_name"},"not.fully_qualified_host_name":{"type":"string","title":"not.fully_qualified_host_name"},"fully_qualified_host_name.keyword":{"type":"string","title":"fully_qualified_host_name.keyword"},"not.fully_qualified_host_name.keyword":{"type":"string","title":"not.fully_qualified_host_name.keyword"},"plugins.asset_manager.plugin_version":{"type":"string","title":"plugins.asset_manager.plugin_version"},"not.plugins.asset_manager.plugin_version":{"type":"string","title":"not.plugins.asset_manager.plugin_version"},"plugins.asset_manager.plugin_version.keyword":{"type":"string","title":"plugins.asset_manager.plugin_version.keyword"},"not.plugins.asset_manager.plugin_version.keyword":{"type":"string","title":"not.plugins.asset_manager.plugin_version.keyword"},"plugins.asset_manager.reboot_reasons":{"type":"string","title":"plugins.asset_manager.reboot_reasons"},"not.plugins.asset_manager.reboot_reasons":{"type":"string","title":"not.plugins.asset_manager.reboot_reasons"},"plugins.asset_manager.reboot_reasons.keyword":{"type":"string","title":"plugins.asset_manager.reboot_reasons.keyword"},"not.plugins.asset_manager.reboot_reasons.keyword":{"type":"string","title":"not.plugins.asset_manager.reboot_reasons.keyword"},"plugins.endpoint_protection.plugin_version":{"type":"string","title":"plugins.endpoint_protection.plugin_version"},"not.plugins.endpoint_protection.plugin_version":{"type":"string","title":"not.plugins.endpoint_protection.plugin_version"},"plugins.endpoint_protection.plugin_version.keyword":{"type":"string","title":"plugins.endpoint_protection.plugin_version.keyword"},"not.plugins.endpoint_protection.plugin_version.keyword":{"type":"string","title":"not.plugins.endpoint_protection.plugin_version.keyword"},"plugins.endpoint_protection.sdk_version":{"type":"string","title":"plugins.endpoint_protection.sdk_version"},"not.plugins.endpoint_protection.sdk_version":{"type":"string","title":"not.plugins.endpoint_protection.sdk_version"},"plugins.endpoint_protection.sdk_version.keyword":{"type":"string","title":"plugins.endpoint_protection.sdk_version.keyword"},"not.plugins.endpoint_protection.sdk_version.keyword":{"type":"string","title":"not.plugins.endpoint_protection.sdk_version.keyword"},"plugins.endpoint_protection.component_package_version":{"type":"string","title":"plugins.endpoint_protection.component_package_version"},"not.plugins.endpoint_protection.component_package_version":{"type":"string","title":"not.plugins.endpoint_protection.component_package_version"},"plugins.endpoint_protection.component_package_version.keyword":{"type":"string","title":"plugins.endpoint_protection.component_package_version.keyword"},"not.plugins.endpoint_protection.component_package_version.keyword":{"type":"string","title":"not.plugins.endpoint_protection.component_package_version.keyword"},"plugins.endpoint_protection.update_package_version":{"type":"string","title":"plugins.endpoint_protection.update_package_version"},"not.plugins.endpoint_protection.update_package_version":{"type":"string","title":"not.plugins.endpoint_protection.update_package_version"},"plugins.endpoint_protection.update_package_version.keyword":{"type":"string","title":"plugins.endpoint_protection.update_package_version.keyword"},"not.plugins.endpoint_protection.update_package_version.keyword":{"type":"string","title":"not.plugins.endpoint_protection.update_package_version.keyword"},"plugins.endpoint_protection.reboot_reasons":{"type":"string","title":"plugins.endpoint_protection.reboot_reasons"},"not.plugins.endpoint_protection.reboot_reasons":{"type":"string","title":"not.plugins.endpoint_protection.reboot_reasons"},"plugins.endpoint_protection.reboot_reasons.keyword":{"type":"string","title":"plugins.endpoint_protection.reboot_reasons.keyword"},"not.plugins.endpoint_protection.reboot_reasons.keyword":{"type":"string","title":"not.plugins.endpoint_protection.reboot_reasons.keyword"},"plugins.endpoint_detection_and_response.plugin_version":{"type":"string","title":"plugins.endpoint_detection_and_response.plugin_version"},"not.plugins.endpoint_detection_and_response.plugin_version":{"type":"string","title":"not.plugins.endpoint_detection_and_response.plugin_version"},"plugins.endpoint_detection_and_response.plugin_version.keyword":{"type":"string","title":"plugins.endpoint_detection_and_response.plugin_version.keyword"},"not.plugins.endpoint_detection_and_response.plugin_version.keyword":{"type":"string","title":"not.plugins.endpoint_detection_and_response.plugin_version.keyword"},"plugins.endpoint_detection_and_response.reboot_reasons":{"type":"string","title":"plugins.endpoint_detection_and_response.reboot_reasons"},"not.plugins.endpoint_detection_and_response.reboot_reasons":{"type":"string","title":"not.plugins.endpoint_detection_and_response.reboot_reasons"},"plugins.endpoint_detection_and_response.reboot_reasons.keyword":{"type":"string","title":"plugins.endpoint_detection_and_response.reboot_reasons.keyword"},"not.plugins.endpoint_detection_and_response.reboot_reasons.keyword":{"type":"string","title":"not.plugins.endpoint_detection_and_response.reboot_reasons.keyword"},"plugins.incident_response.plugin_version":{"type":"string","title":"plugins.incident_response.plugin_version"},"not.plugins.incident_response.plugin_version":{"type":"string","title":"not.plugins.incident_response.plugin_version"},"plugins.incident_response.plugin_version.keyword":{"type":"string","title":"plugins.incident_response.plugin_version.keyword"},"not.plugins.incident_response.plugin_version.keyword":{"type":"string","title":"not.plugins.incident_response.plugin_version.keyword"},"plugins.incident_response.reboot_reasons":{"type":"string","title":"plugins.incident_response.reboot_reasons"},"not.plugins.incident_response.reboot_reasons":{"type":"string","title":"not.plugins.incident_response.reboot_reasons"},"plugins.incident_response.reboot_reasons.keyword":{"type":"string","title":"plugins.incident_response.reboot_reasons.keyword"},"not.plugins.incident_response.reboot_reasons.keyword":{"type":"string","title":"not.plugins.incident_response.reboot_reasons.keyword"},"plugins.siem.plugin_version":{"type":"string","title":"plugins.siem.plugin_version"},"not.plugins.siem.plugin_version":{"type":"string","title":"not.plugins.siem.plugin_version"},"plugins.siem.plugin_version.keyword":{"type":"string","title":"plugins.siem.plugin_version.keyword"},"not.plugins.siem.plugin_version.keyword":{"type":"string","title":"not.plugins.siem.plugin_version.keyword"},"plugins.browser_phishing_protection.plugin_version":{"type":"string","title":"plugins.browser_phishing_protection.plugin_version"},"not.plugins.browser_phishing_protection.plugin_version":{"type":"string","title":"not.plugins.browser_phishing_protection.plugin_version"},"plugins.browser_phishing_protection.plugin_version.keyword":{"type":"string","title":"plugins.browser_phishing_protection.plugin_version.keyword"},"not.plugins.browser_phishing_protection.plugin_version.keyword":{"type":"string","title":"not.plugins.browser_phishing_protection.plugin_version.keyword"},"plugins.browser_phishing_protection.reboot_reasons":{"type":"string","title":"plugins.browser_phishing_protection.reboot_reasons"},"not.plugins.browser_phishing_protection.reboot_reasons":{"type":"string","title":"not.plugins.browser_phishing_protection.reboot_reasons"},"plugins.browser_phishing_protection.reboot_reasons.keyword":{"type":"string","title":"plugins.browser_phishing_protection.reboot_reasons.keyword"},"not.plugins.browser_phishing_protection.reboot_reasons.keyword":{"type":"string","title":"not.plugins.browser_phishing_protection.reboot_reasons.keyword"},"plugins.siem.reboot_reasons":{"type":"string","title":"plugins.siem.reboot_reasons"},"not.plugins.siem.reboot_reasons":{"type":"string","title":"not.plugins.siem.reboot_reasons"},"plugins.siem.reboot_reasons.keyword":{"type":"string","title":"plugins.siem.reboot_reasons.keyword"},"not.plugins.siem.reboot_reasons.keyword":{"type":"string","title":"not.plugins.siem.reboot_reasons.keyword"},"engine_version":{"type":"string","title":"engine_version"},"not.engine_version":{"type":"string","title":"not.engine_version"},"engine_version.keyword":{"type":"string","title":"engine_version.keyword"},"not.engine_version.keyword":{"type":"string","title":"not.engine_version.keyword"},"domain_name":{"type":"string","title":"domain_name"},"not.domain_name":{"type":"string","title":"not.domain_name"},"domain_name.keyword":{"type":"string","title":"domain_name.keyword"},"not.domain_name.keyword":{"type":"string","title":"not.domain_name.keyword"},"policy_etag":{"type":"string","title":"policy_etag"},"not.policy_etag":{"type":"string","title":"not.policy_etag"},"policy_etag.keyword":{"type":"string","title":"policy_etag.keyword"},"not.policy_etag.keyword":{"type":"string","title":"not.policy_etag.keyword"},"last_user":{"type":"string","title":"last_user"},"not.last_user":{"type":"string","title":"not.last_user"},"last_user.keyword":{"type":"string","title":"last_user.keyword"},"not.last_user.keyword":{"type":"string","title":"not.last_user.keyword"},"serial_number":{"type":"string","title":"serial_number"},"not.serial_number":{"type":"string","title":"not.serial_number"},"serial_number.keyword":{"type":"string","title":"serial_number.keyword"},"not.serial_number.keyword":{"type":"string","title":"not.serial_number.keyword"}}},{"type":"object","title":"Active Directory Search Filters","properties":{"active_directory.user.display_name":{"type":"string","title":"Filter the search by active_directory.user.display_name. Search for the matches that are equal to the value"},"active_directory.user.display_name.keyword":{"type":"string","title":"Filter the search by active_directory.user.display_name.keyword. Search for the matches that contain the value"},"active_directory.user.ou":{"type":"string","title":"Filter the search by active_directory.user.ou. Search for the matches that are equal to the value"},"active_directory.user.ou.keyword":{"type":"string","title":"Filter the search by active_directory.user.ou.keyword. Search for the matches that contain the value"},"active_directory.user.ou.path":{"type":"string","title":"Filter the search by active_directory.user.ou.path. Search for the matches that are equal to the value"},"active_directory.user.ou.path.keyword":{"type":"string","title":"Filter the search by active_directory.user.ou.path.keyword. Search for the matches that contain the value"},"active_directory.user.sam_account_name":{"type":"string","title":"Filter the search by active_directory.user.sam_account_name. Search for the matches that are equal to the value"},"active_directory.user.sam_account_name.keyword":{"type":"string","title":"Filter the search by active_directory.user.sam_account_name.keyword. Search for the matches that contain the value"},"active_directory.machine.display_name":{"type":"string","title":"Filter the search by active_directory.machine.display_name. Search for the matches that are equal to the value"},"active_directory.machine.display_name.keyword":{"type":"string","title":"Filter the search by active_directory.machine.display_name.keyword. Search for the matches that contain the value"},"active_directory.machine.ou":{"type":"string","title":"Filter the search by active_directory.machine.ou. Search for the matches that are equal to the value"},"active_directory.machine.ou.keyword":{"type":"string","title":"Filter the search by active_directory.machine.ou.keyword. Search for the matches that contain the value"},"active_directory.machine.ou.path":{"type":"string","title":"Filter the search by active_directory.machine.ou.path. Search for the matches that are equal to the value"},"active_directory.machine.ou.path.keyword":{"type":"string","title":"Filter the search by active_directory.machine.ou.path.keyword. Search for the matches that contain the value"},"active_directory.machine.sam_account_name":{"type":"string","title":"Filter the search by active_directory.machine.sam_account_name. Search for the matches that are equal to the value"},"active_directory.machine.sam_account_name.keyword":{"type":"string","title":"Filter the search by active_directory.machine.sam_account_name.keyword. Search for the matches that contain the value"}}}],"properties":{"id":{"type":"string","title":"Filter the search by DNS event id. Search for an exact match"},"not.id":{"type":"string","title":"Filter the search by not.id. Search for the matches that are not equal to the value"},"machine_id":{"type":"string","title":"Filter the search by machine_id. Search for an exact match"},"machine_id.keyword":{"type":"string","title":"Filter the search by machine_id.keyword. Search for the matches that contain the value"},"not.machine_id":{"type":"string","title":"Filter the search by not.machine_id. Search for the matches that are not equal to the value"},"not.machine_id.keyword":{"type":"string","title":"Filter the search by not.machine_id.keyword. Search for the matches that doesnt contain the value"},"group_id":{"type":"string","title":"Filter the search by group_id. Search for an exact match"},"group_id.keyword":{"type":"string","title":"Filter the search by group_id.keyword. Search for the matches that contain the value"},"not.group_id":{"type":"string","title":"Filter the search by not.group_id. Search for the matches that are not equal to the value"},"not.group_id.keyword":{"type":"string","title":"Filter the search by not.group_id.keyword. Search for the matches that doesnt contain the value"},"group_name":{"type":"string","title":"Filter the search by group_name. Search for an exact match"},"group_name.keyword":{"type":"string","title":"Filter the search by group_name.keyword. Search for the matches that contain the value"},"not.group_name":{"type":"string","title":"Filter the search by not.group_name. Search for the matches that are not equal to the value"},"not.group_name.keyword":{"type":"string","title":"Filter the search by not.group_name.keyword. Search for the matches that doesnt contain the value"},"rule_id":{"type":"string","title":"Filter the search by rule_id. Search for an exact match"},"rule_id.keyword":{"type":"string","title":"Filter the search by rule_id.keyword. Search for the matches that contain the value"},"not.rule_id":{"type":"string","title":"Filter the search by not.rule_id. Search for the matches that are not equal to the value"},"not.rule_id.keyword":{"type":"string","title":"Filter the search by not.rule_id.keyword. Search for the matches that doesnt contain the value"},"rule_name":{"type":"string","title":"Filter the search by rule_name. Search for an exact match"},"rule_name.keyword":{"type":"string","title":"Filter the search by rule_name.keyword. Search for the matches that contain the value"},"not.rule_name":{"type":"string","title":"Filter the search by not.rule_name. Search for the matches that are not equal to the value"},"not.rule_name.keyword":{"type":"string","title":"Filter the search by not.rule_name.keyword. Search for the matches that doesnt contain the value"},"policy_id":{"type":"string","title":"Filter the search by policy_id. Search for an exact match"},"policy_id.keyword":{"type":"string","title":"Filter the search by policy_id.keyword. Search for the matches that contain the value"},"not.policy_id":{"type":"string","title":"Filter the search by not.policy_id. Search for the matches that are not equal to the value"},"not.policy_id.keyword":{"type":"string","title":"Filter the search by not.policy_id.keyword. Search for the matches that doesnt contain the value"},"policy_name":{"type":"string","title":"Filter the search by policy_name. Search for an exact match"},"policy_name.keyword":{"type":"string","title":"Filter the search by policy_name.keyword. Search for the matches that contain the value"},"not.policy_name":{"type":"string","title":"Filter the search by not.policy_name. Search for the matches that are not equal to the value"},"not.policy_name.keyword":{"type":"string","title":"Filter the search by not.policy_name.keyword. Search for the matches that doesnt contain the value"},"account_id":{"type":"string","title":"Filter the search by account_id. Search for an exact match"},"account_id.keyword":{"type":"string","title":"Filter the search by account_id.keyword. Search for the matches that contain the value"},"not.account_id":{"type":"string","title":"Filter the search by not.account_id. Search for the matches that are not equal to the value"},"not.account_id.keyword":{"type":"string","title":"Filter the search by not.account_id.keyword. Search for the matches that doesnt contain the value"},"parent_account_id":{"type":"string","title":"Filter the search by parent_account_id. Search for an exact match"},"parent_account_id.keyword":{"type":"string","title":"Filter the search by parent_account_id.keyword. Search for the matches that contain the value"},"not.parent_account_id":{"type":"string","title":"Filter the search by not.parent_account_id. Search for the matches that are not equal to the value"},"not.parent_account_id.keyword":{"type":"string","title":"Filter the search by not.parent_account_id.keyword. Search for the matches that doesnt contain the value"},"action":{"type":"string","title":"Filter the search by action. Search for an exact match"},"action.keyword":{"type":"string","title":"Filter the search by action.keyword. Search for the matches that contain the value"},"not.action":{"type":"string","title":"Filter the search by not.action. Search for the matches that are not equal to the value"},"not.action.keyword":{"type":"string","title":"Filter the search by not.action.keyword. Search for the matches that doesnt contain the value"},"log.policy_id":{"type":"string","title":"Filter the search by log.policy_id. Search for an exact match"},"log.policy_id.keyword":{"type":"string","title":"Filter the search by log.policy_id.keyword. Search for the matches that contain the value"},"not.log.policy_id":{"type":"string","title":"Filter the search by not.log.policy_id. Search for the matches that are not equal to the value"},"not.log.policy_id.keyword":{"type":"string","title":"Filter the search by not.log.policy_id.keyword. Search for the matches that doesnt contain the value"},"log.policy":{"type":"string","title":"Filter the search by log.policy. Search for an exact match"},"log.policy.keyword":{"type":"string","title":"Filter the search by log.policy.keyword. Search for the matches that contain the value"},"not.log.policy":{"type":"string","title":"Filter the search by not.log.policy. Search for the matches that are not equal to the value"},"not.log.policy.keyword":{"type":"string","title":"Filter the search by not.log.policy.keyword. Search for the matches that doesnt contain the value"},"log.protocol":{"type":"string","title":"Filter the search by log.protocol. Search for an exact match"},"log.protocol.keyword":{"type":"string","title":"Filter the search by log.protocol.keyword. Search for the matches that contain the value"},"not.log.protocol":{"type":"string","title":"Filter the search by not.log.protocol. Search for the matches that are not equal to the value"},"not.log.protocol.keyword":{"type":"string","title":"Filter the search by not.log.protocol.keyword. Search for the matches that doesnt contain the value"},"log.query_name":{"type":"string","title":"Filter the search by log.query_name. Search for an exact match"},"log.query_name.keyword":{"type":"string","title":"Filter the search by log.query_name.keyword. Search for the matches that contain the value"},"not.log.query_name":{"type":"string","title":"Filter the search by not.log.query_name. Search for the matches that are not equal to the value"},"not.log.query_name.keyword":{"type":"string","title":"Filter the search by not.log.query_name.keyword. Search for the matches that doesnt contain the value"},"log.query_name_reversed":{"type":"string","title":"Filter the search by log.query_name_reversed. Search for an exact match"},"log.query_name_reversed.keyword":{"type":"string","title":"Filter the search by log.query_name_reversed.keyword. Search for the matches that contain the value"},"not.log.query_name_reversed":{"type":"string","title":"Filter the search by not.log.query_name_reversed. Search for the matches that are not equal to the value"},"not.log.query_name_reversed.keyword":{"type":"string","title":"Filter the search by not.log.query_name_reversed.keyword. Search for the matches that doesnt contain the value"},"log.resolver_decision":{"type":"string","title":"Filter the search by log.resolver_decision. Search for an exact match"},"log.resolver_decision.keyword":{"type":"string","title":"Filter the search by log.resolver_decision.keyword. Search for the matches that contain the value"},"not.log.resolver_decision":{"type":"string","title":"Filter the search by not.log.resolver_decision. Search for the matches that are not equal to the value"},"not.log.resolver_decision.keyword":{"type":"string","title":"Filter the search by not.log.resolver_decision.keyword. Search for the matches that doesnt contain the value"},"log.user_id":{"type":"string","title":"Filter the search by log.user_id. Search for an exact match"},"log.user_id.keyword":{"type":"string","title":"Filter the search by log.user_id.keyword. Search for the matches that contain the value"},"not.log.user_id":{"type":"string","title":"Filter the search by not.log.user_id. Search for the matches that are not equal to the value"},"not.log.user_id.keyword":{"type":"string","title":"Filter the search by not.log.user_id.keyword. Search for the matches that doesnt contain the value"},"log.colo_id":{"type":"number","title":"Filter the search by log.colo_id. Search for an exact match of the integer value"},"log.colo_id_lt":{"type":"number","title":"Filter the search by log.colo_id_lt. Search for the documents that are less than the value"},"log.colo_id_lte":{"type":"number","title":"Filter the search by log.colo_id_lte. Search for the documents that are less or equal than the value"},"log.colo_id_gt":{"type":"number","title":"Filter the search by log.colo_id_gt. Search for the documents that are greater than the value"},"log.colo_id_gte":{"type":"number","title":"Filter the search by log.colo_id_gte. Search for the documents that are greater or equal than the value"},"log.dst_port":{"type":"number","title":"Filter the search by log.dst_port. Search for an exact match of the integer value"},"log.dst_port_lt":{"type":"number","title":"Filter the search by log.dst_port_lt. Search for the documents that are less than the value"},"log.dst_port_lte":{"type":"number","title":"Filter the search by log.dst_port_lte. Search for the documents that are less or equal than the value"},"log.dst_port_gt":{"type":"number","title":"Filter the search by log.dst_port_gt. Search for the documents that are greater than the value"},"log.dst_port_gte":{"type":"number","title":"Filter the search by log.dst_port_gte. Search for the documents that are greater or equal than the value"},"log.query_category_ids":{"type":"array","items":{"type":"number"},"title":"Filter the search by log.query_category_ids. Search for an exact match of the integer value"},"log.query_size":{"type":"number","title":"Filter the search by log.query_size. Search for an exact match of the integer value"},"log.query_size_lt":{"type":"number","title":"Filter the search by log.query_size_lt. Search for the documents that are less than the value"},"log.query_size_lte":{"type":"number","title":"Filter the search by log.query_size_lte. Search for the documents that are less or equal than the value"},"log.query_size_gt":{"type":"number","title":"Filter the search by log.query_size_gt. Search for the documents that are greater than the value"},"log.query_size_gte":{"type":"number","title":"Filter the search by log.query_size_gte. Search for the documents that are greater or equal than the value"},"log.query_type":{"type":"number","title":"Filter the search by log.query_type. Search for an exact match of the integer value"},"log.query_type_lt":{"type":"number","title":"Filter the search by log.query_type_lt. Search for the documents that are less than the value"},"log.query_type_lte":{"type":"number","title":"Filter the search by log.query_type_lte. Search for the documents that are less or equal than the value"},"log.query_type_gt":{"type":"number","title":"Filter the search by log.query_type_gt. Search for the documents that are greater than the value"},"log.query_type_gte":{"type":"number","title":"Filter the search by log.query_type_gte. Search for the documents that are greater or equal than the value"},"log.src_port":{"type":"number","title":"Filter the search by log.src_port. Search for an exact match of the integer value"},"log.src_port_lt":{"type":"number","title":"Filter the search by log.src_port_lt. Search for the documents that are less than the value"},"log.src_port_lte":{"type":"number","title":"Filter the search by log.src_port_lte. Search for the documents that are less or equal than the value"},"log.src_port_gt":{"type":"number","title":"Filter the search by log.src_port_gt. Search for the documents that are greater than the value"},"log.src_port_gte":{"type":"number","title":"Filter the search by log.src_port_gte. Search for the documents that are greater or equal than the value"},"log.datetime_before":{"type":"string","format":"date-time","title":"Filter the search by log.datetime_before. Search for the documents that are after the given timestamp"},"log.datetime_after":{"type":"string","format":"date-time","title":"Filter the search by log.datetime_after. "},"timestamp_before":{"type":"string","format":"date-time","title":"Filter the search by timestamp_before. Search for the documents that are after the given timestamp"},"timestamp_after":{"type":"string","format":"date-time","title":"Filter the search by timestamp_after. "},"log.dst_ip":{"type":"string","format":"ipv4","title":"Filter the search by log.dst_ip. Search for an exact match"},"not.log.dst_ip":{"type":"string","format":"ipv4","title":"Filter the search by not.log.dst_ip. Search for the matches that are not equal to the value"},"log.src_ip":{"type":"string","format":"ipv4","title":"Filter the search by log.src_ip. Search for an exact match"},"not.log.src_ip":{"type":"string","format":"ipv4","title":"Filter the search by not.log.src_ip. Search for the matches that are not equal to the value"},"resolved_ips":{"type":"string","title":"Filter the search by resolved_ips. Search for an exact match"},"not.resolved_ips":{"type":"string","title":"Filter the search by not.resolved_ips. Search for the matches that are not equal to the value"},"sort_field":{"type":"string","title":"Sort field","enum":["machine_id","group_id","group_name","rule_id","rule_name","resolved_ips","policy_id","policy_name","account_id","parent_account_id","action","log.policy_id","log.policy","log.protocol","log.query_name","log.query_name_reversed","log.resolver_decision","log.user_id","log.colo_id","log.dst_port","log.query_category_ids","log.query_size","log.query_type","log.src_port","log.dst_ip","log.src_ip","timestamp","log.datetime","agent.at","agent.last_user","agent.fully_qualified_host_name","agent.started_at_local","agent.started_at_offset","agent.os_info.os_type","agent.os_info.os_version","agent.os_info.os_platform","agent.os_info.os_architecture","agent.os_info.os_release_name","agent.domain_name","agent.engine_version","agent.policy_etag","agent.host_name","agent.nics.ips","agent.nics.mac_address","machine.tags.alias","agent.has_alerts","agent.machine_ip","agent.object_guid","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.source_location.city","agent.source_location.country","agent.source_location.country_iso","agent.source_location.continent","agent.source_location.time_zone","agent.source_location.postal_code","agent.source_location.subdivisions","agent.source_location.anonymous_proxy","agent.serial_number","active_directory.user.display_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.machine.display_name","active_directory.machine.sam_account_name","active_directory.machine.ou"]},"populate":{"type":"object","title":"Populate object schema","properties":{"group":{"type":"boolean","title":"Populates group data (group name, policy name, policy id)"},"endpoint":{"type":"boolean","title":"Populate with the endpoint data (last day seen, last user)"}}},"sort_order":{"type":"string","title":"Sorting direction","default":"asc","enum":["asc","desc"]},"page_size":{"type":"number","title":"The size of the page. If you only need aggregations, set it to 0","minimum":0,"default":50,"maximum":2000},"aggregations":{"type":"array","title":"The Aggregations Schema","items":{"type":"string","title":"Aggregations","default":[],"enum":["machine_id","group_id","rule_id","rule_name","resolved_ips","group_name","policy_id","policy_name","account_id","parent_account_id","action","log.policy_id","log.policy","log.protocol","log.query_name","log.query_name_reversed","log.resolver_decision","log.user_id","log.colo_id","log.dst_port","log.query_category_ids","log.query_size","log.query_type","log.src_port","log.dst_ip","log.src_ip","timestamp","log.datetime","agent.at","agent.last_user","agent.fully_qualified_host_name","agent.started_at_local","agent.started_at_offset","agent.os_info.os_type","agent.os_info.os_version","agent.os_info.os_platform","agent.os_info.os_architecture","agent.os_info.os_release_name","agent.domain_name","agent.engine_version","agent.policy_etag","agent.host_name","agent.nics.ips","agent.nics.mac_address","machine.tags.alias","agent.has_alerts","agent.machine_ip","agent.object_guid","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.source_location.city","agent.source_location.country","agent.source_location.country_iso","agent.source_location.continent","agent.source_location.time_zone","agent.source_location.postal_code","agent.source_location.subdivisions","agent.source_location.anonymous_proxy","agent.serial_number","daily_logs"]}},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}],"properties":{"group_by":{"type":"string","title":"The groupBy Schema","enum":["rule_id","rule_name","machine_id","group_id","group_name","policy_id","policy_name","account_id","parent_account_id","action","log.policy_id","log.policy","log.protocol","log.query_name","log.query_name_reversed","log.resolver_decision","log.user_id","log.colo_id","log.dst_port","log.query_category_ids","log.query_size","log.query_type","log.src_port","log.dst_ip","log.src_ip","timestamp","log.datetime","agent.at","agent.last_user","agent.fully_qualified_host_name","agent.started_at_local","agent.started_at_offset","agent.os_info.os_type","agent.os_info.os_version","agent.os_info.os_platform","agent.os_info.os_architecture","agent.os_info.os_release_name","agent.domain_name","agent.engine_version","agent.policy_etag","agent.host_name","agent.nics.ips","agent.nics.mac_address","machine.tags.alias","agent.has_alerts","agent.machine_ip","agent.object_guid","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.source_location.city","agent.source_location.country","agent.source_location.country_iso","agent.source_location.continent","agent.source_location.time_zone","agent.source_location.postal_code","agent.source_location.subdivisions","agent.source_location.anonymous_proxy","agent.serial_number","active_directory.user.display_name","active_directory.user.ou","active_directory.machine.display_name","active_directory.machine.ou"]},"page_size":{"type":"number","title":"The page_size Schema","minimum":50,"maximum":2000},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}},{"type":"object","required":["account_ids"],"properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"The Post DNS Logs Search GroupBy Response Schema","required":["results","next_cursor"],"properties":{"results":{"type":"array","title":"The Results Schema","default":[]},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}}}}},"tags":["DNS"],"operationId":"api.v2.rmm.search.dns.group"}},"/oneview/v1/rid/rules/export":{"post":{"description":"Export RID rules","summary":"Export RID rules","security":[{"client_credentials":["execute"]},{"user_permissions":["bruteForce.view"]}],"status":{"outage":["auth","search_stateful"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Export request","required":["groups","select","format"],"properties":{"format":{"type":"string","title":"The output file","enum":["csv","xlsx","html","ods","txt","rtf","json"]},"download":{"type":"boolean","title":"Whether to instruct the client to download the response as a file. Only clients like browsers are supported"},"type":{"type":"string","title":"The encoding of the output","enum":["string","base64","binary"],"default":"string"},"select":{"type":"array","title":"Which fields to select from the response","items":{"type":"object","title":"Field","required":["field","newField"],"properties":{"newField":{"type":"string","title":"the new value"},"field":{"type":"string","title":"The response field to map to a new value"}}}},"groups":{"type":"array","title":"List of queries","items":{"type":"object","required":["account_ids"],"title":"Query to fetch endpoints","allOf":[{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"Search rid rules request. Leading wildcards are not supported for constraint fields without '.keyword' suffix.","required":["account_ids"],"properties":{"nics.mac_address":{"type":"string","title":"Filter the search by nics.mac_address. Search for the documents that contains the value"},"not.nics.mac_address":{"type":"string","title":"Filter the search by not.nics.mac_address. Search for the documents that does not contain the value"},"nics.mac_address.keyword":{"type":"string","title":"Filter the search by nics.mac_address.keyword. Search for the documents that equals the value"},"not.nics.mac_address.keyword":{"type":"string","title":"Filter the search by not.nics.mac_address.keyword. Search for the documents that are not equal to the value"},"nics.description":{"type":"string","title":"Filter the search by nics.description. Search for the documents that contains the value"},"not.nics.description":{"type":"string","title":"Filter the search by not.nics.description. Search for the documents that does not contain the value"},"nics.description.keyword":{"type":"string","title":"Filter the search by nics.description.keyword. Search for the documents that equals the value"},"not.nics.description.keyword":{"type":"string","title":"Filter the search by not.nics.description.keyword. Search for the documents that are not equal to the value"},"os_info.os_type":{"type":"string","title":"Filter the search by os_info.os_type. Search for the documents that contains the value"},"not.os_info.os_type":{"type":"string","title":"Filter the search by not.os_info.os_type. Search for the documents that does not contain the value"},"os_info.os_type.keyword":{"type":"string","title":"Filter the search by os_info.os_type.keyword. Search for the documents that equals the value"},"not.os_info.os_type.keyword":{"type":"string","title":"Filter the search by not.os_info.os_type.keyword. Search for the documents that are not equal to the value"},"os_info.os_version":{"type":"string","title":"Filter the search by os_info.os_version. Search for the documents that contains the value"},"not.os_info.os_version":{"type":"string","title":"Filter the search by not.os_info.os_version. Search for the documents that does not contain the value"},"os_info.os_version.keyword":{"type":"string","title":"Filter the search by os_info.os_version.keyword. Search for the documents that equals the value"},"not.os_info.os_version.keyword":{"type":"string","title":"Filter the search by not.os_info.os_version.keyword. Search for the documents that are not equal to the value"},"os_info.os_platform":{"type":"string","title":"Filter the search by os_info.os_platform. Search for the documents that contains the value"},"not.os_info.os_platform":{"type":"string","title":"Filter the search by not.os_info.os_platform. Search for the documents that does not contain the value"},"os_info.os_platform.keyword":{"type":"string","title":"Filter the search by os_info.os_platform.keyword. Search for the documents that equals the value"},"not.os_info.os_platform.keyword":{"type":"string","title":"Filter the search by not.os_info.os_platform.keyword. Search for the documents that are not equal to the value"},"os_info.os_architecture":{"type":"string","title":"Filter the search by os_info.os_architecture. Search for the documents that contains the value"},"not.os_info.os_architecture":{"type":"string","title":"Filter the search by not.os_info.os_architecture. Search for the documents that does not contain the value"},"os_info.os_architecture.keyword":{"type":"string","title":"Filter the search by os_info.os_architecture.keyword. Search for the documents that equals the value"},"not.os_info.os_architecture.keyword":{"type":"string","title":"Filter the search by not.os_info.os_architecture.keyword. Search for the documents that are not equal to the value"},"os_info.os_release_name":{"type":"string","title":"Filter the search by os_info.os_release_name. Search for the documents that contains the value"},"not.os_info.os_release_name":{"type":"string","title":"Filter the search by not.os_info.os_release_name. Search for the documents that does not contain the value"},"os_info.os_release_name.keyword":{"type":"string","title":"Filter the search by os_info.os_release_name.keyword. Search for the documents that equals the value"},"not.os_info.os_release_name.keyword":{"type":"string","title":"Filter the search by not.os_info.os_release_name.keyword. Search for the documents that are not equal to the value"},"host_name":{"type":"string","title":"Filter the search by host_name. Search for the documents that contains the value"},"not.host_name":{"type":"string","title":"Filter the search by not.host_name. Search for the documents that does not contain the value"},"host_name.keyword":{"type":"string","title":"Filter the search by host_name.keyword. Search for the documents that equals the value"},"not.host_name.keyword":{"type":"string","title":"Filter the search by not.host_name.keyword. Search for the documents that are not equal to the value"},"fully_qualified_host_name":{"type":"string","title":"Filter the search by fully_qualified_host_name. Search for the documents that contains the value"},"not.fully_qualified_host_name":{"type":"string","title":"Filter the search by not.fully_qualified_host_name. Search for the documents that does not contain the value"},"fully_qualified_host_name.keyword":{"type":"string","title":"Filter the search by fully_qualified_host_name.keyword. Search for the documents that equals the value"},"not.fully_qualified_host_name.keyword":{"type":"string","title":"Filter the search by not.fully_qualified_host_name.keyword. Search for the documents that are not equal to the value"},"plugins.asset_manager.plugin_version":{"type":"string","title":"Filter the search by plugins.asset_manager.plugin_version. Search for the documents that contains the value"},"not.plugins.asset_manager.plugin_version":{"type":"string","title":"Filter the search by not.plugins.asset_manager.plugin_version. Search for the documents that does not contain the value"},"plugins.asset_manager.plugin_version.keyword":{"type":"string","title":"Filter the search by plugins.asset_manager.plugin_version.keyword. Search for the documents that equals the value"},"not.plugins.asset_manager.plugin_version.keyword":{"type":"string","title":"Filter the search by not.plugins.asset_manager.plugin_version.keyword. Search for the documents that are not equal to the value"},"plugins.asset_manager.reboot_reasons":{"type":"string","title":"Filter the search by plugins.asset_manager.reboot_reasons. Search for the documents that contains the value"},"not.plugins.asset_manager.reboot_reasons":{"type":"string","title":"Filter the search by not.plugins.asset_manager.reboot_reasons. Search for the documents that does not contain the value"},"plugins.asset_manager.reboot_reasons.keyword":{"type":"string","title":"Filter the search by plugins.asset_manager.reboot_reasons.keyword. Search for the documents that equals the value"},"not.plugins.asset_manager.reboot_reasons.keyword":{"type":"string","title":"Filter the search by not.plugins.asset_manager.reboot_reasons.keyword. Search for the documents that are not equal to the value"},"plugins.endpoint_protection.plugin_version":{"type":"string","title":"Filter the search by plugins.endpoint_protection.plugin_version. Search for the documents that contains the value"},"not.plugins.endpoint_protection.plugin_version":{"type":"string","title":"Filter the search by not.plugins.endpoint_protection.plugin_version. Search for the documents that does not contain the value"},"plugins.endpoint_protection.plugin_version.keyword":{"type":"string","title":"Filter the search by plugins.endpoint_protection.plugin_version.keyword. Search for the documents that equals the value"},"not.plugins.endpoint_protection.plugin_version.keyword":{"type":"string","title":"Filter the search by not.plugins.endpoint_protection.plugin_version.keyword. Search for the documents that are not equal to the value"},"plugins.endpoint_protection.sdk_version":{"type":"string","title":"Filter the search by plugins.endpoint_protection.sdk_version. Search for the documents that contains the value"},"not.plugins.endpoint_protection.sdk_version":{"type":"string","title":"Filter the search by not.plugins.endpoint_protection.sdk_version. Search for the documents that does not contain the value"},"plugins.endpoint_protection.sdk_version.keyword":{"type":"string","title":"Filter the search by plugins.endpoint_protection.sdk_version.keyword. Search for the documents that equals the value"},"not.plugins.endpoint_protection.sdk_version.keyword":{"type":"string","title":"Filter the search by not.plugins.endpoint_protection.sdk_version.keyword. Search for the documents that are not equal to the value"},"plugins.endpoint_protection.component_package_version":{"type":"string","title":"Filter the search by plugins.endpoint_protection.component_package_version. Search for the documents that contains the value"},"not.plugins.endpoint_protection.component_package_version":{"type":"string","title":"Filter the search by not.plugins.endpoint_protection.component_package_version. Search for the documents that does not contain the value"},"plugins.endpoint_protection.component_package_version.keyword":{"type":"string","title":"Filter the search by plugins.endpoint_protection.component_package_version.keyword. Search for the documents that equals the value"},"not.plugins.endpoint_protection.component_package_version.keyword":{"type":"string","title":"Filter the search by not.plugins.endpoint_protection.component_package_version.keyword. Search for the documents that are not equal to the value"},"plugins.endpoint_protection.update_package_version":{"type":"string","title":"Filter the search by plugins.endpoint_protection.update_package_version. Search for the documents that contains the value"},"not.plugins.endpoint_protection.update_package_version":{"type":"string","title":"Filter the search by not.plugins.endpoint_protection.update_package_version. Search for the documents that does not contain the value"},"plugins.endpoint_protection.update_package_version.keyword":{"type":"string","title":"Filter the search by plugins.endpoint_protection.update_package_version.keyword. Search for the documents that equals the value"},"not.plugins.endpoint_protection.update_package_version.keyword":{"type":"string","title":"Filter the search by not.plugins.endpoint_protection.update_package_version.keyword. Search for the documents that are not equal to the value"},"plugins.endpoint_protection.reboot_reasons":{"type":"string","title":"Filter the search by plugins.endpoint_protection.reboot_reasons. Search for the documents that contains the value"},"not.plugins.endpoint_protection.reboot_reasons":{"type":"string","title":"Filter the search by not.plugins.endpoint_protection.reboot_reasons. Search for the documents that does not contain the value"},"plugins.endpoint_protection.reboot_reasons.keyword":{"type":"string","title":"Filter the search by plugins.endpoint_protection.reboot_reasons.keyword. Search for the documents that equals the value"},"not.plugins.endpoint_protection.reboot_reasons.keyword":{"type":"string","title":"Filter the search by not.plugins.endpoint_protection.reboot_reasons.keyword. Search for the documents that are not equal to the value"},"plugins.endpoint_detection_and_response.plugin_version":{"type":"string","title":"Filter the search by plugins.endpoint_detection_and_response.plugin_version. Search for the documents that contains the value"},"not.plugins.endpoint_detection_and_response.plugin_version":{"type":"string","title":"Filter the search by not.plugins.endpoint_detection_and_response.plugin_version. Search for the documents that does not contain the value"},"plugins.endpoint_detection_and_response.plugin_version.keyword":{"type":"string","title":"Filter the search by plugins.endpoint_detection_and_response.plugin_version.keyword. Search for the documents that equals the value"},"not.plugins.endpoint_detection_and_response.plugin_version.keyword":{"type":"string","title":"Filter the search by not.plugins.endpoint_detection_and_response.plugin_version.keyword. Search for the documents that are not equal to the value"},"plugins.endpoint_detection_and_response.reboot_reasons":{"type":"string","title":"Filter the search by plugins.endpoint_detection_and_response.reboot_reasons. Search for the documents that contains the value"},"not.plugins.endpoint_detection_and_response.reboot_reasons":{"type":"string","title":"Filter the search by not.plugins.endpoint_detection_and_response.reboot_reasons. Search for the documents that does not contain the value"},"plugins.endpoint_detection_and_response.reboot_reasons.keyword":{"type":"string","title":"Filter the search by plugins.endpoint_detection_and_response.reboot_reasons.keyword. Search for the documents that equals the value"},"not.plugins.endpoint_detection_and_response.reboot_reasons.keyword":{"type":"string","title":"Filter the search by not.plugins.endpoint_detection_and_response.reboot_reasons.keyword. Search for the documents that are not equal to the value"},"plugins.incident_response.plugin_version":{"type":"string","title":"Filter the search by plugins.incident_response.plugin_version. Search for the documents that contains the value"},"not.plugins.incident_response.plugin_version":{"type":"string","title":"Filter the search by not.plugins.incident_response.plugin_version. Search for the documents that does not contain the value"},"plugins.incident_response.plugin_version.keyword":{"type":"string","title":"Filter the search by plugins.incident_response.plugin_version.keyword. Search for the documents that equals the value"},"not.plugins.incident_response.plugin_version.keyword":{"type":"string","title":"Filter the search by not.plugins.incident_response.plugin_version.keyword. Search for the documents that are not equal to the value"},"plugins.incident_response.reboot_reasons":{"type":"string","title":"Filter the search by plugins.incident_response.reboot_reasons. Search for the documents that contains the value"},"not.plugins.incident_response.reboot_reasons":{"type":"string","title":"Filter the search by not.plugins.incident_response.reboot_reasons. Search for the documents that does not contain the value"},"plugins.incident_response.reboot_reasons.keyword":{"type":"string","title":"Filter the search by plugins.incident_response.reboot_reasons.keyword. Search for the documents that equals the value"},"not.plugins.incident_response.reboot_reasons.keyword":{"type":"string","title":"Filter the search by not.plugins.incident_response.reboot_reasons.keyword. Search for the documents that are not equal to the value"},"plugins.siem.plugin_version":{"type":"string","title":"Filter the search by plugins.siem.plugin_version. Search for the documents that contains the value"},"not.plugins.siem.plugin_version":{"type":"string","title":"Filter the search by not.plugins.siem.plugin_version. Search for the documents that does not contain the value"},"plugins.siem.plugin_version.keyword":{"type":"string","title":"Filter the search by plugins.siem.plugin_version.keyword. Search for the documents that equals the value"},"not.plugins.siem.plugin_version.keyword":{"type":"string","title":"Filter the search by not.plugins.siem.plugin_version.keyword. Search for the documents that are not equal to the value"},"plugins.browser_phishing_protection.plugin_version":{"type":"string","title":"Filter the search by plugins.browser_phishing_protection.plugin_version. Search for the documents that contains the value"},"not.plugins.browser_phishing_protection.plugin_version":{"type":"string","title":"Filter the search by not.plugins.browser_phishing_protection.plugin_version. Search for the documents that does not contain the value"},"plugins.browser_phishing_protection.plugin_version.keyword":{"type":"string","title":"Filter the search by plugins.browser_phishing_protection.plugin_version.keyword. Search for the documents that equals the value"},"not.plugins.browser_phishing_protection.plugin_version.keyword":{"type":"string","title":"Filter the search by not.plugins.browser_phishing_protection.plugin_version.keyword. Search for the documents that are not equal to the value"},"plugins.siem.reboot_reasons":{"type":"string","title":"Filter the search by plugins.siem.reboot_reasons. Search for the documents that contains the value"},"not.plugins.siem.reboot_reasons":{"type":"string","title":"Filter the search by not.plugins.siem.reboot_reasons. Search for the documents that does not contain the value"},"plugins.siem.reboot_reasons.keyword":{"type":"string","title":"Filter the search by plugins.siem.reboot_reasons.keyword. Search for the documents that equals the value"},"not.plugins.siem.reboot_reasons.keyword":{"type":"string","title":"Filter the search by not.plugins.siem.reboot_reasons.keyword. Search for the documents that are not equal to the value"},"engine_version":{"type":"string","title":"Filter the search by engine_version. Search for the documents that equal the value"},"not.engine_version":{"type":"string","title":"Filter the search by not.engine_version. Search for the documents that does not equal the value"},"engine_version.keyword":{"type":"string","title":"Filter the search by engine_version.keyword. Search for the documents that equals the value"},"not.engine_version.keyword":{"type":"string","title":"Filter the search by not.engine_version.keyword. Search for the documents that are not equal to the value"},"domain_name":{"type":"string","title":"Filter the search by domain_name. Search for the documents that contains the value"},"not.domain_name":{"type":"string","title":"Filter the search by not.domain_name. Search for the documents that does not contain the value"},"domain_name.keyword":{"type":"string","title":"Filter the search by domain_name.keyword. Search for the documents that equals the value"},"not.domain_name.keyword":{"type":"string","title":"Filter the search by not.domain_name.keyword. Search for the documents that are not equal to the value"},"policy_etag":{"type":"string","title":"Filter the search by policy_etag. Search for the documents that contains the value"},"not.policy_etag":{"type":"string","title":"Filter the search by not.policy_etag. Search for the documents that does not contain the value"},"policy_etag.keyword":{"type":"string","title":"Filter the search by policy_etag.keyword. Search for the documents that equals the value"},"not.policy_etag.keyword":{"type":"string","title":"Filter the search by not.policy_etag.keyword. Search for the documents that are not equal to the value"},"last_user":{"type":"string","title":"Filter the search by last_user. Search for the documents that contains the value"},"not.last_user":{"type":"string","title":"Filter the search by not.last_user. Search for the documents that does not contain the value"},"last_user.keyword":{"type":"string","title":"Filter the search by last_user.keyword. Search for the documents that equals the value"},"not.last_user.keyword":{"type":"string","title":"Filter the search by not.last_user.keyword. Search for the documents that are not equal to the value"},"id":{"type":"string","title":"Filter the search by id. Search for the documents that contains the value"},"not.id":{"type":"string","title":"Filter the search by not.id. Search for the documents that does not contain the value"},"id.keyword":{"type":"string","title":"Filter the search by id.keyword. Search for the documents that equals the value"},"not.id.keyword":{"type":"string","title":"Filter the search by not.id.keyword. Search for the documents that are not equal to the value"},"rule_id":{"type":"string","title":"Filter the search by rule_id. Search for the documents that contains the value"},"not.rule_id":{"type":"string","title":"Filter the search by not.rule_id. Search for the documents that does not contain the value"},"rule_id.keyword":{"type":"string","title":"Filter the search by rule_id.keyword. Search for the documents that equals the value"},"not.rule_id.keyword":{"type":"string","title":"Filter the search by not.rule_id.keyword. Search for the documents that are not equal to the value"},"origin_id":{"type":"string","title":"Filter the search by origin_id. Search for the documents that contains the value"},"not.origin_id":{"type":"string","title":"Filter the search by not.origin_id. Search for the documents that does not contain the value"},"origin_id.keyword":{"type":"string","title":"Filter the search by origin_id.keyword. Search for the documents that equals the value"},"not.origin_id.keyword":{"type":"string","title":"Filter the search by not.origin_id.keyword. Search for the documents that are not equal to the value"},"machine_id":{"type":"string","title":"Filter the search by machine_id. Search for the documents that contains the value"},"not.machine_id":{"type":"string","title":"Filter the search by not.machine_id. Search for the documents that does not contain the value"},"machine_id.keyword":{"type":"string","title":"Filter the search by machine_id.keyword. Search for the documents that equals the value"},"not.machine_id.keyword":{"type":"string","title":"Filter the search by not.machine_id.keyword. Search for the documents that are not equal to the value"},"group_ids":{"type":"array","title":"Filter the search by group_ids. Search for the documents that contains the value","items":{"type":"string"}},"group_id":{"type":"string","title":"Filter the search by group_id. Search for the documents that contains the value"},"not.group_id":{"type":"string","title":"Filter the search by not.group_id. Search for the documents that does not contain the value"},"group_id.keyword":{"type":"string","title":"Filter the search by group_id.keyword. Search for the documents that equals the value"},"not.group_id.keyword":{"type":"string","title":"Filter the search by not.group_id.keyword. Search for the documents that are not equal to the value"},"root_group_id":{"type":"string","title":"Filter the search by root_group_id. Search for the documents that contains the value"},"not.root_group_id":{"type":"string","title":"Filter the search by not.root_group_id. Search for the documents that does not contain the value"},"root_group_id.keyword":{"type":"string","title":"Filter the search by root_group_id.keyword. Search for the documents that equals the value"},"not.root_group_id.keyword":{"type":"string","title":"Filter the search by not.root_group_id.keyword. Search for the documents that are not equal to the value"},"group_name":{"type":"string","title":"Filter the search by group_name. Search for the documents that contains the value"},"not.group_name":{"type":"string","title":"Filter the search by not.group_name. Search for the documents that does not contain the value"},"group_name.keyword":{"type":"string","title":"Filter the search by group_name.keyword. Search for the documents that equals the value"},"not.group_name.keyword":{"type":"string","title":"Filter the search by not.group_name.keyword. Search for the documents that are not equal to the value"},"policy_id":{"type":"string","title":"Filter the search by policy_id. Search for the documents that contains the value"},"not.policy_id":{"type":"string","title":"Filter the search by not.policy_id. Search for the documents that does not contain the value"},"policy_id.keyword":{"type":"string","title":"Filter the search by policy_id.keyword. Search for the documents that equals the value"},"not.policy_id.keyword":{"type":"string","title":"Filter the search by not.policy_id.keyword. Search for the documents that are not equal to the value"},"policy_name":{"type":"string","title":"Filter the search by policy_name. Search for the documents that contains the value"},"not.policy_name":{"type":"string","title":"Filter the search by not.policy_name. Search for the documents that does not contain the value"},"policy_name.keyword":{"type":"string","title":"Filter the search by policy_name.keyword. Search for the documents that equals the value"},"not.policy_name.keyword":{"type":"string","title":"Filter the search by not.policy_name.keyword. Search for the documents that are not equal to the value"},"account_name":{"type":"string","title":"Filter the search by account_name. Search for the documents that contains the value"},"not.account_name":{"type":"string","title":"Filter the search by not.account_name. Search for the documents that does not contain the value"},"account_name.keyword":{"type":"string","title":"Filter the search by account_name.keyword. Search for the documents that equals the value"},"not.account_name.keyword":{"type":"string","title":"Filter the search by not.account_name.keyword. Search for the documents that are not equal to the value"},"parent_id":{"type":"string","title":"Filter the search by parent_id. Search for the documents that contains the value"},"not.parent_id":{"type":"string","title":"Filter the search by not.parent_id. Search for the documents that does not contain the value"},"parent_id.keyword":{"type":"string","title":"Filter the search by parent_id.keyword. Search for the documents that equals the value"},"not.parent_id.keyword":{"type":"string","title":"Filter the search by not.parent_id.keyword. Search for the documents that are not equal to the value"},"protocol":{"type":"string","title":"Filter the search by protocol. Search for the documents that contains the value"},"not.protocol":{"type":"string","title":"Filter the search by not.protocol. Search for the documents that does not contain the value"},"protocol.keyword":{"type":"string","title":"Filter the search by protocol.keyword. Search for the documents that equals the value"},"not.protocol.keyword":{"type":"string","title":"Filter the search by not.protocol.keyword. Search for the documents that are not equal to the value"},"attack_user":{"type":"string","title":"Filter the search by attack_user. Search for the documents that contains the value"},"not.attack_user":{"type":"string","title":"Filter the search by not.attack_user. Search for the documents that does not contain the value"},"attack_user.keyword":{"type":"string","title":"Filter the search by attack_user.keyword. Search for the documents that equals the value"},"not.attack_user.keyword":{"type":"string","title":"Filter the search by not.attack_user.keyword. Search for the documents that are not equal to the value"},"machine_name":{"type":"string","title":"Filter the search by machine_name. Search for the documents that contains the value"},"not.machine_name":{"type":"string","title":"Filter the search by not.machine_name. Search for the documents that does not contain the value"},"machine_name.keyword":{"type":"string","title":"Filter the search by machine_name.keyword. Search for the documents that equals the value"},"not.machine_name.keyword":{"type":"string","title":"Filter the search by not.machine_name.keyword. Search for the documents that are not equal to the value"},"ip":{"type":"string","title":"Filter the search by the source ip. Search for the documents that match the value"},"not.ip":{"type":"string","title":"Filter the search by the source not.ip. Search for the documents that does not match the value"},"machine_ip":{"type":"string","title":"Filter the search by the destination machine_ip. Search for the documents that mach the value"},"not.machine_ip":{"type":"string","title":"Filter the search by destination not.machine_ip. Search for the documents that does not match the value"},"deleted":{"type":"boolean","title":"Filter the search by deleted. Search for the documents that have been deleted"},"create_time_before":{"type":"string","title":"Filter the search by create_time_before. Search for the documents that occurs before the value"},"create_time_after":{"type":"string","title":"Filter the search by create_time_after. Search for the documents that occurs after the value"},"expire_time_before":{"type":"string","title":"Filter the search by expire_time_before. Search for the documents that occurs before the value"},"expire_time_after":{"type":"string","title":"Filter the search by expire_time_after. Search for the documents that occurs after the value"},"port_lt":{"type":["integer","string"],"pattern":"^\\d+$","title":"Filter the search by port_lt. Search for the documents that are less than the value (Ex. \"1234\")"},"port_lte":{"type":["integer","string"],"pattern":"^\\d+$","title":"Filter the search by port_lte. Search for the documents that are less than the value (Ex. \"1234\")"},"port_gt":{"type":["integer","string"],"pattern":"^\\d+$","title":"Filter the search by port_gt. Search for the documents that are greater than the value (Ex. \"1234\")"},"port_gte":{"type":["integer","string"],"pattern":"^\\d+$","title":"Filter the search by port_gte. Search for the documents that are greater than the value (Ex. \"1234\")"},"attempts_lt":{"type":["integer","string"],"pattern":"^\\d+$","title":"Filter the search by attempts_lt. Search for the documents that are less than the value (Ex. \"1234\")"},"attempts_lte":{"type":["integer","string"],"pattern":"^\\d+$","title":"Filter the search by attempts_lte. Search for the documents that are less than the value (Ex. \"1234\")"},"attempts_gt":{"type":["integer","string"],"pattern":"^\\d+$","title":"Filter the search by attempts_gt. Search for the documents that are greater than the value (Ex. \"1234\")"},"attempts_gte":{"type":["integer","string"],"pattern":"^\\d+$","title":"Filter the search by attempts_gte. Search for the documents that are greater than the value (Ex. \"1234\")"},"duration_lt":{"type":["integer","string"],"pattern":"^\\d+$","title":"Filter the search by duration_lt. Search for the documents that are less than the value (Ex. \"1234\")"},"duration_lte":{"type":["integer","string"],"pattern":"^\\d+$","title":"Filter the search by duration_lte. Search for the documents that are less than the value (Ex. \"1234\")"},"duration_gt":{"type":["integer","string"],"pattern":"^\\d+$","title":"Filter the search by duration_gt. Search for the documents that are greater than the value (Ex. \"1234\")"},"duration_gte":{"type":["integer","string"],"pattern":"^\\d+$","title":"Filter the search by duration_gte. Search for the documents that are greater than the value (Ex. \"1234\")"},"source_location.city":{"type":"string","title":"Filter the search by source_location.city. Search for the documents that contains the value"},"not.source_location.city":{"type":"string","title":"Filter the search by not.source_location.city. Search for the documents that does not contain the value"},"source_location.city.keyword":{"type":"string","title":"Filter the search by source_location.city.keyword. Search for the documents that equals the value"},"not.source_location.city.keyword":{"type":"string","title":"Filter the search by not.source_location.city.keyword. Search for the documents that are not equal to the value"},"source_location.country":{"type":"string","title":"Filter the search by source_location.country. Search for the documents that contains the value"},"not.source_location.country":{"type":"string","title":"Filter the search by not.source_location.country. Search for the documents that does not contain the value"},"source_location.country.keyword":{"type":"string","title":"Filter the search by source_location.country.keyword. Search for the documents that equals the value"},"not.source_location.country.keyword":{"type":"string","title":"Filter the search by not.source_location.country.keyword. Search for the documents that are not equal to the value"},"source_location.country_iso":{"type":"string","title":"Filter the search by source_location.country_iso. Search for the documents that contains the value"},"not.source_location.country_iso":{"type":"string","title":"Filter the search by not.source_location.country_iso. Search for the documents that does not contain the value"},"source_location.country_iso.keyword":{"type":"string","title":"Filter the search by source_location.country_iso.keyword. Search for the documents that equals the value"},"not.source_location.country_iso.keyword":{"type":"string","title":"Filter the search by not.source_location.country_iso.keyword. Search for the documents that are not equal to the value"},"source_location.continent":{"type":"string","title":"Filter the search by source_location.continent. Search for the documents that contains the value"},"not.source_location.continent":{"type":"string","title":"Filter the search by not.source_location.continent. Search for the documents that does not contain the value"},"source_location.continent.keyword":{"type":"string","title":"Filter the search by source_location.continent.keyword. Search for the documents that equals the value"},"not.source_location.continent.keyword":{"type":"string","title":"Filter the search by not.source_location.continent.keyword. Search for the documents that are not equal to the value"},"source_location.time_zone":{"type":"string","title":"Filter the search by source_location.time_zone. Search for the documents that contains the value"},"not.source_location.time_zone":{"type":"string","title":"Filter the search by not.source_location.time_zone. Search for the documents that does not contain the value"},"source_location.time_zone.keyword":{"type":"string","title":"Filter the search by source_location.time_zone.keyword. Search for the documents that equals the value"},"not.source_location.time_zone.keyword":{"type":"string","title":"Filter the search by not.source_location.time_zone.keyword. Search for the documents that are not equal to the value"},"source_location.postal_code":{"type":"string","title":"Filter the search by source_location.postal_code. Search for the documents that contains the value"},"not.source_location.postal_code":{"type":"string","title":"Filter the search by not.source_location.postal_code. Search for the documents that does not contain the value"},"source_location.postal_code.keyword":{"type":"string","title":"Filter the search by source_location.postal_code.keyword. Search for the documents that equals the value"},"not.source_location.postal_code.keyword":{"type":"string","title":"Filter the search by not.source_location.postal_code.keyword. Search for the documents that are not equal to the value"},"source_location.subdivisions":{"type":"string","title":"Filter the search by source_location.subdivisions. Search for the documents that contains the value"},"not.source_location.subdivisions":{"type":"string","title":"Filter the search by not.source_location.subdivisions. Search for the documents that does not contain the value"},"source_location.subdivisions.keyword":{"type":"string","title":"Filter the search by source_location.subdivisions.keyword. Search for the documents that equals the value"},"not.source_location.subdivisions.keyword":{"type":"string","title":"Filter the search by not.source_location.subdivisions.keyword. Search for the documents that are not equal to the value"},"destination_location.city":{"type":"string","title":"Filter the search by destination_location.city. Search for the documents that contains the value"},"not.destination_location.city":{"type":"string","title":"Filter the search by not.destination_location.city. Search for the documents that does not contain the value"},"destination_location.city.keyword":{"type":"string","title":"Filter the search by destination_location.city.keyword. Search for the documents that equals the value"},"not.destination_location.city.keyword":{"type":"string","title":"Filter the search by not.destination_location.city.keyword. Search for the documents that are not equal to the value"},"destination_location.country":{"type":"string","title":"Filter the search by destination_location.country. Search for the documents that contains the value"},"not.destination_location.country":{"type":"string","title":"Filter the search by not.destination_location.country. Search for the documents that does not contain the value"},"destination_location.country.keyword":{"type":"string","title":"Filter the search by destination_location.country.keyword. Search for the documents that equals the value"},"not.destination_location.country.keyword":{"type":"string","title":"Filter the search by not.destination_location.country.keyword. Search for the documents that are not equal to the value"},"destination_location.country_iso":{"type":"string","title":"Filter the search by destination_location.country_iso. Search for the documents that contains the value"},"not.destination_location.country_iso":{"type":"string","title":"Filter the search by not.destination_location.country_iso. Search for the documents that does not contain the value"},"destination_location.country_iso.keyword":{"type":"string","title":"Filter the search by destination_location.country_iso.keyword. Search for the documents that equals the value"},"not.destination_location.country_iso.keyword":{"type":"string","title":"Filter the search by not.destination_location.country_iso.keyword. Search for the documents that are not equal to the value"},"destination_location.continent":{"type":"string","title":"Filter the search by destination_location.continent. Search for the documents that contains the value"},"not.destination_location.continent":{"type":"string","title":"Filter the search by not.destination_location.continent. Search for the documents that does not contain the value"},"destination_location.continent.keyword":{"type":"string","title":"Filter the search by destination_location.continent.keyword. Search for the documents that equals the value"},"not.destination_location.continent.keyword":{"type":"string","title":"Filter the search by not.destination_location.continent.keyword. Search for the documents that are not equal to the value"},"destination_location.time_zone":{"type":"string","title":"Filter the search by destination_location.time_zone. Search for the documents that contains the value"},"not.destination_location.time_zone":{"type":"string","title":"Filter the search by not.destination_location.time_zone. Search for the documents that does not contain the value"},"destination_location.time_zone.keyword":{"type":"string","title":"Filter the search by destination_location.time_zone.keyword. Search for the documents that equals the value"},"not.destination_location.time_zone.keyword":{"type":"string","title":"Filter the search by not.destination_location.time_zone.keyword. Search for the documents that are not equal to the value"},"destination_location.postal_code":{"type":"string","title":"Filter the search by destination_location.postal_code. Search for the documents that contains the value"},"not.destination_location.postal_code":{"type":"string","title":"Filter the search by not.destination_location.postal_code. Search for the documents that does not contain the value"},"destination_location.postal_code.keyword":{"type":"string","title":"Filter the search by destination_location.postal_code.keyword. Search for the documents that equals the value"},"not.destination_location.postal_code.keyword":{"type":"string","title":"Filter the search by not.destination_location.postal_code.keyword. Search for the documents that are not equal to the value"},"destination_location.subdivisions":{"type":"string","title":"Filter the search by destination_location.subdivisions. Search for the documents that contains the value"},"not.destination_location.subdivisions":{"type":"string","title":"Filter the search by not.destination_location.subdivisions. Search for the documents that does not contain the value"},"destination_location.subdivisions.keyword":{"type":"string","title":"Filter the search by destination_location.subdivisions.keyword. Search for the documents that equals the value"},"not.destination_location.subdivisions.keyword":{"type":"string","title":"Filter the search by not.destination_location.subdivisions.keyword. Search for the documents that are not equal to the value"},"sort_field":{"type":"string","title":"Sort field","default":"expire_time","enum":["id","rule_id","origin_id","machine_id","group_id","root_group_id","group_name","policy_id","policy_name","account_id","account_name","parent_id","port","attempts","duration","protocol","attack_user","machine_ip","ip","create_time","expire_time","deleted","machine_name","at","nics.ips","nics.mac_address","nics.description.keyword","os_info.os_type","os_info.os_version.keyword","os_info.os_platform","os_info.os_architecture","os_info.os_release_name.keyword","host_name.keyword","fully_qualified_host_name.keyword","plugins.asset_manager.plugin_version.keyword","plugins.asset_manager.reboot_reasons","plugins.endpoint_protection.plugin_version.keyword","plugins.endpoint_protection.sdk_version.keyword","plugins.endpoint_protection.component_package_version.keyword","plugins.endpoint_protection.update_package_version.keyword","plugins.endpoint_protection.reboot_reasons","plugins.endpoint_detection_and_response.plugin_version.keyword","plugins.endpoint_detection_and_response.reboot_reasons","plugins.incident_response.plugin_version.keyword","plugins.incident_response.reboot_reasons","plugins.siem.plugin_version.keyword","plugins.siem.reboot_reasons","engine_version.keyword","domain_name.keyword","policy_etag","source_location.city","source_location.country","source_location.country_iso","source_location.continent","source_location.time_zone","source_location.postal_code","source_location.subdivisions","destination_location.city","destination_location.country","destination_location.country_iso","destination_location.continent","destination_location.time_zone","destination_location.postal_code","destination_location.subdivisions"]},"sort_order":{"type":"string","title":"Sorting direction","default":"asc","enum":["asc","desc"]},"page_size":{"type":"number","title":"The size of the page. If you only need aggregations, set it to 0","minimum":0,"default":50,"maximum":2000},"aggregations":{"type":"array","title":"The Aggregations Schema","items":{"type":"string","title":"Aggregations","default":[],"enum":["protection_status","os_info.os_release_name.keyword","nics.ips","nics.mac_address","nics.description.keyword","os_info.os_type","os_info.os_version.keyword","os_info.os_platform","os_info.os_architecture","host_name.keyword","fully_qualified_host_name.keyword","plugins.asset_manager.plugin_version.keyword","plugins.asset_manager.reboot_reasons","plugins.endpoint_protection.plugin_version.keyword","plugins.endpoint_protection.sdk_version.keyword","plugins.endpoint_protection.component_package_version.keyword","plugins.endpoint_protection.update_package_version.keyword","plugins.endpoint_protection.reboot_reasons","plugins.endpoint_detection_and_response.plugin_version.keyword","plugins.endpoint_detection_and_response.reboot_reasons","plugins.incident_response.plugin_version.keyword","plugins.incident_response.reboot_reasons","plugins.siem.plugin_version.keyword","plugins.siem.reboot_reasons","engine_version.keyword","domain_name.keyword","policy_etag","last_user.keyword","is_software_update_available","origin_id","machine_id","group_id","root_group_id","group_name","policy_id","policy_name","account_id","parent_id","port","protocol","attack_user","machine_ip","ip","deleted","machine_name","source_location.city","source_location.country","source_location.country_iso","source_location.continent","source_location.time_zone","source_location.postal_code","source_location.subdivisions","destination_location.city","destination_location.country","destination_location.country_iso","destination_location.continent","destination_location.time_zone","destination_location.postal_code","destination_location.subdivisions"]}},"account_ids":{"type":"array","title":"The account ids to filter your search","items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}]}}}}}}},"responses":{"200":{"description":"Successful response"}},"tags":["Remote Intrusion Detection"],"operationId":"api.v2.rmm.post.export.rid"}},"/oneview/v1/rid/rules/export/async":{"post":{"description":"Export RID rules","summary":"Export RID rules asynchronously","security":[{"client_credentials":["execute"]},{"user_permissions":["bruteForce.view"]}],"status":{"outage":["auth","search_stateful"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Export request","required":["groups","select","format"],"properties":{"format":{"type":"string","title":"The output file","enum":["csv","xlsx","html","ods","txt","rtf","json"]},"download":{"type":"boolean","title":"Whether to instruct the client to download the response as a file. Only clients like browsers are supported"},"type":{"type":"string","title":"The encoding of the output","enum":["string","base64","binary"],"default":"string"},"select":{"type":"array","title":"Which fields to select from the response","items":{"type":"object","title":"Field","required":["field","newField"],"properties":{"newField":{"type":"string","title":"the new value"},"field":{"type":"string","title":"The response field to map to a new value"}}}},"groups":{"type":"array","title":"List of queries","items":{"type":"object","required":["account_ids"],"title":"Query to fetch endpoints","allOf":[{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"Search rid rules request. Leading wildcards are not supported for constraint fields without '.keyword' suffix.","required":["account_ids"],"properties":{"nics.mac_address":{"type":"string","title":"Filter the search by nics.mac_address. Search for the documents that contains the value"},"not.nics.mac_address":{"type":"string","title":"Filter the search by not.nics.mac_address. Search for the documents that does not contain the value"},"nics.mac_address.keyword":{"type":"string","title":"Filter the search by nics.mac_address.keyword. Search for the documents that equals the value"},"not.nics.mac_address.keyword":{"type":"string","title":"Filter the search by not.nics.mac_address.keyword. Search for the documents that are not equal to the value"},"nics.description":{"type":"string","title":"Filter the search by nics.description. Search for the documents that contains the value"},"not.nics.description":{"type":"string","title":"Filter the search by not.nics.description. Search for the documents that does not contain the value"},"nics.description.keyword":{"type":"string","title":"Filter the search by nics.description.keyword. Search for the documents that equals the value"},"not.nics.description.keyword":{"type":"string","title":"Filter the search by not.nics.description.keyword. Search for the documents that are not equal to the value"},"os_info.os_type":{"type":"string","title":"Filter the search by os_info.os_type. Search for the documents that contains the value"},"not.os_info.os_type":{"type":"string","title":"Filter the search by not.os_info.os_type. Search for the documents that does not contain the value"},"os_info.os_type.keyword":{"type":"string","title":"Filter the search by os_info.os_type.keyword. Search for the documents that equals the value"},"not.os_info.os_type.keyword":{"type":"string","title":"Filter the search by not.os_info.os_type.keyword. Search for the documents that are not equal to the value"},"os_info.os_version":{"type":"string","title":"Filter the search by os_info.os_version. Search for the documents that contains the value"},"not.os_info.os_version":{"type":"string","title":"Filter the search by not.os_info.os_version. Search for the documents that does not contain the value"},"os_info.os_version.keyword":{"type":"string","title":"Filter the search by os_info.os_version.keyword. Search for the documents that equals the value"},"not.os_info.os_version.keyword":{"type":"string","title":"Filter the search by not.os_info.os_version.keyword. Search for the documents that are not equal to the value"},"os_info.os_platform":{"type":"string","title":"Filter the search by os_info.os_platform. Search for the documents that contains the value"},"not.os_info.os_platform":{"type":"string","title":"Filter the search by not.os_info.os_platform. Search for the documents that does not contain the value"},"os_info.os_platform.keyword":{"type":"string","title":"Filter the search by os_info.os_platform.keyword. Search for the documents that equals the value"},"not.os_info.os_platform.keyword":{"type":"string","title":"Filter the search by not.os_info.os_platform.keyword. Search for the documents that are not equal to the value"},"os_info.os_architecture":{"type":"string","title":"Filter the search by os_info.os_architecture. Search for the documents that contains the value"},"not.os_info.os_architecture":{"type":"string","title":"Filter the search by not.os_info.os_architecture. Search for the documents that does not contain the value"},"os_info.os_architecture.keyword":{"type":"string","title":"Filter the search by os_info.os_architecture.keyword. Search for the documents that equals the value"},"not.os_info.os_architecture.keyword":{"type":"string","title":"Filter the search by not.os_info.os_architecture.keyword. Search for the documents that are not equal to the value"},"os_info.os_release_name":{"type":"string","title":"Filter the search by os_info.os_release_name. Search for the documents that contains the value"},"not.os_info.os_release_name":{"type":"string","title":"Filter the search by not.os_info.os_release_name. Search for the documents that does not contain the value"},"os_info.os_release_name.keyword":{"type":"string","title":"Filter the search by os_info.os_release_name.keyword. Search for the documents that equals the value"},"not.os_info.os_release_name.keyword":{"type":"string","title":"Filter the search by not.os_info.os_release_name.keyword. Search for the documents that are not equal to the value"},"host_name":{"type":"string","title":"Filter the search by host_name. Search for the documents that contains the value"},"not.host_name":{"type":"string","title":"Filter the search by not.host_name. Search for the documents that does not contain the value"},"host_name.keyword":{"type":"string","title":"Filter the search by host_name.keyword. Search for the documents that equals the value"},"not.host_name.keyword":{"type":"string","title":"Filter the search by not.host_name.keyword. Search for the documents that are not equal to the value"},"fully_qualified_host_name":{"type":"string","title":"Filter the search by fully_qualified_host_name. Search for the documents that contains the value"},"not.fully_qualified_host_name":{"type":"string","title":"Filter the search by not.fully_qualified_host_name. Search for the documents that does not contain the value"},"fully_qualified_host_name.keyword":{"type":"string","title":"Filter the search by fully_qualified_host_name.keyword. Search for the documents that equals the value"},"not.fully_qualified_host_name.keyword":{"type":"string","title":"Filter the search by not.fully_qualified_host_name.keyword. Search for the documents that are not equal to the value"},"plugins.asset_manager.plugin_version":{"type":"string","title":"Filter the search by plugins.asset_manager.plugin_version. Search for the documents that contains the value"},"not.plugins.asset_manager.plugin_version":{"type":"string","title":"Filter the search by not.plugins.asset_manager.plugin_version. Search for the documents that does not contain the value"},"plugins.asset_manager.plugin_version.keyword":{"type":"string","title":"Filter the search by plugins.asset_manager.plugin_version.keyword. Search for the documents that equals the value"},"not.plugins.asset_manager.plugin_version.keyword":{"type":"string","title":"Filter the search by not.plugins.asset_manager.plugin_version.keyword. Search for the documents that are not equal to the value"},"plugins.asset_manager.reboot_reasons":{"type":"string","title":"Filter the search by plugins.asset_manager.reboot_reasons. Search for the documents that contains the value"},"not.plugins.asset_manager.reboot_reasons":{"type":"string","title":"Filter the search by not.plugins.asset_manager.reboot_reasons. Search for the documents that does not contain the value"},"plugins.asset_manager.reboot_reasons.keyword":{"type":"string","title":"Filter the search by plugins.asset_manager.reboot_reasons.keyword. Search for the documents that equals the value"},"not.plugins.asset_manager.reboot_reasons.keyword":{"type":"string","title":"Filter the search by not.plugins.asset_manager.reboot_reasons.keyword. Search for the documents that are not equal to the value"},"plugins.endpoint_protection.plugin_version":{"type":"string","title":"Filter the search by plugins.endpoint_protection.plugin_version. Search for the documents that contains the value"},"not.plugins.endpoint_protection.plugin_version":{"type":"string","title":"Filter the search by not.plugins.endpoint_protection.plugin_version. Search for the documents that does not contain the value"},"plugins.endpoint_protection.plugin_version.keyword":{"type":"string","title":"Filter the search by plugins.endpoint_protection.plugin_version.keyword. Search for the documents that equals the value"},"not.plugins.endpoint_protection.plugin_version.keyword":{"type":"string","title":"Filter the search by not.plugins.endpoint_protection.plugin_version.keyword. Search for the documents that are not equal to the value"},"plugins.endpoint_protection.sdk_version":{"type":"string","title":"Filter the search by plugins.endpoint_protection.sdk_version. Search for the documents that contains the value"},"not.plugins.endpoint_protection.sdk_version":{"type":"string","title":"Filter the search by not.plugins.endpoint_protection.sdk_version. Search for the documents that does not contain the value"},"plugins.endpoint_protection.sdk_version.keyword":{"type":"string","title":"Filter the search by plugins.endpoint_protection.sdk_version.keyword. Search for the documents that equals the value"},"not.plugins.endpoint_protection.sdk_version.keyword":{"type":"string","title":"Filter the search by not.plugins.endpoint_protection.sdk_version.keyword. Search for the documents that are not equal to the value"},"plugins.endpoint_protection.component_package_version":{"type":"string","title":"Filter the search by plugins.endpoint_protection.component_package_version. Search for the documents that contains the value"},"not.plugins.endpoint_protection.component_package_version":{"type":"string","title":"Filter the search by not.plugins.endpoint_protection.component_package_version. Search for the documents that does not contain the value"},"plugins.endpoint_protection.component_package_version.keyword":{"type":"string","title":"Filter the search by plugins.endpoint_protection.component_package_version.keyword. Search for the documents that equals the value"},"not.plugins.endpoint_protection.component_package_version.keyword":{"type":"string","title":"Filter the search by not.plugins.endpoint_protection.component_package_version.keyword. Search for the documents that are not equal to the value"},"plugins.endpoint_protection.update_package_version":{"type":"string","title":"Filter the search by plugins.endpoint_protection.update_package_version. Search for the documents that contains the value"},"not.plugins.endpoint_protection.update_package_version":{"type":"string","title":"Filter the search by not.plugins.endpoint_protection.update_package_version. Search for the documents that does not contain the value"},"plugins.endpoint_protection.update_package_version.keyword":{"type":"string","title":"Filter the search by plugins.endpoint_protection.update_package_version.keyword. Search for the documents that equals the value"},"not.plugins.endpoint_protection.update_package_version.keyword":{"type":"string","title":"Filter the search by not.plugins.endpoint_protection.update_package_version.keyword. Search for the documents that are not equal to the value"},"plugins.endpoint_protection.reboot_reasons":{"type":"string","title":"Filter the search by plugins.endpoint_protection.reboot_reasons. Search for the documents that contains the value"},"not.plugins.endpoint_protection.reboot_reasons":{"type":"string","title":"Filter the search by not.plugins.endpoint_protection.reboot_reasons. Search for the documents that does not contain the value"},"plugins.endpoint_protection.reboot_reasons.keyword":{"type":"string","title":"Filter the search by plugins.endpoint_protection.reboot_reasons.keyword. Search for the documents that equals the value"},"not.plugins.endpoint_protection.reboot_reasons.keyword":{"type":"string","title":"Filter the search by not.plugins.endpoint_protection.reboot_reasons.keyword. Search for the documents that are not equal to the value"},"plugins.endpoint_detection_and_response.plugin_version":{"type":"string","title":"Filter the search by plugins.endpoint_detection_and_response.plugin_version. Search for the documents that contains the value"},"not.plugins.endpoint_detection_and_response.plugin_version":{"type":"string","title":"Filter the search by not.plugins.endpoint_detection_and_response.plugin_version. Search for the documents that does not contain the value"},"plugins.endpoint_detection_and_response.plugin_version.keyword":{"type":"string","title":"Filter the search by plugins.endpoint_detection_and_response.plugin_version.keyword. Search for the documents that equals the value"},"not.plugins.endpoint_detection_and_response.plugin_version.keyword":{"type":"string","title":"Filter the search by not.plugins.endpoint_detection_and_response.plugin_version.keyword. Search for the documents that are not equal to the value"},"plugins.endpoint_detection_and_response.reboot_reasons":{"type":"string","title":"Filter the search by plugins.endpoint_detection_and_response.reboot_reasons. Search for the documents that contains the value"},"not.plugins.endpoint_detection_and_response.reboot_reasons":{"type":"string","title":"Filter the search by not.plugins.endpoint_detection_and_response.reboot_reasons. Search for the documents that does not contain the value"},"plugins.endpoint_detection_and_response.reboot_reasons.keyword":{"type":"string","title":"Filter the search by plugins.endpoint_detection_and_response.reboot_reasons.keyword. Search for the documents that equals the value"},"not.plugins.endpoint_detection_and_response.reboot_reasons.keyword":{"type":"string","title":"Filter the search by not.plugins.endpoint_detection_and_response.reboot_reasons.keyword. Search for the documents that are not equal to the value"},"plugins.incident_response.plugin_version":{"type":"string","title":"Filter the search by plugins.incident_response.plugin_version. Search for the documents that contains the value"},"not.plugins.incident_response.plugin_version":{"type":"string","title":"Filter the search by not.plugins.incident_response.plugin_version. Search for the documents that does not contain the value"},"plugins.incident_response.plugin_version.keyword":{"type":"string","title":"Filter the search by plugins.incident_response.plugin_version.keyword. Search for the documents that equals the value"},"not.plugins.incident_response.plugin_version.keyword":{"type":"string","title":"Filter the search by not.plugins.incident_response.plugin_version.keyword. Search for the documents that are not equal to the value"},"plugins.incident_response.reboot_reasons":{"type":"string","title":"Filter the search by plugins.incident_response.reboot_reasons. Search for the documents that contains the value"},"not.plugins.incident_response.reboot_reasons":{"type":"string","title":"Filter the search by not.plugins.incident_response.reboot_reasons. Search for the documents that does not contain the value"},"plugins.incident_response.reboot_reasons.keyword":{"type":"string","title":"Filter the search by plugins.incident_response.reboot_reasons.keyword. Search for the documents that equals the value"},"not.plugins.incident_response.reboot_reasons.keyword":{"type":"string","title":"Filter the search by not.plugins.incident_response.reboot_reasons.keyword. Search for the documents that are not equal to the value"},"plugins.siem.plugin_version":{"type":"string","title":"Filter the search by plugins.siem.plugin_version. Search for the documents that contains the value"},"not.plugins.siem.plugin_version":{"type":"string","title":"Filter the search by not.plugins.siem.plugin_version. Search for the documents that does not contain the value"},"plugins.siem.plugin_version.keyword":{"type":"string","title":"Filter the search by plugins.siem.plugin_version.keyword. Search for the documents that equals the value"},"not.plugins.siem.plugin_version.keyword":{"type":"string","title":"Filter the search by not.plugins.siem.plugin_version.keyword. Search for the documents that are not equal to the value"},"plugins.browser_phishing_protection.plugin_version":{"type":"string","title":"Filter the search by plugins.browser_phishing_protection.plugin_version. Search for the documents that contains the value"},"not.plugins.browser_phishing_protection.plugin_version":{"type":"string","title":"Filter the search by not.plugins.browser_phishing_protection.plugin_version. Search for the documents that does not contain the value"},"plugins.browser_phishing_protection.plugin_version.keyword":{"type":"string","title":"Filter the search by plugins.browser_phishing_protection.plugin_version.keyword. Search for the documents that equals the value"},"not.plugins.browser_phishing_protection.plugin_version.keyword":{"type":"string","title":"Filter the search by not.plugins.browser_phishing_protection.plugin_version.keyword. Search for the documents that are not equal to the value"},"plugins.siem.reboot_reasons":{"type":"string","title":"Filter the search by plugins.siem.reboot_reasons. Search for the documents that contains the value"},"not.plugins.siem.reboot_reasons":{"type":"string","title":"Filter the search by not.plugins.siem.reboot_reasons. Search for the documents that does not contain the value"},"plugins.siem.reboot_reasons.keyword":{"type":"string","title":"Filter the search by plugins.siem.reboot_reasons.keyword. Search for the documents that equals the value"},"not.plugins.siem.reboot_reasons.keyword":{"type":"string","title":"Filter the search by not.plugins.siem.reboot_reasons.keyword. Search for the documents that are not equal to the value"},"engine_version":{"type":"string","title":"Filter the search by engine_version. Search for the documents that equal the value"},"not.engine_version":{"type":"string","title":"Filter the search by not.engine_version. Search for the documents that does not equal the value"},"engine_version.keyword":{"type":"string","title":"Filter the search by engine_version.keyword. Search for the documents that equals the value"},"not.engine_version.keyword":{"type":"string","title":"Filter the search by not.engine_version.keyword. Search for the documents that are not equal to the value"},"domain_name":{"type":"string","title":"Filter the search by domain_name. Search for the documents that contains the value"},"not.domain_name":{"type":"string","title":"Filter the search by not.domain_name. Search for the documents that does not contain the value"},"domain_name.keyword":{"type":"string","title":"Filter the search by domain_name.keyword. Search for the documents that equals the value"},"not.domain_name.keyword":{"type":"string","title":"Filter the search by not.domain_name.keyword. Search for the documents that are not equal to the value"},"policy_etag":{"type":"string","title":"Filter the search by policy_etag. Search for the documents that contains the value"},"not.policy_etag":{"type":"string","title":"Filter the search by not.policy_etag. Search for the documents that does not contain the value"},"policy_etag.keyword":{"type":"string","title":"Filter the search by policy_etag.keyword. Search for the documents that equals the value"},"not.policy_etag.keyword":{"type":"string","title":"Filter the search by not.policy_etag.keyword. Search for the documents that are not equal to the value"},"last_user":{"type":"string","title":"Filter the search by last_user. Search for the documents that contains the value"},"not.last_user":{"type":"string","title":"Filter the search by not.last_user. Search for the documents that does not contain the value"},"last_user.keyword":{"type":"string","title":"Filter the search by last_user.keyword. Search for the documents that equals the value"},"not.last_user.keyword":{"type":"string","title":"Filter the search by not.last_user.keyword. Search for the documents that are not equal to the value"},"id":{"type":"string","title":"Filter the search by id. Search for the documents that contains the value"},"not.id":{"type":"string","title":"Filter the search by not.id. Search for the documents that does not contain the value"},"id.keyword":{"type":"string","title":"Filter the search by id.keyword. Search for the documents that equals the value"},"not.id.keyword":{"type":"string","title":"Filter the search by not.id.keyword. Search for the documents that are not equal to the value"},"rule_id":{"type":"string","title":"Filter the search by rule_id. Search for the documents that contains the value"},"not.rule_id":{"type":"string","title":"Filter the search by not.rule_id. Search for the documents that does not contain the value"},"rule_id.keyword":{"type":"string","title":"Filter the search by rule_id.keyword. Search for the documents that equals the value"},"not.rule_id.keyword":{"type":"string","title":"Filter the search by not.rule_id.keyword. Search for the documents that are not equal to the value"},"origin_id":{"type":"string","title":"Filter the search by origin_id. Search for the documents that contains the value"},"not.origin_id":{"type":"string","title":"Filter the search by not.origin_id. Search for the documents that does not contain the value"},"origin_id.keyword":{"type":"string","title":"Filter the search by origin_id.keyword. Search for the documents that equals the value"},"not.origin_id.keyword":{"type":"string","title":"Filter the search by not.origin_id.keyword. Search for the documents that are not equal to the value"},"machine_id":{"type":"string","title":"Filter the search by machine_id. Search for the documents that contains the value"},"not.machine_id":{"type":"string","title":"Filter the search by not.machine_id. Search for the documents that does not contain the value"},"machine_id.keyword":{"type":"string","title":"Filter the search by machine_id.keyword. Search for the documents that equals the value"},"not.machine_id.keyword":{"type":"string","title":"Filter the search by not.machine_id.keyword. Search for the documents that are not equal to the value"},"group_ids":{"type":"array","title":"Filter the search by group_ids. Search for the documents that contains the value","items":{"type":"string"}},"group_id":{"type":"string","title":"Filter the search by group_id. Search for the documents that contains the value"},"not.group_id":{"type":"string","title":"Filter the search by not.group_id. Search for the documents that does not contain the value"},"group_id.keyword":{"type":"string","title":"Filter the search by group_id.keyword. Search for the documents that equals the value"},"not.group_id.keyword":{"type":"string","title":"Filter the search by not.group_id.keyword. Search for the documents that are not equal to the value"},"root_group_id":{"type":"string","title":"Filter the search by root_group_id. Search for the documents that contains the value"},"not.root_group_id":{"type":"string","title":"Filter the search by not.root_group_id. Search for the documents that does not contain the value"},"root_group_id.keyword":{"type":"string","title":"Filter the search by root_group_id.keyword. Search for the documents that equals the value"},"not.root_group_id.keyword":{"type":"string","title":"Filter the search by not.root_group_id.keyword. Search for the documents that are not equal to the value"},"group_name":{"type":"string","title":"Filter the search by group_name. Search for the documents that contains the value"},"not.group_name":{"type":"string","title":"Filter the search by not.group_name. Search for the documents that does not contain the value"},"group_name.keyword":{"type":"string","title":"Filter the search by group_name.keyword. Search for the documents that equals the value"},"not.group_name.keyword":{"type":"string","title":"Filter the search by not.group_name.keyword. Search for the documents that are not equal to the value"},"policy_id":{"type":"string","title":"Filter the search by policy_id. Search for the documents that contains the value"},"not.policy_id":{"type":"string","title":"Filter the search by not.policy_id. Search for the documents that does not contain the value"},"policy_id.keyword":{"type":"string","title":"Filter the search by policy_id.keyword. Search for the documents that equals the value"},"not.policy_id.keyword":{"type":"string","title":"Filter the search by not.policy_id.keyword. Search for the documents that are not equal to the value"},"policy_name":{"type":"string","title":"Filter the search by policy_name. Search for the documents that contains the value"},"not.policy_name":{"type":"string","title":"Filter the search by not.policy_name. Search for the documents that does not contain the value"},"policy_name.keyword":{"type":"string","title":"Filter the search by policy_name.keyword. Search for the documents that equals the value"},"not.policy_name.keyword":{"type":"string","title":"Filter the search by not.policy_name.keyword. Search for the documents that are not equal to the value"},"account_name":{"type":"string","title":"Filter the search by account_name. Search for the documents that contains the value"},"not.account_name":{"type":"string","title":"Filter the search by not.account_name. Search for the documents that does not contain the value"},"account_name.keyword":{"type":"string","title":"Filter the search by account_name.keyword. Search for the documents that equals the value"},"not.account_name.keyword":{"type":"string","title":"Filter the search by not.account_name.keyword. Search for the documents that are not equal to the value"},"parent_id":{"type":"string","title":"Filter the search by parent_id. Search for the documents that contains the value"},"not.parent_id":{"type":"string","title":"Filter the search by not.parent_id. Search for the documents that does not contain the value"},"parent_id.keyword":{"type":"string","title":"Filter the search by parent_id.keyword. Search for the documents that equals the value"},"not.parent_id.keyword":{"type":"string","title":"Filter the search by not.parent_id.keyword. Search for the documents that are not equal to the value"},"protocol":{"type":"string","title":"Filter the search by protocol. Search for the documents that contains the value"},"not.protocol":{"type":"string","title":"Filter the search by not.protocol. Search for the documents that does not contain the value"},"protocol.keyword":{"type":"string","title":"Filter the search by protocol.keyword. Search for the documents that equals the value"},"not.protocol.keyword":{"type":"string","title":"Filter the search by not.protocol.keyword. Search for the documents that are not equal to the value"},"attack_user":{"type":"string","title":"Filter the search by attack_user. Search for the documents that contains the value"},"not.attack_user":{"type":"string","title":"Filter the search by not.attack_user. Search for the documents that does not contain the value"},"attack_user.keyword":{"type":"string","title":"Filter the search by attack_user.keyword. Search for the documents that equals the value"},"not.attack_user.keyword":{"type":"string","title":"Filter the search by not.attack_user.keyword. Search for the documents that are not equal to the value"},"machine_name":{"type":"string","title":"Filter the search by machine_name. Search for the documents that contains the value"},"not.machine_name":{"type":"string","title":"Filter the search by not.machine_name. Search for the documents that does not contain the value"},"machine_name.keyword":{"type":"string","title":"Filter the search by machine_name.keyword. Search for the documents that equals the value"},"not.machine_name.keyword":{"type":"string","title":"Filter the search by not.machine_name.keyword. Search for the documents that are not equal to the value"},"ip":{"type":"string","title":"Filter the search by the source ip. Search for the documents that match the value"},"not.ip":{"type":"string","title":"Filter the search by the source not.ip. Search for the documents that does not match the value"},"machine_ip":{"type":"string","title":"Filter the search by the destination machine_ip. Search for the documents that mach the value"},"not.machine_ip":{"type":"string","title":"Filter the search by destination not.machine_ip. Search for the documents that does not match the value"},"deleted":{"type":"boolean","title":"Filter the search by deleted. Search for the documents that have been deleted"},"create_time_before":{"type":"string","title":"Filter the search by create_time_before. Search for the documents that occurs before the value"},"create_time_after":{"type":"string","title":"Filter the search by create_time_after. Search for the documents that occurs after the value"},"expire_time_before":{"type":"string","title":"Filter the search by expire_time_before. Search for the documents that occurs before the value"},"expire_time_after":{"type":"string","title":"Filter the search by expire_time_after. Search for the documents that occurs after the value"},"port_lt":{"type":["integer","string"],"pattern":"^\\d+$","title":"Filter the search by port_lt. Search for the documents that are less than the value (Ex. \"1234\")"},"port_lte":{"type":["integer","string"],"pattern":"^\\d+$","title":"Filter the search by port_lte. Search for the documents that are less than the value (Ex. \"1234\")"},"port_gt":{"type":["integer","string"],"pattern":"^\\d+$","title":"Filter the search by port_gt. Search for the documents that are greater than the value (Ex. \"1234\")"},"port_gte":{"type":["integer","string"],"pattern":"^\\d+$","title":"Filter the search by port_gte. Search for the documents that are greater than the value (Ex. \"1234\")"},"attempts_lt":{"type":["integer","string"],"pattern":"^\\d+$","title":"Filter the search by attempts_lt. Search for the documents that are less than the value (Ex. \"1234\")"},"attempts_lte":{"type":["integer","string"],"pattern":"^\\d+$","title":"Filter the search by attempts_lte. Search for the documents that are less than the value (Ex. \"1234\")"},"attempts_gt":{"type":["integer","string"],"pattern":"^\\d+$","title":"Filter the search by attempts_gt. Search for the documents that are greater than the value (Ex. \"1234\")"},"attempts_gte":{"type":["integer","string"],"pattern":"^\\d+$","title":"Filter the search by attempts_gte. Search for the documents that are greater than the value (Ex. \"1234\")"},"duration_lt":{"type":["integer","string"],"pattern":"^\\d+$","title":"Filter the search by duration_lt. Search for the documents that are less than the value (Ex. \"1234\")"},"duration_lte":{"type":["integer","string"],"pattern":"^\\d+$","title":"Filter the search by duration_lte. Search for the documents that are less than the value (Ex. \"1234\")"},"duration_gt":{"type":["integer","string"],"pattern":"^\\d+$","title":"Filter the search by duration_gt. Search for the documents that are greater than the value (Ex. \"1234\")"},"duration_gte":{"type":["integer","string"],"pattern":"^\\d+$","title":"Filter the search by duration_gte. Search for the documents that are greater than the value (Ex. \"1234\")"},"source_location.city":{"type":"string","title":"Filter the search by source_location.city. Search for the documents that contains the value"},"not.source_location.city":{"type":"string","title":"Filter the search by not.source_location.city. Search for the documents that does not contain the value"},"source_location.city.keyword":{"type":"string","title":"Filter the search by source_location.city.keyword. Search for the documents that equals the value"},"not.source_location.city.keyword":{"type":"string","title":"Filter the search by not.source_location.city.keyword. Search for the documents that are not equal to the value"},"source_location.country":{"type":"string","title":"Filter the search by source_location.country. Search for the documents that contains the value"},"not.source_location.country":{"type":"string","title":"Filter the search by not.source_location.country. Search for the documents that does not contain the value"},"source_location.country.keyword":{"type":"string","title":"Filter the search by source_location.country.keyword. Search for the documents that equals the value"},"not.source_location.country.keyword":{"type":"string","title":"Filter the search by not.source_location.country.keyword. Search for the documents that are not equal to the value"},"source_location.country_iso":{"type":"string","title":"Filter the search by source_location.country_iso. Search for the documents that contains the value"},"not.source_location.country_iso":{"type":"string","title":"Filter the search by not.source_location.country_iso. Search for the documents that does not contain the value"},"source_location.country_iso.keyword":{"type":"string","title":"Filter the search by source_location.country_iso.keyword. Search for the documents that equals the value"},"not.source_location.country_iso.keyword":{"type":"string","title":"Filter the search by not.source_location.country_iso.keyword. Search for the documents that are not equal to the value"},"source_location.continent":{"type":"string","title":"Filter the search by source_location.continent. Search for the documents that contains the value"},"not.source_location.continent":{"type":"string","title":"Filter the search by not.source_location.continent. Search for the documents that does not contain the value"},"source_location.continent.keyword":{"type":"string","title":"Filter the search by source_location.continent.keyword. Search for the documents that equals the value"},"not.source_location.continent.keyword":{"type":"string","title":"Filter the search by not.source_location.continent.keyword. Search for the documents that are not equal to the value"},"source_location.time_zone":{"type":"string","title":"Filter the search by source_location.time_zone. Search for the documents that contains the value"},"not.source_location.time_zone":{"type":"string","title":"Filter the search by not.source_location.time_zone. Search for the documents that does not contain the value"},"source_location.time_zone.keyword":{"type":"string","title":"Filter the search by source_location.time_zone.keyword. Search for the documents that equals the value"},"not.source_location.time_zone.keyword":{"type":"string","title":"Filter the search by not.source_location.time_zone.keyword. Search for the documents that are not equal to the value"},"source_location.postal_code":{"type":"string","title":"Filter the search by source_location.postal_code. Search for the documents that contains the value"},"not.source_location.postal_code":{"type":"string","title":"Filter the search by not.source_location.postal_code. Search for the documents that does not contain the value"},"source_location.postal_code.keyword":{"type":"string","title":"Filter the search by source_location.postal_code.keyword. Search for the documents that equals the value"},"not.source_location.postal_code.keyword":{"type":"string","title":"Filter the search by not.source_location.postal_code.keyword. Search for the documents that are not equal to the value"},"source_location.subdivisions":{"type":"string","title":"Filter the search by source_location.subdivisions. Search for the documents that contains the value"},"not.source_location.subdivisions":{"type":"string","title":"Filter the search by not.source_location.subdivisions. Search for the documents that does not contain the value"},"source_location.subdivisions.keyword":{"type":"string","title":"Filter the search by source_location.subdivisions.keyword. Search for the documents that equals the value"},"not.source_location.subdivisions.keyword":{"type":"string","title":"Filter the search by not.source_location.subdivisions.keyword. Search for the documents that are not equal to the value"},"destination_location.city":{"type":"string","title":"Filter the search by destination_location.city. Search for the documents that contains the value"},"not.destination_location.city":{"type":"string","title":"Filter the search by not.destination_location.city. Search for the documents that does not contain the value"},"destination_location.city.keyword":{"type":"string","title":"Filter the search by destination_location.city.keyword. Search for the documents that equals the value"},"not.destination_location.city.keyword":{"type":"string","title":"Filter the search by not.destination_location.city.keyword. Search for the documents that are not equal to the value"},"destination_location.country":{"type":"string","title":"Filter the search by destination_location.country. Search for the documents that contains the value"},"not.destination_location.country":{"type":"string","title":"Filter the search by not.destination_location.country. Search for the documents that does not contain the value"},"destination_location.country.keyword":{"type":"string","title":"Filter the search by destination_location.country.keyword. Search for the documents that equals the value"},"not.destination_location.country.keyword":{"type":"string","title":"Filter the search by not.destination_location.country.keyword. Search for the documents that are not equal to the value"},"destination_location.country_iso":{"type":"string","title":"Filter the search by destination_location.country_iso. Search for the documents that contains the value"},"not.destination_location.country_iso":{"type":"string","title":"Filter the search by not.destination_location.country_iso. Search for the documents that does not contain the value"},"destination_location.country_iso.keyword":{"type":"string","title":"Filter the search by destination_location.country_iso.keyword. Search for the documents that equals the value"},"not.destination_location.country_iso.keyword":{"type":"string","title":"Filter the search by not.destination_location.country_iso.keyword. Search for the documents that are not equal to the value"},"destination_location.continent":{"type":"string","title":"Filter the search by destination_location.continent. Search for the documents that contains the value"},"not.destination_location.continent":{"type":"string","title":"Filter the search by not.destination_location.continent. Search for the documents that does not contain the value"},"destination_location.continent.keyword":{"type":"string","title":"Filter the search by destination_location.continent.keyword. Search for the documents that equals the value"},"not.destination_location.continent.keyword":{"type":"string","title":"Filter the search by not.destination_location.continent.keyword. Search for the documents that are not equal to the value"},"destination_location.time_zone":{"type":"string","title":"Filter the search by destination_location.time_zone. Search for the documents that contains the value"},"not.destination_location.time_zone":{"type":"string","title":"Filter the search by not.destination_location.time_zone. Search for the documents that does not contain the value"},"destination_location.time_zone.keyword":{"type":"string","title":"Filter the search by destination_location.time_zone.keyword. Search for the documents that equals the value"},"not.destination_location.time_zone.keyword":{"type":"string","title":"Filter the search by not.destination_location.time_zone.keyword. Search for the documents that are not equal to the value"},"destination_location.postal_code":{"type":"string","title":"Filter the search by destination_location.postal_code. Search for the documents that contains the value"},"not.destination_location.postal_code":{"type":"string","title":"Filter the search by not.destination_location.postal_code. Search for the documents that does not contain the value"},"destination_location.postal_code.keyword":{"type":"string","title":"Filter the search by destination_location.postal_code.keyword. Search for the documents that equals the value"},"not.destination_location.postal_code.keyword":{"type":"string","title":"Filter the search by not.destination_location.postal_code.keyword. Search for the documents that are not equal to the value"},"destination_location.subdivisions":{"type":"string","title":"Filter the search by destination_location.subdivisions. Search for the documents that contains the value"},"not.destination_location.subdivisions":{"type":"string","title":"Filter the search by not.destination_location.subdivisions. Search for the documents that does not contain the value"},"destination_location.subdivisions.keyword":{"type":"string","title":"Filter the search by destination_location.subdivisions.keyword. Search for the documents that equals the value"},"not.destination_location.subdivisions.keyword":{"type":"string","title":"Filter the search by not.destination_location.subdivisions.keyword. Search for the documents that are not equal to the value"},"sort_field":{"type":"string","title":"Sort field","default":"expire_time","enum":["id","rule_id","origin_id","machine_id","group_id","root_group_id","group_name","policy_id","policy_name","account_id","account_name","parent_id","port","attempts","duration","protocol","attack_user","machine_ip","ip","create_time","expire_time","deleted","machine_name","at","nics.ips","nics.mac_address","nics.description.keyword","os_info.os_type","os_info.os_version.keyword","os_info.os_platform","os_info.os_architecture","os_info.os_release_name.keyword","host_name.keyword","fully_qualified_host_name.keyword","plugins.asset_manager.plugin_version.keyword","plugins.asset_manager.reboot_reasons","plugins.endpoint_protection.plugin_version.keyword","plugins.endpoint_protection.sdk_version.keyword","plugins.endpoint_protection.component_package_version.keyword","plugins.endpoint_protection.update_package_version.keyword","plugins.endpoint_protection.reboot_reasons","plugins.endpoint_detection_and_response.plugin_version.keyword","plugins.endpoint_detection_and_response.reboot_reasons","plugins.incident_response.plugin_version.keyword","plugins.incident_response.reboot_reasons","plugins.siem.plugin_version.keyword","plugins.siem.reboot_reasons","engine_version.keyword","domain_name.keyword","policy_etag","source_location.city","source_location.country","source_location.country_iso","source_location.continent","source_location.time_zone","source_location.postal_code","source_location.subdivisions","destination_location.city","destination_location.country","destination_location.country_iso","destination_location.continent","destination_location.time_zone","destination_location.postal_code","destination_location.subdivisions"]},"sort_order":{"type":"string","title":"Sorting direction","default":"asc","enum":["asc","desc"]},"page_size":{"type":"number","title":"The size of the page. If you only need aggregations, set it to 0","minimum":0,"default":50,"maximum":2000},"aggregations":{"type":"array","title":"The Aggregations Schema","items":{"type":"string","title":"Aggregations","default":[],"enum":["protection_status","os_info.os_release_name.keyword","nics.ips","nics.mac_address","nics.description.keyword","os_info.os_type","os_info.os_version.keyword","os_info.os_platform","os_info.os_architecture","host_name.keyword","fully_qualified_host_name.keyword","plugins.asset_manager.plugin_version.keyword","plugins.asset_manager.reboot_reasons","plugins.endpoint_protection.plugin_version.keyword","plugins.endpoint_protection.sdk_version.keyword","plugins.endpoint_protection.component_package_version.keyword","plugins.endpoint_protection.update_package_version.keyword","plugins.endpoint_protection.reboot_reasons","plugins.endpoint_detection_and_response.plugin_version.keyword","plugins.endpoint_detection_and_response.reboot_reasons","plugins.incident_response.plugin_version.keyword","plugins.incident_response.reboot_reasons","plugins.siem.plugin_version.keyword","plugins.siem.reboot_reasons","engine_version.keyword","domain_name.keyword","policy_etag","last_user.keyword","is_software_update_available","origin_id","machine_id","group_id","root_group_id","group_name","policy_id","policy_name","account_id","parent_id","port","protocol","attack_user","machine_ip","ip","deleted","machine_name","source_location.city","source_location.country","source_location.country_iso","source_location.continent","source_location.time_zone","source_location.postal_code","source_location.subdivisions","destination_location.city","destination_location.country","destination_location.country_iso","destination_location.continent","destination_location.time_zone","destination_location.postal_code","destination_location.subdivisions"]}},"account_ids":{"type":"array","title":"The account ids to filter your search","items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}]}}}}}}},"responses":{"200":{"description":"Successful response"}},"tags":["Remote Intrusion Detection"],"operationId":"api.v2.rmm.post.export.rid.async"}},"/oneview/v1/rid/rules":{"post":{"description":"Search RID rules","summary":"Search RID rules","security":[{"client_credentials":["read"]},{"user_permissions":["bruteForce.view"]}],"status":{"outage":["auth","search_stateful"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"Search rid rules request. Leading wildcards are not supported for constraint fields without '.keyword' suffix.","required":["account_ids"],"properties":{"nics.mac_address":{"type":"string","title":"Filter the search by nics.mac_address. Search for the documents that contains the value"},"not.nics.mac_address":{"type":"string","title":"Filter the search by not.nics.mac_address. Search for the documents that does not contain the value"},"nics.mac_address.keyword":{"type":"string","title":"Filter the search by nics.mac_address.keyword. Search for the documents that equals the value"},"not.nics.mac_address.keyword":{"type":"string","title":"Filter the search by not.nics.mac_address.keyword. Search for the documents that are not equal to the value"},"nics.description":{"type":"string","title":"Filter the search by nics.description. Search for the documents that contains the value"},"not.nics.description":{"type":"string","title":"Filter the search by not.nics.description. Search for the documents that does not contain the value"},"nics.description.keyword":{"type":"string","title":"Filter the search by nics.description.keyword. Search for the documents that equals the value"},"not.nics.description.keyword":{"type":"string","title":"Filter the search by not.nics.description.keyword. Search for the documents that are not equal to the value"},"os_info.os_type":{"type":"string","title":"Filter the search by os_info.os_type. Search for the documents that contains the value"},"not.os_info.os_type":{"type":"string","title":"Filter the search by not.os_info.os_type. Search for the documents that does not contain the value"},"os_info.os_type.keyword":{"type":"string","title":"Filter the search by os_info.os_type.keyword. Search for the documents that equals the value"},"not.os_info.os_type.keyword":{"type":"string","title":"Filter the search by not.os_info.os_type.keyword. Search for the documents that are not equal to the value"},"os_info.os_version":{"type":"string","title":"Filter the search by os_info.os_version. Search for the documents that contains the value"},"not.os_info.os_version":{"type":"string","title":"Filter the search by not.os_info.os_version. Search for the documents that does not contain the value"},"os_info.os_version.keyword":{"type":"string","title":"Filter the search by os_info.os_version.keyword. Search for the documents that equals the value"},"not.os_info.os_version.keyword":{"type":"string","title":"Filter the search by not.os_info.os_version.keyword. Search for the documents that are not equal to the value"},"os_info.os_platform":{"type":"string","title":"Filter the search by os_info.os_platform. Search for the documents that contains the value"},"not.os_info.os_platform":{"type":"string","title":"Filter the search by not.os_info.os_platform. Search for the documents that does not contain the value"},"os_info.os_platform.keyword":{"type":"string","title":"Filter the search by os_info.os_platform.keyword. Search for the documents that equals the value"},"not.os_info.os_platform.keyword":{"type":"string","title":"Filter the search by not.os_info.os_platform.keyword. Search for the documents that are not equal to the value"},"os_info.os_architecture":{"type":"string","title":"Filter the search by os_info.os_architecture. Search for the documents that contains the value"},"not.os_info.os_architecture":{"type":"string","title":"Filter the search by not.os_info.os_architecture. Search for the documents that does not contain the value"},"os_info.os_architecture.keyword":{"type":"string","title":"Filter the search by os_info.os_architecture.keyword. Search for the documents that equals the value"},"not.os_info.os_architecture.keyword":{"type":"string","title":"Filter the search by not.os_info.os_architecture.keyword. Search for the documents that are not equal to the value"},"os_info.os_release_name":{"type":"string","title":"Filter the search by os_info.os_release_name. Search for the documents that contains the value"},"not.os_info.os_release_name":{"type":"string","title":"Filter the search by not.os_info.os_release_name. Search for the documents that does not contain the value"},"os_info.os_release_name.keyword":{"type":"string","title":"Filter the search by os_info.os_release_name.keyword. Search for the documents that equals the value"},"not.os_info.os_release_name.keyword":{"type":"string","title":"Filter the search by not.os_info.os_release_name.keyword. Search for the documents that are not equal to the value"},"host_name":{"type":"string","title":"Filter the search by host_name. Search for the documents that contains the value"},"not.host_name":{"type":"string","title":"Filter the search by not.host_name. Search for the documents that does not contain the value"},"host_name.keyword":{"type":"string","title":"Filter the search by host_name.keyword. Search for the documents that equals the value"},"not.host_name.keyword":{"type":"string","title":"Filter the search by not.host_name.keyword. Search for the documents that are not equal to the value"},"fully_qualified_host_name":{"type":"string","title":"Filter the search by fully_qualified_host_name. Search for the documents that contains the value"},"not.fully_qualified_host_name":{"type":"string","title":"Filter the search by not.fully_qualified_host_name. Search for the documents that does not contain the value"},"fully_qualified_host_name.keyword":{"type":"string","title":"Filter the search by fully_qualified_host_name.keyword. Search for the documents that equals the value"},"not.fully_qualified_host_name.keyword":{"type":"string","title":"Filter the search by not.fully_qualified_host_name.keyword. Search for the documents that are not equal to the value"},"plugins.asset_manager.plugin_version":{"type":"string","title":"Filter the search by plugins.asset_manager.plugin_version. Search for the documents that contains the value"},"not.plugins.asset_manager.plugin_version":{"type":"string","title":"Filter the search by not.plugins.asset_manager.plugin_version. Search for the documents that does not contain the value"},"plugins.asset_manager.plugin_version.keyword":{"type":"string","title":"Filter the search by plugins.asset_manager.plugin_version.keyword. Search for the documents that equals the value"},"not.plugins.asset_manager.plugin_version.keyword":{"type":"string","title":"Filter the search by not.plugins.asset_manager.plugin_version.keyword. Search for the documents that are not equal to the value"},"plugins.asset_manager.reboot_reasons":{"type":"string","title":"Filter the search by plugins.asset_manager.reboot_reasons. Search for the documents that contains the value"},"not.plugins.asset_manager.reboot_reasons":{"type":"string","title":"Filter the search by not.plugins.asset_manager.reboot_reasons. Search for the documents that does not contain the value"},"plugins.asset_manager.reboot_reasons.keyword":{"type":"string","title":"Filter the search by plugins.asset_manager.reboot_reasons.keyword. Search for the documents that equals the value"},"not.plugins.asset_manager.reboot_reasons.keyword":{"type":"string","title":"Filter the search by not.plugins.asset_manager.reboot_reasons.keyword. Search for the documents that are not equal to the value"},"plugins.endpoint_protection.plugin_version":{"type":"string","title":"Filter the search by plugins.endpoint_protection.plugin_version. Search for the documents that contains the value"},"not.plugins.endpoint_protection.plugin_version":{"type":"string","title":"Filter the search by not.plugins.endpoint_protection.plugin_version. Search for the documents that does not contain the value"},"plugins.endpoint_protection.plugin_version.keyword":{"type":"string","title":"Filter the search by plugins.endpoint_protection.plugin_version.keyword. Search for the documents that equals the value"},"not.plugins.endpoint_protection.plugin_version.keyword":{"type":"string","title":"Filter the search by not.plugins.endpoint_protection.plugin_version.keyword. Search for the documents that are not equal to the value"},"plugins.endpoint_protection.sdk_version":{"type":"string","title":"Filter the search by plugins.endpoint_protection.sdk_version. Search for the documents that contains the value"},"not.plugins.endpoint_protection.sdk_version":{"type":"string","title":"Filter the search by not.plugins.endpoint_protection.sdk_version. Search for the documents that does not contain the value"},"plugins.endpoint_protection.sdk_version.keyword":{"type":"string","title":"Filter the search by plugins.endpoint_protection.sdk_version.keyword. Search for the documents that equals the value"},"not.plugins.endpoint_protection.sdk_version.keyword":{"type":"string","title":"Filter the search by not.plugins.endpoint_protection.sdk_version.keyword. Search for the documents that are not equal to the value"},"plugins.endpoint_protection.component_package_version":{"type":"string","title":"Filter the search by plugins.endpoint_protection.component_package_version. Search for the documents that contains the value"},"not.plugins.endpoint_protection.component_package_version":{"type":"string","title":"Filter the search by not.plugins.endpoint_protection.component_package_version. Search for the documents that does not contain the value"},"plugins.endpoint_protection.component_package_version.keyword":{"type":"string","title":"Filter the search by plugins.endpoint_protection.component_package_version.keyword. Search for the documents that equals the value"},"not.plugins.endpoint_protection.component_package_version.keyword":{"type":"string","title":"Filter the search by not.plugins.endpoint_protection.component_package_version.keyword. Search for the documents that are not equal to the value"},"plugins.endpoint_protection.update_package_version":{"type":"string","title":"Filter the search by plugins.endpoint_protection.update_package_version. Search for the documents that contains the value"},"not.plugins.endpoint_protection.update_package_version":{"type":"string","title":"Filter the search by not.plugins.endpoint_protection.update_package_version. Search for the documents that does not contain the value"},"plugins.endpoint_protection.update_package_version.keyword":{"type":"string","title":"Filter the search by plugins.endpoint_protection.update_package_version.keyword. Search for the documents that equals the value"},"not.plugins.endpoint_protection.update_package_version.keyword":{"type":"string","title":"Filter the search by not.plugins.endpoint_protection.update_package_version.keyword. Search for the documents that are not equal to the value"},"plugins.endpoint_protection.reboot_reasons":{"type":"string","title":"Filter the search by plugins.endpoint_protection.reboot_reasons. Search for the documents that contains the value"},"not.plugins.endpoint_protection.reboot_reasons":{"type":"string","title":"Filter the search by not.plugins.endpoint_protection.reboot_reasons. Search for the documents that does not contain the value"},"plugins.endpoint_protection.reboot_reasons.keyword":{"type":"string","title":"Filter the search by plugins.endpoint_protection.reboot_reasons.keyword. Search for the documents that equals the value"},"not.plugins.endpoint_protection.reboot_reasons.keyword":{"type":"string","title":"Filter the search by not.plugins.endpoint_protection.reboot_reasons.keyword. Search for the documents that are not equal to the value"},"plugins.endpoint_detection_and_response.plugin_version":{"type":"string","title":"Filter the search by plugins.endpoint_detection_and_response.plugin_version. Search for the documents that contains the value"},"not.plugins.endpoint_detection_and_response.plugin_version":{"type":"string","title":"Filter the search by not.plugins.endpoint_detection_and_response.plugin_version. Search for the documents that does not contain the value"},"plugins.endpoint_detection_and_response.plugin_version.keyword":{"type":"string","title":"Filter the search by plugins.endpoint_detection_and_response.plugin_version.keyword. Search for the documents that equals the value"},"not.plugins.endpoint_detection_and_response.plugin_version.keyword":{"type":"string","title":"Filter the search by not.plugins.endpoint_detection_and_response.plugin_version.keyword. Search for the documents that are not equal to the value"},"plugins.endpoint_detection_and_response.reboot_reasons":{"type":"string","title":"Filter the search by plugins.endpoint_detection_and_response.reboot_reasons. Search for the documents that contains the value"},"not.plugins.endpoint_detection_and_response.reboot_reasons":{"type":"string","title":"Filter the search by not.plugins.endpoint_detection_and_response.reboot_reasons. Search for the documents that does not contain the value"},"plugins.endpoint_detection_and_response.reboot_reasons.keyword":{"type":"string","title":"Filter the search by plugins.endpoint_detection_and_response.reboot_reasons.keyword. Search for the documents that equals the value"},"not.plugins.endpoint_detection_and_response.reboot_reasons.keyword":{"type":"string","title":"Filter the search by not.plugins.endpoint_detection_and_response.reboot_reasons.keyword. Search for the documents that are not equal to the value"},"plugins.incident_response.plugin_version":{"type":"string","title":"Filter the search by plugins.incident_response.plugin_version. Search for the documents that contains the value"},"not.plugins.incident_response.plugin_version":{"type":"string","title":"Filter the search by not.plugins.incident_response.plugin_version. Search for the documents that does not contain the value"},"plugins.incident_response.plugin_version.keyword":{"type":"string","title":"Filter the search by plugins.incident_response.plugin_version.keyword. Search for the documents that equals the value"},"not.plugins.incident_response.plugin_version.keyword":{"type":"string","title":"Filter the search by not.plugins.incident_response.plugin_version.keyword. Search for the documents that are not equal to the value"},"plugins.incident_response.reboot_reasons":{"type":"string","title":"Filter the search by plugins.incident_response.reboot_reasons. Search for the documents that contains the value"},"not.plugins.incident_response.reboot_reasons":{"type":"string","title":"Filter the search by not.plugins.incident_response.reboot_reasons. Search for the documents that does not contain the value"},"plugins.incident_response.reboot_reasons.keyword":{"type":"string","title":"Filter the search by plugins.incident_response.reboot_reasons.keyword. Search for the documents that equals the value"},"not.plugins.incident_response.reboot_reasons.keyword":{"type":"string","title":"Filter the search by not.plugins.incident_response.reboot_reasons.keyword. Search for the documents that are not equal to the value"},"plugins.siem.plugin_version":{"type":"string","title":"Filter the search by plugins.siem.plugin_version. Search for the documents that contains the value"},"not.plugins.siem.plugin_version":{"type":"string","title":"Filter the search by not.plugins.siem.plugin_version. Search for the documents that does not contain the value"},"plugins.siem.plugin_version.keyword":{"type":"string","title":"Filter the search by plugins.siem.plugin_version.keyword. Search for the documents that equals the value"},"not.plugins.siem.plugin_version.keyword":{"type":"string","title":"Filter the search by not.plugins.siem.plugin_version.keyword. Search for the documents that are not equal to the value"},"plugins.browser_phishing_protection.plugin_version":{"type":"string","title":"Filter the search by plugins.browser_phishing_protection.plugin_version. Search for the documents that contains the value"},"not.plugins.browser_phishing_protection.plugin_version":{"type":"string","title":"Filter the search by not.plugins.browser_phishing_protection.plugin_version. Search for the documents that does not contain the value"},"plugins.browser_phishing_protection.plugin_version.keyword":{"type":"string","title":"Filter the search by plugins.browser_phishing_protection.plugin_version.keyword. Search for the documents that equals the value"},"not.plugins.browser_phishing_protection.plugin_version.keyword":{"type":"string","title":"Filter the search by not.plugins.browser_phishing_protection.plugin_version.keyword. Search for the documents that are not equal to the value"},"plugins.siem.reboot_reasons":{"type":"string","title":"Filter the search by plugins.siem.reboot_reasons. Search for the documents that contains the value"},"not.plugins.siem.reboot_reasons":{"type":"string","title":"Filter the search by not.plugins.siem.reboot_reasons. Search for the documents that does not contain the value"},"plugins.siem.reboot_reasons.keyword":{"type":"string","title":"Filter the search by plugins.siem.reboot_reasons.keyword. Search for the documents that equals the value"},"not.plugins.siem.reboot_reasons.keyword":{"type":"string","title":"Filter the search by not.plugins.siem.reboot_reasons.keyword. Search for the documents that are not equal to the value"},"engine_version":{"type":"string","title":"Filter the search by engine_version. Search for the documents that equal the value"},"not.engine_version":{"type":"string","title":"Filter the search by not.engine_version. Search for the documents that does not equal the value"},"engine_version.keyword":{"type":"string","title":"Filter the search by engine_version.keyword. Search for the documents that equals the value"},"not.engine_version.keyword":{"type":"string","title":"Filter the search by not.engine_version.keyword. Search for the documents that are not equal to the value"},"domain_name":{"type":"string","title":"Filter the search by domain_name. Search for the documents that contains the value"},"not.domain_name":{"type":"string","title":"Filter the search by not.domain_name. Search for the documents that does not contain the value"},"domain_name.keyword":{"type":"string","title":"Filter the search by domain_name.keyword. Search for the documents that equals the value"},"not.domain_name.keyword":{"type":"string","title":"Filter the search by not.domain_name.keyword. Search for the documents that are not equal to the value"},"policy_etag":{"type":"string","title":"Filter the search by policy_etag. Search for the documents that contains the value"},"not.policy_etag":{"type":"string","title":"Filter the search by not.policy_etag. Search for the documents that does not contain the value"},"policy_etag.keyword":{"type":"string","title":"Filter the search by policy_etag.keyword. Search for the documents that equals the value"},"not.policy_etag.keyword":{"type":"string","title":"Filter the search by not.policy_etag.keyword. Search for the documents that are not equal to the value"},"last_user":{"type":"string","title":"Filter the search by last_user. Search for the documents that contains the value"},"not.last_user":{"type":"string","title":"Filter the search by not.last_user. Search for the documents that does not contain the value"},"last_user.keyword":{"type":"string","title":"Filter the search by last_user.keyword. Search for the documents that equals the value"},"not.last_user.keyword":{"type":"string","title":"Filter the search by not.last_user.keyword. Search for the documents that are not equal to the value"},"id":{"type":"string","title":"Filter the search by id. Search for the documents that contains the value"},"not.id":{"type":"string","title":"Filter the search by not.id. Search for the documents that does not contain the value"},"id.keyword":{"type":"string","title":"Filter the search by id.keyword. Search for the documents that equals the value"},"not.id.keyword":{"type":"string","title":"Filter the search by not.id.keyword. Search for the documents that are not equal to the value"},"rule_id":{"type":"string","title":"Filter the search by rule_id. Search for the documents that contains the value"},"not.rule_id":{"type":"string","title":"Filter the search by not.rule_id. Search for the documents that does not contain the value"},"rule_id.keyword":{"type":"string","title":"Filter the search by rule_id.keyword. Search for the documents that equals the value"},"not.rule_id.keyword":{"type":"string","title":"Filter the search by not.rule_id.keyword. Search for the documents that are not equal to the value"},"origin_id":{"type":"string","title":"Filter the search by origin_id. Search for the documents that contains the value"},"not.origin_id":{"type":"string","title":"Filter the search by not.origin_id. Search for the documents that does not contain the value"},"origin_id.keyword":{"type":"string","title":"Filter the search by origin_id.keyword. Search for the documents that equals the value"},"not.origin_id.keyword":{"type":"string","title":"Filter the search by not.origin_id.keyword. Search for the documents that are not equal to the value"},"machine_id":{"type":"string","title":"Filter the search by machine_id. Search for the documents that contains the value"},"not.machine_id":{"type":"string","title":"Filter the search by not.machine_id. Search for the documents that does not contain the value"},"machine_id.keyword":{"type":"string","title":"Filter the search by machine_id.keyword. Search for the documents that equals the value"},"not.machine_id.keyword":{"type":"string","title":"Filter the search by not.machine_id.keyword. Search for the documents that are not equal to the value"},"group_ids":{"type":"array","title":"Filter the search by group_ids. Search for the documents that contains the value","items":{"type":"string"}},"group_id":{"type":"string","title":"Filter the search by group_id. Search for the documents that contains the value"},"not.group_id":{"type":"string","title":"Filter the search by not.group_id. Search for the documents that does not contain the value"},"group_id.keyword":{"type":"string","title":"Filter the search by group_id.keyword. Search for the documents that equals the value"},"not.group_id.keyword":{"type":"string","title":"Filter the search by not.group_id.keyword. Search for the documents that are not equal to the value"},"root_group_id":{"type":"string","title":"Filter the search by root_group_id. Search for the documents that contains the value"},"not.root_group_id":{"type":"string","title":"Filter the search by not.root_group_id. Search for the documents that does not contain the value"},"root_group_id.keyword":{"type":"string","title":"Filter the search by root_group_id.keyword. Search for the documents that equals the value"},"not.root_group_id.keyword":{"type":"string","title":"Filter the search by not.root_group_id.keyword. Search for the documents that are not equal to the value"},"group_name":{"type":"string","title":"Filter the search by group_name. Search for the documents that contains the value"},"not.group_name":{"type":"string","title":"Filter the search by not.group_name. Search for the documents that does not contain the value"},"group_name.keyword":{"type":"string","title":"Filter the search by group_name.keyword. Search for the documents that equals the value"},"not.group_name.keyword":{"type":"string","title":"Filter the search by not.group_name.keyword. Search for the documents that are not equal to the value"},"policy_id":{"type":"string","title":"Filter the search by policy_id. Search for the documents that contains the value"},"not.policy_id":{"type":"string","title":"Filter the search by not.policy_id. Search for the documents that does not contain the value"},"policy_id.keyword":{"type":"string","title":"Filter the search by policy_id.keyword. Search for the documents that equals the value"},"not.policy_id.keyword":{"type":"string","title":"Filter the search by not.policy_id.keyword. Search for the documents that are not equal to the value"},"policy_name":{"type":"string","title":"Filter the search by policy_name. Search for the documents that contains the value"},"not.policy_name":{"type":"string","title":"Filter the search by not.policy_name. Search for the documents that does not contain the value"},"policy_name.keyword":{"type":"string","title":"Filter the search by policy_name.keyword. Search for the documents that equals the value"},"not.policy_name.keyword":{"type":"string","title":"Filter the search by not.policy_name.keyword. Search for the documents that are not equal to the value"},"account_name":{"type":"string","title":"Filter the search by account_name. Search for the documents that contains the value"},"not.account_name":{"type":"string","title":"Filter the search by not.account_name. Search for the documents that does not contain the value"},"account_name.keyword":{"type":"string","title":"Filter the search by account_name.keyword. Search for the documents that equals the value"},"not.account_name.keyword":{"type":"string","title":"Filter the search by not.account_name.keyword. Search for the documents that are not equal to the value"},"parent_id":{"type":"string","title":"Filter the search by parent_id. Search for the documents that contains the value"},"not.parent_id":{"type":"string","title":"Filter the search by not.parent_id. Search for the documents that does not contain the value"},"parent_id.keyword":{"type":"string","title":"Filter the search by parent_id.keyword. Search for the documents that equals the value"},"not.parent_id.keyword":{"type":"string","title":"Filter the search by not.parent_id.keyword. Search for the documents that are not equal to the value"},"protocol":{"type":"string","title":"Filter the search by protocol. Search for the documents that contains the value"},"not.protocol":{"type":"string","title":"Filter the search by not.protocol. Search for the documents that does not contain the value"},"protocol.keyword":{"type":"string","title":"Filter the search by protocol.keyword. Search for the documents that equals the value"},"not.protocol.keyword":{"type":"string","title":"Filter the search by not.protocol.keyword. Search for the documents that are not equal to the value"},"attack_user":{"type":"string","title":"Filter the search by attack_user. Search for the documents that contains the value"},"not.attack_user":{"type":"string","title":"Filter the search by not.attack_user. Search for the documents that does not contain the value"},"attack_user.keyword":{"type":"string","title":"Filter the search by attack_user.keyword. Search for the documents that equals the value"},"not.attack_user.keyword":{"type":"string","title":"Filter the search by not.attack_user.keyword. Search for the documents that are not equal to the value"},"machine_name":{"type":"string","title":"Filter the search by machine_name. Search for the documents that contains the value"},"not.machine_name":{"type":"string","title":"Filter the search by not.machine_name. Search for the documents that does not contain the value"},"machine_name.keyword":{"type":"string","title":"Filter the search by machine_name.keyword. Search for the documents that equals the value"},"not.machine_name.keyword":{"type":"string","title":"Filter the search by not.machine_name.keyword. Search for the documents that are not equal to the value"},"ip":{"type":"string","title":"Filter the search by the source ip. Search for the documents that match the value"},"not.ip":{"type":"string","title":"Filter the search by the source not.ip. Search for the documents that does not match the value"},"machine_ip":{"type":"string","title":"Filter the search by the destination machine_ip. Search for the documents that mach the value"},"not.machine_ip":{"type":"string","title":"Filter the search by destination not.machine_ip. Search for the documents that does not match the value"},"deleted":{"type":"boolean","title":"Filter the search by deleted. Search for the documents that have been deleted"},"create_time_before":{"type":"string","title":"Filter the search by create_time_before. Search for the documents that occurs before the value"},"create_time_after":{"type":"string","title":"Filter the search by create_time_after. Search for the documents that occurs after the value"},"expire_time_before":{"type":"string","title":"Filter the search by expire_time_before. Search for the documents that occurs before the value"},"expire_time_after":{"type":"string","title":"Filter the search by expire_time_after. Search for the documents that occurs after the value"},"port_lt":{"type":["integer","string"],"pattern":"^\\d+$","title":"Filter the search by port_lt. Search for the documents that are less than the value (Ex. \"1234\")"},"port_lte":{"type":["integer","string"],"pattern":"^\\d+$","title":"Filter the search by port_lte. Search for the documents that are less than the value (Ex. \"1234\")"},"port_gt":{"type":["integer","string"],"pattern":"^\\d+$","title":"Filter the search by port_gt. Search for the documents that are greater than the value (Ex. \"1234\")"},"port_gte":{"type":["integer","string"],"pattern":"^\\d+$","title":"Filter the search by port_gte. Search for the documents that are greater than the value (Ex. \"1234\")"},"attempts_lt":{"type":["integer","string"],"pattern":"^\\d+$","title":"Filter the search by attempts_lt. Search for the documents that are less than the value (Ex. \"1234\")"},"attempts_lte":{"type":["integer","string"],"pattern":"^\\d+$","title":"Filter the search by attempts_lte. Search for the documents that are less than the value (Ex. \"1234\")"},"attempts_gt":{"type":["integer","string"],"pattern":"^\\d+$","title":"Filter the search by attempts_gt. Search for the documents that are greater than the value (Ex. \"1234\")"},"attempts_gte":{"type":["integer","string"],"pattern":"^\\d+$","title":"Filter the search by attempts_gte. Search for the documents that are greater than the value (Ex. \"1234\")"},"duration_lt":{"type":["integer","string"],"pattern":"^\\d+$","title":"Filter the search by duration_lt. Search for the documents that are less than the value (Ex. \"1234\")"},"duration_lte":{"type":["integer","string"],"pattern":"^\\d+$","title":"Filter the search by duration_lte. Search for the documents that are less than the value (Ex. \"1234\")"},"duration_gt":{"type":["integer","string"],"pattern":"^\\d+$","title":"Filter the search by duration_gt. Search for the documents that are greater than the value (Ex. \"1234\")"},"duration_gte":{"type":["integer","string"],"pattern":"^\\d+$","title":"Filter the search by duration_gte. Search for the documents that are greater than the value (Ex. \"1234\")"},"source_location.city":{"type":"string","title":"Filter the search by source_location.city. Search for the documents that contains the value"},"not.source_location.city":{"type":"string","title":"Filter the search by not.source_location.city. Search for the documents that does not contain the value"},"source_location.city.keyword":{"type":"string","title":"Filter the search by source_location.city.keyword. Search for the documents that equals the value"},"not.source_location.city.keyword":{"type":"string","title":"Filter the search by not.source_location.city.keyword. Search for the documents that are not equal to the value"},"source_location.country":{"type":"string","title":"Filter the search by source_location.country. Search for the documents that contains the value"},"not.source_location.country":{"type":"string","title":"Filter the search by not.source_location.country. Search for the documents that does not contain the value"},"source_location.country.keyword":{"type":"string","title":"Filter the search by source_location.country.keyword. Search for the documents that equals the value"},"not.source_location.country.keyword":{"type":"string","title":"Filter the search by not.source_location.country.keyword. Search for the documents that are not equal to the value"},"source_location.country_iso":{"type":"string","title":"Filter the search by source_location.country_iso. Search for the documents that contains the value"},"not.source_location.country_iso":{"type":"string","title":"Filter the search by not.source_location.country_iso. Search for the documents that does not contain the value"},"source_location.country_iso.keyword":{"type":"string","title":"Filter the search by source_location.country_iso.keyword. Search for the documents that equals the value"},"not.source_location.country_iso.keyword":{"type":"string","title":"Filter the search by not.source_location.country_iso.keyword. Search for the documents that are not equal to the value"},"source_location.continent":{"type":"string","title":"Filter the search by source_location.continent. Search for the documents that contains the value"},"not.source_location.continent":{"type":"string","title":"Filter the search by not.source_location.continent. Search for the documents that does not contain the value"},"source_location.continent.keyword":{"type":"string","title":"Filter the search by source_location.continent.keyword. Search for the documents that equals the value"},"not.source_location.continent.keyword":{"type":"string","title":"Filter the search by not.source_location.continent.keyword. Search for the documents that are not equal to the value"},"source_location.time_zone":{"type":"string","title":"Filter the search by source_location.time_zone. Search for the documents that contains the value"},"not.source_location.time_zone":{"type":"string","title":"Filter the search by not.source_location.time_zone. Search for the documents that does not contain the value"},"source_location.time_zone.keyword":{"type":"string","title":"Filter the search by source_location.time_zone.keyword. Search for the documents that equals the value"},"not.source_location.time_zone.keyword":{"type":"string","title":"Filter the search by not.source_location.time_zone.keyword. Search for the documents that are not equal to the value"},"source_location.postal_code":{"type":"string","title":"Filter the search by source_location.postal_code. Search for the documents that contains the value"},"not.source_location.postal_code":{"type":"string","title":"Filter the search by not.source_location.postal_code. Search for the documents that does not contain the value"},"source_location.postal_code.keyword":{"type":"string","title":"Filter the search by source_location.postal_code.keyword. Search for the documents that equals the value"},"not.source_location.postal_code.keyword":{"type":"string","title":"Filter the search by not.source_location.postal_code.keyword. Search for the documents that are not equal to the value"},"source_location.subdivisions":{"type":"string","title":"Filter the search by source_location.subdivisions. Search for the documents that contains the value"},"not.source_location.subdivisions":{"type":"string","title":"Filter the search by not.source_location.subdivisions. Search for the documents that does not contain the value"},"source_location.subdivisions.keyword":{"type":"string","title":"Filter the search by source_location.subdivisions.keyword. Search for the documents that equals the value"},"not.source_location.subdivisions.keyword":{"type":"string","title":"Filter the search by not.source_location.subdivisions.keyword. Search for the documents that are not equal to the value"},"destination_location.city":{"type":"string","title":"Filter the search by destination_location.city. Search for the documents that contains the value"},"not.destination_location.city":{"type":"string","title":"Filter the search by not.destination_location.city. Search for the documents that does not contain the value"},"destination_location.city.keyword":{"type":"string","title":"Filter the search by destination_location.city.keyword. Search for the documents that equals the value"},"not.destination_location.city.keyword":{"type":"string","title":"Filter the search by not.destination_location.city.keyword. Search for the documents that are not equal to the value"},"destination_location.country":{"type":"string","title":"Filter the search by destination_location.country. Search for the documents that contains the value"},"not.destination_location.country":{"type":"string","title":"Filter the search by not.destination_location.country. Search for the documents that does not contain the value"},"destination_location.country.keyword":{"type":"string","title":"Filter the search by destination_location.country.keyword. Search for the documents that equals the value"},"not.destination_location.country.keyword":{"type":"string","title":"Filter the search by not.destination_location.country.keyword. Search for the documents that are not equal to the value"},"destination_location.country_iso":{"type":"string","title":"Filter the search by destination_location.country_iso. Search for the documents that contains the value"},"not.destination_location.country_iso":{"type":"string","title":"Filter the search by not.destination_location.country_iso. Search for the documents that does not contain the value"},"destination_location.country_iso.keyword":{"type":"string","title":"Filter the search by destination_location.country_iso.keyword. Search for the documents that equals the value"},"not.destination_location.country_iso.keyword":{"type":"string","title":"Filter the search by not.destination_location.country_iso.keyword. Search for the documents that are not equal to the value"},"destination_location.continent":{"type":"string","title":"Filter the search by destination_location.continent. Search for the documents that contains the value"},"not.destination_location.continent":{"type":"string","title":"Filter the search by not.destination_location.continent. Search for the documents that does not contain the value"},"destination_location.continent.keyword":{"type":"string","title":"Filter the search by destination_location.continent.keyword. Search for the documents that equals the value"},"not.destination_location.continent.keyword":{"type":"string","title":"Filter the search by not.destination_location.continent.keyword. Search for the documents that are not equal to the value"},"destination_location.time_zone":{"type":"string","title":"Filter the search by destination_location.time_zone. Search for the documents that contains the value"},"not.destination_location.time_zone":{"type":"string","title":"Filter the search by not.destination_location.time_zone. Search for the documents that does not contain the value"},"destination_location.time_zone.keyword":{"type":"string","title":"Filter the search by destination_location.time_zone.keyword. Search for the documents that equals the value"},"not.destination_location.time_zone.keyword":{"type":"string","title":"Filter the search by not.destination_location.time_zone.keyword. Search for the documents that are not equal to the value"},"destination_location.postal_code":{"type":"string","title":"Filter the search by destination_location.postal_code. Search for the documents that contains the value"},"not.destination_location.postal_code":{"type":"string","title":"Filter the search by not.destination_location.postal_code. Search for the documents that does not contain the value"},"destination_location.postal_code.keyword":{"type":"string","title":"Filter the search by destination_location.postal_code.keyword. Search for the documents that equals the value"},"not.destination_location.postal_code.keyword":{"type":"string","title":"Filter the search by not.destination_location.postal_code.keyword. Search for the documents that are not equal to the value"},"destination_location.subdivisions":{"type":"string","title":"Filter the search by destination_location.subdivisions. Search for the documents that contains the value"},"not.destination_location.subdivisions":{"type":"string","title":"Filter the search by not.destination_location.subdivisions. Search for the documents that does not contain the value"},"destination_location.subdivisions.keyword":{"type":"string","title":"Filter the search by destination_location.subdivisions.keyword. Search for the documents that equals the value"},"not.destination_location.subdivisions.keyword":{"type":"string","title":"Filter the search by not.destination_location.subdivisions.keyword. Search for the documents that are not equal to the value"},"sort_field":{"type":"string","title":"Sort field","default":"expire_time","enum":["id","rule_id","origin_id","machine_id","group_id","root_group_id","group_name","policy_id","policy_name","account_id","account_name","parent_id","port","attempts","duration","protocol","attack_user","machine_ip","ip","create_time","expire_time","deleted","machine_name","at","nics.ips","nics.mac_address","nics.description.keyword","os_info.os_type","os_info.os_version.keyword","os_info.os_platform","os_info.os_architecture","os_info.os_release_name.keyword","host_name.keyword","fully_qualified_host_name.keyword","plugins.asset_manager.plugin_version.keyword","plugins.asset_manager.reboot_reasons","plugins.endpoint_protection.plugin_version.keyword","plugins.endpoint_protection.sdk_version.keyword","plugins.endpoint_protection.component_package_version.keyword","plugins.endpoint_protection.update_package_version.keyword","plugins.endpoint_protection.reboot_reasons","plugins.endpoint_detection_and_response.plugin_version.keyword","plugins.endpoint_detection_and_response.reboot_reasons","plugins.incident_response.plugin_version.keyword","plugins.incident_response.reboot_reasons","plugins.siem.plugin_version.keyword","plugins.siem.reboot_reasons","engine_version.keyword","domain_name.keyword","policy_etag","source_location.city","source_location.country","source_location.country_iso","source_location.continent","source_location.time_zone","source_location.postal_code","source_location.subdivisions","destination_location.city","destination_location.country","destination_location.country_iso","destination_location.continent","destination_location.time_zone","destination_location.postal_code","destination_location.subdivisions"]},"sort_order":{"type":"string","title":"Sorting direction","default":"asc","enum":["asc","desc"]},"page_size":{"type":"number","title":"The size of the page. If you only need aggregations, set it to 0","minimum":0,"default":50,"maximum":2000},"aggregations":{"type":"array","title":"The Aggregations Schema","items":{"type":"string","title":"Aggregations","default":[],"enum":["protection_status","os_info.os_release_name.keyword","nics.ips","nics.mac_address","nics.description.keyword","os_info.os_type","os_info.os_version.keyword","os_info.os_platform","os_info.os_architecture","host_name.keyword","fully_qualified_host_name.keyword","plugins.asset_manager.plugin_version.keyword","plugins.asset_manager.reboot_reasons","plugins.endpoint_protection.plugin_version.keyword","plugins.endpoint_protection.sdk_version.keyword","plugins.endpoint_protection.component_package_version.keyword","plugins.endpoint_protection.update_package_version.keyword","plugins.endpoint_protection.reboot_reasons","plugins.endpoint_detection_and_response.plugin_version.keyword","plugins.endpoint_detection_and_response.reboot_reasons","plugins.incident_response.plugin_version.keyword","plugins.incident_response.reboot_reasons","plugins.siem.plugin_version.keyword","plugins.siem.reboot_reasons","engine_version.keyword","domain_name.keyword","policy_etag","last_user.keyword","is_software_update_available","origin_id","machine_id","group_id","root_group_id","group_name","policy_id","policy_name","account_id","parent_id","port","protocol","attack_user","machine_ip","ip","deleted","machine_name","source_location.city","source_location.country","source_location.country_iso","source_location.continent","source_location.time_zone","source_location.postal_code","source_location.subdivisions","destination_location.city","destination_location.country","destination_location.country_iso","destination_location.continent","destination_location.time_zone","destination_location.postal_code","destination_location.subdivisions"]}},"account_ids":{"type":"array","title":"The account ids to filter your search","items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"Search assets software result","properties":{"rules":{"type":"array","items":{"allOf":[{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"The root schema","description":"The root schema comprises the entire JSON document.","default":{},"examples":[{"parentId":"39a42ecb-bfd1-40e6-8b83-70318b7d30af","rootGroupId":"76132a40-5a9f-4197-9f38-c185f31f1d45","ruleId":"ed31c443-42fa-40ae-a4a6-a05ad8b560e4","ip":"10.153.0.162","attackUser":"Administrator","attempts":2,"expireTime":"2020-10-23T13:25:35Z","deleted":false,"protocol":"RDP","createTime":"2020-10-23T13:20:35Z","groupId":"76132a40-5a9f-4197-9f38-c185f31f1d45","port":3389,"machineId":"f2bcafe1-cb2b-4833-b6c9-6148b9511c8f","accountId":"39a42ecb-bfd1-40e6-8b83-70318b7d30af","machineName":"sahamedw8-1x86","duration":3}],"properties":{"parent_id":{"type":"string","title":"The parent_id schema","default":"","examples":["39a42ecb-bfd1-40e6-8b83-70318b7d30af"]},"root_group_id":{"type":"string","title":"The root_group_id schema","default":"","examples":["76132a40-5a9f-4197-9f38-c185f31f1d45"]},"rule_id":{"type":"string","title":"The rule_id schema","default":"","examples":["ed31c443-42fa-40ae-a4a6-a05ad8b560e4"]},"ip":{"type":"string","title":"The ip schema","default":"","examples":["10.153.0.162"]},"attack_user":{"type":"string","title":"The attack_user schema","default":"","examples":["Administrator"]},"attempts":{"type":"integer","title":"The attempts schema","default":0,"examples":[2]},"expire_time":{"type":"string","title":"The expireTime schema","default":"","examples":["2020-10-23T13:25:35Z"]},"deleted":{"type":"boolean","title":"The deleted schema","default":false,"examples":[false]},"protocol":{"type":"string","title":"The protocol schema","default":"","examples":["RDP"]},"create_time":{"type":"string","title":"The create_time schema","default":"","examples":["2020-10-23T13:20:35Z"]},"group_id":{"type":"string","title":"The group_id schema","default":"","examples":["76132a40-5a9f-4197-9f38-c185f31f1d45"]},"port":{"type":"integer","title":"The port schema","default":0,"examples":[3389]},"machine_id":{"type":"string","title":"The machine_id schema","default":"","examples":["f2bcafe1-cb2b-4833-b6c9-6148b9511c8f"]},"account_id":{"type":"string","title":"The account_id schema","default":"","examples":["39a42ecb-bfd1-40e6-8b83-70318b7d30af"]},"account_name":{"type":"string","title":"The account_name schema","default":"","examples":["my_account"]},"machine_name":{"type":"string","title":"The machine_name schema","default":"","examples":["sahamedw8-1x86"]},"duration":{"type":"integer","title":"The duration schema","default":0,"examples":[3]}}},{"properties":{"agent":{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"The root schema","description":"The root schema comprises the entire JSON document.","default":{},"examples":[{"at":"2020-10-23T14:20:51.006558Z","is_software_update_available":false,"started_at_local":"2020-10-23T14:20:50.920306Z","started_at_offset":-25200,"nics":[{"ips":["10.151.110.52"],"description":"Intel(R) 82574L Gigabit Network Connection","mac_address":"005056B91173"}],"os_info":{"os_type":"Workstation","os_version":"6.3.9600","os_platform":"Windows","os_architecture":"x86","os_release_name":"Microsoft Windows 8.1 Pro"},"fully_qualified_host_name":"sahamedw8-1x86","plugins":{"windows_remote_intrusion_detection_and_prevention":{"product_name":"Windows Remote Intrusion Detection and Prevention","plugin_version":"1.2.0.21"},"endpoint_protection":{"sdk_version":"4.2.1.90","product_name":"Endpoint Protection","plugin_version":"1.2.0.844","update_package_version":"1.0.31870","component_package_version":"1.0.1085","reboot_reasons":0},"asset_manager":{"product_name":"Asset Manager","plugin_version":"1.2.0.330","reboot_reasons":0},"endpoint_detection_and_response":{"product_name":"Endpoint Detection and Response","plugin_version":"1.2.0.297","reboot_reasons":0}},"engine_version":"1.2.0.821","policy_etag":"c6ea44914b72c92cba939ac3bd369dc4","last_user":"SAHAMEDW8-1X86\\Administrator","serial_number":"c02thb32g8wn","host_name":"sahamedw8-1x86","machine_id":"f2bcafe1-cb2b-4833-b6c9-6148b9511c8f","machine_ip":"216.75.233.210"}],"properties":{"at":{"type":"string","title":"The at schema","default":"","examples":["2020-10-23T14:20:51.006558Z"]},"is_software_update_available":{"type":"boolean","title":"The is_software_update_available schema","default":false,"examples":[false]},"started_at_local":{"type":"string","title":"The started_at_local schema","default":"","examples":["2020-10-23T14:20:50.920306Z"]},"started_at_offset":{"type":"integer","title":"The started_at_offset schema","default":0,"examples":[-25200]},"nics":{"type":"array","title":"The nics schema","default":[],"examples":[[{"ips":["10.151.110.52"],"description":"Intel(R) 82574L Gigabit Network Connection","mac_address":"005056B91173"}]],"additionalItems":true,"items":{"anyOf":[{"type":"object","title":"The first anyOf schema","default":{},"examples":[{"ips":["10.151.110.52"],"description":"Intel(R) 82574L Gigabit Network Connection","mac_address":"005056B91173"}],"properties":{"ips":{"type":"array","title":"The ips schema","default":[],"examples":[["10.151.110.52"]],"additionalItems":true,"items":{"anyOf":[{"type":"string","title":"The first anyOf schema","default":"","examples":["10.151.110.52"]}]}},"description":{"type":"string","title":"The description schema","default":"","examples":["Intel(R) 82574L Gigabit Network Connection"]},"mac_address":{"type":"string","title":"The mac_address schema","default":"","examples":["005056B91173"]}},"additionalProperties":true}]}},"os_info":{"type":"object","title":"The os_info schema","default":{},"examples":[{"os_type":"Workstation","os_version":"6.3.9600","os_platform":"Windows","os_architecture":"x86","os_release_name":"Microsoft Windows 8.1 Pro"}],"properties":{"os_type":{"type":"string","title":"The os_type schema","default":"","examples":["Workstation"]},"os_version":{"type":"string","title":"The os_version schema","default":"","examples":["6.3.9600"]},"os_platform":{"type":"string","title":"The os_platform schema","default":"","examples":["Windows"]},"os_architecture":{"type":"string","title":"The os_architecture schema","default":"","examples":["x86"]},"os_release_name":{"type":"string","title":"The os_release_name schema","default":"","examples":["Microsoft Windows 8.1 Pro"]}},"additionalProperties":true},"fully_qualified_host_name":{"type":"string","title":"The fully_qualified_host_name schema","default":"","examples":["sahamedw8-1x86"]},"plugins":{"type":"object","title":"The plugins schema","default":{},"examples":[{"windows_remote_intrusion_detection_and_prevention":{"product_name":"Windows Remote Intrusion Detection and Prevention","plugin_version":"1.2.0.21"},"endpoint_protection":{"sdk_version":"4.2.1.90","product_name":"Endpoint Protection","plugin_version":"1.2.0.844","update_package_version":"1.0.31870","component_package_version":"1.0.1085","reboot_reasons":0},"asset_manager":{"product_name":"Asset Manager","plugin_version":"1.2.0.330","reboot_reasons":0},"endpoint_detection_and_response":{"product_name":"Endpoint Detection and Response","plugin_version":"1.2.0.297","reboot_reasons":0}}],"properties":{"windows_remote_intrusion_detection_and_prevention":{"type":"object","title":"The windows_remote_intrusion_detection_and_prevention schema","default":{},"examples":[{"product_name":"Windows Remote Intrusion Detection and Prevention","plugin_version":"1.2.0.21"}],"properties":{"product_name":{"type":"string","title":"The product_name schema","default":"","examples":["Windows Remote Intrusion Detection and Prevention"]},"plugin_version":{"type":"string","title":"The plugin_version schema","default":"","examples":["1.2.0.21"]}},"additionalProperties":true},"endpoint_protection":{"type":"object","title":"The endpoint_protection schema","default":{},"examples":[{"sdk_version":"4.2.1.90","product_name":"Endpoint Protection","plugin_version":"1.2.0.844","update_package_version":"1.0.31870","component_package_version":"1.0.1085","reboot_reasons":0}],"properties":{"sdk_version":{"type":"string","title":"The sdk_version schema","default":"","examples":["4.2.1.90"]},"product_name":{"type":"string","title":"The product_name schema","default":"","examples":["Endpoint Protection"]},"plugin_version":{"type":"string","title":"The plugin_version schema","default":"","examples":["1.2.0.844"]},"update_package_version":{"type":"string","title":"The update_package_version schema","default":"","examples":["1.0.31870"]},"component_package_version":{"type":"string","title":"The component_package_version schema","default":"","examples":["1.0.1085"]},"reboot_reasons":{"type":"integer","title":"The reboot_reasons schema","default":0,"examples":[0]}},"additionalProperties":true},"asset_manager":{"type":"object","title":"The asset_manager schema","default":{},"examples":[{"product_name":"Asset Manager","plugin_version":"1.2.0.330","reboot_reasons":0}],"properties":{"product_name":{"type":"string","title":"The product_name schema","default":"","examples":["Asset Manager"]},"plugin_version":{"type":"string","title":"The plugin_version schema","default":"","examples":["1.2.0.330"]},"reboot_reasons":{"type":"integer","title":"The reboot_reasons schema","default":0,"examples":[0]}},"additionalProperties":true},"endpoint_detection_and_response":{"type":"object","title":"The endpoint_detection_and_response schema","default":{},"examples":[{"product_name":"Endpoint Detection and Response","plugin_version":"1.2.0.297","reboot_reasons":0}],"properties":{"product_name":{"type":"string","title":"The product_name schema","default":"","examples":["Endpoint Detection and Response"]},"plugin_version":{"type":"string","title":"The plugin_version schema","default":"","examples":["1.2.0.297"]},"reboot_reasons":{"type":"integer","title":"The reboot_reasons schema","default":0,"examples":[0]}},"additionalProperties":true}},"additionalProperties":true},"engine_version":{"type":"string","title":"The engine_version schema","default":"","examples":["1.2.0.821"]},"policy_etag":{"type":"string","title":"The policy_etag schema","default":"","examples":["c6ea44914b72c92cba939ac3bd369dc4"]},"last_user":{"type":"string","title":"The last_user schema","default":"","examples":["SAHAMEDW8-1X86\\Administrator"]},"host_name":{"type":"string","title":"The host_name schema","default":"","examples":["sahamedw8-1x86"]},"machine_id":{"type":"string","title":"The machine_id schema","default":"","examples":["f2bcafe1-cb2b-4833-b6c9-6148b9511c8f"]},"machine_ip":{"type":"string","title":"The machine_ip schema","default":"","examples":["216.75.233.210"]},"object_guid":{"type":"string","title":"The object_guid schema","default":""}}},"source_location":{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"The root schema","description":"The root schema comprises the entire JSON document.","default":{},"examples":[{"city":"Santa Clara","continent":"North America","subdivisions":["California"],"country":"United States","country_iso":"US","accuracy_radius":10,"point":{"lat":37.3417,"lon":-121.9753},"postal_code":"95051","anonymous_proxy":false,"time_zone":"America/Los_Angeles"}],"properties":{"city":{"type":"string","title":"The city schema","default":"","examples":["Santa Clara"]},"continent":{"type":"string","title":"The continent schema","default":"","examples":["North America"]},"subdivisions":{"type":"array","title":"The subdivisions schema","default":[],"examples":[["California"]],"items":{"anyOf":[{"type":"string","title":"The first anyOf schema","default":"","examples":["California"]}]}},"country":{"type":"string","title":"The country schema","default":"","examples":["United States"]},"country_iso":{"type":"string","title":"The country_iso schema","default":"","examples":["United States"]},"accuracy_radius":{"type":"integer","title":"The accuracy_radius schema","default":0,"examples":[10]},"point":{"type":"object","title":"The point schema","default":{},"examples":[{"lat":37.3417,"lon":-121.9753}],"properties":{"lat":{"allOf":[{"bignumber":true},{"type":"number","title":"The latitude","default":0,"examples":[37.3417]}]},"lon":{"allOf":[{"bignumber":true},{"type":"number","title":"The longitude","default":0,"examples":[-121.9753]}]}}},"postal_code":{"type":"string","title":"The postal_code schema","default":"","examples":["95051"]},"anonymous_proxy":{"type":"boolean","title":"The anonymous_proxy schema","default":false,"examples":[false]},"time_zone":{"type":"string","title":"The time_zone schema","default":"","examples":["America/Los_Angeles"]}}},"destination_location":{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"The root schema","description":"The root schema comprises the entire JSON document.","default":{},"examples":[{"city":"Santa Clara","continent":"North America","subdivisions":["California"],"country":"United States","country_iso":"US","accuracy_radius":10,"point":{"lat":37.3417,"lon":-121.9753},"postal_code":"95051","anonymous_proxy":false,"time_zone":"America/Los_Angeles"}],"properties":{"city":{"type":"string","title":"The city schema","default":"","examples":["Santa Clara"]},"continent":{"type":"string","title":"The continent schema","default":"","examples":["North America"]},"subdivisions":{"type":"array","title":"The subdivisions schema","default":[],"examples":[["California"]],"items":{"anyOf":[{"type":"string","title":"The first anyOf schema","default":"","examples":["California"]}]}},"country":{"type":"string","title":"The country schema","default":"","examples":["United States"]},"country_iso":{"type":"string","title":"The country_iso schema","default":"","examples":["United States"]},"accuracy_radius":{"type":"integer","title":"The accuracy_radius schema","default":0,"examples":[10]},"point":{"type":"object","title":"The point schema","default":{},"examples":[{"lat":37.3417,"lon":-121.9753}],"properties":{"lat":{"allOf":[{"bignumber":true},{"type":"number","title":"The latitude","default":0,"examples":[37.3417]}]},"lon":{"allOf":[{"bignumber":true},{"type":"number","title":"The longitude","default":0,"examples":[-121.9753]}]}}},"postal_code":{"type":"string","title":"The postal_code schema","default":"","examples":["95051"]},"anonymous_proxy":{"type":"boolean","title":"The anonymous_proxy schema","default":false,"examples":[false]},"time_zone":{"type":"string","title":"The time_zone schema","default":"","examples":["America/Los_Angeles"]}}}}}]}},"aggregations":{"type":"object","title":"Aggregations","additionalProperties":true},"total_count":{"type":"integer","title":"Total count of found detections"},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}},"required":["rules","total_count"]}}}}},"tags":["Remote Intrusion Detection"],"operationId":"api.v2.rmm.search.rid.rules"}},"/oneview/v1/rid/rules/search-groupby":{"post":{"description":"Search grouped RID","summary":"Search grouped RID","security":[{"client_credentials":["read"]},{"user_permissions":["bruteForce.view"]}],"status":{"incident":["read_nebula_data"],"outage":["auth","search_stateful"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"The Post Assets Search GroupBy Request Schema","required":["group_by"],"allOf":[{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"Search rid rules request. Leading wildcards are not supported for constraint fields without '.keyword' suffix.","required":["account_ids"],"properties":{"nics.mac_address":{"type":"string","title":"Filter the search by nics.mac_address. Search for the documents that contains the value"},"not.nics.mac_address":{"type":"string","title":"Filter the search by not.nics.mac_address. Search for the documents that does not contain the value"},"nics.mac_address.keyword":{"type":"string","title":"Filter the search by nics.mac_address.keyword. Search for the documents that equals the value"},"not.nics.mac_address.keyword":{"type":"string","title":"Filter the search by not.nics.mac_address.keyword. Search for the documents that are not equal to the value"},"nics.description":{"type":"string","title":"Filter the search by nics.description. Search for the documents that contains the value"},"not.nics.description":{"type":"string","title":"Filter the search by not.nics.description. Search for the documents that does not contain the value"},"nics.description.keyword":{"type":"string","title":"Filter the search by nics.description.keyword. Search for the documents that equals the value"},"not.nics.description.keyword":{"type":"string","title":"Filter the search by not.nics.description.keyword. Search for the documents that are not equal to the value"},"os_info.os_type":{"type":"string","title":"Filter the search by os_info.os_type. Search for the documents that contains the value"},"not.os_info.os_type":{"type":"string","title":"Filter the search by not.os_info.os_type. Search for the documents that does not contain the value"},"os_info.os_type.keyword":{"type":"string","title":"Filter the search by os_info.os_type.keyword. Search for the documents that equals the value"},"not.os_info.os_type.keyword":{"type":"string","title":"Filter the search by not.os_info.os_type.keyword. Search for the documents that are not equal to the value"},"os_info.os_version":{"type":"string","title":"Filter the search by os_info.os_version. Search for the documents that contains the value"},"not.os_info.os_version":{"type":"string","title":"Filter the search by not.os_info.os_version. Search for the documents that does not contain the value"},"os_info.os_version.keyword":{"type":"string","title":"Filter the search by os_info.os_version.keyword. Search for the documents that equals the value"},"not.os_info.os_version.keyword":{"type":"string","title":"Filter the search by not.os_info.os_version.keyword. Search for the documents that are not equal to the value"},"os_info.os_platform":{"type":"string","title":"Filter the search by os_info.os_platform. Search for the documents that contains the value"},"not.os_info.os_platform":{"type":"string","title":"Filter the search by not.os_info.os_platform. Search for the documents that does not contain the value"},"os_info.os_platform.keyword":{"type":"string","title":"Filter the search by os_info.os_platform.keyword. Search for the documents that equals the value"},"not.os_info.os_platform.keyword":{"type":"string","title":"Filter the search by not.os_info.os_platform.keyword. Search for the documents that are not equal to the value"},"os_info.os_architecture":{"type":"string","title":"Filter the search by os_info.os_architecture. Search for the documents that contains the value"},"not.os_info.os_architecture":{"type":"string","title":"Filter the search by not.os_info.os_architecture. Search for the documents that does not contain the value"},"os_info.os_architecture.keyword":{"type":"string","title":"Filter the search by os_info.os_architecture.keyword. Search for the documents that equals the value"},"not.os_info.os_architecture.keyword":{"type":"string","title":"Filter the search by not.os_info.os_architecture.keyword. Search for the documents that are not equal to the value"},"os_info.os_release_name":{"type":"string","title":"Filter the search by os_info.os_release_name. Search for the documents that contains the value"},"not.os_info.os_release_name":{"type":"string","title":"Filter the search by not.os_info.os_release_name. Search for the documents that does not contain the value"},"os_info.os_release_name.keyword":{"type":"string","title":"Filter the search by os_info.os_release_name.keyword. Search for the documents that equals the value"},"not.os_info.os_release_name.keyword":{"type":"string","title":"Filter the search by not.os_info.os_release_name.keyword. Search for the documents that are not equal to the value"},"host_name":{"type":"string","title":"Filter the search by host_name. Search for the documents that contains the value"},"not.host_name":{"type":"string","title":"Filter the search by not.host_name. Search for the documents that does not contain the value"},"host_name.keyword":{"type":"string","title":"Filter the search by host_name.keyword. Search for the documents that equals the value"},"not.host_name.keyword":{"type":"string","title":"Filter the search by not.host_name.keyword. Search for the documents that are not equal to the value"},"fully_qualified_host_name":{"type":"string","title":"Filter the search by fully_qualified_host_name. Search for the documents that contains the value"},"not.fully_qualified_host_name":{"type":"string","title":"Filter the search by not.fully_qualified_host_name. Search for the documents that does not contain the value"},"fully_qualified_host_name.keyword":{"type":"string","title":"Filter the search by fully_qualified_host_name.keyword. Search for the documents that equals the value"},"not.fully_qualified_host_name.keyword":{"type":"string","title":"Filter the search by not.fully_qualified_host_name.keyword. Search for the documents that are not equal to the value"},"plugins.asset_manager.plugin_version":{"type":"string","title":"Filter the search by plugins.asset_manager.plugin_version. Search for the documents that contains the value"},"not.plugins.asset_manager.plugin_version":{"type":"string","title":"Filter the search by not.plugins.asset_manager.plugin_version. Search for the documents that does not contain the value"},"plugins.asset_manager.plugin_version.keyword":{"type":"string","title":"Filter the search by plugins.asset_manager.plugin_version.keyword. Search for the documents that equals the value"},"not.plugins.asset_manager.plugin_version.keyword":{"type":"string","title":"Filter the search by not.plugins.asset_manager.plugin_version.keyword. Search for the documents that are not equal to the value"},"plugins.asset_manager.reboot_reasons":{"type":"string","title":"Filter the search by plugins.asset_manager.reboot_reasons. Search for the documents that contains the value"},"not.plugins.asset_manager.reboot_reasons":{"type":"string","title":"Filter the search by not.plugins.asset_manager.reboot_reasons. Search for the documents that does not contain the value"},"plugins.asset_manager.reboot_reasons.keyword":{"type":"string","title":"Filter the search by plugins.asset_manager.reboot_reasons.keyword. Search for the documents that equals the value"},"not.plugins.asset_manager.reboot_reasons.keyword":{"type":"string","title":"Filter the search by not.plugins.asset_manager.reboot_reasons.keyword. Search for the documents that are not equal to the value"},"plugins.endpoint_protection.plugin_version":{"type":"string","title":"Filter the search by plugins.endpoint_protection.plugin_version. Search for the documents that contains the value"},"not.plugins.endpoint_protection.plugin_version":{"type":"string","title":"Filter the search by not.plugins.endpoint_protection.plugin_version. Search for the documents that does not contain the value"},"plugins.endpoint_protection.plugin_version.keyword":{"type":"string","title":"Filter the search by plugins.endpoint_protection.plugin_version.keyword. Search for the documents that equals the value"},"not.plugins.endpoint_protection.plugin_version.keyword":{"type":"string","title":"Filter the search by not.plugins.endpoint_protection.plugin_version.keyword. Search for the documents that are not equal to the value"},"plugins.endpoint_protection.sdk_version":{"type":"string","title":"Filter the search by plugins.endpoint_protection.sdk_version. Search for the documents that contains the value"},"not.plugins.endpoint_protection.sdk_version":{"type":"string","title":"Filter the search by not.plugins.endpoint_protection.sdk_version. Search for the documents that does not contain the value"},"plugins.endpoint_protection.sdk_version.keyword":{"type":"string","title":"Filter the search by plugins.endpoint_protection.sdk_version.keyword. Search for the documents that equals the value"},"not.plugins.endpoint_protection.sdk_version.keyword":{"type":"string","title":"Filter the search by not.plugins.endpoint_protection.sdk_version.keyword. Search for the documents that are not equal to the value"},"plugins.endpoint_protection.component_package_version":{"type":"string","title":"Filter the search by plugins.endpoint_protection.component_package_version. Search for the documents that contains the value"},"not.plugins.endpoint_protection.component_package_version":{"type":"string","title":"Filter the search by not.plugins.endpoint_protection.component_package_version. Search for the documents that does not contain the value"},"plugins.endpoint_protection.component_package_version.keyword":{"type":"string","title":"Filter the search by plugins.endpoint_protection.component_package_version.keyword. Search for the documents that equals the value"},"not.plugins.endpoint_protection.component_package_version.keyword":{"type":"string","title":"Filter the search by not.plugins.endpoint_protection.component_package_version.keyword. Search for the documents that are not equal to the value"},"plugins.endpoint_protection.update_package_version":{"type":"string","title":"Filter the search by plugins.endpoint_protection.update_package_version. Search for the documents that contains the value"},"not.plugins.endpoint_protection.update_package_version":{"type":"string","title":"Filter the search by not.plugins.endpoint_protection.update_package_version. Search for the documents that does not contain the value"},"plugins.endpoint_protection.update_package_version.keyword":{"type":"string","title":"Filter the search by plugins.endpoint_protection.update_package_version.keyword. Search for the documents that equals the value"},"not.plugins.endpoint_protection.update_package_version.keyword":{"type":"string","title":"Filter the search by not.plugins.endpoint_protection.update_package_version.keyword. Search for the documents that are not equal to the value"},"plugins.endpoint_protection.reboot_reasons":{"type":"string","title":"Filter the search by plugins.endpoint_protection.reboot_reasons. Search for the documents that contains the value"},"not.plugins.endpoint_protection.reboot_reasons":{"type":"string","title":"Filter the search by not.plugins.endpoint_protection.reboot_reasons. Search for the documents that does not contain the value"},"plugins.endpoint_protection.reboot_reasons.keyword":{"type":"string","title":"Filter the search by plugins.endpoint_protection.reboot_reasons.keyword. Search for the documents that equals the value"},"not.plugins.endpoint_protection.reboot_reasons.keyword":{"type":"string","title":"Filter the search by not.plugins.endpoint_protection.reboot_reasons.keyword. Search for the documents that are not equal to the value"},"plugins.endpoint_detection_and_response.plugin_version":{"type":"string","title":"Filter the search by plugins.endpoint_detection_and_response.plugin_version. Search for the documents that contains the value"},"not.plugins.endpoint_detection_and_response.plugin_version":{"type":"string","title":"Filter the search by not.plugins.endpoint_detection_and_response.plugin_version. Search for the documents that does not contain the value"},"plugins.endpoint_detection_and_response.plugin_version.keyword":{"type":"string","title":"Filter the search by plugins.endpoint_detection_and_response.plugin_version.keyword. Search for the documents that equals the value"},"not.plugins.endpoint_detection_and_response.plugin_version.keyword":{"type":"string","title":"Filter the search by not.plugins.endpoint_detection_and_response.plugin_version.keyword. Search for the documents that are not equal to the value"},"plugins.endpoint_detection_and_response.reboot_reasons":{"type":"string","title":"Filter the search by plugins.endpoint_detection_and_response.reboot_reasons. Search for the documents that contains the value"},"not.plugins.endpoint_detection_and_response.reboot_reasons":{"type":"string","title":"Filter the search by not.plugins.endpoint_detection_and_response.reboot_reasons. Search for the documents that does not contain the value"},"plugins.endpoint_detection_and_response.reboot_reasons.keyword":{"type":"string","title":"Filter the search by plugins.endpoint_detection_and_response.reboot_reasons.keyword. Search for the documents that equals the value"},"not.plugins.endpoint_detection_and_response.reboot_reasons.keyword":{"type":"string","title":"Filter the search by not.plugins.endpoint_detection_and_response.reboot_reasons.keyword. Search for the documents that are not equal to the value"},"plugins.incident_response.plugin_version":{"type":"string","title":"Filter the search by plugins.incident_response.plugin_version. Search for the documents that contains the value"},"not.plugins.incident_response.plugin_version":{"type":"string","title":"Filter the search by not.plugins.incident_response.plugin_version. Search for the documents that does not contain the value"},"plugins.incident_response.plugin_version.keyword":{"type":"string","title":"Filter the search by plugins.incident_response.plugin_version.keyword. Search for the documents that equals the value"},"not.plugins.incident_response.plugin_version.keyword":{"type":"string","title":"Filter the search by not.plugins.incident_response.plugin_version.keyword. Search for the documents that are not equal to the value"},"plugins.incident_response.reboot_reasons":{"type":"string","title":"Filter the search by plugins.incident_response.reboot_reasons. Search for the documents that contains the value"},"not.plugins.incident_response.reboot_reasons":{"type":"string","title":"Filter the search by not.plugins.incident_response.reboot_reasons. Search for the documents that does not contain the value"},"plugins.incident_response.reboot_reasons.keyword":{"type":"string","title":"Filter the search by plugins.incident_response.reboot_reasons.keyword. Search for the documents that equals the value"},"not.plugins.incident_response.reboot_reasons.keyword":{"type":"string","title":"Filter the search by not.plugins.incident_response.reboot_reasons.keyword. Search for the documents that are not equal to the value"},"plugins.siem.plugin_version":{"type":"string","title":"Filter the search by plugins.siem.plugin_version. Search for the documents that contains the value"},"not.plugins.siem.plugin_version":{"type":"string","title":"Filter the search by not.plugins.siem.plugin_version. Search for the documents that does not contain the value"},"plugins.siem.plugin_version.keyword":{"type":"string","title":"Filter the search by plugins.siem.plugin_version.keyword. Search for the documents that equals the value"},"not.plugins.siem.plugin_version.keyword":{"type":"string","title":"Filter the search by not.plugins.siem.plugin_version.keyword. Search for the documents that are not equal to the value"},"plugins.browser_phishing_protection.plugin_version":{"type":"string","title":"Filter the search by plugins.browser_phishing_protection.plugin_version. Search for the documents that contains the value"},"not.plugins.browser_phishing_protection.plugin_version":{"type":"string","title":"Filter the search by not.plugins.browser_phishing_protection.plugin_version. Search for the documents that does not contain the value"},"plugins.browser_phishing_protection.plugin_version.keyword":{"type":"string","title":"Filter the search by plugins.browser_phishing_protection.plugin_version.keyword. Search for the documents that equals the value"},"not.plugins.browser_phishing_protection.plugin_version.keyword":{"type":"string","title":"Filter the search by not.plugins.browser_phishing_protection.plugin_version.keyword. Search for the documents that are not equal to the value"},"plugins.siem.reboot_reasons":{"type":"string","title":"Filter the search by plugins.siem.reboot_reasons. Search for the documents that contains the value"},"not.plugins.siem.reboot_reasons":{"type":"string","title":"Filter the search by not.plugins.siem.reboot_reasons. Search for the documents that does not contain the value"},"plugins.siem.reboot_reasons.keyword":{"type":"string","title":"Filter the search by plugins.siem.reboot_reasons.keyword. Search for the documents that equals the value"},"not.plugins.siem.reboot_reasons.keyword":{"type":"string","title":"Filter the search by not.plugins.siem.reboot_reasons.keyword. Search for the documents that are not equal to the value"},"engine_version":{"type":"string","title":"Filter the search by engine_version. Search for the documents that equal the value"},"not.engine_version":{"type":"string","title":"Filter the search by not.engine_version. Search for the documents that does not equal the value"},"engine_version.keyword":{"type":"string","title":"Filter the search by engine_version.keyword. Search for the documents that equals the value"},"not.engine_version.keyword":{"type":"string","title":"Filter the search by not.engine_version.keyword. Search for the documents that are not equal to the value"},"domain_name":{"type":"string","title":"Filter the search by domain_name. Search for the documents that contains the value"},"not.domain_name":{"type":"string","title":"Filter the search by not.domain_name. Search for the documents that does not contain the value"},"domain_name.keyword":{"type":"string","title":"Filter the search by domain_name.keyword. Search for the documents that equals the value"},"not.domain_name.keyword":{"type":"string","title":"Filter the search by not.domain_name.keyword. Search for the documents that are not equal to the value"},"policy_etag":{"type":"string","title":"Filter the search by policy_etag. Search for the documents that contains the value"},"not.policy_etag":{"type":"string","title":"Filter the search by not.policy_etag. Search for the documents that does not contain the value"},"policy_etag.keyword":{"type":"string","title":"Filter the search by policy_etag.keyword. Search for the documents that equals the value"},"not.policy_etag.keyword":{"type":"string","title":"Filter the search by not.policy_etag.keyword. Search for the documents that are not equal to the value"},"last_user":{"type":"string","title":"Filter the search by last_user. Search for the documents that contains the value"},"not.last_user":{"type":"string","title":"Filter the search by not.last_user. Search for the documents that does not contain the value"},"last_user.keyword":{"type":"string","title":"Filter the search by last_user.keyword. Search for the documents that equals the value"},"not.last_user.keyword":{"type":"string","title":"Filter the search by not.last_user.keyword. Search for the documents that are not equal to the value"},"id":{"type":"string","title":"Filter the search by id. Search for the documents that contains the value"},"not.id":{"type":"string","title":"Filter the search by not.id. Search for the documents that does not contain the value"},"id.keyword":{"type":"string","title":"Filter the search by id.keyword. Search for the documents that equals the value"},"not.id.keyword":{"type":"string","title":"Filter the search by not.id.keyword. Search for the documents that are not equal to the value"},"rule_id":{"type":"string","title":"Filter the search by rule_id. Search for the documents that contains the value"},"not.rule_id":{"type":"string","title":"Filter the search by not.rule_id. Search for the documents that does not contain the value"},"rule_id.keyword":{"type":"string","title":"Filter the search by rule_id.keyword. Search for the documents that equals the value"},"not.rule_id.keyword":{"type":"string","title":"Filter the search by not.rule_id.keyword. Search for the documents that are not equal to the value"},"origin_id":{"type":"string","title":"Filter the search by origin_id. Search for the documents that contains the value"},"not.origin_id":{"type":"string","title":"Filter the search by not.origin_id. Search for the documents that does not contain the value"},"origin_id.keyword":{"type":"string","title":"Filter the search by origin_id.keyword. Search for the documents that equals the value"},"not.origin_id.keyword":{"type":"string","title":"Filter the search by not.origin_id.keyword. Search for the documents that are not equal to the value"},"machine_id":{"type":"string","title":"Filter the search by machine_id. Search for the documents that contains the value"},"not.machine_id":{"type":"string","title":"Filter the search by not.machine_id. Search for the documents that does not contain the value"},"machine_id.keyword":{"type":"string","title":"Filter the search by machine_id.keyword. Search for the documents that equals the value"},"not.machine_id.keyword":{"type":"string","title":"Filter the search by not.machine_id.keyword. Search for the documents that are not equal to the value"},"group_ids":{"type":"array","title":"Filter the search by group_ids. Search for the documents that contains the value","items":{"type":"string"}},"group_id":{"type":"string","title":"Filter the search by group_id. Search for the documents that contains the value"},"not.group_id":{"type":"string","title":"Filter the search by not.group_id. Search for the documents that does not contain the value"},"group_id.keyword":{"type":"string","title":"Filter the search by group_id.keyword. Search for the documents that equals the value"},"not.group_id.keyword":{"type":"string","title":"Filter the search by not.group_id.keyword. Search for the documents that are not equal to the value"},"root_group_id":{"type":"string","title":"Filter the search by root_group_id. Search for the documents that contains the value"},"not.root_group_id":{"type":"string","title":"Filter the search by not.root_group_id. Search for the documents that does not contain the value"},"root_group_id.keyword":{"type":"string","title":"Filter the search by root_group_id.keyword. Search for the documents that equals the value"},"not.root_group_id.keyword":{"type":"string","title":"Filter the search by not.root_group_id.keyword. Search for the documents that are not equal to the value"},"group_name":{"type":"string","title":"Filter the search by group_name. Search for the documents that contains the value"},"not.group_name":{"type":"string","title":"Filter the search by not.group_name. Search for the documents that does not contain the value"},"group_name.keyword":{"type":"string","title":"Filter the search by group_name.keyword. Search for the documents that equals the value"},"not.group_name.keyword":{"type":"string","title":"Filter the search by not.group_name.keyword. Search for the documents that are not equal to the value"},"policy_id":{"type":"string","title":"Filter the search by policy_id. Search for the documents that contains the value"},"not.policy_id":{"type":"string","title":"Filter the search by not.policy_id. Search for the documents that does not contain the value"},"policy_id.keyword":{"type":"string","title":"Filter the search by policy_id.keyword. Search for the documents that equals the value"},"not.policy_id.keyword":{"type":"string","title":"Filter the search by not.policy_id.keyword. Search for the documents that are not equal to the value"},"policy_name":{"type":"string","title":"Filter the search by policy_name. Search for the documents that contains the value"},"not.policy_name":{"type":"string","title":"Filter the search by not.policy_name. Search for the documents that does not contain the value"},"policy_name.keyword":{"type":"string","title":"Filter the search by policy_name.keyword. Search for the documents that equals the value"},"not.policy_name.keyword":{"type":"string","title":"Filter the search by not.policy_name.keyword. Search for the documents that are not equal to the value"},"account_name":{"type":"string","title":"Filter the search by account_name. Search for the documents that contains the value"},"not.account_name":{"type":"string","title":"Filter the search by not.account_name. Search for the documents that does not contain the value"},"account_name.keyword":{"type":"string","title":"Filter the search by account_name.keyword. Search for the documents that equals the value"},"not.account_name.keyword":{"type":"string","title":"Filter the search by not.account_name.keyword. Search for the documents that are not equal to the value"},"parent_id":{"type":"string","title":"Filter the search by parent_id. Search for the documents that contains the value"},"not.parent_id":{"type":"string","title":"Filter the search by not.parent_id. Search for the documents that does not contain the value"},"parent_id.keyword":{"type":"string","title":"Filter the search by parent_id.keyword. Search for the documents that equals the value"},"not.parent_id.keyword":{"type":"string","title":"Filter the search by not.parent_id.keyword. Search for the documents that are not equal to the value"},"protocol":{"type":"string","title":"Filter the search by protocol. Search for the documents that contains the value"},"not.protocol":{"type":"string","title":"Filter the search by not.protocol. Search for the documents that does not contain the value"},"protocol.keyword":{"type":"string","title":"Filter the search by protocol.keyword. Search for the documents that equals the value"},"not.protocol.keyword":{"type":"string","title":"Filter the search by not.protocol.keyword. Search for the documents that are not equal to the value"},"attack_user":{"type":"string","title":"Filter the search by attack_user. Search for the documents that contains the value"},"not.attack_user":{"type":"string","title":"Filter the search by not.attack_user. Search for the documents that does not contain the value"},"attack_user.keyword":{"type":"string","title":"Filter the search by attack_user.keyword. Search for the documents that equals the value"},"not.attack_user.keyword":{"type":"string","title":"Filter the search by not.attack_user.keyword. Search for the documents that are not equal to the value"},"machine_name":{"type":"string","title":"Filter the search by machine_name. Search for the documents that contains the value"},"not.machine_name":{"type":"string","title":"Filter the search by not.machine_name. Search for the documents that does not contain the value"},"machine_name.keyword":{"type":"string","title":"Filter the search by machine_name.keyword. Search for the documents that equals the value"},"not.machine_name.keyword":{"type":"string","title":"Filter the search by not.machine_name.keyword. Search for the documents that are not equal to the value"},"ip":{"type":"string","title":"Filter the search by the source ip. Search for the documents that match the value"},"not.ip":{"type":"string","title":"Filter the search by the source not.ip. Search for the documents that does not match the value"},"machine_ip":{"type":"string","title":"Filter the search by the destination machine_ip. Search for the documents that mach the value"},"not.machine_ip":{"type":"string","title":"Filter the search by destination not.machine_ip. Search for the documents that does not match the value"},"deleted":{"type":"boolean","title":"Filter the search by deleted. Search for the documents that have been deleted"},"create_time_before":{"type":"string","title":"Filter the search by create_time_before. Search for the documents that occurs before the value"},"create_time_after":{"type":"string","title":"Filter the search by create_time_after. Search for the documents that occurs after the value"},"expire_time_before":{"type":"string","title":"Filter the search by expire_time_before. Search for the documents that occurs before the value"},"expire_time_after":{"type":"string","title":"Filter the search by expire_time_after. Search for the documents that occurs after the value"},"port_lt":{"type":["integer","string"],"pattern":"^\\d+$","title":"Filter the search by port_lt. Search for the documents that are less than the value (Ex. \"1234\")"},"port_lte":{"type":["integer","string"],"pattern":"^\\d+$","title":"Filter the search by port_lte. Search for the documents that are less than the value (Ex. \"1234\")"},"port_gt":{"type":["integer","string"],"pattern":"^\\d+$","title":"Filter the search by port_gt. Search for the documents that are greater than the value (Ex. \"1234\")"},"port_gte":{"type":["integer","string"],"pattern":"^\\d+$","title":"Filter the search by port_gte. Search for the documents that are greater than the value (Ex. \"1234\")"},"attempts_lt":{"type":["integer","string"],"pattern":"^\\d+$","title":"Filter the search by attempts_lt. Search for the documents that are less than the value (Ex. \"1234\")"},"attempts_lte":{"type":["integer","string"],"pattern":"^\\d+$","title":"Filter the search by attempts_lte. Search for the documents that are less than the value (Ex. \"1234\")"},"attempts_gt":{"type":["integer","string"],"pattern":"^\\d+$","title":"Filter the search by attempts_gt. Search for the documents that are greater than the value (Ex. \"1234\")"},"attempts_gte":{"type":["integer","string"],"pattern":"^\\d+$","title":"Filter the search by attempts_gte. Search for the documents that are greater than the value (Ex. \"1234\")"},"duration_lt":{"type":["integer","string"],"pattern":"^\\d+$","title":"Filter the search by duration_lt. Search for the documents that are less than the value (Ex. \"1234\")"},"duration_lte":{"type":["integer","string"],"pattern":"^\\d+$","title":"Filter the search by duration_lte. Search for the documents that are less than the value (Ex. \"1234\")"},"duration_gt":{"type":["integer","string"],"pattern":"^\\d+$","title":"Filter the search by duration_gt. Search for the documents that are greater than the value (Ex. \"1234\")"},"duration_gte":{"type":["integer","string"],"pattern":"^\\d+$","title":"Filter the search by duration_gte. Search for the documents that are greater than the value (Ex. \"1234\")"},"source_location.city":{"type":"string","title":"Filter the search by source_location.city. Search for the documents that contains the value"},"not.source_location.city":{"type":"string","title":"Filter the search by not.source_location.city. Search for the documents that does not contain the value"},"source_location.city.keyword":{"type":"string","title":"Filter the search by source_location.city.keyword. Search for the documents that equals the value"},"not.source_location.city.keyword":{"type":"string","title":"Filter the search by not.source_location.city.keyword. Search for the documents that are not equal to the value"},"source_location.country":{"type":"string","title":"Filter the search by source_location.country. Search for the documents that contains the value"},"not.source_location.country":{"type":"string","title":"Filter the search by not.source_location.country. Search for the documents that does not contain the value"},"source_location.country.keyword":{"type":"string","title":"Filter the search by source_location.country.keyword. Search for the documents that equals the value"},"not.source_location.country.keyword":{"type":"string","title":"Filter the search by not.source_location.country.keyword. Search for the documents that are not equal to the value"},"source_location.country_iso":{"type":"string","title":"Filter the search by source_location.country_iso. Search for the documents that contains the value"},"not.source_location.country_iso":{"type":"string","title":"Filter the search by not.source_location.country_iso. Search for the documents that does not contain the value"},"source_location.country_iso.keyword":{"type":"string","title":"Filter the search by source_location.country_iso.keyword. Search for the documents that equals the value"},"not.source_location.country_iso.keyword":{"type":"string","title":"Filter the search by not.source_location.country_iso.keyword. Search for the documents that are not equal to the value"},"source_location.continent":{"type":"string","title":"Filter the search by source_location.continent. Search for the documents that contains the value"},"not.source_location.continent":{"type":"string","title":"Filter the search by not.source_location.continent. Search for the documents that does not contain the value"},"source_location.continent.keyword":{"type":"string","title":"Filter the search by source_location.continent.keyword. Search for the documents that equals the value"},"not.source_location.continent.keyword":{"type":"string","title":"Filter the search by not.source_location.continent.keyword. Search for the documents that are not equal to the value"},"source_location.time_zone":{"type":"string","title":"Filter the search by source_location.time_zone. Search for the documents that contains the value"},"not.source_location.time_zone":{"type":"string","title":"Filter the search by not.source_location.time_zone. Search for the documents that does not contain the value"},"source_location.time_zone.keyword":{"type":"string","title":"Filter the search by source_location.time_zone.keyword. Search for the documents that equals the value"},"not.source_location.time_zone.keyword":{"type":"string","title":"Filter the search by not.source_location.time_zone.keyword. Search for the documents that are not equal to the value"},"source_location.postal_code":{"type":"string","title":"Filter the search by source_location.postal_code. Search for the documents that contains the value"},"not.source_location.postal_code":{"type":"string","title":"Filter the search by not.source_location.postal_code. Search for the documents that does not contain the value"},"source_location.postal_code.keyword":{"type":"string","title":"Filter the search by source_location.postal_code.keyword. Search for the documents that equals the value"},"not.source_location.postal_code.keyword":{"type":"string","title":"Filter the search by not.source_location.postal_code.keyword. Search for the documents that are not equal to the value"},"source_location.subdivisions":{"type":"string","title":"Filter the search by source_location.subdivisions. Search for the documents that contains the value"},"not.source_location.subdivisions":{"type":"string","title":"Filter the search by not.source_location.subdivisions. Search for the documents that does not contain the value"},"source_location.subdivisions.keyword":{"type":"string","title":"Filter the search by source_location.subdivisions.keyword. Search for the documents that equals the value"},"not.source_location.subdivisions.keyword":{"type":"string","title":"Filter the search by not.source_location.subdivisions.keyword. Search for the documents that are not equal to the value"},"destination_location.city":{"type":"string","title":"Filter the search by destination_location.city. Search for the documents that contains the value"},"not.destination_location.city":{"type":"string","title":"Filter the search by not.destination_location.city. Search for the documents that does not contain the value"},"destination_location.city.keyword":{"type":"string","title":"Filter the search by destination_location.city.keyword. Search for the documents that equals the value"},"not.destination_location.city.keyword":{"type":"string","title":"Filter the search by not.destination_location.city.keyword. Search for the documents that are not equal to the value"},"destination_location.country":{"type":"string","title":"Filter the search by destination_location.country. Search for the documents that contains the value"},"not.destination_location.country":{"type":"string","title":"Filter the search by not.destination_location.country. Search for the documents that does not contain the value"},"destination_location.country.keyword":{"type":"string","title":"Filter the search by destination_location.country.keyword. Search for the documents that equals the value"},"not.destination_location.country.keyword":{"type":"string","title":"Filter the search by not.destination_location.country.keyword. Search for the documents that are not equal to the value"},"destination_location.country_iso":{"type":"string","title":"Filter the search by destination_location.country_iso. Search for the documents that contains the value"},"not.destination_location.country_iso":{"type":"string","title":"Filter the search by not.destination_location.country_iso. Search for the documents that does not contain the value"},"destination_location.country_iso.keyword":{"type":"string","title":"Filter the search by destination_location.country_iso.keyword. Search for the documents that equals the value"},"not.destination_location.country_iso.keyword":{"type":"string","title":"Filter the search by not.destination_location.country_iso.keyword. Search for the documents that are not equal to the value"},"destination_location.continent":{"type":"string","title":"Filter the search by destination_location.continent. Search for the documents that contains the value"},"not.destination_location.continent":{"type":"string","title":"Filter the search by not.destination_location.continent. Search for the documents that does not contain the value"},"destination_location.continent.keyword":{"type":"string","title":"Filter the search by destination_location.continent.keyword. Search for the documents that equals the value"},"not.destination_location.continent.keyword":{"type":"string","title":"Filter the search by not.destination_location.continent.keyword. Search for the documents that are not equal to the value"},"destination_location.time_zone":{"type":"string","title":"Filter the search by destination_location.time_zone. Search for the documents that contains the value"},"not.destination_location.time_zone":{"type":"string","title":"Filter the search by not.destination_location.time_zone. Search for the documents that does not contain the value"},"destination_location.time_zone.keyword":{"type":"string","title":"Filter the search by destination_location.time_zone.keyword. Search for the documents that equals the value"},"not.destination_location.time_zone.keyword":{"type":"string","title":"Filter the search by not.destination_location.time_zone.keyword. Search for the documents that are not equal to the value"},"destination_location.postal_code":{"type":"string","title":"Filter the search by destination_location.postal_code. Search for the documents that contains the value"},"not.destination_location.postal_code":{"type":"string","title":"Filter the search by not.destination_location.postal_code. Search for the documents that does not contain the value"},"destination_location.postal_code.keyword":{"type":"string","title":"Filter the search by destination_location.postal_code.keyword. Search for the documents that equals the value"},"not.destination_location.postal_code.keyword":{"type":"string","title":"Filter the search by not.destination_location.postal_code.keyword. Search for the documents that are not equal to the value"},"destination_location.subdivisions":{"type":"string","title":"Filter the search by destination_location.subdivisions. Search for the documents that contains the value"},"not.destination_location.subdivisions":{"type":"string","title":"Filter the search by not.destination_location.subdivisions. Search for the documents that does not contain the value"},"destination_location.subdivisions.keyword":{"type":"string","title":"Filter the search by destination_location.subdivisions.keyword. Search for the documents that equals the value"},"not.destination_location.subdivisions.keyword":{"type":"string","title":"Filter the search by not.destination_location.subdivisions.keyword. Search for the documents that are not equal to the value"},"sort_field":{"type":"string","title":"Sort field","default":"expire_time","enum":["id","rule_id","origin_id","machine_id","group_id","root_group_id","group_name","policy_id","policy_name","account_id","account_name","parent_id","port","attempts","duration","protocol","attack_user","machine_ip","ip","create_time","expire_time","deleted","machine_name","at","nics.ips","nics.mac_address","nics.description.keyword","os_info.os_type","os_info.os_version.keyword","os_info.os_platform","os_info.os_architecture","os_info.os_release_name.keyword","host_name.keyword","fully_qualified_host_name.keyword","plugins.asset_manager.plugin_version.keyword","plugins.asset_manager.reboot_reasons","plugins.endpoint_protection.plugin_version.keyword","plugins.endpoint_protection.sdk_version.keyword","plugins.endpoint_protection.component_package_version.keyword","plugins.endpoint_protection.update_package_version.keyword","plugins.endpoint_protection.reboot_reasons","plugins.endpoint_detection_and_response.plugin_version.keyword","plugins.endpoint_detection_and_response.reboot_reasons","plugins.incident_response.plugin_version.keyword","plugins.incident_response.reboot_reasons","plugins.siem.plugin_version.keyword","plugins.siem.reboot_reasons","engine_version.keyword","domain_name.keyword","policy_etag","source_location.city","source_location.country","source_location.country_iso","source_location.continent","source_location.time_zone","source_location.postal_code","source_location.subdivisions","destination_location.city","destination_location.country","destination_location.country_iso","destination_location.continent","destination_location.time_zone","destination_location.postal_code","destination_location.subdivisions"]},"sort_order":{"type":"string","title":"Sorting direction","default":"asc","enum":["asc","desc"]},"page_size":{"type":"number","title":"The size of the page. If you only need aggregations, set it to 0","minimum":0,"default":50,"maximum":2000},"aggregations":{"type":"array","title":"The Aggregations Schema","items":{"type":"string","title":"Aggregations","default":[],"enum":["protection_status","os_info.os_release_name.keyword","nics.ips","nics.mac_address","nics.description.keyword","os_info.os_type","os_info.os_version.keyword","os_info.os_platform","os_info.os_architecture","host_name.keyword","fully_qualified_host_name.keyword","plugins.asset_manager.plugin_version.keyword","plugins.asset_manager.reboot_reasons","plugins.endpoint_protection.plugin_version.keyword","plugins.endpoint_protection.sdk_version.keyword","plugins.endpoint_protection.component_package_version.keyword","plugins.endpoint_protection.update_package_version.keyword","plugins.endpoint_protection.reboot_reasons","plugins.endpoint_detection_and_response.plugin_version.keyword","plugins.endpoint_detection_and_response.reboot_reasons","plugins.incident_response.plugin_version.keyword","plugins.incident_response.reboot_reasons","plugins.siem.plugin_version.keyword","plugins.siem.reboot_reasons","engine_version.keyword","domain_name.keyword","policy_etag","last_user.keyword","is_software_update_available","origin_id","machine_id","group_id","root_group_id","group_name","policy_id","policy_name","account_id","parent_id","port","protocol","attack_user","machine_ip","ip","deleted","machine_name","source_location.city","source_location.country","source_location.country_iso","source_location.continent","source_location.time_zone","source_location.postal_code","source_location.subdivisions","destination_location.city","destination_location.country","destination_location.country_iso","destination_location.continent","destination_location.time_zone","destination_location.postal_code","destination_location.subdivisions"]}},"account_ids":{"type":"array","title":"The account ids to filter your search","items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}],"properties":{"group_by":{"type":"string","title":"The sort field Schema","enum":["origin_id","machine_id","group_id","root_group_id","group_name","policy_id","policy_name","account_id","account_name","parent_id","port","protocol","attack_user","machine_ip","ip","machine_name","source_location.city","source_location.country","source_location.country_iso","source_location.continent","source_location.time_zone","source_location.postal_code","destination_location.city","destination_location.country","destination_location.country_iso","destination_location.continent","destination_location.time_zone","destination_location.postal_code"]}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"The Post Assets Search GroupBy Response Schema","required":["results","next_cursor"],"properties":{"results":{"type":"array","title":"The Results Schema","default":[],"items":{"type":"object","title":"The Items Schema","required":["value","total"],"properties":{"value":{"type":"string","title":"The Value Schema"},"total":{"type":"integer","title":"The Total Schema"},"host_name":{"type":"string","title":"The host name Schema (only for machine_id aggregation)"},"fully_qualified_host_name":{"type":"string","title":"The host name Schema (only for machine_id aggregation)"},"tags":{"type":"object","additionalProperties":true,"title":"The tags Schema (only for machine_id aggregation)"},"account_name":{"type":"string","title":"The account name Schema (only for accountId aggregation)"}}}},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}}}}},"tags":["Remote Intrusion Detection"],"operationId":"api.v2.rmm.search.rid.group"}},"/oneview/v1/accounts/{account_id}/endpoints/{id}":{"delete":{"description":"Delete an endpoint from the console using the endpoint ID.","summary":"Delete an endpoint","security":[{"client_credentials":["write"]},{"user_permissions":["endpoints.delete"]}],"status":{"outage":["auth","search_stateful"]},"parameters":[{"name":"id","required":true,"in":"path","description":"Valid UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"account_id","required":false,"in":"path","description":"Valid account UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":["object","null"],"title":"Delete endpoint request","properties":{"unregister_isolated":{"type":"boolean","title":"Force delete isolated endpoints"}}}}}},"responses":{"200":{"description":"Successful response"}},"tags":["Endpoints"],"operationId":"api.v2.rmm.delete.endpoint"},"get":{"description":"Retrieve information of a single endpoint by its universally unique identifier.","summary":"Get endpoint","security":[{"client_credentials":["read"]},{"user_permissions":["endpoints.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":true,"in":"path","description":"Valid UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"account_id","required":false,"in":"path","description":"Valid account UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}},{"name":"populate_diag_info","required":false,"in":"query","schema":{"type":"boolean"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"The Get Endpoint By Id Body 200 Schema","required":["id","policy_id","group_id","name","online","is_deleted"],"properties":{"id":{"type":"string","title":"ID of the endpoint (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"policy_id":{"type":"string","title":"ID of the policy (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"group_id":{"type":"string","title":"ID of the group (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"name":{"type":"string","title":"The Name of the endpoint"},"online":{"type":"boolean","title":"Whether the endpoint is online or not"},"is_deleted":{"type":"boolean","title":"Whether the endpoint was deleted"},"os_architecture":{"type":"string","title":"OS architecture"},"os_platform":{"type":"string","title":"OS platform"},"os_release_name":{"type":"string","title":"OS release name"},"tags":{"type":"object","title":"Tags for this machine","additionalProperties":true},"last_seen_at":{"type":"string","title":"The last time the endpoint checked in as online (max 1 per hour) (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^\\d{4}-[0-1]\\d-[0-3]\\d[(t|T)\\s](?:[0-2]\\d:[0-5]\\d:[0-5]\\d|23:59:60)(?:\\.\\d+)?(?:(z|Z)|[+-]\\d{2}:\\d{2})$","examples":["2020-03-23T17:23:17.860482Z"]},"diag_info":{"type":"object","title":"Information on diagnostic logs","properties":{"has_diag_logs":{"type":"boolean","title":"Indicates whether diagnostic logs are available"}}}}}}}}},"tags":["Endpoints"],"operationId":"api.v2.rmm.get.endpoint.id"}},"/oneview/v1/endpoints":{"delete":{"description":"Use this endpoint to mark machines as deleted.\nThis API endpoint allows you to specify queries instead of explicitly specifying endpoint ids. See example for more details.\n\n> **Be extremely cautious**: If you don't specify any constraint, all your machines will match the search and be deleted. For example, the following payload:\n```json\n \"groups\": [{ \n \"account_ids\": [\"\", \"\"]\n }]\n```\nwill select all the machines in the two accounts. Always test the result of your query using the [Search endpoints APIs](#operation/api.v2.rmm.post.endpoints)\n\n\n\nIf you want to mark all of your `Mac Os` endpoints as deleted across two of your manages sites, and on all your endpoints for a certain account with policy matching the string `serious policy`, do the following:\n\n```json\n \"groups\": [{ \n \"account_ids\": [\"\", \"\"],\n \"os_info.os_platform\": \"Mac Os\"\n }, {\n \"account_ids\": [\"\"],\n \"policy_name\": \"serious policy\" \n }]\n```\nThe constraints accepted are the same accepted by the search endpoints route. Refer to `POST -> /endpoints` for more information about the constraints accepted.\n\nYou can also send a mix of explicit endpoint ids and queries in the same request: \n```json\n \"endpoints\": [{ \"id\": \"\", \"account_id\": \"\" }],\n \"groups\": [{ \n \"account_ids\": [\"\", \"\"],\n \"os_info.os_platform\": \"Mac Os\"\n }, {\n \"account_ids\": [\"\"],\n \"policy_name\": \"serious policy\" \n }]\n```\n","summary":"Delete multiple endpoints across accounts","security":[{"client_credentials":["write"]},{"user_permissions":["endpoints.delete"]}],"status":{"outage":["auth","search_stateful"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Delete in bulk","required":["endpoints","groups"],"properties":{"endpoints":{"type":"array","title":"Endpoints","items":{"type":"object","title":"Endpoint items","required":["id","account_id"],"properties":{"id":{"type":"string","title":"Machine ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"account_id":{"type":"string","title":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}},"groups":{"type":"array","title":"Groups","items":{"type":"object","title":"List of queries to fetch endpoints","allOf":[{"type":"object","title":"Search endpoints request. Leading wildcards are not supported for constraint fields without '.keyword' suffix.","required":["account_ids"],"properties":{"has_alerts":{"type":"boolean","title":"Indicates whether the endpoint needs attention"},"name_multi_search":{"type":"string","title":"Search either alias, host name of fully qualified host name"},"alerts.codes":{"type":"string","title":"Alert codes"},"is_software_update_available":{"type":"boolean","title":"Indicates whether the agent has an available update"},"protection_status":{"type":"string","title":"Protection status of the endpoint(s)","pattern":"(^$|protected|scan_only|unprotected|unknown|pending|mobile_protection)"},"is_isolated":{"type":"boolean","title":"Indicates whether the endpoints are isolated or not"},"suspicious_activity_found":{"type":"boolean","title":"Filter the search to the endpoints that have open suspicious activities"},"reboot_required":{"type":"boolean","title":"Filter the search to the endpoints needing a reboot"},"infection_found":{"type":"boolean","title":"Filter the search to the endpoints with one or more security threats found"},"policy_id":{"type":"string","title":"Filter the search to the endpoints with specified policy (id)"},"policy_name":{"type":"string","title":"Filter the search to the endpoints with specified policy (name)"},"policy_etag":{"type":"string","title":"Filter the search to the endpoints with specified policy etag"},"domain_name":{"type":"string","title":"Filter the search to the endpoints with specified domain name"},"engine_version":{"type":"string","title":"Filter the search to the endpoints with specified engine version"},"last_user":{"type":"string","title":"Last user that logged into the machine"},"last_user.keyword":{"type":"string","title":"Last user that logged into the machine (exact match). This 'contains' type search will look for the exact match anywhere in the field."},"alias":{"type":"string","title":"Aliases for the machine"},"plugins.siem.reboot_reason":{"type":"string","title":"Filter the search to the endpoints with specified reboot reason, as reported by the SIEM plugin"},"plugins.siem.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified SIEM plugin version"},"plugins.siem.alerts.codes":{"type":"string","title":"Filter the search to the endpoints with specified SIEM alerts"},"plugins.browser_phishing_protection.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified Browser Phishing Protection plugin version"},"plugins.browser_phishing_protection.alerts.codes":{"type":"string","title":"Filter the search to the endpoints with specified Browser Phishing Protection alerts"},"plugins.incident_response.reboot_reason":{"type":"string","title":"Filter the search to the endpoints with specified reboot reason, as reported by IR plugin"},"plugins.incident_response.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified IR plugin version"},"plugins.incident_response.alerts.codes":{"type":"string","title":"Filter the search to the endpoints with specified IR plugin alerts"},"plugins.endpoint_detection_and_response.reboot_reason":{"type":"string","title":"Filter the search to the endpoints with specified reboot reason, as reported by EDR plugin"},"plugins.endpoint_detection_and_response.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified EDR plugin version"},"plugins.endpoint_detection_and_response.alerts.codes":{"type":"string","title":"Filter the search to the endpoints with specified EDR plugin alerts"},"plugins.endpoint_protection.reboot_reason":{"type":"string","title":"Filter the search to the endpoints with specified reboot reason, as reported by EP plugin"},"plugins.endpoint_protection.update_package_version":{"type":"string","title":"Filter the search to the endpoints with specified EP update package version"},"plugins.endpoint_protection.component_package_version":{"type":"string","title":"Filter the search to the endpoints with specified EP component package version"},"plugins.endpoint_protection.sdk_version":{"type":"string","title":"Filter the search to the endpoints with specified EP SDK version"},"plugins.endpoint_protection.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified EP plugin version"},"plugins.endpoint_protection.alerts.codes":{"type":"string","title":"Filter the search to the endpoints with specified EP plugin alerts"},"plugins.asset_manager.reboot_reason":{"type":"string","title":"Filter the search to the endpoints with specified reboot reason, as reported by asset manager plugin"},"plugins.asset_manager.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified asset manager plugin version"},"plugins.asset_manager.alerts.codes":{"type":"string","title":"Filter the search to the endpoints with specified asset manager alerts"},"fully_qualified_host_name":{"type":"string","title":"Filter the search to the endpoints with specified, fully qualified host name"},"host_name":{"type":"string","title":"Filter the search to the endpoints with specified host name"},"os_info.os_release_name":{"type":"string","title":"Filter the search to the endpoints with specified release name of OS"},"os_info.os_release_name.keyword":{"type":"string","title":"Filter the search to the endpoints with specified release name of OS"},"os_info.os_architecture":{"type":"string","title":"Filter the search to the endpoints with specified OS architecture"},"os_info.os_platform":{"type":"string","title":"Filter the search to the endpoints with specified OS"},"os_info.os_version":{"type":"string","title":"Filter the search to the endpoints with specified OS version"},"os_info.os_type":{"type":"string","title":"Filter the search to the endpoints with specified OS type"},"nics.description":{"type":"string","title":"Filter the search to the endpoints with specified NICS description"},"nics.mac_address":{"type":"string","title":"Filter the search to the endpoints with specified NICS MAC address"},"nics.ips":{"type":"string","title":"Filter the search to the endpoints with specified ips"},"group_name.keyword":{"type":"string","title":"Filter the search to the endpoints belonging to the specified group's name. This 'contains' type search will look for the exact match anywhere in the field."},"policy_name.keyword":{"type":"string","title":"Filter the search to the endpoints assigned to the specified policy's name. This 'contains' type search will look for the exact match anywhere in the field."},"host_name.keyword":{"type":"string","title":"Filter the search to the endpoints that have the specified host's name. This 'contains' type search will look for the exact match anywhere in the field."},"fully_qualified_host_name.keyword":{"type":"string","title":"Filter the search to the endpoints that have the specified, fully_qualified_host's name. This 'contains' type search will look for the exact match anywhere in the field."},"engine_version.keyword":{"type":"string","title":"Filter the search by specified engine version."},"engine_version_gt":{"type":"string","title":"Filter the search by engine version greater than specified value."},"engine_version_gte":{"type":"string","title":"Filter the search by engine version greater than or equal to specified value."},"engine_version_lt":{"type":"string","title":"Filter the search by engine version less than specified value."},"engine_version_lte":{"type":"string","title":"Filter the search by engine version less than or equal to specified value."},"domain_name.keyword":{"type":"string","title":"Filter the search by domain name. This 'contains' type search will look for the exact match anywhere in the field."},"group_id":{"type":"string","title":"Filter the search by group id"},"group_name":{"type":"string","title":"Filter the search by group's name"},"source_location.city":{"type":"string","title":"Source location city filter"},"source_location.country":{"type":"string","title":"Source location country filter"},"source_location.country_iso":{"type":"string","title":"Source location country_iso filter"},"source_location.continent":{"type":"string","title":"Source location continent filter"},"source_location.time_zone":{"type":"string","title":"Source location time_zone filter"},"source_location.postal_code":{"type":"string","title":"Source location postal_code filter"},"source_location.subdivisions":{"type":"string","title":"Source location subdivisions filter"},"source_location.is_anonymous_proxy":{"type":"boolean","title":"Source location is_anonymous_proxy filter"},"machine_ip":{"type":"string","title":"machine_ip filter"},"serial_number":{"type":"string","title":"Serial number filter"},"serial_number.keyword":{"type":"string","title":"Serial number filter"},"object_guid":{"type":"string","title":"object_guid filter"},"is_deleted":{"type":"boolean","default":false,"nullable":true,"title":"is_deleted filter"},"vulnerabilities_found_total_gt":{"type":"number","title":"vulnerabilities_found_total_gt"},"vulnerabilities_found_total_lt":{"type":"number","title":"vulnerabilities_found_total_lt"},"vulnerabilities_found_total_gte":{"type":"number","title":"vulnerabilities_found_total_gte"},"vulnerabilities_found_total_lte":{"type":"number","title":"vulnerabilities_found_total_lte"},"connected":{"type":"boolean","title":"connected"},"sort_field":{"type":"string","title":"Sort field","enum":["at","nics.ips","nics.mac_address","nics.description","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","host_name","fully_qualified_host_name","plugins.asset_manager.plugin_version","plugins.asset_manager.reboot_reason","plugins.endpoint_protection.plugin_version","plugins.endpoint_protection.sdk_version","plugins.endpoint_protection.component_package_version","plugins.endpoint_protection.update_package_version","plugins.endpoint_protection.reboot_reason","plugins.endpoint_detection_and_response.plugin_version","plugins.endpoint_detection_and_response.reboot_reason","plugins.incident_response.plugin_version","plugins.incident_response.reboot_reason","plugins.siem.plugin_version","plugins.browser_phishing_protection.plugin_version","plugins.siem.reboot_reason","engine_version","domain_name","policy_etag","account_id","group_id","root_group_id","group_name","policy_name","policy_id","deleted_at","created_at","marked_for_deletion","is_deleted","last_day_seen","last_scanned_at","last_user","tags.alias","name_multi_search","machine_ip","serial_number","object_guid","vulnerabilities_found.critical","vulnerabilities_found.high","vulnerabilities_found.medium","vulnerabilities_found.low","vulnerabilities_found.none","vulnerabilities_found.total","os_patches_available","last_assets_scan_at","connected"]},"multi_sort":{"type":"array","title":"The multi_sort schema","items":{"type":"object","title":"Sort field and direction","properties":{"field":{"type":"string","title":"Sort field","enum":["at","nics.ips","nics.mac_address","nics.description","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","host_name","fully_qualified_host_name","plugins.asset_manager.plugin_version","plugins.asset_manager.reboot_reason","plugins.endpoint_protection.plugin_version","plugins.endpoint_protection.sdk_version","plugins.endpoint_protection.component_package_version","plugins.endpoint_protection.update_package_version","plugins.endpoint_protection.reboot_reason","plugins.endpoint_detection_and_response.plugin_version","plugins.endpoint_detection_and_response.reboot_reason","plugins.incident_response.plugin_version","plugins.incident_response.reboot_reason","plugins.siem.plugin_version","plugins.browser_phishing_protection.plugin_version","plugins.siem.reboot_reason","engine_version","domain_name","policy_etag","account_id","group_id","root_group_id","group_name","policy_name","policy_id","deleted_at","created_at","marked_for_deletion","is_deleted","last_day_seen","last_scanned_at","last_user","tags.alias","name_multi_search","machine_ip","serial_number","object_guid","vulnerabilities_found.critical","vulnerabilities_found.high","vulnerabilities_found.medium","vulnerabilities_found.low","vulnerabilities_found.none","vulnerabilities_found.total","os_patches_available","last_assets_scan_at","connected"]},"direction":{"type":"string","title":"Direction","enum":["asc","desc"]},"missing":{"type":"string","title":"Missing values sorting","enum":["_first","_last"]}}}},"populate":{"type":"object","title":"Specify whether you need to populate the server's response with additional data, like account info or last task","properties":{"last_job":{"type":"boolean","title":"The last_job data"},"account":{"type":"boolean","title":"The account data"},"platform":{"type":"boolean","title":"Specify the platform on OS release name aggregation"}}},"page_size":{"type":"number","title":"The page size. If you just need to aggregate, set it to 0","minimum":0,"maximum":2000},"aggregations":{"type":"array","title":"The fields onto which you can perform aggregations","default":[],"items":{"type":"string","title":"The Items Schema","enum":["has_alerts","infected","suspicious","scan_needed","reboot_required","check-in_status","isolated","protection_status","os_info.os_release_name","nics.ips","nics.mac_address","nics.description","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","host_name","fully_qualified_host_name","plugins.asset_manager.plugin_version","plugins.asset_manager.reboot_reason","plugins.asset_manager.alerts.codes","plugins.endpoint_protection.plugin_version","plugins.endpoint_protection.sdk_version","plugins.endpoint_protection.alerts.codes","plugins.endpoint_protection.component_package_version","plugins.endpoint_protection.update_package_version","plugins.endpoint_protection.reboot_reason","plugins.endpoint_detection_and_response.plugin_version","plugins.endpoint_detection_and_response.reboot_reason","plugins.endpoint_detection_and_response.alerts.codes","plugins.incident_response.plugin_version","plugins.incident_response.reboot_reason","plugins.incident_response.alerts.codes","plugins.siem.plugin_version","plugins.siem.reboot_reason","plugins.siem.alerts.codes","engine_version","domain_name","policy_etag","account_id","group_id","root_group_id","group_name","policy_name","policy_id","is_deleted","is_software_update_available","machine_ip","serial_number","object_guid"]}},"account_ids":{"type":"array","title":"The account_ids against which you want to run the search. This field is mandatory, and you need to explicitly set all the account_ids in which you want to search endpoints","items":{"type":"string","title":"The Items Schema (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}},"sort_order":{"type":"string","title":"Whether sorting should be ascending or descending","enum":["asc","desc"]},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]},"at_after":{"type":"string","title":"At after cursor (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"at_before":{"type":"string","title":"At before cursor (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"last_day_seen_before":{"type":"string","title":"ISO date string. Results include endpoints that have last connected before the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"last_scan_before":{"type":"string","title":"ISO date string. Results include endpoints that have been scanned before the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"last_scan_after":{"type":"string","title":"ISO date string. Results include endpoints that have been scanned after the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"last_day_seen_after":{"type":"string","title":"ISO date string. Results include endpoints that have last connected after the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"marked_for_deletion_after":{"type":"string","title":"ISO date string. Results include endpoints that have been marked for deletion after the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"marked_for_deletion_before":{"type":"string","title":"ISO date string. Results include endpoints that have been marked for deletion before the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"deleted_at_after":{"type":"string","title":"ISO date string. Results include endpoints that have been deleted after the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"deleted_at_before":{"type":"string","title":"ISO date string. Results include endpoints that have been deleted before the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"created_at_after":{"type":"string","title":"ISO date string. Results include endpoints that have been deleted after the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"created_at_before":{"type":"string","title":"ISO date string. Results include endpoints that have been deleted before the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"last_assets_scan_at_after":{"type":"string","title":"Last asset scan after cursor (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"last_assets_scan_at_before":{"type":"string","title":"Last asset scan before cursor (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"aggregate_by_account":{"type":"boolean","title":"Indicates whether aggregations should be scoped by account"}}}]}},"unregister_isolated":{"type":"boolean","title":"Force delete isolated endpoints"},"endpoint_count_confirmation":{"type":"integer","minimum":1,"title":"Expected total number of endpoints to delete. Deletion proceeds only if the actual count matches this value."}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"The Delete Endpoints Bulk Body 200 Schema","required":["deleted"],"properties":{"deleted":{"type":"array","title":"IDs of the deleted endpoint","items":{"type":"string","title":"Endpoint ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}},"errors":{"type":"array","title":"tasks not performed","items":{"type":"object","title":"Endpoint ID","additionalProperties":true,"properties":{"id":{"type":"string","title":"Machine ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"account_id":{"type":"string","title":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"account_ids":{"type":"array","title":"Account IDs","items":{"type":"string","title":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}}}}}}}},"tags":["Endpoints"],"operationId":"api.v2.rmm.delete.endpoints.bulk"},"post":{"description":"Search endpoints across all your managed accounts. The search will be scoped to the account_ids you specify in the request body. Constraints with the suffix `keyword` indicates an exact match. Constraints without the `keyword` suffix will be tokenized.\n\n### Examples\nIf you want to find endpoints belonging to the `Default group` (the search is case insensitive), use `group_name.keyword` as a constraint.\n```json\n{\n \"account_ids\": [\"\"],\n \"group_name.keyword\": \"default group\"\n}\n```\nAlternatively, if you want to find endpoints which group includes `department_one OR department_two`, use `group_name` as a constraint.\n```json\n{\n \"account_ids\": [\"\"],\n \"group_name\": \"department_one department_two department_three\"\n}\n```\n","summary":"Search endpoints across accounts","security":[{"client_credentials":["read"]},{"user_permissions":["endpoints.view"]}],"status":{"incident":["read_nebula_data","caching"],"outage":["auth","search_stateful"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Search endpoints request. Leading wildcards are not supported for constraint fields without '.keyword' suffix.","required":["account_ids"],"properties":{"has_alerts":{"type":"boolean","title":"Indicates whether the endpoint needs attention"},"name_multi_search":{"type":"string","title":"Search either alias, host name of fully qualified host name"},"alerts.codes":{"type":"string","title":"Alert codes"},"is_software_update_available":{"type":"boolean","title":"Indicates whether the agent has an available update"},"protection_status":{"type":"string","title":"Protection status of the endpoint(s)","pattern":"(^$|protected|scan_only|unprotected|unknown|pending|mobile_protection)"},"is_isolated":{"type":"boolean","title":"Indicates whether the endpoints are isolated or not"},"suspicious_activity_found":{"type":"boolean","title":"Filter the search to the endpoints that have open suspicious activities"},"reboot_required":{"type":"boolean","title":"Filter the search to the endpoints needing a reboot"},"infection_found":{"type":"boolean","title":"Filter the search to the endpoints with one or more security threats found"},"policy_id":{"type":"string","title":"Filter the search to the endpoints with specified policy (id)"},"policy_name":{"type":"string","title":"Filter the search to the endpoints with specified policy (name)"},"policy_etag":{"type":"string","title":"Filter the search to the endpoints with specified policy etag"},"domain_name":{"type":"string","title":"Filter the search to the endpoints with specified domain name"},"engine_version":{"type":"string","title":"Filter the search to the endpoints with specified engine version"},"last_user":{"type":"string","title":"Last user that logged into the machine"},"last_user.keyword":{"type":"string","title":"Last user that logged into the machine (exact match). This 'contains' type search will look for the exact match anywhere in the field."},"alias":{"type":"string","title":"Aliases for the machine"},"plugins.siem.reboot_reason":{"type":"string","title":"Filter the search to the endpoints with specified reboot reason, as reported by the SIEM plugin"},"plugins.siem.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified SIEM plugin version"},"plugins.siem.alerts.codes":{"type":"string","title":"Filter the search to the endpoints with specified SIEM alerts"},"plugins.browser_phishing_protection.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified Browser Phishing Protection plugin version"},"plugins.browser_phishing_protection.alerts.codes":{"type":"string","title":"Filter the search to the endpoints with specified Browser Phishing Protection alerts"},"plugins.incident_response.reboot_reason":{"type":"string","title":"Filter the search to the endpoints with specified reboot reason, as reported by IR plugin"},"plugins.incident_response.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified IR plugin version"},"plugins.incident_response.alerts.codes":{"type":"string","title":"Filter the search to the endpoints with specified IR plugin alerts"},"plugins.endpoint_detection_and_response.reboot_reason":{"type":"string","title":"Filter the search to the endpoints with specified reboot reason, as reported by EDR plugin"},"plugins.endpoint_detection_and_response.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified EDR plugin version"},"plugins.endpoint_detection_and_response.alerts.codes":{"type":"string","title":"Filter the search to the endpoints with specified EDR plugin alerts"},"plugins.endpoint_protection.reboot_reason":{"type":"string","title":"Filter the search to the endpoints with specified reboot reason, as reported by EP plugin"},"plugins.endpoint_protection.update_package_version":{"type":"string","title":"Filter the search to the endpoints with specified EP update package version"},"plugins.endpoint_protection.component_package_version":{"type":"string","title":"Filter the search to the endpoints with specified EP component package version"},"plugins.endpoint_protection.sdk_version":{"type":"string","title":"Filter the search to the endpoints with specified EP SDK version"},"plugins.endpoint_protection.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified EP plugin version"},"plugins.endpoint_protection.alerts.codes":{"type":"string","title":"Filter the search to the endpoints with specified EP plugin alerts"},"plugins.asset_manager.reboot_reason":{"type":"string","title":"Filter the search to the endpoints with specified reboot reason, as reported by asset manager plugin"},"plugins.asset_manager.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified asset manager plugin version"},"plugins.asset_manager.alerts.codes":{"type":"string","title":"Filter the search to the endpoints with specified asset manager alerts"},"fully_qualified_host_name":{"type":"string","title":"Filter the search to the endpoints with specified, fully qualified host name"},"host_name":{"type":"string","title":"Filter the search to the endpoints with specified host name"},"os_info.os_release_name":{"type":"string","title":"Filter the search to the endpoints with specified release name of OS"},"os_info.os_release_name.keyword":{"type":"string","title":"Filter the search to the endpoints with specified release name of OS"},"os_info.os_architecture":{"type":"string","title":"Filter the search to the endpoints with specified OS architecture"},"os_info.os_platform":{"type":"string","title":"Filter the search to the endpoints with specified OS"},"os_info.os_version":{"type":"string","title":"Filter the search to the endpoints with specified OS version"},"os_info.os_type":{"type":"string","title":"Filter the search to the endpoints with specified OS type"},"nics.description":{"type":"string","title":"Filter the search to the endpoints with specified NICS description"},"nics.mac_address":{"type":"string","title":"Filter the search to the endpoints with specified NICS MAC address"},"nics.ips":{"type":"string","title":"Filter the search to the endpoints with specified ips"},"group_name.keyword":{"type":"string","title":"Filter the search to the endpoints belonging to the specified group's name. This 'contains' type search will look for the exact match anywhere in the field."},"policy_name.keyword":{"type":"string","title":"Filter the search to the endpoints assigned to the specified policy's name. This 'contains' type search will look for the exact match anywhere in the field."},"host_name.keyword":{"type":"string","title":"Filter the search to the endpoints that have the specified host's name. This 'contains' type search will look for the exact match anywhere in the field."},"fully_qualified_host_name.keyword":{"type":"string","title":"Filter the search to the endpoints that have the specified, fully_qualified_host's name. This 'contains' type search will look for the exact match anywhere in the field."},"engine_version.keyword":{"type":"string","title":"Filter the search by specified engine version."},"engine_version_gt":{"type":"string","title":"Filter the search by engine version greater than specified value."},"engine_version_gte":{"type":"string","title":"Filter the search by engine version greater than or equal to specified value."},"engine_version_lt":{"type":"string","title":"Filter the search by engine version less than specified value."},"engine_version_lte":{"type":"string","title":"Filter the search by engine version less than or equal to specified value."},"domain_name.keyword":{"type":"string","title":"Filter the search by domain name. This 'contains' type search will look for the exact match anywhere in the field."},"group_id":{"type":"string","title":"Filter the search by group id"},"group_name":{"type":"string","title":"Filter the search by group's name"},"source_location.city":{"type":"string","title":"Source location city filter"},"source_location.country":{"type":"string","title":"Source location country filter"},"source_location.country_iso":{"type":"string","title":"Source location country_iso filter"},"source_location.continent":{"type":"string","title":"Source location continent filter"},"source_location.time_zone":{"type":"string","title":"Source location time_zone filter"},"source_location.postal_code":{"type":"string","title":"Source location postal_code filter"},"source_location.subdivisions":{"type":"string","title":"Source location subdivisions filter"},"source_location.is_anonymous_proxy":{"type":"boolean","title":"Source location is_anonymous_proxy filter"},"machine_ip":{"type":"string","title":"machine_ip filter"},"serial_number":{"type":"string","title":"Serial number filter"},"serial_number.keyword":{"type":"string","title":"Serial number filter"},"object_guid":{"type":"string","title":"object_guid filter"},"is_deleted":{"type":"boolean","default":false,"nullable":true,"title":"is_deleted filter"},"vulnerabilities_found_total_gt":{"type":"number","title":"vulnerabilities_found_total_gt"},"vulnerabilities_found_total_lt":{"type":"number","title":"vulnerabilities_found_total_lt"},"vulnerabilities_found_total_gte":{"type":"number","title":"vulnerabilities_found_total_gte"},"vulnerabilities_found_total_lte":{"type":"number","title":"vulnerabilities_found_total_lte"},"connected":{"type":"boolean","title":"connected"},"sort_field":{"type":"string","title":"Sort field","enum":["at","nics.ips","nics.mac_address","nics.description","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","host_name","fully_qualified_host_name","plugins.asset_manager.plugin_version","plugins.asset_manager.reboot_reason","plugins.endpoint_protection.plugin_version","plugins.endpoint_protection.sdk_version","plugins.endpoint_protection.component_package_version","plugins.endpoint_protection.update_package_version","plugins.endpoint_protection.reboot_reason","plugins.endpoint_detection_and_response.plugin_version","plugins.endpoint_detection_and_response.reboot_reason","plugins.incident_response.plugin_version","plugins.incident_response.reboot_reason","plugins.siem.plugin_version","plugins.browser_phishing_protection.plugin_version","plugins.siem.reboot_reason","engine_version","domain_name","policy_etag","account_id","group_id","root_group_id","group_name","policy_name","policy_id","deleted_at","created_at","marked_for_deletion","is_deleted","last_day_seen","last_scanned_at","last_user","tags.alias","name_multi_search","machine_ip","serial_number","object_guid","vulnerabilities_found.critical","vulnerabilities_found.high","vulnerabilities_found.medium","vulnerabilities_found.low","vulnerabilities_found.none","vulnerabilities_found.total","os_patches_available","last_assets_scan_at","connected"]},"multi_sort":{"type":"array","title":"The multi_sort schema","items":{"type":"object","title":"Sort field and direction","properties":{"field":{"type":"string","title":"Sort field","enum":["at","nics.ips","nics.mac_address","nics.description","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","host_name","fully_qualified_host_name","plugins.asset_manager.plugin_version","plugins.asset_manager.reboot_reason","plugins.endpoint_protection.plugin_version","plugins.endpoint_protection.sdk_version","plugins.endpoint_protection.component_package_version","plugins.endpoint_protection.update_package_version","plugins.endpoint_protection.reboot_reason","plugins.endpoint_detection_and_response.plugin_version","plugins.endpoint_detection_and_response.reboot_reason","plugins.incident_response.plugin_version","plugins.incident_response.reboot_reason","plugins.siem.plugin_version","plugins.browser_phishing_protection.plugin_version","plugins.siem.reboot_reason","engine_version","domain_name","policy_etag","account_id","group_id","root_group_id","group_name","policy_name","policy_id","deleted_at","created_at","marked_for_deletion","is_deleted","last_day_seen","last_scanned_at","last_user","tags.alias","name_multi_search","machine_ip","serial_number","object_guid","vulnerabilities_found.critical","vulnerabilities_found.high","vulnerabilities_found.medium","vulnerabilities_found.low","vulnerabilities_found.none","vulnerabilities_found.total","os_patches_available","last_assets_scan_at","connected"]},"direction":{"type":"string","title":"Direction","enum":["asc","desc"]},"missing":{"type":"string","title":"Missing values sorting","enum":["_first","_last"]}}}},"populate":{"type":"object","title":"Specify whether you need to populate the server's response with additional data, like account info or last task","properties":{"last_job":{"type":"boolean","title":"The last_job data"},"account":{"type":"boolean","title":"The account data"},"platform":{"type":"boolean","title":"Specify the platform on OS release name aggregation"}}},"page_size":{"type":"number","title":"The page size. If you just need to aggregate, set it to 0","minimum":0,"maximum":2000},"aggregations":{"type":"array","title":"The fields onto which you can perform aggregations","default":[],"items":{"type":"string","title":"The Items Schema","enum":["has_alerts","infected","suspicious","scan_needed","reboot_required","check-in_status","isolated","protection_status","os_info.os_release_name","nics.ips","nics.mac_address","nics.description","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","host_name","fully_qualified_host_name","plugins.asset_manager.plugin_version","plugins.asset_manager.reboot_reason","plugins.asset_manager.alerts.codes","plugins.endpoint_protection.plugin_version","plugins.endpoint_protection.sdk_version","plugins.endpoint_protection.alerts.codes","plugins.endpoint_protection.component_package_version","plugins.endpoint_protection.update_package_version","plugins.endpoint_protection.reboot_reason","plugins.endpoint_detection_and_response.plugin_version","plugins.endpoint_detection_and_response.reboot_reason","plugins.endpoint_detection_and_response.alerts.codes","plugins.incident_response.plugin_version","plugins.incident_response.reboot_reason","plugins.incident_response.alerts.codes","plugins.siem.plugin_version","plugins.siem.reboot_reason","plugins.siem.alerts.codes","engine_version","domain_name","policy_etag","account_id","group_id","root_group_id","group_name","policy_name","policy_id","is_deleted","is_software_update_available","machine_ip","serial_number","object_guid"]}},"account_ids":{"type":"array","title":"The account_ids against which you want to run the search. This field is mandatory, and you need to explicitly set all the account_ids in which you want to search endpoints","items":{"type":"string","title":"The Items Schema (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}},"sort_order":{"type":"string","title":"Whether sorting should be ascending or descending","enum":["asc","desc"]},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]},"at_after":{"type":"string","title":"At after cursor (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"at_before":{"type":"string","title":"At before cursor (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"last_day_seen_before":{"type":"string","title":"ISO date string. Results include endpoints that have last connected before the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"last_scan_before":{"type":"string","title":"ISO date string. Results include endpoints that have been scanned before the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"last_scan_after":{"type":"string","title":"ISO date string. Results include endpoints that have been scanned after the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"last_day_seen_after":{"type":"string","title":"ISO date string. Results include endpoints that have last connected after the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"marked_for_deletion_after":{"type":"string","title":"ISO date string. Results include endpoints that have been marked for deletion after the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"marked_for_deletion_before":{"type":"string","title":"ISO date string. Results include endpoints that have been marked for deletion before the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"deleted_at_after":{"type":"string","title":"ISO date string. Results include endpoints that have been deleted after the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"deleted_at_before":{"type":"string","title":"ISO date string. Results include endpoints that have been deleted before the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"created_at_after":{"type":"string","title":"ISO date string. Results include endpoints that have been deleted after the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"created_at_before":{"type":"string","title":"ISO date string. Results include endpoints that have been deleted before the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"last_assets_scan_at_after":{"type":"string","title":"Last asset scan after cursor (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"last_assets_scan_at_before":{"type":"string","title":"Last asset scan before cursor (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"aggregate_by_account":{"type":"boolean","title":"Indicates whether aggregations should be scoped by account"}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Search endpoints","required":["endpoints","total_count","next_cursor"],"properties":{"aggregations":{"type":"object","additionalProperties":true},"endpoints":{"type":"array","title":"Endpoints","items":{"type":"object","title":"Endpoint items","additionalProperties":true,"properties":{"link":{"type":"string","title":"Link"},"protection_status":{"type":"string","title":"Protection Status"},"display_name":{"type":"string","title":"Display Name"},"agent":{"type":"object","title":"Agent","additionalProperties":true,"properties":{"has_alerts":{"type":"boolean","title":"Indicates whether the endpoint needs attention"},"is_software_update_available":{"type":"boolean","title":"Indicates whether the agent has an available update"},"last_user":{"type":"string","title":"The last user logging in"},"at":{"type":"string","title":"Reported At"},"machine_id":{"type":"string","title":"Endpoint ID"},"account_id":{"type":"string","title":"Account ID"},"group_id":{"type":"string","title":"Group ID"},"nics":{"type":"array","title":"Nics","items":{"type":"object","title":"Nics items","properties":{"ips":{"type":"array","title":"IPs","items":{"type":"string","title":"IP items"}},"description":{"type":"string","title":"Description"},"mac_address":{"type":"string","title":"Mac address"}}}},"os_info":{"type":"object","title":"Os info","properties":{"os_type":{"type":"string","title":"OS type"},"os_version":{"type":"string","title":"OS version"},"os_platform":{"type":"string","title":"OS platform"},"os_architecture":{"type":"string","title":"OS architecture"},"os_release_name":{"type":"string","title":"OS release name"}}},"domain_name":{"type":"string","title":"Domain name"},"host_name":{"type":"string","title":"Host name"},"fully_qualified_host_name":{"type":"string","title":"Fully qualified host name"},"object_guid":{"type":"string","title":"Object guid"},"plugins":{"type":"object","title":"Plugins","properties":{"incident_response":{"type":"object","title":"Incident response","properties":{"product_name":{"type":"string","title":"Product name"},"plugin_version":{"type":"string","title":"Plugin version"},"update_package_version":{"type":"string","title":"Update package version"},"component_package_version":{"type":"string","title":"Component package version"},"alerts":{"type":"object","properties":{"codes":{"type":"array","items":{"type":"string"}}}}}},"endpoint_protection":{"type":"object","title":"Endpoint protection plugin","properties":{"sdk_version":{"type":"string","title":"SDK version plugin"},"product_name":{"type":"string","title":"Name of the product"},"plugin_version":{"type":"string","title":"Version of the product"},"update_package_version":{"type":"string","title":"Update version"},"component_package_version":{"type":"string","title":"Component version"},"alerts":{"type":"object","properties":{"codes":{"type":"array","items":{"type":"string"}}}}}},"asset_manager":{"type":"object","title":"Asset manager","properties":{"product_name":{"type":"string","title":"Product name"},"plugin_version":{"type":"string","title":"Plugin version"},"alerts":{"type":"object","properties":{"codes":{"type":"array","items":{"type":"string"}}}}}},"endpoint_detection_and_response":{"type":"object","title":"Endpoint detection and response","properties":{"product_name":{"type":"string","title":"Product name"},"plugin_version":{"type":"string","title":"Plugin version"},"alerts":{"type":"object","properties":{"codes":{"type":"array","items":{"type":"string"}}}}}}}},"engine_version":{"type":"string","title":"Engine version"},"policy_etag":{"type":"string","title":"Policy etag"},"version":{"type":"integer","title":"Version"},"document_id":{"type":"string","title":"Document ID"},"machine_ip":{"type":"string","title":"Machine public IP"},"source_location":{"type":"object","properties":{"city":{"type":"string"},"country":{"type":"string"},"country_iso":{"type":"string"},"continent":{"type":"string"},"accuracy_radius":{"type":"integer"},"point":{"properties":{"lat":{"allOf":[{"bignumber":true},{"type":"number"}]},"lon":{"allOf":[{"bignumber":true},{"type":"number"}]}}},"time_zone":{"type":"string"},"postal_code":{"type":"string"},"subdivisions":{"type":"array","items":{"type":"string"}},"anonymous_proxy":{"type":"boolean"}}},"serial_number":{"type":"string","title":"Serial number of this endpoint"},"active_directory":{"type":"object","patternProperties":{"^(user|machine)$":{"type":"object","properties":{"display_name":{"type":"string"},"distinguished_name":{"type":"string"},"sam_account_name":{"type":"string"},"ou":{"type":"string"}}}}}}},"machine":{"type":"object","title":"Endpoint","additionalProperties":true,"properties":{"id":{"type":"string","title":"ID"},"job":{"type":"object","title":"The last job","additionalProperties":true},"account":{"type":"object","title":"Account","additionalProperties":true},"online":{"type":"boolean","title":"Is online"},"account_id":{"type":"string","title":"Account ID"},"group_id":{"type":"string","title":"Group ID"},"root_group_id":{"type":"string","title":"Root group ID"},"group_name":{"type":"string","title":"Group name"},"policy_id":{"type":"string","title":"Policy id"},"policy_account_id":{"type":"string","title":"Policy account ID"},"policy_name":{"type":"string","title":"Policy name"},"last_day_seen":{"type":"string","title":"Last day seen"},"last_active":{"type":"string","title":"Last time the endpoint connected to Nebula in real time"},"isolated":{"type":"boolean","title":"Is isolated"},"scan_age_days":{"type":"integer","title":"Days from last scan"},"suspicious_activity_count":{"type":"integer","title":"Count of suspicious activities"},"infection_count":{"type":"integer","title":"Count of infections found"},"reboot_required":{"type":"integer","title":"Is reboot required"},"last_scanned_at":{"type":"string","title":"Last scanned at"},"is_deleted":{"type":"boolean","title":"Is deleted"},"version":{"type":"integer","title":"Version"},"document_id":{"type":"string","title":"Document ID"},"created_at":{"type":"string","format":"date-time","title":"Created At"}}},"machineVersion":{"type":"integer","title":"Machine version"}}}},"total_count":{"type":"integer","title":"The Total_count Schema"},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]},"after":{"type":"string","title":"After cursor"}}}}}}},"tags":["Endpoints"],"operationId":"api.v2.rmm.post.endpoints"}},"/oneview/v1/endpoints/export":{"post":{"description":"Export endpoint data across multiple accounts. Specify your interested fields and the output format.\n\nSupported output formats: csv, xlsx, json.\n\n## Settings\n\n| Name | Description |\n|------|-------------|\n| groups | List of queries. The constraints accepted are the same accepted by the search endpoints route. Refer to `POST -> /endpoints` for more information about the constraints accepted. |\n| endpoints | List of explicit endpoint ids. Accounts ids are required along with the endpoint ids |\n| populate | Whether to populate the response with additional data. Currently supported `account` and `last_job` |\n| download | If set to true, the server will set the `Content-Disposition` header using the `filename` and `format` |\n| select | Which fields to select, and which field name to map to. See request schema for allowed values |\n| type | Output encoding (for `csv` and `json` format) |\n| filename | Name of the file to be set in `Content-Disposition` header if `download` = true |\n\n## Examples\n\n### Download HTML file\n\nA request with this body sent by a browser will download a file called `nameofthefile.html`, displaying a table with columns: `Deleted`, `Task`, `ID`, `Name` for all `windows` endpoints within account id `1e14cd0a-2ef3-4db3-b8a4-c89894d9aa34` and the endpoint with id `211a4cfc-557e-4ba7-a96f-70685a07c29e`:\n\n```json\n\t{\n\t\t\"groups\": [{\n\t\t\t\"account_ids\": [\"1e14cd0a-2ef3-4db3-b8a4-c89894d9aa34\"],\n\t\t\t\"os_info.os_platform\": \"windows\"\n\t\t}],\n\t\t\"endpoints\": [{ \"id\": \"211a4cfc-557e-4ba7-a96f-70685a07c29e\", \"account_id\": \"1e14cd0a-2ef3-4db3-b8a4-c89894d9aa34\"}],\n\t\t\"populate\": { \"account\": true, \"last_job\": true },\n\t\t\"format\": \"html\",\n\t\t\"type\": \"string\",\n\t\t\"filename\": \"nameofthefile\",\n\t\t\"download\": true,\n\t\t\"select\": [{\n\t\t\t\"field\": \"machine.is_deleted\",\n\t\t\t\"newField\": \"Deleted\"\n\t\t},{\n\t\t\t\"field\": \"machine.job.status\",\n\t\t\t\"newField\": \"Task\"\n\t\t}, {\n\t\t\t\"field\": \"machine.id\",\n\t\t\t\"newField\": \"ID\"\n\t\t}, {\n\t\t\t\"field\": \"machine.account.name\",\n\t\t\t\"newField\": \"Name\"\n\t\t}]\n\t}\n```\n\n### Download xlsx file\n\nA request with this body sent by a browser will download a file called `report.html`, displaying a table with columns: `Deleted`, `Task`, `ID`, `Name` for all `windows` endpoints within account id `1e14cd0a-2ef3-4db3-b8a4-c89894d9aa34` and the endpoint with id `211a4cfc-557e-4ba7-a96f-70685a07c29e`:\n\n```json\n\t{\n\t\t\"groups\": [{\n\t\t\t\"account_ids\": [\"1e14cd0a-2ef3-4db3-b8a4-c89894d9aa34\"],\n\t\t\t\"os_info.os_platform\": \"windows\"\n\t\t}],\n\t\t\"endpoints\": [{ \"id\": \"211a4cfc-557e-4ba7-a96f-70685a07c29e\", \"account_id\": \"1e14cd0a-2ef3-4db3-b8a4-c89894d9aa34\"}],\n\t\t\"populate\": { \"account\": true, \"last_job\": true },\n\t\t\"format\": \"xlsx\",\n\t\t\"type\": \"base64\",\n\t\t\"filename\": \"report\",\n\t\t\"download\": true,\n\t\t\"select\": [{\n\t\t\t\"field\": \"machine.is_deleted\",\n\t\t\t\"newField\": \"Deleted\"\n\t\t},{\n\t\t\t\"field\": \"machine.job.status\",\n\t\t\t\"newField\": \"Task\"\n\t\t}, {\n\t\t\t\"field\": \"machine.id\",\n\t\t\t\"newField\": \"ID\"\n\t\t}, {\n\t\t\t\"field\": \"machine.account.name\",\n\t\t\t\"newField\": \"Name\"\n\t\t}]\n\t}\n```\n\n### Get JSON with all ids for programmatic usage\n\nA request with the following body sent by a browser will respond with a json body containing an array of objects with the following properties: `Deleted`, `Task`, `ID`, `Name` for all `windows` endpoints within account id `1e14cd0a-2ef3-4db3-b8a4-c89894d9aa34` and the endpoint with id `211a4cfc-557e-4ba7-a96f-70685a07c29e`:\n\n```json\n\t{\n\t\t\"groups\": [{\n\t\t\t\"account_ids\": [\"1e14cd0a-2ef3-4db3-b8a4-c89894d9aa34\"],\n\t\t\t\"os_info.os_platform\": \"windows\"\n\t\t}],\n\t\t\"endpoints\": [{ \"id\": \"211a4cfc-557e-4ba7-a96f-70685a07c29e\", \"account_id\": \"1e14cd0a-2ef3-4db3-b8a4-c89894d9aa34\"}],\n\t\t\"populate\": { \"account\": true, \"last_job\": true },\n\t\t\"format\": \"json\",\n\t\t\"type\": \"string\",\n\t\t\"select\": [{\n\t\t\t\"field\": \"machine.is_deleted\",\n\t\t\t\"newField\": \"Deleted\"\n\t\t},{\n\t\t\t\"field\": \"machine.job.status\",\n\t\t\t\"newField\": \"Task\"\n\t\t}, {\n\t\t\t\"field\": \"machine.id\",\n\t\t\t\"newField\": \"ID\"\n\t\t}, {\n\t\t\t\"field\": \"machine.account.name\",\n\t\t\t\"newField\": \"Name\"\n\t\t}]\n\t}\n```\n\n*Example response*\n```\n[\n {\n \"Deleted\": false,\n \"Task\": \"PENDING\",\n \"ID\": \"211a4cfc-557e-4ba7-a96f-70685a07c29e\",\n \"Name\": \"Postman Test Account2040c322-c98a-4e98-bb67-9d3f94ff1867\"\n },\n {\n \"Deleted\": false,\n \"Task\": \"PENDING\",\n \"ID\": \"211a4cfc-557e-4ba7-a96f-70685a07c29e\",\n \"Name\": \"Postman Test Account2040c322-c98a-4e98-bb67-9d3f94ff1867\"\n },\n {\n \"Deleted\": false,\n \"Task\": \"PENDING\",\n \"ID\": \"49a92495-ff82-433d-b1ec-6e49376ddf06\",\n \"Name\": \"Postman Test Account2040c322-c98a-4e98-bb67-9d3f94ff1867\"\n },\n {\n \"Deleted\": false,\n \"ID\": \"cb35a2a2-e391-4fb5-b0d2-11693797c648\",\n \"Name\": \"Postman Test Account2040c322-c98a-4e98-bb67-9d3f94ff1867\"\n },\n {\n \"Deleted\": false,\n \"ID\": \"df974ca9-229c-40f2-93fe-a29bde6f77c8\",\n \"Name\": \"Postman Test Account2040c322-c98a-4e98-bb67-9d3f94ff1867\"\n },\n {\n \"Deleted\": false,\n \"ID\": \"e7093336-cd45-4492-bb0f-8bebc62db0c3\",\n \"Name\": \"Postman Test Account2040c322-c98a-4e98-bb67-9d3f94ff1867\"\n }\n]\n```\n\n\n","summary":"Export endpoints (Bulk across accounts)","security":[{"client_credentials":["execute"]},{"user_permissions":["endpoints.view"]}],"status":{"outage":["auth","search_stateful"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Export request","required":["endpoints","groups","select","format"],"properties":{"format":{"type":"string","title":"The output file","enum":["csv","xlsx","html","ods","txt","rtf","json"]},"download":{"type":"boolean","title":"Whether to instruct the client to download the response as a file. Only clients like browsers are supported"},"type":{"type":"string","title":"The encoding of the output","enum":["string","base64","binary"],"default":"string"},"select":{"type":"array","title":"Which fields to select from the response","items":{"type":"object","title":"Field","required":["field","newField"],"properties":{"newField":{"type":"string","title":"the new value"},"field":{"type":"string","title":"The response field to map to a new value","enum":["machine.is_deleted","machine.scan_age_days","machine.root_group_id","machine.last_day_seen","machine.isolated","machine.suspicious_activity_count","machine.infection_count","machine.reboot_required","machine.last_scanned_at","machine.group_name","machine.policy_id","machine.policy_name","machine.tags","machine.group_id","machine.id","machine.account_id","machine.online","machine.created_at","machine.job.status","machine.account.name","agent.at","agent.last_user","agent.fully_qualified_host_name","agent.started_at_local","agent.started_at_offset","agent.os_info.os_type","agent.os_info.os_version","agent.os_info.os_platform","agent.os_info.os_architecture","agent.os_info.os_release_name","agent.domain_name","agent.engine_version","agent.policy_etag","agent.host_name","agent.nics.ips","agent.nics.mac_address","machine.tags.alias","agent.is_software_update_available","agent.has_alerts","agent.machine_ip","agent.object_guid","agent.available_software_updates.sdk_version.new","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.plugins.endpoint_protection.update_package_version","agent.source_location.city","agent.source_location.country","agent.source_location.country_iso","agent.source_location.continent","agent.source_location.time_zone","agent.source_location.postal_code","agent.source_location.subdivisions","agent.source_location.anonymous_proxy","agent.serial_number","protection_status","stats.assets.vulnerabilities_found","stats.assets.os_patches_available","stats.assets.last_scanned_at","stats.app_block_count","connected","agent.plugins.browser_phishing_protection.plugin_version"]}}}},"endpoints":{"type":"array","title":"Endpoints IDs","items":{"type":"object","title":"Explicit list of endpoints","required":["id","account_id"],"properties":{"id":{"type":"string","title":"ID of the endpoint (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"account_id":{"type":"string","title":"Account to which the endpoint belongs (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}},"groups":{"type":"array","title":"List of queries","items":{"type":"object","title":"List of queries to fetch endpoints","allOf":[{"type":"object","title":"Search endpoints request. Leading wildcards are not supported for constraint fields without '.keyword' suffix.","required":["account_ids"],"properties":{"has_alerts":{"type":"boolean","title":"Indicates whether the endpoint needs attention"},"name_multi_search":{"type":"string","title":"Search either alias, host name of fully qualified host name"},"alerts.codes":{"type":"string","title":"Alert codes"},"is_software_update_available":{"type":"boolean","title":"Indicates whether the agent has an available update"},"protection_status":{"type":"string","title":"Protection status of the endpoint(s)","pattern":"(^$|protected|scan_only|unprotected|unknown|pending|mobile_protection)"},"is_isolated":{"type":"boolean","title":"Indicates whether the endpoints are isolated or not"},"suspicious_activity_found":{"type":"boolean","title":"Filter the search to the endpoints that have open suspicious activities"},"reboot_required":{"type":"boolean","title":"Filter the search to the endpoints needing a reboot"},"infection_found":{"type":"boolean","title":"Filter the search to the endpoints with one or more security threats found"},"policy_id":{"type":"string","title":"Filter the search to the endpoints with specified policy (id)"},"policy_name":{"type":"string","title":"Filter the search to the endpoints with specified policy (name)"},"policy_etag":{"type":"string","title":"Filter the search to the endpoints with specified policy etag"},"domain_name":{"type":"string","title":"Filter the search to the endpoints with specified domain name"},"engine_version":{"type":"string","title":"Filter the search to the endpoints with specified engine version"},"last_user":{"type":"string","title":"Last user that logged into the machine"},"last_user.keyword":{"type":"string","title":"Last user that logged into the machine (exact match). This 'contains' type search will look for the exact match anywhere in the field."},"alias":{"type":"string","title":"Aliases for the machine"},"plugins.siem.reboot_reason":{"type":"string","title":"Filter the search to the endpoints with specified reboot reason, as reported by the SIEM plugin"},"plugins.siem.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified SIEM plugin version"},"plugins.siem.alerts.codes":{"type":"string","title":"Filter the search to the endpoints with specified SIEM alerts"},"plugins.browser_phishing_protection.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified Browser Phishing Protection plugin version"},"plugins.browser_phishing_protection.alerts.codes":{"type":"string","title":"Filter the search to the endpoints with specified Browser Phishing Protection alerts"},"plugins.incident_response.reboot_reason":{"type":"string","title":"Filter the search to the endpoints with specified reboot reason, as reported by IR plugin"},"plugins.incident_response.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified IR plugin version"},"plugins.incident_response.alerts.codes":{"type":"string","title":"Filter the search to the endpoints with specified IR plugin alerts"},"plugins.endpoint_detection_and_response.reboot_reason":{"type":"string","title":"Filter the search to the endpoints with specified reboot reason, as reported by EDR plugin"},"plugins.endpoint_detection_and_response.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified EDR plugin version"},"plugins.endpoint_detection_and_response.alerts.codes":{"type":"string","title":"Filter the search to the endpoints with specified EDR plugin alerts"},"plugins.endpoint_protection.reboot_reason":{"type":"string","title":"Filter the search to the endpoints with specified reboot reason, as reported by EP plugin"},"plugins.endpoint_protection.update_package_version":{"type":"string","title":"Filter the search to the endpoints with specified EP update package version"},"plugins.endpoint_protection.component_package_version":{"type":"string","title":"Filter the search to the endpoints with specified EP component package version"},"plugins.endpoint_protection.sdk_version":{"type":"string","title":"Filter the search to the endpoints with specified EP SDK version"},"plugins.endpoint_protection.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified EP plugin version"},"plugins.endpoint_protection.alerts.codes":{"type":"string","title":"Filter the search to the endpoints with specified EP plugin alerts"},"plugins.asset_manager.reboot_reason":{"type":"string","title":"Filter the search to the endpoints with specified reboot reason, as reported by asset manager plugin"},"plugins.asset_manager.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified asset manager plugin version"},"plugins.asset_manager.alerts.codes":{"type":"string","title":"Filter the search to the endpoints with specified asset manager alerts"},"fully_qualified_host_name":{"type":"string","title":"Filter the search to the endpoints with specified, fully qualified host name"},"host_name":{"type":"string","title":"Filter the search to the endpoints with specified host name"},"os_info.os_release_name":{"type":"string","title":"Filter the search to the endpoints with specified release name of OS"},"os_info.os_release_name.keyword":{"type":"string","title":"Filter the search to the endpoints with specified release name of OS"},"os_info.os_architecture":{"type":"string","title":"Filter the search to the endpoints with specified OS architecture"},"os_info.os_platform":{"type":"string","title":"Filter the search to the endpoints with specified OS"},"os_info.os_version":{"type":"string","title":"Filter the search to the endpoints with specified OS version"},"os_info.os_type":{"type":"string","title":"Filter the search to the endpoints with specified OS type"},"nics.description":{"type":"string","title":"Filter the search to the endpoints with specified NICS description"},"nics.mac_address":{"type":"string","title":"Filter the search to the endpoints with specified NICS MAC address"},"nics.ips":{"type":"string","title":"Filter the search to the endpoints with specified ips"},"group_name.keyword":{"type":"string","title":"Filter the search to the endpoints belonging to the specified group's name. This 'contains' type search will look for the exact match anywhere in the field."},"policy_name.keyword":{"type":"string","title":"Filter the search to the endpoints assigned to the specified policy's name. This 'contains' type search will look for the exact match anywhere in the field."},"host_name.keyword":{"type":"string","title":"Filter the search to the endpoints that have the specified host's name. This 'contains' type search will look for the exact match anywhere in the field."},"fully_qualified_host_name.keyword":{"type":"string","title":"Filter the search to the endpoints that have the specified, fully_qualified_host's name. This 'contains' type search will look for the exact match anywhere in the field."},"engine_version.keyword":{"type":"string","title":"Filter the search by specified engine version."},"engine_version_gt":{"type":"string","title":"Filter the search by engine version greater than specified value."},"engine_version_gte":{"type":"string","title":"Filter the search by engine version greater than or equal to specified value."},"engine_version_lt":{"type":"string","title":"Filter the search by engine version less than specified value."},"engine_version_lte":{"type":"string","title":"Filter the search by engine version less than or equal to specified value."},"domain_name.keyword":{"type":"string","title":"Filter the search by domain name. This 'contains' type search will look for the exact match anywhere in the field."},"group_id":{"type":"string","title":"Filter the search by group id"},"group_name":{"type":"string","title":"Filter the search by group's name"},"source_location.city":{"type":"string","title":"Source location city filter"},"source_location.country":{"type":"string","title":"Source location country filter"},"source_location.country_iso":{"type":"string","title":"Source location country_iso filter"},"source_location.continent":{"type":"string","title":"Source location continent filter"},"source_location.time_zone":{"type":"string","title":"Source location time_zone filter"},"source_location.postal_code":{"type":"string","title":"Source location postal_code filter"},"source_location.subdivisions":{"type":"string","title":"Source location subdivisions filter"},"source_location.is_anonymous_proxy":{"type":"boolean","title":"Source location is_anonymous_proxy filter"},"machine_ip":{"type":"string","title":"machine_ip filter"},"serial_number":{"type":"string","title":"Serial number filter"},"serial_number.keyword":{"type":"string","title":"Serial number filter"},"object_guid":{"type":"string","title":"object_guid filter"},"is_deleted":{"type":"boolean","default":false,"nullable":true,"title":"is_deleted filter"},"vulnerabilities_found_total_gt":{"type":"number","title":"vulnerabilities_found_total_gt"},"vulnerabilities_found_total_lt":{"type":"number","title":"vulnerabilities_found_total_lt"},"vulnerabilities_found_total_gte":{"type":"number","title":"vulnerabilities_found_total_gte"},"vulnerabilities_found_total_lte":{"type":"number","title":"vulnerabilities_found_total_lte"},"connected":{"type":"boolean","title":"connected"},"sort_field":{"type":"string","title":"Sort field","enum":["at","nics.ips","nics.mac_address","nics.description","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","host_name","fully_qualified_host_name","plugins.asset_manager.plugin_version","plugins.asset_manager.reboot_reason","plugins.endpoint_protection.plugin_version","plugins.endpoint_protection.sdk_version","plugins.endpoint_protection.component_package_version","plugins.endpoint_protection.update_package_version","plugins.endpoint_protection.reboot_reason","plugins.endpoint_detection_and_response.plugin_version","plugins.endpoint_detection_and_response.reboot_reason","plugins.incident_response.plugin_version","plugins.incident_response.reboot_reason","plugins.siem.plugin_version","plugins.browser_phishing_protection.plugin_version","plugins.siem.reboot_reason","engine_version","domain_name","policy_etag","account_id","group_id","root_group_id","group_name","policy_name","policy_id","deleted_at","created_at","marked_for_deletion","is_deleted","last_day_seen","last_scanned_at","last_user","tags.alias","name_multi_search","machine_ip","serial_number","object_guid","vulnerabilities_found.critical","vulnerabilities_found.high","vulnerabilities_found.medium","vulnerabilities_found.low","vulnerabilities_found.none","vulnerabilities_found.total","os_patches_available","last_assets_scan_at","connected"]},"multi_sort":{"type":"array","title":"The multi_sort schema","items":{"type":"object","title":"Sort field and direction","properties":{"field":{"type":"string","title":"Sort field","enum":["at","nics.ips","nics.mac_address","nics.description","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","host_name","fully_qualified_host_name","plugins.asset_manager.plugin_version","plugins.asset_manager.reboot_reason","plugins.endpoint_protection.plugin_version","plugins.endpoint_protection.sdk_version","plugins.endpoint_protection.component_package_version","plugins.endpoint_protection.update_package_version","plugins.endpoint_protection.reboot_reason","plugins.endpoint_detection_and_response.plugin_version","plugins.endpoint_detection_and_response.reboot_reason","plugins.incident_response.plugin_version","plugins.incident_response.reboot_reason","plugins.siem.plugin_version","plugins.browser_phishing_protection.plugin_version","plugins.siem.reboot_reason","engine_version","domain_name","policy_etag","account_id","group_id","root_group_id","group_name","policy_name","policy_id","deleted_at","created_at","marked_for_deletion","is_deleted","last_day_seen","last_scanned_at","last_user","tags.alias","name_multi_search","machine_ip","serial_number","object_guid","vulnerabilities_found.critical","vulnerabilities_found.high","vulnerabilities_found.medium","vulnerabilities_found.low","vulnerabilities_found.none","vulnerabilities_found.total","os_patches_available","last_assets_scan_at","connected"]},"direction":{"type":"string","title":"Direction","enum":["asc","desc"]},"missing":{"type":"string","title":"Missing values sorting","enum":["_first","_last"]}}}},"populate":{"type":"object","title":"Specify whether you need to populate the server's response with additional data, like account info or last task","properties":{"last_job":{"type":"boolean","title":"The last_job data"},"account":{"type":"boolean","title":"The account data"},"platform":{"type":"boolean","title":"Specify the platform on OS release name aggregation"}}},"page_size":{"type":"number","title":"The page size. If you just need to aggregate, set it to 0","minimum":0,"maximum":2000},"aggregations":{"type":"array","title":"The fields onto which you can perform aggregations","default":[],"items":{"type":"string","title":"The Items Schema","enum":["has_alerts","infected","suspicious","scan_needed","reboot_required","check-in_status","isolated","protection_status","os_info.os_release_name","nics.ips","nics.mac_address","nics.description","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","host_name","fully_qualified_host_name","plugins.asset_manager.plugin_version","plugins.asset_manager.reboot_reason","plugins.asset_manager.alerts.codes","plugins.endpoint_protection.plugin_version","plugins.endpoint_protection.sdk_version","plugins.endpoint_protection.alerts.codes","plugins.endpoint_protection.component_package_version","plugins.endpoint_protection.update_package_version","plugins.endpoint_protection.reboot_reason","plugins.endpoint_detection_and_response.plugin_version","plugins.endpoint_detection_and_response.reboot_reason","plugins.endpoint_detection_and_response.alerts.codes","plugins.incident_response.plugin_version","plugins.incident_response.reboot_reason","plugins.incident_response.alerts.codes","plugins.siem.plugin_version","plugins.siem.reboot_reason","plugins.siem.alerts.codes","engine_version","domain_name","policy_etag","account_id","group_id","root_group_id","group_name","policy_name","policy_id","is_deleted","is_software_update_available","machine_ip","serial_number","object_guid"]}},"account_ids":{"type":"array","title":"The account_ids against which you want to run the search. This field is mandatory, and you need to explicitly set all the account_ids in which you want to search endpoints","items":{"type":"string","title":"The Items Schema (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}},"sort_order":{"type":"string","title":"Whether sorting should be ascending or descending","enum":["asc","desc"]},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]},"at_after":{"type":"string","title":"At after cursor (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"at_before":{"type":"string","title":"At before cursor (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"last_day_seen_before":{"type":"string","title":"ISO date string. Results include endpoints that have last connected before the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"last_scan_before":{"type":"string","title":"ISO date string. Results include endpoints that have been scanned before the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"last_scan_after":{"type":"string","title":"ISO date string. Results include endpoints that have been scanned after the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"last_day_seen_after":{"type":"string","title":"ISO date string. Results include endpoints that have last connected after the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"marked_for_deletion_after":{"type":"string","title":"ISO date string. Results include endpoints that have been marked for deletion after the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"marked_for_deletion_before":{"type":"string","title":"ISO date string. Results include endpoints that have been marked for deletion before the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"deleted_at_after":{"type":"string","title":"ISO date string. Results include endpoints that have been deleted after the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"deleted_at_before":{"type":"string","title":"ISO date string. Results include endpoints that have been deleted before the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"created_at_after":{"type":"string","title":"ISO date string. Results include endpoints that have been deleted after the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"created_at_before":{"type":"string","title":"ISO date string. Results include endpoints that have been deleted before the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"last_assets_scan_at_after":{"type":"string","title":"Last asset scan after cursor (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"last_assets_scan_at_before":{"type":"string","title":"Last asset scan before cursor (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"aggregate_by_account":{"type":"boolean","title":"Indicates whether aggregations should be scoped by account"}}}]}}}}}}},"responses":{"200":{"description":"Successful response"}},"tags":["Endpoints"],"operationId":"api.v2.rmm.post.export"}},"/oneview/v1/endpoints/export/async":{"post":{"description":"Export endpoints asynchronously","summary":"Export endpoints asynchronously","security":[{"client_credentials":["execute"]},{"user_permissions":["endpoints.view"]}],"status":{"outage":["auth","search_stateful"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Export request","required":["endpoints","groups","select","format"],"properties":{"format":{"type":"string","title":"The output file","enum":["csv","xlsx","html","ods","txt","rtf","json"]},"download":{"type":"boolean","title":"Whether to instruct the client to download the response as a file. Only clients like browsers are supported"},"type":{"type":"string","title":"The encoding of the output","enum":["string","base64","binary"],"default":"string"},"select":{"type":"array","title":"Which fields to select from the response","items":{"type":"object","title":"Field","required":["field","newField"],"properties":{"newField":{"type":"string","title":"the new value"},"field":{"type":"string","title":"The response field to map to a new value","enum":["machine.is_deleted","machine.scan_age_days","machine.root_group_id","machine.last_day_seen","machine.isolated","machine.suspicious_activity_count","machine.infection_count","machine.reboot_required","machine.last_scanned_at","machine.group_name","machine.policy_id","machine.policy_name","machine.tags","machine.group_id","machine.id","machine.account_id","machine.online","machine.created_at","machine.job.status","machine.account.name","agent.at","agent.last_user","agent.fully_qualified_host_name","agent.started_at_local","agent.started_at_offset","agent.os_info.os_type","agent.os_info.os_version","agent.os_info.os_platform","agent.os_info.os_architecture","agent.os_info.os_release_name","agent.domain_name","agent.engine_version","agent.policy_etag","agent.host_name","agent.nics.ips","agent.nics.mac_address","machine.tags.alias","agent.is_software_update_available","agent.has_alerts","agent.machine_ip","agent.object_guid","agent.available_software_updates.sdk_version.new","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.plugins.endpoint_protection.update_package_version","agent.source_location.city","agent.source_location.country","agent.source_location.country_iso","agent.source_location.continent","agent.source_location.time_zone","agent.source_location.postal_code","agent.source_location.subdivisions","agent.source_location.anonymous_proxy","agent.serial_number","protection_status","stats.assets.vulnerabilities_found","stats.assets.os_patches_available","stats.assets.last_scanned_at","stats.app_block_count","connected","agent.plugins.browser_phishing_protection.plugin_version"]}}}},"endpoints":{"type":"array","title":"Endpoints IDs","items":{"type":"object","title":"Explicit list of endpoints","required":["id","account_id"],"properties":{"id":{"type":"string","title":"ID of the endpoint (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"account_id":{"type":"string","title":"Account to which the endpoint belongs (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}},"groups":{"type":"array","title":"List of queries","items":{"type":"object","title":"List of queries to fetch endpoints","allOf":[{"type":"object","title":"Search endpoints request. Leading wildcards are not supported for constraint fields without '.keyword' suffix.","required":["account_ids"],"properties":{"has_alerts":{"type":"boolean","title":"Indicates whether the endpoint needs attention"},"name_multi_search":{"type":"string","title":"Search either alias, host name of fully qualified host name"},"alerts.codes":{"type":"string","title":"Alert codes"},"is_software_update_available":{"type":"boolean","title":"Indicates whether the agent has an available update"},"protection_status":{"type":"string","title":"Protection status of the endpoint(s)","pattern":"(^$|protected|scan_only|unprotected|unknown|pending|mobile_protection)"},"is_isolated":{"type":"boolean","title":"Indicates whether the endpoints are isolated or not"},"suspicious_activity_found":{"type":"boolean","title":"Filter the search to the endpoints that have open suspicious activities"},"reboot_required":{"type":"boolean","title":"Filter the search to the endpoints needing a reboot"},"infection_found":{"type":"boolean","title":"Filter the search to the endpoints with one or more security threats found"},"policy_id":{"type":"string","title":"Filter the search to the endpoints with specified policy (id)"},"policy_name":{"type":"string","title":"Filter the search to the endpoints with specified policy (name)"},"policy_etag":{"type":"string","title":"Filter the search to the endpoints with specified policy etag"},"domain_name":{"type":"string","title":"Filter the search to the endpoints with specified domain name"},"engine_version":{"type":"string","title":"Filter the search to the endpoints with specified engine version"},"last_user":{"type":"string","title":"Last user that logged into the machine"},"last_user.keyword":{"type":"string","title":"Last user that logged into the machine (exact match). This 'contains' type search will look for the exact match anywhere in the field."},"alias":{"type":"string","title":"Aliases for the machine"},"plugins.siem.reboot_reason":{"type":"string","title":"Filter the search to the endpoints with specified reboot reason, as reported by the SIEM plugin"},"plugins.siem.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified SIEM plugin version"},"plugins.siem.alerts.codes":{"type":"string","title":"Filter the search to the endpoints with specified SIEM alerts"},"plugins.browser_phishing_protection.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified Browser Phishing Protection plugin version"},"plugins.browser_phishing_protection.alerts.codes":{"type":"string","title":"Filter the search to the endpoints with specified Browser Phishing Protection alerts"},"plugins.incident_response.reboot_reason":{"type":"string","title":"Filter the search to the endpoints with specified reboot reason, as reported by IR plugin"},"plugins.incident_response.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified IR plugin version"},"plugins.incident_response.alerts.codes":{"type":"string","title":"Filter the search to the endpoints with specified IR plugin alerts"},"plugins.endpoint_detection_and_response.reboot_reason":{"type":"string","title":"Filter the search to the endpoints with specified reboot reason, as reported by EDR plugin"},"plugins.endpoint_detection_and_response.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified EDR plugin version"},"plugins.endpoint_detection_and_response.alerts.codes":{"type":"string","title":"Filter the search to the endpoints with specified EDR plugin alerts"},"plugins.endpoint_protection.reboot_reason":{"type":"string","title":"Filter the search to the endpoints with specified reboot reason, as reported by EP plugin"},"plugins.endpoint_protection.update_package_version":{"type":"string","title":"Filter the search to the endpoints with specified EP update package version"},"plugins.endpoint_protection.component_package_version":{"type":"string","title":"Filter the search to the endpoints with specified EP component package version"},"plugins.endpoint_protection.sdk_version":{"type":"string","title":"Filter the search to the endpoints with specified EP SDK version"},"plugins.endpoint_protection.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified EP plugin version"},"plugins.endpoint_protection.alerts.codes":{"type":"string","title":"Filter the search to the endpoints with specified EP plugin alerts"},"plugins.asset_manager.reboot_reason":{"type":"string","title":"Filter the search to the endpoints with specified reboot reason, as reported by asset manager plugin"},"plugins.asset_manager.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified asset manager plugin version"},"plugins.asset_manager.alerts.codes":{"type":"string","title":"Filter the search to the endpoints with specified asset manager alerts"},"fully_qualified_host_name":{"type":"string","title":"Filter the search to the endpoints with specified, fully qualified host name"},"host_name":{"type":"string","title":"Filter the search to the endpoints with specified host name"},"os_info.os_release_name":{"type":"string","title":"Filter the search to the endpoints with specified release name of OS"},"os_info.os_release_name.keyword":{"type":"string","title":"Filter the search to the endpoints with specified release name of OS"},"os_info.os_architecture":{"type":"string","title":"Filter the search to the endpoints with specified OS architecture"},"os_info.os_platform":{"type":"string","title":"Filter the search to the endpoints with specified OS"},"os_info.os_version":{"type":"string","title":"Filter the search to the endpoints with specified OS version"},"os_info.os_type":{"type":"string","title":"Filter the search to the endpoints with specified OS type"},"nics.description":{"type":"string","title":"Filter the search to the endpoints with specified NICS description"},"nics.mac_address":{"type":"string","title":"Filter the search to the endpoints with specified NICS MAC address"},"nics.ips":{"type":"string","title":"Filter the search to the endpoints with specified ips"},"group_name.keyword":{"type":"string","title":"Filter the search to the endpoints belonging to the specified group's name. This 'contains' type search will look for the exact match anywhere in the field."},"policy_name.keyword":{"type":"string","title":"Filter the search to the endpoints assigned to the specified policy's name. This 'contains' type search will look for the exact match anywhere in the field."},"host_name.keyword":{"type":"string","title":"Filter the search to the endpoints that have the specified host's name. This 'contains' type search will look for the exact match anywhere in the field."},"fully_qualified_host_name.keyword":{"type":"string","title":"Filter the search to the endpoints that have the specified, fully_qualified_host's name. This 'contains' type search will look for the exact match anywhere in the field."},"engine_version.keyword":{"type":"string","title":"Filter the search by specified engine version."},"engine_version_gt":{"type":"string","title":"Filter the search by engine version greater than specified value."},"engine_version_gte":{"type":"string","title":"Filter the search by engine version greater than or equal to specified value."},"engine_version_lt":{"type":"string","title":"Filter the search by engine version less than specified value."},"engine_version_lte":{"type":"string","title":"Filter the search by engine version less than or equal to specified value."},"domain_name.keyword":{"type":"string","title":"Filter the search by domain name. This 'contains' type search will look for the exact match anywhere in the field."},"group_id":{"type":"string","title":"Filter the search by group id"},"group_name":{"type":"string","title":"Filter the search by group's name"},"source_location.city":{"type":"string","title":"Source location city filter"},"source_location.country":{"type":"string","title":"Source location country filter"},"source_location.country_iso":{"type":"string","title":"Source location country_iso filter"},"source_location.continent":{"type":"string","title":"Source location continent filter"},"source_location.time_zone":{"type":"string","title":"Source location time_zone filter"},"source_location.postal_code":{"type":"string","title":"Source location postal_code filter"},"source_location.subdivisions":{"type":"string","title":"Source location subdivisions filter"},"source_location.is_anonymous_proxy":{"type":"boolean","title":"Source location is_anonymous_proxy filter"},"machine_ip":{"type":"string","title":"machine_ip filter"},"serial_number":{"type":"string","title":"Serial number filter"},"serial_number.keyword":{"type":"string","title":"Serial number filter"},"object_guid":{"type":"string","title":"object_guid filter"},"is_deleted":{"type":"boolean","default":false,"nullable":true,"title":"is_deleted filter"},"vulnerabilities_found_total_gt":{"type":"number","title":"vulnerabilities_found_total_gt"},"vulnerabilities_found_total_lt":{"type":"number","title":"vulnerabilities_found_total_lt"},"vulnerabilities_found_total_gte":{"type":"number","title":"vulnerabilities_found_total_gte"},"vulnerabilities_found_total_lte":{"type":"number","title":"vulnerabilities_found_total_lte"},"connected":{"type":"boolean","title":"connected"},"sort_field":{"type":"string","title":"Sort field","enum":["at","nics.ips","nics.mac_address","nics.description","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","host_name","fully_qualified_host_name","plugins.asset_manager.plugin_version","plugins.asset_manager.reboot_reason","plugins.endpoint_protection.plugin_version","plugins.endpoint_protection.sdk_version","plugins.endpoint_protection.component_package_version","plugins.endpoint_protection.update_package_version","plugins.endpoint_protection.reboot_reason","plugins.endpoint_detection_and_response.plugin_version","plugins.endpoint_detection_and_response.reboot_reason","plugins.incident_response.plugin_version","plugins.incident_response.reboot_reason","plugins.siem.plugin_version","plugins.browser_phishing_protection.plugin_version","plugins.siem.reboot_reason","engine_version","domain_name","policy_etag","account_id","group_id","root_group_id","group_name","policy_name","policy_id","deleted_at","created_at","marked_for_deletion","is_deleted","last_day_seen","last_scanned_at","last_user","tags.alias","name_multi_search","machine_ip","serial_number","object_guid","vulnerabilities_found.critical","vulnerabilities_found.high","vulnerabilities_found.medium","vulnerabilities_found.low","vulnerabilities_found.none","vulnerabilities_found.total","os_patches_available","last_assets_scan_at","connected"]},"multi_sort":{"type":"array","title":"The multi_sort schema","items":{"type":"object","title":"Sort field and direction","properties":{"field":{"type":"string","title":"Sort field","enum":["at","nics.ips","nics.mac_address","nics.description","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","host_name","fully_qualified_host_name","plugins.asset_manager.plugin_version","plugins.asset_manager.reboot_reason","plugins.endpoint_protection.plugin_version","plugins.endpoint_protection.sdk_version","plugins.endpoint_protection.component_package_version","plugins.endpoint_protection.update_package_version","plugins.endpoint_protection.reboot_reason","plugins.endpoint_detection_and_response.plugin_version","plugins.endpoint_detection_and_response.reboot_reason","plugins.incident_response.plugin_version","plugins.incident_response.reboot_reason","plugins.siem.plugin_version","plugins.browser_phishing_protection.plugin_version","plugins.siem.reboot_reason","engine_version","domain_name","policy_etag","account_id","group_id","root_group_id","group_name","policy_name","policy_id","deleted_at","created_at","marked_for_deletion","is_deleted","last_day_seen","last_scanned_at","last_user","tags.alias","name_multi_search","machine_ip","serial_number","object_guid","vulnerabilities_found.critical","vulnerabilities_found.high","vulnerabilities_found.medium","vulnerabilities_found.low","vulnerabilities_found.none","vulnerabilities_found.total","os_patches_available","last_assets_scan_at","connected"]},"direction":{"type":"string","title":"Direction","enum":["asc","desc"]},"missing":{"type":"string","title":"Missing values sorting","enum":["_first","_last"]}}}},"populate":{"type":"object","title":"Specify whether you need to populate the server's response with additional data, like account info or last task","properties":{"last_job":{"type":"boolean","title":"The last_job data"},"account":{"type":"boolean","title":"The account data"},"platform":{"type":"boolean","title":"Specify the platform on OS release name aggregation"}}},"page_size":{"type":"number","title":"The page size. If you just need to aggregate, set it to 0","minimum":0,"maximum":2000},"aggregations":{"type":"array","title":"The fields onto which you can perform aggregations","default":[],"items":{"type":"string","title":"The Items Schema","enum":["has_alerts","infected","suspicious","scan_needed","reboot_required","check-in_status","isolated","protection_status","os_info.os_release_name","nics.ips","nics.mac_address","nics.description","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","host_name","fully_qualified_host_name","plugins.asset_manager.plugin_version","plugins.asset_manager.reboot_reason","plugins.asset_manager.alerts.codes","plugins.endpoint_protection.plugin_version","plugins.endpoint_protection.sdk_version","plugins.endpoint_protection.alerts.codes","plugins.endpoint_protection.component_package_version","plugins.endpoint_protection.update_package_version","plugins.endpoint_protection.reboot_reason","plugins.endpoint_detection_and_response.plugin_version","plugins.endpoint_detection_and_response.reboot_reason","plugins.endpoint_detection_and_response.alerts.codes","plugins.incident_response.plugin_version","plugins.incident_response.reboot_reason","plugins.incident_response.alerts.codes","plugins.siem.plugin_version","plugins.siem.reboot_reason","plugins.siem.alerts.codes","engine_version","domain_name","policy_etag","account_id","group_id","root_group_id","group_name","policy_name","policy_id","is_deleted","is_software_update_available","machine_ip","serial_number","object_guid"]}},"account_ids":{"type":"array","title":"The account_ids against which you want to run the search. This field is mandatory, and you need to explicitly set all the account_ids in which you want to search endpoints","items":{"type":"string","title":"The Items Schema (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}},"sort_order":{"type":"string","title":"Whether sorting should be ascending or descending","enum":["asc","desc"]},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]},"at_after":{"type":"string","title":"At after cursor (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"at_before":{"type":"string","title":"At before cursor (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"last_day_seen_before":{"type":"string","title":"ISO date string. Results include endpoints that have last connected before the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"last_scan_before":{"type":"string","title":"ISO date string. Results include endpoints that have been scanned before the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"last_scan_after":{"type":"string","title":"ISO date string. Results include endpoints that have been scanned after the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"last_day_seen_after":{"type":"string","title":"ISO date string. Results include endpoints that have last connected after the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"marked_for_deletion_after":{"type":"string","title":"ISO date string. Results include endpoints that have been marked for deletion after the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"marked_for_deletion_before":{"type":"string","title":"ISO date string. Results include endpoints that have been marked for deletion before the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"deleted_at_after":{"type":"string","title":"ISO date string. Results include endpoints that have been deleted after the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"deleted_at_before":{"type":"string","title":"ISO date string. Results include endpoints that have been deleted before the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"created_at_after":{"type":"string","title":"ISO date string. Results include endpoints that have been deleted after the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"created_at_before":{"type":"string","title":"ISO date string. Results include endpoints that have been deleted before the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"last_assets_scan_at_after":{"type":"string","title":"Last asset scan after cursor (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"last_assets_scan_at_before":{"type":"string","title":"Last asset scan before cursor (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"aggregate_by_account":{"type":"boolean","title":"Indicates whether aggregations should be scoped by account"}}}]}}}}}}},"responses":{"200":{"description":"Successful response"}},"tags":["Endpoints"],"operationId":"api.v2.rmm.post.export.async"}},"/oneview/v1/accounts/{account_id}/endpoints/{id}/agent_info":{"get":{"description":"Retrieve agent information of a given endpoint using its endpoint ID.","summary":"Get endpoint agent info","security":[{"client_credentials":["read"]},{"user_permissions":["endpoints.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":true,"in":"path","description":"Valid UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"account_id","required":false,"in":"path","description":"Valid account UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"The Get Agent Info of Endpoint Body 200 Schema","additionalProperties":true,"properties":{"nics":{"type":"array","title":"NICs","additionalItems":true,"items":{"type":"object","title":"NICs items","additionalProperties":true,"properties":{"ips":{"type":"array","title":"IPs schema","default":[],"examples":[["10.151.110.219"]],"additionalItems":true,"items":{"type":"string","title":"IP"}},"description":{"type":"string","title":"Description","examples":["Intel(R) 82574L Gigabit Network Connection"]},"mac_address":{"type":"string","title":"MAC address","examples":["000C29DD431E"]}}}},"os_info":{"type":"object","title":"OS info","default":{},"additionalProperties":true,"properties":{"os_type":{"type":"string","title":"OS type","examples":["Server"]},"os_version":{"type":"string","title":"OS version","examples":["10.0.14393"]},"os_platform":{"type":"string","title":"OS platform","examples":["Windows"]},"os_architecture":{"type":"string","title":"OS architecture","examples":["Amd64"]},"os_release_name":{"type":"string","title":"OS release name","examples":["Microsoft Windows Server 2016 Standard"]}}},"plugins":{"type":"array","title":"Plugins","default":[],"additionalItems":true,"items":{"type":"object","title":"Plugin items","default":{},"properties":{"product_name":{"type":"string","title":"Product name","examples":["Endpoint Detection and Response"]},"sdk_version":{"type":"string","title":"SDK version","examples":["3.7.1.2840"]},"plugin_version":{"type":"string","title":"Plugin version","examples":["1.2.0.289"]},"update_package_version":{"type":"string","title":"Update package version","examples":["3.1.4.1"]},"component_package_version":{"type":"string","title":"Component package version","examples":["1.0.545"]},"desktop_isolation":{"type":"string","title":"Desktop isolation","examples":["False"]},"network_isolation":{"type":"string","title":"Network isolation","examples":["False"]},"process_isolation":{"type":"string","title":"Process isolation"},"reboot_reasons":{"type":"integer","title":"Reboot reasons"},"medrnet_version":{"type":"string","title":"Medrnet version","examples":["1.13.0.0"]},"frcore_version":{"type":"string","title":"FR Core version","examples":["1.8.1.152"]},"alerts":{"type":"object","title":"Alerts","properties":{"codes":{"type":"array","items":{"type":"string"}}}}}}},"host_name":{"type":"string","title":"Host name","examples":["CJR-2016-RDS-ESXi"]},"last_user":{"type":"string","title":"last user","examples":["ONEVIEW\\ovadmin"]},"domain_name":{"type":"string","title":"Domain name","examples":["nebula.qa"]},"policy_etag":{"type":"string","title":"Policy etag","examples":["943695dd5fb09047802c6ddbf87883bf"]},"engine_version":{"type":"string","title":"Engine version","examples":["1.2.0.778"]},"dhcp_scope_name":{"type":"string","title":"DHCP scope name"},"fully_qualified_host_name":{"type":"string","title":"Fully qualified host name","examples":["CJR-2016-RDS-ESXi.nebula.qa"]},"last_seen_at":{"type":"string","title":"last seen at","examples":["2020-04-24T20:02:37.989756Z"]},"agent_info_last_updated_at":{"type":"string","title":"Agent info last updated at","examples":["2020-04-24T19:04:20.600724Z"]},"has_alerts":{"type":"boolean","title":"Indicates whether the endpoint needs attention"},"source_location":{"type":"object","properties":{"city":{"type":"string"},"country":{"type":"string"},"country_iso":{"type":"string"},"continent":{"type":"string"},"accuracy_radius":{"type":"integer"},"point":{"properties":{"lat":{"allOf":[{"bignumber":true},{"type":"number"}]},"lon":{"allOf":[{"bignumber":true},{"type":"number"}]}}},"time_zone":{"type":"string"},"postal_code":{"type":"string"},"subdivisions":{"type":"array","items":{"type":"string"}},"anonymous_proxy":{"type":"boolean"}}}}}}}}},"tags":["Endpoints"],"operationId":"api.v2.rmm.get.endpoint.id.agent_info"}},"/oneview/v1/accounts/{account_id}/endpoints/{id}/assets":{"get":{"description":"Retrieve asset information of a given endpoint using its endpoint ID.","summary":"Get endpoint assets","security":[{"client_credentials":["read"]},{"user_permissions":["endpoints.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":true,"in":"path","description":"Valid UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"account_id","required":false,"in":"path","description":"Valid account UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"title":"Get assets of an endpoint","type":"object","properties":{"startups":{"type":"array","title":"Startup programs","items":{"type":"object","properties":{"key":{"title":"Key","type":"string"},"name":{"title":"Name","type":"string"},"value":{"title":"Value","type":["string","null"]}}}},"os_info":{"type":"object","title":"Operating System info","properties":{"os_platform":{"type":"string","title":"OS platform"},"os_architecture":{"type":"string","title":"OS architecture"},"os_version":{"type":"string","title":"OS version"},"os_release_name":{"type":"string","title":"OS release name"},"os_type":{"type":"string","title":"OS type"}}},"memory":{"type":["object","null"],"title":"Memory","properties":{"total_virtual":{"type":"number","title":"Total virtual space"},"free_virtual":{"type":"number","title":"Free virtual space"},"total_physical":{"type":"number","title":"Total physical space"},"free_physical":{"type":"number","title":"Free physical space"}}},"computer_info":{"type":"object","title":"Computer info","properties":{"manufacturer":{"type":"string","title":"Manufacturer"},"model":{"type":"string","title":"Model"}}},"software_installed":{"type":"array","title":"Software installed","items":{"type":"object","properties":{"vendor":{"type":"string","title":"Vendor"},"product":{"type":"string","title":"Product"},"installed_date":{"type":["string","null"],"title":"Installed at date"},"version":{"type":"string","title":"Version"}}}},"nics":{"type":"array","title":"NICs","items":{"type":"object","properties":{"mac_address":{"type":"string","title":"MAC address"},"description":{"type":"string","title":"Description"},"ips":{"type":"array","title":"IPs","items":{"type":"string"}}}}},"drives":{"type":["array","null"],"title":"Drives","items":{"type":"object","properties":{"freespace_available":{"type":"number","title":"Available free space"},"volume_label":{"type":"string","title":"Volume label"},"drive_format":{"type":"string","title":"Drive format"},"freespace_total":{"type":"number","title":"Total of space free"},"name":{"type":"string","title":"Name"},"encryption":{"type":"integer","title":"Encryption","description":"0 = not encrypted, 1 = encrypted, 2 = error, undefined = unknown"},"total_size":{"type":"number","title":"Total size"}}}},"updates_installed":{"type":"array","title":"Updates installed","items":{"type":"object","properties":{"installed_date":{"type":["string","null"],"title":"Installed at data"},"title":{"type":"string","title":"Title"}}}},"domain_name":{"type":["string","null"],"title":"Domain name"},"culture":{"type":"string","title":"Culture"},"object_sid":{"type":["string","null"],"title":"SID of object"},"dhcp_scope_name":{"type":"string","title":"DJCP scope name"},"time_zone":{"type":"string","title":"Timezone"},"host_name":{"type":"string","title":"Host name"},"fully_qualified_host_name":{"type":"string","title":"Fully qualified hostname"},"object_guid":{"type":["string","null"],"title":"GUID of object"},"plugin_version":{"type":"string","title":"Plugin version"}}}}}}},"tags":["Endpoints"],"operationId":"api.v2.rmm.get.endpoint.id.assets"}},"/oneview/v1/accounts/{account_id}/endpoints/{id}/network":{"get":{"description":"Get network information about an endpoint using its endpoint ID.","summary":"Network information","security":[{"client_credentials":["read"]},{"user_permissions":["endpoints.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":true,"in":"path","description":"Valid UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"account_id","required":false,"in":"path","description":"Valid account UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Get network information about an endpoint.","properties":{"nics":{"type":"array","title":"The Nics Schema","items":{"type":"object","title":"The Items Schema","properties":{"ips":{"type":"array","title":"The Ips Schema","items":{"type":"string","title":"The IP addresses"}},"description":{"type":"string","title":"The Description of the nics"},"mac_address":{"type":"string","title":"The Mac address"}}}},"host_name":{"type":"string","title":"Host name"},"fully_qualified_host_name":{"type":"string","title":"Fully qualified host name"},"last_seen_at":{"type":"string","title":"The last time the endpoint checked in as online (max 1 per hour) (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^\\d{4}-[0-1]\\d-[0-3]\\d[(t|T)\\s](?:[0-2]\\d:[0-5]\\d:[0-5]\\d|23:59:60)(?:\\.\\d+)?(?:(z|Z)|[+-]\\d{2}:\\d{2})$","examples":["2020-03-23T17:23:17.860482Z"]},"agent_info_last_updated_at":{"type":"string","title":"Agent info last updated at (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^\\d{4}-[0-1]\\d-[0-3]\\d[(t|T)\\s](?:[0-2]\\d:[0-5]\\d:[0-5]\\d|23:59:60)(?:\\.\\d+)?(?:(z|Z)|[+-]\\d{2}:\\d{2})$","examples":["2020-03-23T17:23:17.860482Z"]}}}}}}},"tags":["Endpoints"],"operationId":"api.v2.rmm.get.endpoint.id.network"}},"/oneview/v1/accounts/{account_id}/endpoints/{id}/sa":{"get":{"description":"Fetch suspicious activity of an endpoint using its endpoint ID.","summary":"All suspicious activity of an endpoint","security":[{"client_credentials":["read"]},{"user_permissions":["edr.view"]}],"status":{"outage":["auth","edr"]},"parameters":[{"name":"id","required":true,"in":"path","description":"Valid UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}},{"name":"sort_field","required":false,"in":"query","description":"Sort field","schema":{"type":"string","enum":["timestamp","level","pc_hostname"]}},{"name":"sort_direction","required":false,"in":"query","description":"Sort direction","schema":{"type":"string","enum":["asc","desc"]}},{"name":"next_cursor","required":false,"in":"query","description":"The pagination cursor for next set of results. For further documentation, check Pagination section.","schema":{"type":"string"}},{"name":"since","required":false,"in":"query","description":"Since (Ex. \"2020-03-23T17:23:17.860482Z\")","schema":{"type":"string","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$"}},{"name":"per_page","required":false,"in":"query","description":"Items per page","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Suspicious activity of an endopint","required":["sa","total_count"],"properties":{"sa":{"type":"array","title":"Suspicious activity","items":{"type":"object","title":"Suspicious activity items","properties":{"detection_id_list":{"type":"array","title":"Suspicious activity IDs","items":{"type":"number"}},"status":{"type":"string","title":"Status"},"timestamp":{"type":"string","title":"Status"},"path":{"type":"string","title":"Path"},"pc_hostname":{"type":"string","title":"Hostname of endpoint"},"machine_id":{"type":"string","title":"Endpoint ID"},"account_id":{"type":"string","title":"Account ID"},"closed":{"type":"integer","title":"Closed"},"level":{"type":"integer","title":"Level"},"detected_by_count":{"type":"integer","title":"Count"}}}},"total_count":{"type":"integer","title":"Total Count","description":"Total count of results."},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}}}}},"tags":["Endpoints"],"operationId":"api.rmm.endpoint.id.sa"}},"/oneview/v1/accounts/{account_id}/endpoints/{id}/sa/{sa_id}/exclusions":{"get":{"description":"Fetch suspicious activity of an endpoint using the endpoint ID and suspicious activity ID.","summary":"Specific suspicious activity of an endpoint","security":[{"client_credentials":["read"]},{"user_permissions":["edr.view"]}],"status":{"outage":["auth","edr"]},"parameters":[{"name":"id","required":true,"in":"path","description":"Endpoint ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"sa_id","required":true,"in":"path","description":"Suspicious activity ID","schema":{"type":"string"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Exclusions for suspicious activity by endpoint","required":["data"],"properties":{"data":{"type":"array","title":"Exclusions","items":{"type":"object","title":"Exclusion","properties":{"path":{"type":"string","title":"Path"},"md5":{"type":"string","title":"MD5"},"command_line":{"type":"string","title":"command_line"}}}}}}}}}},"tags":["Endpoints"],"operationId":"api.rmm.endpoint.id.sa.id.exclusion"}},"/oneview/v1/accounts/{account_id}/endpoints/{id}/sa/{sa_id}/remediate":{"post":{"description":"Remediate suspicious activity of an endpoint using the endpoint ID and suspicious activity ID.","summary":"Remediate suspicious activity of an endpoint","security":[{"client_credentials":["read"]},{"user_permissions":["edr.manage"]}],"status":{"outage":["auth","edr"]},"parameters":[{"name":"id","required":true,"in":"path","description":"Endpoint ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"sa_id","required":true,"in":"path","description":"Suspicious activity ID","schema":{"type":"string"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"201":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"The eagle remediate schema","properties":{"job_id":{"type":["string","null"],"title":"ID of the remediation job (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"correlation_id":{"type":"string","title":"Correlation ID of the job (Parent job ID). Could be used to find related child jobs.","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}}}},"tags":["Endpoints"],"operationId":"api.rmm.endpoint.id.sa.sa_id.remediate"}},"/oneview/v1/accounts/{account_id}/endpoints/{id}/scans/{scan_id}":{"get":{"description":"Get a scan of an endpoint by ID.","summary":"Get a scan of an endpoint","security":[{"client_credentials":["read"]},{"user_permissions":["detections.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"account_id","required":true,"in":"path","description":"Valid Account UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"id","required":true,"in":"path","description":"Machine ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"scan_id","required":true,"in":"path","description":"Scan ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}},{"name":"populate_schedule_name","required":false,"in":"query","description":"Populate the schedule name","schema":{"type":"boolean"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"title":"The Get Endpoint By Id Scans By Id Body 200 Schema","type":"object","required":["id","machine_id","from_cloud","ondemand","scan_type","started_at","started_at_local","reported_at","duration_seconds","found_count","quarantined_count","deleted_count","total_count","metadata","machine_name","os_platform"],"additionalProperties":false,"properties":{"id":{"type":"string","title":"The Id Schema (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"machine_id":{"type":"string","title":"The Machine_id Schema(Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"schedule_id":{"type":["string","null"],"title":"The schedule_id Schema(Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"schedule_name":{"type":"string","title":"Schedule name (when populated)"},"from_cloud":{"type":"boolean","title":"The From_cloud Schema"},"ondemand":{"type":"boolean","title":"The Ondemand Schema"},"scan_type":{"type":"string","title":"The Scan_type Schema"},"started_at":{"type":"string","title":"The Started_at Schema (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^\\d{4}-[0-1]\\d-[0-3]\\d[(t|T)\\s](?:[0-2]\\d:[0-5]\\d:[0-5]\\d|23:59:60)(?:\\.\\d+)?(?:(z|Z)|[+-]\\d{2}:\\d{2})$","examples":["2020-03-23T17:23:17.860482Z"]},"started_at_local":{"type":"string","title":"The Started_at_local Schema (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^\\d{4}-[0-1]\\d-[0-3]\\d[(t|T)\\s](?:[0-2]\\d:[0-5]\\d:[0-5]\\d|23:59:60)(?:\\.\\d+)?(?:(z|Z)|[+-]\\d{2}:\\d{2})$","examples":["2020-03-23T17:23:17.860482Z"]},"reported_at":{"type":"string","title":"The Reported_at Schema (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^\\d{4}-[0-1]\\d-[0-3]\\d[(t|T)\\s](?:[0-2]\\d:[0-5]\\d:[0-5]\\d|23:59:60)(?:\\.\\d+)?(?:(z|Z)|[+-]\\d{2}:\\d{2})$","examples":["2020-03-23T17:23:17.860482Z"]},"duration_seconds":{"type":"integer","title":"The Duration_seconds Schema"},"found_count":{"type":"integer","title":"The Found_count Schema"},"quarantined_count":{"type":"integer","title":"The Quarantined_count Schema"},"deleted_count":{"type":"integer","title":"The Deleted_count Schema"},"total_count":{"type":"integer","title":"The Total_count Schema"},"metadata":{"type":"object","title":"The Metadata Schema","properties":{"id":{"type":"string","title":"The Id Schema"},"cpu":{"type":"string","title":"The Cpu Schema"},"foldersDetected":{"type":"integer","title":"The Foldersdetected Schema"},"componentsUpdatePackageVersion":{"type":"string","title":"The Componentsupdatepackageversion Schema"},"registryValuesDetected":{"type":"integer","title":"The Registryvaluesdetected Schema"},"schemaVersion":{"type":"integer","title":"The Schemaversion Schema"},"processesDetected":{"type":"integer","title":"The Processesdetected Schema"},"isUserAdmin":{"type":"boolean","title":"The Isuseradmin Schema"},"sourceDetails":{"type":"object","title":"The Sourcedetails Schema","properties":{"scanDurationSecs":{"type":"integer","title":"The Scandurationsecs Schema"},"scanOptions":{"type":"object","title":"The Scanoptions Schema","properties":{"scanMemoryObjects":{"type":"boolean","title":"The Scanmemoryobjects Schema"},"scanStartupAndRegistry":{"type":"boolean","title":"The Scanstartupandregistry Schema"},"scanRootKits":{"type":"boolean","title":"The Scanrootkits Schema"},"scanType":{"type":"string","title":"The Scantype Schema"},"scanPUMs":{"type":"boolean","title":"The Scanpums Schema"},"scanArchives":{"type":"boolean","title":"The Scanarchives Schema"},"scanFileSystem":{"type":"boolean","title":"The Scanfilesystem Schema"},"scanPUPs":{"type":"boolean","title":"The Scanpups Schema"},"useHeuristics":{"type":"boolean","title":"The Useheuristics Schema"}}},"objectsScanned":{"type":"integer","title":"The Objectsscanned Schema"},"scanResult":{"type":"string","title":"The Scanresult Schema"},"type":{"type":"string","title":"The Type Schema"}}},"fileSystem":{"type":"string","title":"The Filesystem Schema"},"dbSDKUpdatePackageVersion":{"type":"string","title":"The Dbsdkupdatepackageversion Schema"},"os":{"type":"string","title":"The Os Schema"},"detectionDateTime":{"type":"string","title":"The Detectiondatetime Schema (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^\\d{4}-[0-1]\\d-[0-3]\\d[(t|T)\\s](?:[0-2]\\d:[0-5]\\d:[0-5]\\d|23:59:60)(?:\\.\\d+)?(?:(z|Z)|[+-]\\d{2}:\\d{2})$","examples":["2020-03-23T17:23:17.860482Z"]},"modulesDetected":{"type":"integer","title":"The Modulesdetected Schema"},"licenseState":{"type":"string","title":"The Licensestate Schema"},"loggedOnUserName":{"type":"string","title":"The Loggedonusername Schema"},"filesDetected":{"type":"integer","title":"The Filesdetected Schema"},"registryKeysDetected":{"type":"integer","title":"The Registrykeysdetected Schema"},"applicationVersion":{"type":"string","title":"The Applicationversion Schema"}}},"machine_name":{"type":"string","title":"The Machine_name Schema"},"os_platform":{"type":"string","title":"The Os_platform Schema"},"devices":{"type":"object","title":"Device control related data"}}}}}}},"tags":["Endpoints"],"operationId":"api.rmm.get.endpoint.id.scans.id"}},"/oneview/v1/accounts/{account_id}/endpoints/{id}/scans":{"get":{"description":"Get a list of scans of an endpoint by its endpoint ID.","summary":"Get scans of an endpoint","security":[{"client_credentials":["read"]},{"user_permissions":["detections.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":true,"in":"path","description":"Valid UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"account_id","required":false,"in":"path","description":"Valid account UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}},{"name":"since","required":false,"in":"query","description":"The Since Schema (Ex. \"2020-03-23T17:23:17.860482Z\")","schema":{"type":"string","pattern":"^\\d{4}-[0-1]\\d-[0-3]\\d[(t|T)\\s](?:[0-2]\\d:[0-5]\\d:[0-5]\\d|23:59:60)(?:\\.\\d+)?(?:(z|Z)|[+-]\\d{2}:\\d{2})$"}},{"name":"threats_detected","required":false,"in":"query","description":"Optional parameter to filter out scan results based on whether threats were found. If omitted defaults to returning all.","schema":{"type":"string","enum":["true","false",""]}},{"name":"start_index","required":false,"in":"query","description":"The start index for pagination","schema":{"type":"string"}},{"name":"page_size","required":false,"in":"query","description":"The page size for pagination","schema":{"type":"string"}},{"name":"populate","required":false,"in":"query","schema":{"type":"string","pattern":"^schedules$"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"title":"The Get Endpoint By Id Scans Body 200 Schema","type":"array","items":{"type":"object","title":"The Items Schema","required":["id","deleted_count","duration_seconds","found_count","from_cloud","machine_id","machine_name","ondemand","os_platform","quarantined_count","reported_at","scan_type","started_at","started_at_local","total_count"],"additionalProperties":false,"properties":{"id":{"type":"string","title":"The Scan_id Schema (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"deleted_count":{"type":"integer","title":"The Deleted_count Schema"},"duration_seconds":{"type":"integer","title":"The Duration_seconds Schema"},"found_count":{"type":"integer","title":"The Found_count Schema"},"from_cloud":{"type":"boolean","title":"The From_cloud Schema"},"machine_id":{"type":"string","title":"The Machine_id Schema"},"machine_name":{"type":"string","title":"The Machine_name Schema"},"ondemand":{"type":"boolean","title":"The Ondemand Schema"},"os_platform":{"type":"string","title":"The Os_platform Schema"},"quarantined_count":{"type":"integer","title":"The Quarantined_count Schema"},"reported_at":{"type":"string","title":"The Reported_at Schema"},"scan_type":{"type":"string","title":"The Scan_type Schema"},"started_at":{"type":"string","title":"The Started_at Schema (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^\\d{4}-[0-1]\\d-[0-3]\\d[(t|T)\\s](?:[0-2]\\d:[0-5]\\d:[0-5]\\d|23:59:60)(?:\\.\\d+)?(?:(z|Z)|[+-]\\d{2}:\\d{2})$","examples":["2020-03-23T17:23:17.860482Z"]},"started_at_local":{"type":"string","title":"The Started_at_local Schema"},"total_count":{"type":"integer","title":"The Total_count Schema"},"schedule_id":{"type":"string","title":"The schedule ID. Present only if the scan is triggered by a schedule"},"schedule_name":{"type":"string","title":"The schedule name. Present only if the scan is triggered by a schedule and populate=schedule is sent in the request"},"job_id":{"type":"string","title":"The Job ID. Present only if the scan is triggered by a job"}}}}}}}},"tags":["Endpoints"],"operationId":"api.rmm.get.endpoint.id.scans"}},"/oneview/v1/accounts/{account_id}/endpoints/{id}/scans/{scan_id}/detections":{"get":{"description":"Get a list of detections of a scan of an endpoint.","summary":"Get the detections of a scan","security":[{"client_credentials":["read"]},{"user_permissions":["detections.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":false,"in":"path","description":"The Id Schema (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"scan_id","required":false,"in":"path","description":"The Scan_id Schema (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"account_id","required":false,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}},{"name":"next_cursor","required":false,"in":"query","description":"The pagination cursor for next set of results. For further documentation, check Pagination section.","schema":{"type":"string"}},{"name":"since","required":false,"in":"query","description":"The Since Schema (Ex. \"2020-03-23T17:23:17.860482Z\")","schema":{"type":"string","pattern":"^\\d{4}-[0-1]\\d-[0-3]\\d[(t|T)\\s](?:[0-2]\\d:[0-5]\\d:[0-5]\\d|23:59:60)(?:\\.\\d+)?(?:(z|Z)|[+-]\\d{2}:\\d{2})$"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"title":"The Get Endpoint By Id Scans By Id Detections Body 200 Schema","type":"object","required":["detections","total_count","next_cursor"],"properties":{"detections":{"type":"array","title":"The Threats Schema","items":{"type":"object","title":"The Items Schema","additionalProperties":true,"required":["id","scan_id","machine_id","machine_name","group_id","detection_id","scanned_at","scanned_at_local","reported_at","status","type","path","category","ip_address","url","port","affected_application","md5","process_name"],"properties":{"id":{"type":"string","title":"The Id Schema (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"scan_id":{"type":"string","title":"The Scan_id Schema (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"machine_id":{"type":"string","title":"The Machine_id Schema (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"machine_name":{"type":"string","title":"The Machine_name Schema"},"group_id":{"type":"string","title":"The Group_id Schema (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"detection_id":{"type":"string","title":"The Detection_id Schema (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"scanned_at":{"type":"string","title":"The Scanned_at Schema (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^\\d{4}-[0-1]\\d-[0-3]\\d[(t|T)\\s](?:[0-2]\\d:[0-5]\\d:[0-5]\\d|23:59:60)(?:\\.\\d+)?(?:(z|Z)|[+-]\\d{2}:\\d{2})$","examples":["2020-03-23T17:23:17.860482Z"]},"scanned_at_local":{"type":"string","title":"The Scanned_at_local Schema (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^\\d{4}-[0-1]\\d-[0-3]\\d[(t|T)\\s](?:[0-2]\\d:[0-5]\\d:[0-5]\\d|23:59:60)(?:\\.\\d+)?(?:(z|Z)|[+-]\\d{2}:\\d{2})$","examples":["2020-03-23T17:23:17.860482Z"]},"reported_at":{"type":"string","title":"The Reported_at Schema (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^\\d{4}-[0-1]\\d-[0-3]\\d[(t|T)\\s](?:[0-2]\\d:[0-5]\\d:[0-5]\\d|23:59:60)(?:\\.\\d+)?(?:(z|Z)|[+-]\\d{2}:\\d{2})$","examples":["2020-03-23T17:23:17.860482Z"]},"resource_created_at":{"type":"string","title":"The creation timestamp of the original quarantined file","format":"date-time"},"resource_modified_at":{"type":"string","title":"The modification timestamp of the original quarantined file","format":"date-time"},"status":{"type":"string","title":"The Status Schema"},"threat_name":{"type":"string","title":"The Threat_name Schema"},"type":{"type":"array","title":"The Type Schema","items":{"type":"string","title":"The Items Schema"}},"path":{"type":"string","title":"The Path Schema"},"category":{"type":"string","title":"The Category Schema"},"ip_address":{"type":"string","title":"The Ip_address Schema"},"url":{"type":"string","title":"The Url Schema","examples":["https://example.com"]},"port":{"type":"string","title":"The Port Schema"},"affected_application":{"type":"string","title":"The Affected_application Schema"},"md5":{"type":"string","title":"The Md5 Schema"},"process_name":{"type":"string","title":"The Process_name Schema"}}}},"total_count":{"type":"integer","title":"The Total_count Schema"},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}}}}},"tags":["Endpoints"],"operationId":"api.rmm.get.endpoint.id.scans.id.detections"}},"/oneview/v1/accounts/{account_id}/endpoints/{id}/status":{"get":{"description":"Get endpoint status by its ID","summary":"Endpoint status","security":[{"client_credentials":["read"]},{"user_permissions":["endpoints.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":true,"in":"path","description":"Valid UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"account_id","required":false,"in":"path","description":"Valid account UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"The Get Endpoint By Id Status Body 200 Schema","required":["remediation_required","reboot_required","suspicious_activity","isolation","scan_needed"],"properties":{"remediation_required":{"type":"object","title":"Whether this endpoint requires remediation","required":["status","infection_count"],"properties":{"status":{"type":"boolean","title":"True if it's infected"},"infection_count":{"type":"integer","title":"Number of threats detected"},"job_state":{"type":"integer","title":"State of the last job issued"}}},"reboot_required":{"type":"object","title":"The Reboot_required Schema","required":["status","reasons"],"properties":{"status":{"type":"boolean","title":"Status"},"reasons":{"type":"integer","title":"Reasons"},"job_id":{"type":"string","title":"Job ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"job_state":{"title":"Job state","type":"integer"}}},"suspicious_activity":{"type":"object","title":"Suspicious activity","required":["status","count"],"properties":{"status":{"type":"boolean","title":"Status"},"count":{"type":"integer","title":"Count"}}},"isolation":{"type":"object","title":"Isolation","required":["status","process","network","desktop"],"properties":{"status":{"type":"boolean","title":"Status"},"process":{"type":"boolean","title":"Process"},"network":{"type":"boolean","title":"Network"},"desktop":{"type":"boolean","title":"Desktop"}}},"scan_needed":{"type":"object","title":"Scan needed","required":["status","job_state"],"properties":{"status":{"type":"boolean","title":"Status"},"job_state":{"type":["null","string"],"title":"Job state"},"last_scanned_at":{"type":"string","title":"Last time scanned at (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^\\d{4}-[0-1]\\d-[0-3]\\d[(t|T)\\s](?:[0-2]\\d:[0-5]\\d:[0-5]\\d|23:59:60)(?:\\.\\d+)?(?:(z|Z)|[+-]\\d{2}:\\d{2})$","examples":["2020-03-23T17:23:17.860482Z"]}}}}}}}}},"tags":["Endpoints"],"operationId":"api.v2.rmm.get.endpoint.id.status"}},"/oneview/v1/accounts/{account_id}/endpoints/{id}/diag-log":{"get":{"description":"Generate a diagnostic log for an endpoint using its ID.","summary":"Generate a diagnostic log","security":[{"client_credentials":["read"]},{"user_permissions":["endpoints.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":true,"in":"path","description":"Valid UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"account_id","required":false,"in":"path","description":"Valid account UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Get Diagnostic Logs Response","properties":{"url":{"type":"string","description":"The URL to download the diagnostic logs"}}}}}}},"tags":["Endpoints"],"operationId":"api.rmm.get.endpoint.id.diag-log"}},"/oneview/v1/accounts/{account_id}/endpoints/{id}/quarantine":{"get":{"description":"Get quarantined items by the endpoint's ID","summary":"Get quarantined items","security":[{"client_credentials":["read"]},{"user_permissions":["detections.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":true,"in":"path","description":"Valid UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"account_id","required":false,"in":"path","description":"Valid account UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}},{"name":"next_cursor","required":false,"in":"query","description":"The pagination cursor for next set of results. For further documentation, check Pagination section.","schema":{"type":"string"}},{"name":"name","required":false,"in":"query","description":"Search with quarantine threat name.","schema":{"type":"string"}},{"name":"category","required":false,"in":"query","description":"Search with quarantine category.","schema":{"type":"string"}},{"name":"type","required":false,"in":"query","description":"Search with quarantine type","schema":{"type":"string"}},{"name":"since","required":false,"in":"query","description":"Timestamp to filter since quarantine scan times.","schema":{"type":"string"}},{"name":"until","required":false,"in":"query","description":"Timestamp to filter until quarantine scan times.","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"The get quearantines response","description":"Get quarantine for a given machine","examples":[{"quarantined_threats":[{"id":"957fc464-9ee1-473c-8f49-d89d2da1d5d8","scan_id":"00000000-0000-0000-0000-000000000000","machine_id":"0ac6eb75-3b3d-49ea-86ea-4349465d32bf","machine_name":"EndpointDetections","group_id":"999a0d78-a983-44fc-a302-995cdfb39da3","detection_id":"1491ac5b-60fc-439c-acd3-4e5e1881337f","scanned_at":"2020-05-20T13:21:21Z","scanned_at_local":"2020-05-20T13:21:21Z","reported_at":"2020-05-20T13:21:23.114719Z","threat_name":"ransomware.script","type":["file"],"path":"C:\\Deploy\\RealTime\\ransomware.exe","category":"arw","ip_address":"","url":"","port":""}],"total_count":1,"next_cursor":""}],"required":["quarantined_threats","total_count","next_cursor"],"properties":{"quarantined_threats":{"type":"array","title":"List of quearantine threats","description":"List of quarantined threats.","examples":[[{"id":"957fc464-9ee1-473c-8f49-d89d2da1d5d8","scan_id":"00000000-0000-0000-0000-000000000000","machine_id":"0ac6eb75-3b3d-49ea-86ea-4349465d32bf","machine_name":"EndpointDetections","group_id":"999a0d78-a983-44fc-a302-995cdfb39da3","detection_id":"1491ac5b-60fc-439c-acd3-4e5e1881337f","scanned_at":"2020-05-20T13:21:21Z","scanned_at_local":"2020-05-20T13:21:21Z","reported_at":"2020-05-20T13:21:23.114719Z","threat_name":"ransomware.script","type":["file"],"path":"C:\\Deploy\\RealTime\\ransomware.exe","category":"arw","ip_address":"","url":"","port":""}]],"items":{"type":"object","title":"Get detection by id","additionalProperties":true,"required":["id","scan_id","machine_id","detection_id","scanned_at","scanned_at_local","reported_at","status","type","path","category"],"properties":{"id":{"type":"string","title":"The ID of the detection (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"scan_id":{"type":"string","title":"Scan ID this detection belongs to (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"machine_id":{"type":"string","title":"Endpoint ID this detection belongs to (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"machine_name":{"type":"string","title":"Machine name"},"group_id":{"type":"string","title":"Group ID the endpoint has (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"group_name":{"type":"string","title":"Group name the endpoint has"},"policy_id":{"type":"string","title":"The ID of the policy associated to the machine where this detection happened (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"policy_name":{"type":"string","title":"Policy name"},"detection_id":{"type":"string","title":"Detection id from endpoint"},"scanned_at":{"type":"string","title":"Scanned at time (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^\\d{4}-[0-1]\\d-[0-3]\\d[(t|T)\\s](?:[0-2]\\d:[0-5]\\d:[0-5]\\d|23:59:60)(?:\\.\\d+)?(?:(z|Z)|[+-]\\d{2}:\\d{2})$","examples":["2020-03-23T17:23:17.860482Z"]},"scanned_at_local":{"type":"string","title":"Scanned at local time (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^\\d{4}-[0-1]\\d-[0-3]\\d[(t|T)\\s](?:[0-2]\\d:[0-5]\\d:[0-5]\\d|23:59:60)(?:\\.\\d+)?(?:(z|Z)|[+-]\\d{2}:\\d{2})$","examples":["2020-03-23T17:23:17.860482Z"]},"reported_at":{"type":"string","title":"Detection reported at time (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^\\d{4}-[0-1]\\d-[0-3]\\d[(t|T)\\s](?:[0-2]\\d:[0-5]\\d:[0-5]\\d|23:59:60)(?:\\.\\d+)?(?:(z|Z)|[+-]\\d{2}:\\d{2})$","examples":["2020-03-23T17:23:17.860482Z"]},"resource_created_at":{"type":"string","title":"The creation timestamp of the original quarantined file","format":"date-time"},"resource_modified_at":{"type":"string","title":"The modification timestamp of the original quarantined file","format":"date-time"},"status":{"type":"string","title":"Status"},"action_taken":{"type":"string","title":"Action Taken","examples":["unknown","failed","noActionByUser","quarantined","replaced","deleteOnReboot","replaceOnReboot","blocked","whitelisted","unquarantined"]},"threat_name":{"type":"string","title":"Threat name"},"type":{"type":"array","title":"Type","items":{"type":"string","title":"Items"}},"path":{"type":"string","title":"Path"},"category":{"type":"string","title":"Category"},"ip_address":{"type":"string","title":"IP address"},"url":{"type":"string","title":"Url"},"port":{"type":"string","title":"Port"},"affected_application":{"type":"string","title":"Affected application"},"md5":{"type":"string","title":"Md5"},"process_name":{"type":"string","title":"Process name"},"auto_removal_at":{"type":["string","null"],"title":"Automatic removal timestamp","description":"When the quarantined item will be automatically removed.","format":"date-time","examples":["2020-03-23T17:23:17.860482Z"]}}}},"total_count":{"type":"integer","title":"Total count of items","description":"Total count of items","default":0,"examples":[1]},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}}}}},"tags":["Endpoints"],"operationId":"api.rmm.get.quarantine"}},"/oneview/v1/accounts/{account_id}/endpoints/{id}/sa/{sa_id}/close":{"put":{"description":"Close suspicious activity of an endpoint by its endpoint ID and suspicious activity ID.","summary":"Close suspicious activity of an endpoint","security":[{"client_credentials":["read"]},{"user_permissions":["edr.manage"]}],"status":{"outage":["auth","edr"]},"parameters":[{"name":"id","required":true,"in":"path","description":"Endpoint ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"sa_id","required":true,"in":"path","description":"Suspicious activity ID","schema":{"type":"string"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"Successful response"}},"tags":["Endpoints"],"operationId":"api.rmm.get.endpoint.id.sa.sa_id.close"}},"/oneview/v1/accounts/{account_id}/endpoints/{id}/sa/{sa_id}/open":{"put":{"description":"Open suspicious activity of an endpoint by its endpoint ID and suspicious activity ID.","summary":"Open suspicious activity of an endpoint","security":[{"client_credentials":["read"]},{"user_permissions":["edr.manage"]}],"status":{"outage":["auth","edr"]},"parameters":[{"name":"id","required":true,"in":"path","description":"Endpoint ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"sa_id","required":true,"in":"path","description":"Suspicious activity ID","schema":{"type":"string"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"Successful response"}},"tags":["Endpoints"],"operationId":"api.rmm.get.endpoint.id.sa.sa_id.open"}},"/oneview/v1/accounts/{account_id}/endpoints/{id}/tags":{"put":{"description":"Add an alias to an endpoint by its id. To remove the alias, send an empty string","summary":"Set endpoint tags","security":[{"client_credentials":["write"]},{"user_permissions":["endpoints.performActions"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":true,"in":"path","description":"Valid UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"account_id","required":false,"in":"path","description":"Valid account UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Set endpoint tags","required":["alias"],"properties":{"alias":{"type":"string","title":"Alias name for the machine. Empty string to remove the alias"}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Search endpoints","required":["created_at","resource_id","tags"],"properties":{"created_at":{"type":"string","title":"When the alias was created"},"updated_at":{"type":"string","title":"When the alias was created"},"resource_id":{"type":"string","title":"Unique identifier for this resource"},"tags":{"type":"object","title":"Tags object","properties":{"alias":{"type":"string","title":"alias"}}}}}}}}},"tags":["Endpoints"],"operationId":"api.v2.nebula.rmm.endpoint.id.tags"}},"/oneview/v1/accounts/{account_id}/endpoints":{"post":{"description":"Search endpoints within an account. The search scopes to the account_id you specify in the URL. Constraints with the suffix `keyword` indicates an exact match. Constraints without the `keyword` suffix will be tokenized.\n\n### Examples\nIf you want to find endpoints belonging to the `Default group` (the search is case insensitive), use `group_name.keyword` as a constraint.\n```json\n{\n \"group_name.keyword\": \"default group\"\n}\n```\nAlternatively, if you want to find endpoints which group includes `department_one OR department_two`, use `group_name` as a constraint.\n```json\n{\n \"group_name\": \"department_one department_two department_three\"\n}\n```\n","summary":"Search endpoints","security":[{"client_credentials":["read"]},{"user_permissions":["endpoints.view"]}],"status":{"incident":["read_nebula_data","caching"],"outage":["auth","search_stateful"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Search accounts endpoints request","properties":{"is_software_update_available":{"type":"boolean","title":"Indicates whether the agent has an available update"},"has_alerts":{"type":"boolean","title":"Indicates whether the endpoint needs attention"},"protection_status":{"type":"string","title":"Protection status of the endpoint(s)","pattern":"(^$|protected|scan_only|unprotected|unknown|pending|mobile_protection)"},"is_isolated":{"type":"boolean","title":"Indicates whether the endpoints are isolated or not"},"suspicious_activity_found":{"type":"boolean","title":"Filter the search to the endpoints that have open suspicious activities"},"reboot_required":{"type":"boolean","title":"Filter the search to the endpoints needing a reboot"},"last_user":{"type":"string","title":"Last user that logged into the machine"},"last_user.keyword":{"type":"string","title":"Last user that logged into the machine (exact match)"},"alias":{"type":"string","title":"Aliases for the machine"},"infection_found":{"type":"boolean","title":"Filter the search to the endpoints with one or more security threats found"},"policy_id":{"type":"string","title":"Filter the search to the endpoints with specified policy (id)"},"policy_name":{"type":"string","title":"Filter the search to the endpoints with specified policy (name)"},"policy_etag":{"type":"string","title":"Filter the search to the endpoints with specified policy etag"},"domain_name":{"type":"string","title":"Filter the search to the endpoints with specified domain name"},"engine_version":{"type":"string","title":"Filter the search to the endpoints with specified engine version"},"plugins.siem.reboot_reason":{"type":"string","title":"Filter the search to the endpoints with specified reboot reason, as reported by the SIEM plugin"},"plugins.siem.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified SIEM plugin version"},"plugins.browser_phishing_protection.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified Browser Phishing Protection plugin version"},"plugins.incident_response.reboot_reason":{"type":"string","title":"Filter the search to the endpoints with specified reboot reason, as reported by IR plugin"},"plugins.incident_response.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified IR plugin version"},"plugins.endpoint_detection_and_response.reboot_reason":{"type":"string","title":"Filter the search to the endpoints with specified reboot reason, as reported by EDR plugin"},"plugins.endpoint_detection_and_response.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified EDR plugin version"},"plugins.endpoint_protection.reboot_reason":{"type":"string","title":"Filter the search to the endpoints with specified reboot reason, as reported by EP plugin"},"plugins.endpoint_protection.update_package_version":{"type":"string","title":"Filter the search to the endpoints with specified EP update package version"},"plugins.endpoint_protection.component_package_version":{"type":"string","title":"Filter the search to the endpoints with specified EP component package version"},"plugins.endpoint_protection.sdk_version":{"type":"string","title":"Filter the search to the endpoints with specified EP SDK version"},"plugins.endpoint_protection.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified EP plugin version"},"plugins.asset_manager.reboot_reason":{"type":"string","title":"Filter the search to the endpoints with specified reboot reason, as reported by asset manager plugin"},"plugins.asset_manager.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified asset manager plugin version"},"fully_qualified_host_name":{"type":"string","title":"Filter the search to the endpoints with specified, fully qualified host name"},"host_name":{"type":"string","title":"Filter the search to the endpoints with specified host name"},"os_info.os_release_name":{"type":"string","title":"Filter the search to the endpoints with specified release name of OS"},"os_info.os_architecture":{"type":"string","title":"Filter the search to the endpoints with specified OS architecture"},"os_info.os_platform":{"type":"string","title":"Filter the search to the endpoints with specified OS"},"os_info.os_version":{"type":"string","title":"Filter the search to the endpoints with specified OS version"},"os_info.os_type":{"type":"string","title":"Filter the search to the endpoints with specified OS type"},"nics.description":{"type":"string","title":"Filter the search to the endpoints with specified NICS description"},"nics.mac_address":{"type":"string","title":"Filter the search to the endpoints with specified NICS MAC address"},"nics.ips":{"type":"string","title":"Filter the search to the endpoints with specified ips"},"group_name.keyword":{"type":"string","title":"Filter the search to the endpoints belonging to the specified group's name"},"policy_name.keyword":{"type":"string","title":"Filter the search to the endpoints assigned to the specified policy's name"},"host_name.keyword":{"type":"string","title":"Filter the search to the endpoints that have the specified host's name"},"fully_qualified_host_name.keyword":{"type":"string","title":"Filter the search to the endpoints that have the specified, fully_qualified_host's name"},"engine_version.keyword":{"type":"string","title":"Filter the search by engine version"},"domain_name.keyword":{"type":"string","title":"Filter the search by domain name"},"group_id":{"type":"string","title":"Filter the search by group id"},"group_name":{"type":"string","title":"Filter the search by group's name"},"source_location.city":{"type":"string","title":"Source location city filter"},"source_location.country":{"type":"string","title":"Source location country filter"},"source_location.country_iso":{"type":"string","title":"Source location country_iso filter"},"source_location.continent":{"type":"string","title":"Source location continent filter"},"source_location.time_zone":{"type":"string","title":"Source location time_zone filter"},"source_location.postal_code":{"type":"string","title":"Source location postal_code filter"},"source_location.subdivisions":{"type":"string","title":"Source location subdivisions filter"},"source_location.is_anonymous_proxy":{"type":"boolean","title":"Source location is_anonymous_proxy filter"},"machine_ip":{"type":"string","title":"machine_ip filter"},"object_guid":{"type":"string","title":"object_guid filter"},"is_deleted":{"type":"boolean","default":false,"nullable":true,"title":"is_deleted filter"},"sort_field":{"type":"string","title":"Specify the field to use for sorting","enum":["group_id","group_name","at","nics.ips","nics.mac_address","nics.description","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","host_name","fully_qualified_host_name","plugins.asset_manager","plugins.asset_manager.plugin_version","plugins.asset_manager.reboot_reason","plugins.endpoint_protection.plugin_version","plugins.endpoint_protection.sdk_version","plugins.endpoint_protection.component_package_version","plugins.endpoint_protection.update_package_version","plugins.endpoint_protection.reboot_reason","plugins.endpoint_detection_and_response.plugin_version","plugins.endpoint_detection_and_response.reboot_reason","plugins.incident_response.plugin_version","plugins.incident_response.reboot_reason","plugins.siem.plugin_version","plugins.siem.reboot_reason","engine_version","domain_name","policy_etag","policy_name","policy_id","last_day_seen","name_multi_search","serial_number","machine_ip"]},"populate":{"type":"object","title":"Specify whether you need to populate the server's response with additional data, like account info or last task","properties":{"last_job":{"type":"boolean","title":"The last_job data"},"account":{"type":"boolean","title":"The account data"},"default_group":{"type":"boolean","title":"Specify if endpoint is in default group"}}},"page_size":{"type":"number","title":"The page size. If you just need to aggregate, set it to 0","minimum":0,"maximum":2000},"aggregations":{"type":"array","title":"The fields onto which you can perform aggregations","default":[],"items":{"type":"string","title":"The Items Schema","enum":["has_alerts","infected","suspicious","scan_needed","reboot_required","check-in_status","isolated","protection_status","os_info.os_release_name","nics.ips","nics.mac_address","nics.description","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","host_name","fully_qualified_host_name","plugins.asset_manager.plugin_version","plugins.asset_manager.reboot_reason","plugins.endpoint_protection.plugin_version","plugins.endpoint_protection.sdk_version","plugins.endpoint_protection.component_package_version","plugins.endpoint_protection.update_package_version","plugins.endpoint_protection.reboot_reason","plugins.endpoint_detection_and_response.plugin_version","plugins.endpoint_detection_and_response.reboot_reason","plugins.incident_response.plugin_version","plugins.incident_response.reboot_reason","plugins.siem.plugin_version","plugins.siem.reboot_reason","engine_version","domain_name","policy_etag","account_id","group_id","root_group_id","group_name","policy_name","policy_id","is_deleted","is_software_update_available","serial_number","machine_ip"]}},"sort_order":{"type":"string","title":"Whether sorting should be ascending or descending","enum":["asc","desc"]},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]},"at_after":{"type":"string","title":"At after cursor (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"at_before":{"type":"string","title":"At before cursor (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"last_day_seen_before":{"type":"string","title":"ISO date string. Results include endpoints that have last connected before the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"last_scan_before":{"type":"string","title":"ISO date string. Results include endpoints that have been scanned before the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"last_scan_after":{"type":"string","title":"ISO date string. Results include endpoints that have been scanned after the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"last_day_seen_after":{"type":"string","title":"ISO date string. Results include endpoints that have last connected after the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"marked_for_deletion_after":{"type":"string","title":"ISO date string. Results include endpoints that have been marked for deletion after the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"marked_for_deletion_before":{"type":"string","title":"ISO date string. Results include endpoints that have been marked for deletion before the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"deleted_at_after":{"type":"string","title":"ISO date string. Results include endpoints that have been deleted after the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"deleted_at_before":{"type":"string","title":"ISO date string. Results include endpoints that have been deleted before the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"aggregate_by_account":{"type":"boolean","title":"Indicates whether aggregations should be scoped by account"}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Search accounts endpoints response","required":["endpoints","total_count","next_cursor"],"properties":{"aggregations":{"type":"object","additionalProperties":true},"endpoints":{"type":"array","title":"Endpoints","items":{"type":"object","title":"Endpoint items","additionalProperties":true,"properties":{"link":{"type":"string","title":"Link"},"protection_status":{"type":"string","title":"Protection Status"},"display_name":{"type":"string","title":"Display Name"},"agent":{"type":"object","title":"Agent","additionalProperties":true,"properties":{"has_alerts":{"type":"boolean","title":"Indicates whether the endpoint needs attention"},"is_software_update_available":{"type":"boolean","title":"Indicates whether the agent has an available update"},"last_user":{"type":"string","title":"The last user logging in"},"at":{"type":"string","title":"Agent reported At"},"machine_id":{"type":"string","title":"Machine ID"},"account_id":{"type":"string","title":"Account ID"},"group_id":{"type":"string","title":"Group ID"},"nics":{"type":"array","title":"Nics","items":{"type":"object","title":"Nics items","properties":{"ips":{"type":"array","title":"Collection of IPs","items":{"type":"string","title":"IP"}},"description":{"type":"string","title":"Description"},"mac_address":{"type":"string","title":"Mac address"}}}},"os_info":{"type":"object","title":"Os info","properties":{"os_type":{"type":"string","title":"Os type"},"os_version":{"type":"string","title":"Os version"},"os_platform":{"type":"string","title":"Os platform"},"os_architecture":{"type":"string","title":"Os architecture"},"os_release_name":{"type":"string","title":"Os release name"}}},"domain_name":{"type":"string","title":"Domain name"},"host_name":{"type":"string","title":"Host name"},"fully_qualified_host_name":{"type":"string","title":"Fully qualified host name"},"plugins":{"type":"object","title":"Plugins","properties":{"incident_response":{"type":"object","title":"Incident response","properties":{"product_name":{"type":"string","title":"Product name"},"plugin_version":{"type":"string","title":"Plugin version"},"update_package_version":{"type":"string","title":"Update package version"},"component_package_version":{"type":"string","title":"Component package version"},"alerts":{"type":"object","properties":{"codes":{"type":"array","items":{"type":"string"}}}}}},"asset_manager":{"type":"object","title":"Asset manager","properties":{"product_name":{"type":"string","title":"Product name"},"plugin_version":{"type":"string","title":"Plugin version"},"alerts":{"type":"object","properties":{"codes":{"type":"array","items":{"type":"string"}}}}}},"endpoint_protection":{"type":"object","title":"Endpoint protection plugin","properties":{"sdk_version":{"type":"string","title":"SDK version plugin"},"product_name":{"type":"string","title":"Name of the product"},"plugin_version":{"type":"string","title":"Version of the product"},"update_package_version":{"type":"string","title":"Update version"},"component_package_version":{"type":"string","title":"Component version"},"alerts":{"type":"object","properties":{"codes":{"type":"array","items":{"type":"string"}}}}}},"endpoint_detection_and_response":{"type":"object","title":"Endpoint detection and response","properties":{"product_name":{"type":"string","title":"Product name"},"plugin_version":{"type":"string","title":"Plugin version"},"alerts":{"type":"object","properties":{"codes":{"type":"array","items":{"type":"string"}}}}}}}},"engine_version":{"type":"string","title":"Engine version"},"policy_etag":{"type":"string","title":"Policy etag"},"version":{"type":"integer","title":"Version"},"document_id":{"type":"string","title":"Document ID"},"machine_ip":{"type":"string","title":"Machine public IP"},"source_location":{"type":"object","properties":{"city":{"type":"string"},"country":{"type":"string"},"country_iso":{"type":"string"},"continent":{"type":"string"},"accuracy_radius":{"type":"integer"},"point":{"properties":{"lat":{"allOf":[{"bignumber":true},{"type":"number"}]},"lon":{"allOf":[{"bignumber":true},{"type":"number"}]}}},"time_zone":{"type":"string"},"postal_code":{"type":"string"},"subdivisions":{"type":"array","items":{"type":"string"}},"anonymous_proxy":{"type":"boolean"}}}}},"machine":{"type":"object","title":"Endpoint","additionalProperties":true,"properties":{"id":{"type":"string","title":"ID"},"job":{"type":"object","title":"Last job","additionalProperties":true},"account":{"type":"object","title":"Last job","additionalProperties":true},"online":{"type":"boolean","title":"Online"},"account_id":{"type":"string","title":"Account ID"},"group_id":{"type":"string","title":"Group ID"},"root_group_id":{"type":"string","title":"Root group ID"},"group_name":{"type":"string","title":"Group name"},"policy_id":{"type":"string","title":"Policy ID"},"policy_name":{"type":"string","title":"Policy name"},"last_day_seen":{"type":"string","title":"Last day seen"},"last_active":{"type":"string","title":"Last time the endpoint connected to Nebula in real time"},"isolated":{"type":"boolean","title":"Is isolated"},"scan_age_days":{"type":"integer","title":"Days from last scan"},"suspicious_activity_count":{"type":"integer","title":"Count of suspicious activities"},"infection_count":{"type":"integer","title":"Count of infections"},"reboot_required":{"type":"integer","title":"Is reboot required"},"last_scanned_at":{"type":"string","title":"Last scanned at"},"is_deleted":{"type":"boolean","title":"Is deleted"},"version":{"type":"integer","title":"Version"},"is_default_group":{"type":"boolean","title":"Default group (only when populated)"},"document_id":{"type":"string","title":"Document ID"}}},"machineVersion":{"type":"integer","title":"Machine version"}}}},"total_count":{"type":"integer","title":"Count"},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]},"after":{"type":"string","title":"After cursor"}}}}}}},"tags":["Endpoints"],"operationId":"api.v2.rmm.search.account.endpoints"}},"/oneview/v1/endpoints/search-groupby":{"post":{"description":"Search grouped endpoints","summary":"Search grouped endpoints","security":[{"client_credentials":["read"]},{"user_permissions":["endpoints.view"]}],"status":{"incident":["read_nebula_data"],"outage":["auth","search_stateful"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"The Post Endpoints Search GroupBy Request Schema","required":["group_by","page_size","account_ids"],"allOf":[{"type":"object","title":"Search endpoints request. Leading wildcards are not supported for constraint fields without '.keyword' suffix.","properties":{"name_multi_search":{"type":"string","title":"Search either alias, host name of fully qualified host name"},"machine_id":{"type":"string","title":"Filter the search to the endpoints with specified id"},"is_isolated":{"type":"boolean","title":"Indicates whether the endpoints are isolated or not"},"is_software_update_available":{"type":"boolean","title":"Indicates whether the agent has an available update"},"has_alerts":{"type":"boolean","title":"Indicates whether the endpoint needs attention"},"alerts.codes":{"type":"string","title":"Alert codes"},"suspicious_activity_found":{"type":"boolean","title":"Filter the search to the endpoints that have open suspicious activities"},"reboot_required":{"type":"boolean","title":"Filter the search to the endpoints needing a reboot"},"infection_found":{"type":"boolean","title":"Filter the search to the endpoints with one or more security threats found"},"policy_id":{"type":"string","title":"Filter the search to the endpoints with specified policy (id)"},"policy_name":{"type":"string","title":"Filter the search to the endpoints with specified policy (name)"},"policy_etag":{"type":"string","title":"Filter the search to the endpoints with specified policy etag"},"domain_name":{"type":"string","title":"Filter the search to the endpoints with specified domain name"},"engine_version":{"type":"string","title":"Filter the search to the endpoints with specified engine version"},"last_user":{"type":"string","title":"Last user that logged into the machine"},"last_user.keyword":{"type":"string","title":"Last user that logged into the machine (exact match). This 'contains' type search will look for the exact match anywhere in the field."},"alias":{"type":"string","title":"Aliases for the machine"},"plugins.siem.reboot_reason":{"type":"string","title":"Filter the search to the endpoints with specified reboot reason, as reported by the SIEM plugin"},"plugins.siem.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified SIEM plugin version"},"plugins.siem.alerts.codes":{"type":"string","title":"Filter the search to the endpoints with specified SIEM alerts"},"plugins.browser_phishing_protection.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified Browser Phishing Protection plugin version"},"plugins.browser_phishing_protection.alerts.codes":{"type":"string","title":"Filter the search to the endpoints with specified Browser Phishing Protection alerts"},"plugins.incident_response.reboot_reason":{"type":"string","title":"Filter the search to the endpoints with specified reboot reason, as reported by IR plugin"},"plugins.incident_response.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified IR plugin version"},"plugins.incident_response.alerts.codes":{"type":"string","title":"Filter the search to the endpoints with specified IR plugin alerts"},"plugins.endpoint_detection_and_response.reboot_reason":{"type":"string","title":"Filter the search to the endpoints with specified reboot reason, as reported by EDR plugin"},"plugins.endpoint_detection_and_response.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified EDR plugin version"},"plugins.endpoint_detection_and_response.alerts.codes":{"type":"string","title":"Filter the search to the endpoints with specified EDR plugin alerts"},"plugins.endpoint_protection.reboot_reason":{"type":"string","title":"Filter the search to the endpoints with specified reboot reason, as reported by EP plugin"},"plugins.endpoint_protection.update_package_version":{"type":"string","title":"Filter the search to the endpoints with specified EP update package version"},"plugins.endpoint_protection.update_package_version.keyword":{"type":"string","title":"Filter the search to the endpoints with wildcard EP update package version"},"plugins.endpoint_protection.component_package_version":{"type":"string","title":"Filter the search to the endpoints with specified EP component package version"},"plugins.endpoint_protection.sdk_version":{"type":"string","title":"Filter the search to the endpoints with specified EP SDK version"},"plugins.endpoint_protection.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified EP plugin version"},"plugins.endpoint_protection.alerts.codes":{"type":"string","title":"Filter the search to the endpoints with specified EP plugin alerts"},"plugins.asset_manager.reboot_reason":{"type":"string","title":"Filter the search to the endpoints with specified reboot reason, as reported by asset manager plugin"},"plugins.asset_manager.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified asset manager plugin version"},"plugins.asset_manager.alerts.codes":{"type":"string","title":"Filter the search to the endpoints with specified asset manager alerts"},"fully_qualified_host_name":{"type":"string","title":"Filter the search to the endpoints with specified, fully qualified host name"},"host_name":{"type":"string","title":"Filter the search to the endpoints with specified host name"},"os_info.os_release_name":{"type":"string","title":"Filter the search to the endpoints with specified release name of OS"},"os_info.os_release_name.keyword":{"type":"string","title":"Filter the search to the endpoints with specified release name of OS"},"os_info.os_architecture":{"type":"string","title":"Filter the search to the endpoints with specified OS architecture"},"os_info.os_platform":{"type":"string","title":"Filter the search to the endpoints with specified OS"},"os_info.os_version":{"type":"string","title":"Filter the search to the endpoints with specified OS version"},"os_info.os_type":{"type":"string","title":"Filter the search to the endpoints with specified OS type"},"nics.description":{"type":"string","title":"Filter the search to the endpoints with specified NICS description"},"nics.mac_address":{"type":"string","title":"Filter the search to the endpoints with specified NICS MAC address"},"nics.ips":{"type":"string","title":"Filter the search to the endpoints with specified ips"},"group_name.keyword":{"type":"string","title":"Filter the search to the endpoints belonging to the specified group's name. This 'contains' type search will look for the exact match anywhere in the field."},"policy_name.keyword":{"type":"string","title":"Filter the search to the endpoints assigned to the specified policy's name. This 'contains' type search will look for the exact match anywhere in the field."},"host_name.keyword":{"type":"string","title":"Filter the search to the endpoints that have the specified host's name. This 'contains' type search will look for the exact match anywhere in the field."},"fully_qualified_host_name.keyword":{"type":"string","title":"Filter the search to the endpoints that have the specified, fully_qualified_host's name. This 'contains' type search will look for the exact match anywhere in the field."},"engine_version.keyword":{"type":"string","title":"Filter the search by specified engine version."},"engine_version_gt":{"type":"string","title":"Filter the search by engine version greater than specified value."},"engine_version_gte":{"type":"string","title":"Filter the search by engine version greater than or equal to specified value."},"engine_version_lt":{"type":"string","title":"Filter the search by engine version less than specified value."},"engine_version_lte":{"type":"string","title":"Filter the search by engine version less than or equal to specified value."},"protection_status":{"type":"string","title":"Protection status of the endpoint(s)","pattern":"(^$|protected|scan_only|unprotected|unknown|pending|mobile_protection)"},"domain_name.keyword":{"type":"string","title":"Filter the search by domain name. This 'contains' type search will look for the exact match anywhere in the field."},"group_id":{"type":"string","title":"Filter the search by group id"},"group_name":{"type":"string","title":"Filter the search by group's name"},"source_location.city":{"type":"string","title":"Source location city filter"},"source_location.country":{"type":"string","title":"Source location country filter"},"source_location.country_iso":{"type":"string","title":"Source location country_iso filter"},"source_location.continent":{"type":"string","title":"Source location continent filter"},"source_location.time_zone":{"type":"string","title":"Source location time_zone filter"},"source_location.postal_code":{"type":"string","title":"Source location postal_code filter"},"source_location.subdivisions":{"type":"string","title":"Source location subdivisions filter"},"source_location.is_anonymous_proxy":{"type":"boolean","title":"Source location is_anonymous_proxy filter"},"machine_ip":{"type":"string","title":"machine_ip filter"},"serial_number":{"type":"string","title":"Serial number filter"},"serial_number.keyword":{"type":"string","title":"Serial number filter"},"object_guid":{"type":"string","title":"object_guid filter"},"is_deleted":{"type":"boolean","default":false,"nullable":true,"title":"is_deleted filter"},"vulnerabilities_found_total_gt":{"type":"number","title":"vulnerabilities_found_total_gt"},"vulnerabilities_found_total_lt":{"type":"number","title":"vulnerabilities_found_total_lt"},"vulnerabilities_found_total_gte":{"type":"number","title":"vulnerabilities_found_total_gte"},"vulnerabilities_found_total_lte":{"type":"number","title":"vulnerabilities_found_total_lte"},"connected":{"type":"boolean","title":"connected"},"sort_field":{"type":"string","title":"Sort field","enum":["at","nics.ips","nics.mac_address","nics.description","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","host_name","fully_qualified_host_name","plugins.asset_manager.plugin_version","plugins.asset_manager.reboot_reason","plugins.endpoint_protection.plugin_version","plugins.endpoint_protection.sdk_version","plugins.endpoint_protection.component_package_version","plugins.endpoint_protection.update_package_version","plugins.endpoint_protection.reboot_reason","plugins.endpoint_detection_and_response.plugin_version","plugins.endpoint_detection_and_response.reboot_reason","plugins.incident_response.plugin_version","plugins.incident_response.reboot_reason","plugins.siem.plugin_version","plugins.browser_phishing_protection.plugin_version","plugins.siem.reboot_reason","engine_version","domain_name","policy_etag","account_id","group_id","root_group_id","group_name","policy_name","policy_id","deleted_at","created_at","marked_for_deletion","is_deleted","last_day_seen","last_scanned_at","last_user","tags.alias","name_multi_search","machine_ip","serial_number","object_guid","vulnerabilities_found.critical","vulnerabilities_found.high","vulnerabilities_found.medium","vulnerabilities_found.low","vulnerabilities_found.none","vulnerabilities_found.total","os_patches_available","last_assets_scan_at","connected"]},"multi_sort":{"type":"array","title":"The multi_sort schema","items":{"type":"object","title":"Sort field and direction","properties":{"field":{"type":"string","title":"Sort field","enum":["at","nics.ips","nics.mac_address","nics.description","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","host_name","fully_qualified_host_name","plugins.asset_manager.plugin_version","plugins.asset_manager.reboot_reason","plugins.endpoint_protection.plugin_version","plugins.endpoint_protection.sdk_version","plugins.endpoint_protection.component_package_version","plugins.endpoint_protection.update_package_version","plugins.endpoint_protection.reboot_reason","plugins.endpoint_detection_and_response.plugin_version","plugins.endpoint_detection_and_response.reboot_reason","plugins.incident_response.plugin_version","plugins.incident_response.reboot_reason","plugins.siem.plugin_version","plugins.browser_phishing_protection.plugin_version","plugins.siem.reboot_reason","engine_version","domain_name","policy_etag","account_id","group_id","root_group_id","group_name","policy_name","policy_id","deleted_at","created_at","marked_for_deletion","is_deleted","last_day_seen","last_scanned_at","last_user","tags.alias","name_multi_search","machine_ip","serial_number","object_guid","vulnerabilities_found.critical","vulnerabilities_found.high","vulnerabilities_found.medium","vulnerabilities_found.low","vulnerabilities_found.none","vulnerabilities_found.total","os_patches_available","last_assets_scan_at","connected"]},"direction":{"type":"string","title":"Direction","enum":["asc","desc"]},"missing":{"type":"string","title":"Missing values sorting","enum":["_first","_last"]}}}},"populate":{"type":"object","title":"Specify whether you need to populate the server's response with additional data, like account info or last task","properties":{"last_job":{"type":"boolean","title":"The last_job data"},"account":{"type":"boolean","title":"The account data"},"default_group":{"type":"boolean","title":"Specify whether the group is default"},"app_block":{"type":"boolean","title":"Specify the number of app block activity"},"platform":{"type":"boolean","title":"Specify the platform on OS release name aggregation"}}},"page_size":{"type":"number","title":"The page size. If you just need to aggregate, set it to 0","minimum":0,"maximum":2000},"aggregations":{"type":"array","title":"The fields onto which you can perform aggregations","default":[],"items":{"type":"string","title":"The Items Schema","enum":["has_alerts","infected","suspicious","scan_needed","reboot_required","check-in_status","isolated","protection_status","os_info.os_release_name","nics.ips","nics.mac_address","nics.description","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","host_name","fully_qualified_host_name","plugins.asset_manager.plugin_version","plugins.asset_manager.reboot_reason","plugins.asset_manager.alerts.codes","plugins.endpoint_protection.plugin_version","plugins.endpoint_protection.sdk_version","plugins.endpoint_protection.alerts.codes","plugins.endpoint_protection.component_package_version","plugins.endpoint_protection.update_package_version","plugins.endpoint_protection.reboot_reason","plugins.endpoint_detection_and_response.plugin_version","plugins.endpoint_detection_and_response.reboot_reason","plugins.endpoint_detection_and_response.alerts.codes","plugins.incident_response.plugin_version","plugins.incident_response.reboot_reason","plugins.incident_response.alerts.codes","plugins.siem.plugin_version","plugins.siem.reboot_reason","plugins.siem.alerts.codes","engine_version","domain_name","policy_etag","account_id","group_id","root_group_id","group_name","policy_name","policy_id","is_deleted","is_software_update_available","machine_ip","object_guid","serial_number"]}},"sort_order":{"type":"string","title":"Whether sorting should be ascending or descending","enum":["asc","desc"]},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]},"at_after":{"type":"string","title":"At after cursor (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["1970-01-01T00:00:00Z"]},"at_before":{"type":"string","title":"At before cursor (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"last_day_seen_before":{"type":"string","title":"ISO date string. Results include endpoints that have last connected before the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"last_scan_before":{"type":"string","title":"ISO date string. Results include endpoints that have been scanned before the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"last_scan_after":{"type":"string","title":"ISO date string. Results include endpoints that have been scanned after the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"last_day_seen_after":{"type":"string","title":"ISO date string. Results include endpoints that have last connected after the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"marked_for_deletion_after":{"type":"string","title":"ISO date string. Results include endpoints that have been marked for deletion after the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"marked_for_deletion_before":{"type":"string","title":"ISO date string. Results include endpoints that have been marked for deletion before the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"deleted_at_after":{"type":"string","title":"ISO date string. Results include endpoints that have been deleted after the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"deleted_at_before":{"type":"string","title":"ISO date string. Results include endpoints that have been deleted before the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"created_at_after":{"type":"string","title":"ISO date string. Results include endpoints that have been deleted after the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"created_at_before":{"type":"string","title":"ISO date string. Results include endpoints that have been deleted before the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"last_assets_scan_at_after":{"type":"string","title":"Last asset scan after cursor (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"last_assets_scan_at_before":{"type":"string","title":"Last asset scan before cursor (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"app_block_count_after":{"type":"string","title":"Specify after which date to start app block activity count (Only when populate: {app_block: true} is set) (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"aggregate_by_account":{"type":"boolean","title":"Indicates whether aggregations should be scoped by account"}}}],"properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}},"group_by":{"type":"string","title":"The sort field Schema","enum":["os_info.os_platform","os_info.os_type","os_info.os_architecture","os_info.os_version","os_info.os_release_name","engine_version","policy_etag","account_id","group_id","root_group_id","policy_id","machine_ip","last_user","object_guid","plugins.endpoint_protection.sdk_version","plugins.endpoint_protection.component_package_version","plugins.endpoint_protection.update_package_version","serial_number","protection_status","plugins.browser_phishing_protection.plugin_version"]},"page_size":{"type":"number","title":"The page_size Schema","minimum":50,"maximum":2000},"account_cardinality":{"type":"boolean","title":"If specified, the number of accounts associated with each result value is displayed (works only with specific groupby-s). When grouping by engine_platform, grouping by os_platform is added by default"}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"The Post Endpoints Search GroupBy Response Schema","required":["results","next_cursor"],"properties":{"results":{"type":"array","title":"The Results Schema","default":[],"items":{"type":"object","title":"The Items Schema","required":["value","total"],"properties":{"value":{"type":["object","string"],"title":"The Value Schema"},"total":{"type":"integer","title":"The Total Schema"},"name":{"type":"string","title":"The Total Schema"}}}},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}}}}},"tags":["Endpoints"],"operationId":"api.rmm.search.endpoints.group"}},"/oneview/v1/accounts/{account_id}/events":{"get":{"description":"An event is a record of activity on your account, such as found a threat, completed a scan, or removed endpoint agent. Retrieve events associated with your account.","summary":"Retrieve events","security":[{"client_credentials":["read"]},{"user_permissions":["events.view","activityLogs.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}},{"name":"next_cursor","required":false,"in":"query","description":"The pagination cursor for next set of results. For further documentation, check Pagination section.","schema":{"type":"string"}},{"name":"search_string","required":false,"in":"query","description":"Search with events with event string.","schema":{"type":"string"}},{"name":"machine_id","required":false,"in":"query","description":"Search with machine_id","schema":{"type":"string"}},{"name":"start","required":false,"in":"query","description":"Timestamp to filter since event times.","schema":{"type":"string"}},{"name":"end","required":false,"in":"query","description":"Timestamp to filter until event times.","schema":{"type":"string"}},{"name":"severity_flags","required":false,"in":"query","description":"Filter with severity flag","schema":{"type":"number","enum":[0,1,2,4,8]}},{"name":"source","required":false,"in":"query","description":"Filter by event source","schema":{"type":"number","enum":[1,2,3,4,5,6]}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Collection of events","required":["events","total_count","next_cursor"],"properties":{"events":{"type":"array","title":"List of events","items":{"type":"object","additionalProperties":true,"title":"Event","properties":{"id":{"type":"string","title":"ID"},"machine_id":{"type":"string","title":"Endpoint ID"},"user_id":{"type":"string","title":"User ID"},"source":{"type":["integer","string"],"title":"Source"},"source_name":{"type":"string","title":"Source name"},"type":{"type":["integer","string"],"title":"Type"},"type_name":{"type":"string","title":"Type name"},"friendly_type":{"type":"string","title":"Friendly name of type"},"severity":{"type":["integer","string"],"title":"Severity"},"severity_name":{"type":"string","title":"Severity name"},"details":{"type":["object","array"],"additionalProperties":true,"title":"Details","properties":{"message":{"type":"string","title":"Message"},"filename":{"type":"string","title":"Filename"},"name":{"type":"string","title":"Name"},"user_email":{"type":"string","title":"User email"},"user_name":{"type":"string","title":"User name"},"user_role":{"type":"string","title":"User role"}}},"timestamp":{"type":"string","title":"Timestamp","examples":["2020-03-10T00:00:18.247444Z"]}}}},"total_count":{"type":"integer","title":"Total Count","description":"Total count of results."},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}}}}},"tags":["Events"],"operationId":"api.rmm.get.events"}},"/oneview/v1/exclusions":{"post":{"description":"Use this API endpoint to add exclusions.\n\n## Validation rules\n\n- type must be a number from the following list: 1, 2, 3, 4, 5, 6, 7, 8, 13, 14\n- exploit_protection can only be true if type is 13\n- ransomware_protection can only be true if type is 1 or 2\n- malware_protection can only be true if type is 1, 2, 4, or 5\n- website_protection can only be true if type is 6, 7, or 8\n- bruteforce_protection can only be true if type is 7\n- if type is 14, only suspicious_activity can and must be true\n- if account_level is false, then policy_ids must be an array of UUID(s)\n- value must be a valid domain or website (domain with protocol prefix) if type is 6\n- value must be a valid IP address if type is 7\n","summary":"Create exclusion","security":[{"client_credentials":["write"]},{"user_permissions":["exclusions.create"]}],"status":{"outage":["auth","ov"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"Payload for creating one exclusion","description":"Payload to send when creating a new exclusion.","examples":[{"exclusion_type":5,"exclusion_value":"something","policy_ids":["36376136326434342D613164382D346633622D616335662D623566383435323264303730","39313561336334612D333933382D343530332D623937332D613737643238623038613132"],"exploit_protection":false,"malware_protection":true,"ransomware_protection":false,"website_protection":false,"comment":"hello","suspicious_activity":false,"account_level":false,"enabled":true}],"required":["exclusion_value","exclusion_type","policy_ids","exploit_protection","malware_protection","ransomware_protection","website_protection","suspicious_activity","account_level","enabled","comment","etag"],"properties":{"exclusion_value":{"type":"string","title":"Value","description":"Value of this exclusion","default":"","examples":["string"]},"exclusion_type":{"type":"integer","title":"The exclusion_type schema","description":"1: Exclusion for file path, 2: Exclusion for folder path, 3: Exclusion for wildcard path, 4: Exclusion for registry, 5: Exclusion for file extensions, 6: Exclusion for web domain, 7: Exclusion for web IP, 8: Exclusion for Web Monitoring, 13: Exclusion for hash, 14: Exclusion for command line","default":1,"enum":[1,2,3,4,5,6,7,8,13,14],"examples":[1,2,3,4,5,6,7,8,13,14]},"policy_ids":{"type":"array","title":"Policies identifier","description":"If its not account level, specify policy to apply this exclusion to","examples":[["string"]],"items":{"type":"string"}},"exploit_protection":{"type":"boolean","title":"Exploit Protection","description":"Whether this exclusion applies for exploit protection.","default":false,"examples":[true]},"malware_protection":{"type":"boolean","title":"Malware Protection","description":"Whether this exclusion applies for malware protection.","default":false,"examples":[true]},"ransomware_protection":{"type":"boolean","title":"Ransomware Protection","description":"Whether this exclusion applies for ransomware protection.","default":false,"examples":[true]},"website_protection":{"type":"boolean","title":"Website protection","description":"Whether this exclusion applies for website protection.","default":false,"examples":[true]},"suspicious_activity":{"type":"boolean","title":"Suspicious activity","description":"Whether this exclusion applies for suspicious activity","default":false,"examples":[true]},"account_level":{"type":"boolean","title":"Account level","description":"Whether to apply this exclusion to all policies","default":true,"examples":[true]},"enabled":{"type":"boolean","title":"Enabled","description":"Boolean indicating whether this exclusion is enabled or not","default":false,"examples":[true]},"comment":{"type":"string","title":"Comment","description":"A comment about this exclusion","default":"","examples":["string"]},"etag":{"type":"string","title":"Update tag","description":"etags are identifiers that change on every update. Their use is to prevent race conditions when multiple clients are modifying the same resource. Supply this tag empty when creating a exclusion. When updating, you need to fetch the latest value by GETting an exclusion. You should always get the current etag before trying to modify a resource that has an etag property.","default":"","examples":[""]}},"if":{"properties":{"enabled":{"const":true}}},"then":{"errorMessage":"should have at least one apply protection property set to true","anyOf":[{"properties":{"exploit_protection":{"const":true}},"required":["exploit_protection"]},{"properties":{"malware_protection":{"const":true}},"required":["malware_protection"]},{"properties":{"ransomware_protection":{"const":true}},"required":["ransomware_protection"]},{"properties":{"website_protection":{"const":true}},"required":["website_protection"]},{"properties":{"suspicious_activity":{"const":true}},"required":["suspicious_activity"]}]},"errorMessage":{"if":"if enabled is true"}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"Properties of one exclusion","description":"Properties of one exclusion","additionalProperties":false,"examples":[{"exclusion_value":"exclude","exclusion_type":5,"policy_ids":["36376136326434342D613164382D346633622D616335662D623566383435323264303730","39313561336334612D333933382D343530332D623937332D613737643238623038613132"],"exploit_protection":false,"malware_protection":true,"ransomware_protection":false,"website_protection":false,"suspicious_activity":false,"account_level":false,"enabled":true,"comment":"hello","etag":"ebf2778dfcf61a83053160ce2bfeb6c5","exclusion_id":"61656333653261372D653539662D346666652D393239622D323465646236386266353332","updated_by":"rrais@yopmail.com","updated_at":"2020-05-26T11:14:54.302+0000","created_by":"rrais@yopmail.com","created_at":"2020-05-26T11:14:54.302+0000"}],"required":["exclusion_value","exclusion_type","policy_ids","exploit_protection","malware_protection","ransomware_protection","website_protection","suspicious_activity","account_level","enabled","comment","etag","exclusion_id","updated_at","created_at"],"properties":{"exclusion_value":{"type":"string","title":"Value","description":"Value of this exclusion","default":"","examples":["string"]},"exclusion_type":{"type":"integer","title":"The exclusion_type schema","description":"1: Exclusion for file path, 2: Exclusion for folder path, 3: Exclusion for wildcard path, 4: Exclusion for registry, 5: Exclusion for file extensions, 6: Exclusion for web domain, 7: Exclusion for web IP, 8: Exclusion for Web Monitoring, 13: Exclusion for hash, 14: Exclusion for command line","default":1,"enum":[1,2,3,4,5,6,7,8,13,14],"examples":[1]},"policy_ids":{"type":"array","title":"Policies identifier","description":"If its not account level, specify policy to apply this exclusion to","examples":[["string"]],"items":{"type":"string"}},"exploit_protection":{"type":"boolean","title":"Exploit Protection","description":"Whether this exclusion applies for exploit protection.","default":false,"examples":[true]},"malware_protection":{"type":"boolean","title":"Malware Protection","description":"Whether this exclusion applies for malware protection.","default":false,"examples":[true]},"ransomware_protection":{"type":"boolean","title":"Ransomware Protection","description":"Whether this exclusion applies for ransomware protection.","default":false,"examples":[true]},"website_protection":{"type":"boolean","title":"Website protection","description":"Whether this exclusion applies for website protection.","default":false,"examples":[true]},"suspicious_activity":{"type":"boolean","title":"Suspicious activity","description":"Whether this exclusion applies for suspicious activity","default":false,"examples":[true]},"account_level":{"type":"boolean","title":"Account level","description":"Whether to apply this exclusion to all policies","default":true,"examples":[true]},"enabled":{"type":"boolean","title":"Enabled","description":"Boolean indicating whether this exclusion is enabled or not","default":false,"examples":[true]},"comment":{"type":"string","title":"Comment","description":"A comment about this exclusion","default":"","examples":["string"]},"etag":{"type":"string","title":"Update tag","description":"etags are identifiers that change on every update. Their use is to prevent race conditions when multiple clients are modifying the same resource. Supply this tag empty when creating a exclusion. When updating, you need to fetch the latest value by GETting an exclusion. You should always get the current etag before trying to modify a resource that has an etag property.","default":"","examples":[""]},"exclusion_id":{"type":"string","title":"ID of the exclusion","description":"Use this identifier for REST operations.","default":"","examples":["61656333653261372D653539662D346666652D393239622D323465646236386266353332"]},"updated_at":{"type":["string","null"],"title":"Updated at","description":"Last time this exclusion was updated.","default":"","examples":["2020-05-26T11:14:54.302+0000"]},"created_at":{"type":["string","null"],"title":"Created at","description":"When this exclusion was created","default":"","examples":["2020-05-26T11:14:54.302+0000"]},"updated_by":{"type":["string","null"],"title":"Updated by","description":"Last user that updated the exclusion","default":""},"created_by":{"type":["string","null"],"title":"Created by","description":"User that created the exclusion","default":""},"updated_by_fullname":{"type":["string","null"],"title":"Updated by full name","description":"Last user full name that updated the exclusion","default":""},"created_by_fullname":{"type":["string","null"],"title":"Created by full name","description":"User full name that created the exclusion","default":""}}}}}}},"tags":["Exclusions"],"operationId":"api.v2.oneview.create.exclusion"},"get":{"description":"Get all exclusions","summary":"Get all exclusions","security":[{"client_credentials":["read"]},{"user_permissions":["exclusions.view"]}],"status":{"outage":["auth","ov"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"Exclusion response schema","description":"The expected response when getting all exclusions","properties":{"exclusions":{"type":"array","items":{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"Properties of one exclusion","description":"Properties of one exclusion","additionalProperties":false,"examples":[{"exclusion_value":"exclude","exclusion_type":5,"policy_ids":["36376136326434342D613164382D346633622D616335662D623566383435323264303730","39313561336334612D333933382D343530332D623937332D613737643238623038613132"],"exploit_protection":false,"malware_protection":true,"ransomware_protection":false,"website_protection":false,"suspicious_activity":false,"account_level":false,"enabled":true,"comment":"hello","etag":"ebf2778dfcf61a83053160ce2bfeb6c5","exclusion_id":"61656333653261372D653539662D346666652D393239622D323465646236386266353332","updated_by":"rrais@yopmail.com","updated_at":"2020-05-26T11:14:54.302+0000","created_by":"rrais@yopmail.com","created_at":"2020-05-26T11:14:54.302+0000"}],"required":["exclusion_value","exclusion_type","policy_ids","exploit_protection","malware_protection","ransomware_protection","website_protection","suspicious_activity","account_level","enabled","comment","etag","exclusion_id","updated_at","created_at"],"properties":{"exclusion_value":{"type":"string","title":"Value","description":"Value of this exclusion","default":"","examples":["string"]},"exclusion_type":{"type":"integer","title":"The exclusion_type schema","description":"1: Exclusion for file path, 2: Exclusion for folder path, 3: Exclusion for wildcard path, 4: Exclusion for registry, 5: Exclusion for file extensions, 6: Exclusion for web domain, 7: Exclusion for web IP, 8: Exclusion for Web Monitoring, 13: Exclusion for hash, 14: Exclusion for command line","default":1,"enum":[1,2,3,4,5,6,7,8,13,14],"examples":[1]},"policy_ids":{"type":"array","title":"Policies identifier","description":"If its not account level, specify policy to apply this exclusion to","examples":[["string"]],"items":{"type":"string"}},"exploit_protection":{"type":"boolean","title":"Exploit Protection","description":"Whether this exclusion applies for exploit protection.","default":false,"examples":[true]},"malware_protection":{"type":"boolean","title":"Malware Protection","description":"Whether this exclusion applies for malware protection.","default":false,"examples":[true]},"ransomware_protection":{"type":"boolean","title":"Ransomware Protection","description":"Whether this exclusion applies for ransomware protection.","default":false,"examples":[true]},"website_protection":{"type":"boolean","title":"Website protection","description":"Whether this exclusion applies for website protection.","default":false,"examples":[true]},"suspicious_activity":{"type":"boolean","title":"Suspicious activity","description":"Whether this exclusion applies for suspicious activity","default":false,"examples":[true]},"account_level":{"type":"boolean","title":"Account level","description":"Whether to apply this exclusion to all policies","default":true,"examples":[true]},"enabled":{"type":"boolean","title":"Enabled","description":"Boolean indicating whether this exclusion is enabled or not","default":false,"examples":[true]},"comment":{"type":"string","title":"Comment","description":"A comment about this exclusion","default":"","examples":["string"]},"etag":{"type":"string","title":"Update tag","description":"etags are identifiers that change on every update. Their use is to prevent race conditions when multiple clients are modifying the same resource. Supply this tag empty when creating a exclusion. When updating, you need to fetch the latest value by GETting an exclusion. You should always get the current etag before trying to modify a resource that has an etag property.","default":"","examples":[""]},"exclusion_id":{"type":"string","title":"ID of the exclusion","description":"Use this identifier for REST operations.","default":"","examples":["61656333653261372D653539662D346666652D393239622D323465646236386266353332"]},"updated_at":{"type":["string","null"],"title":"Updated at","description":"Last time this exclusion was updated.","default":"","examples":["2020-05-26T11:14:54.302+0000"]},"created_at":{"type":["string","null"],"title":"Created at","description":"When this exclusion was created","default":"","examples":["2020-05-26T11:14:54.302+0000"]},"updated_by":{"type":["string","null"],"title":"Updated by","description":"Last user that updated the exclusion","default":""},"created_by":{"type":["string","null"],"title":"Created by","description":"User that created the exclusion","default":""},"updated_by_fullname":{"type":["string","null"],"title":"Updated by full name","description":"Last user full name that updated the exclusion","default":""},"created_by_fullname":{"type":["string","null"],"title":"Created by full name","description":"User full name that created the exclusion","default":""}}}}}}}}}},"tags":["Exclusions"],"operationId":"api.v2.oneview.get-all.exclusions"}},"/oneview/v1/exclusions/{id}":{"delete":{"description":"Delete exclusion by the exclusion ID.","summary":"Delete exclusion","security":[{"client_credentials":["write"]},{"user_permissions":["exclusions.delete"]}],"status":{"outage":["auth","ov"]},"parameters":[{"name":"id","required":true,"in":"path","description":"Valid UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{},"tags":["Exclusions"],"operationId":"api.v2.oneview.delete.exclusion"},"get":{"description":"Get details of an exclusion by the exclusion ID","summary":"Get one exclusions","security":[{"client_credentials":["read"]},{"user_permissions":["exclusions.view"]}],"status":{"outage":["auth","ov"]},"parameters":[{"name":"id","required":true,"in":"path","description":"Valid UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"Properties of one exclusion","description":"Properties of one exclusion","additionalProperties":false,"examples":[{"exclusion_value":"exclude","exclusion_type":5,"policy_ids":["36376136326434342D613164382D346633622D616335662D623566383435323264303730","39313561336334612D333933382D343530332D623937332D613737643238623038613132"],"exploit_protection":false,"malware_protection":true,"ransomware_protection":false,"website_protection":false,"suspicious_activity":false,"account_level":false,"enabled":true,"comment":"hello","etag":"ebf2778dfcf61a83053160ce2bfeb6c5","exclusion_id":"61656333653261372D653539662D346666652D393239622D323465646236386266353332","updated_by":"rrais@yopmail.com","updated_at":"2020-05-26T11:14:54.302+0000","created_by":"rrais@yopmail.com","created_at":"2020-05-26T11:14:54.302+0000"}],"required":["exclusion_value","exclusion_type","policy_ids","exploit_protection","malware_protection","ransomware_protection","website_protection","suspicious_activity","account_level","enabled","comment","etag","exclusion_id","updated_at","created_at"],"properties":{"exclusion_value":{"type":"string","title":"Value","description":"Value of this exclusion","default":"","examples":["string"]},"exclusion_type":{"type":"integer","title":"The exclusion_type schema","description":"1: Exclusion for file path, 2: Exclusion for folder path, 3: Exclusion for wildcard path, 4: Exclusion for registry, 5: Exclusion for file extensions, 6: Exclusion for web domain, 7: Exclusion for web IP, 8: Exclusion for Web Monitoring, 13: Exclusion for hash, 14: Exclusion for command line","default":1,"enum":[1,2,3,4,5,6,7,8,13,14],"examples":[1]},"policy_ids":{"type":"array","title":"Policies identifier","description":"If its not account level, specify policy to apply this exclusion to","examples":[["string"]],"items":{"type":"string"}},"exploit_protection":{"type":"boolean","title":"Exploit Protection","description":"Whether this exclusion applies for exploit protection.","default":false,"examples":[true]},"malware_protection":{"type":"boolean","title":"Malware Protection","description":"Whether this exclusion applies for malware protection.","default":false,"examples":[true]},"ransomware_protection":{"type":"boolean","title":"Ransomware Protection","description":"Whether this exclusion applies for ransomware protection.","default":false,"examples":[true]},"website_protection":{"type":"boolean","title":"Website protection","description":"Whether this exclusion applies for website protection.","default":false,"examples":[true]},"suspicious_activity":{"type":"boolean","title":"Suspicious activity","description":"Whether this exclusion applies for suspicious activity","default":false,"examples":[true]},"account_level":{"type":"boolean","title":"Account level","description":"Whether to apply this exclusion to all policies","default":true,"examples":[true]},"enabled":{"type":"boolean","title":"Enabled","description":"Boolean indicating whether this exclusion is enabled or not","default":false,"examples":[true]},"comment":{"type":"string","title":"Comment","description":"A comment about this exclusion","default":"","examples":["string"]},"etag":{"type":"string","title":"Update tag","description":"etags are identifiers that change on every update. Their use is to prevent race conditions when multiple clients are modifying the same resource. Supply this tag empty when creating a exclusion. When updating, you need to fetch the latest value by GETting an exclusion. You should always get the current etag before trying to modify a resource that has an etag property.","default":"","examples":[""]},"exclusion_id":{"type":"string","title":"ID of the exclusion","description":"Use this identifier for REST operations.","default":"","examples":["61656333653261372D653539662D346666652D393239622D323465646236386266353332"]},"updated_at":{"type":["string","null"],"title":"Updated at","description":"Last time this exclusion was updated.","default":"","examples":["2020-05-26T11:14:54.302+0000"]},"created_at":{"type":["string","null"],"title":"Created at","description":"When this exclusion was created","default":"","examples":["2020-05-26T11:14:54.302+0000"]},"updated_by":{"type":["string","null"],"title":"Updated by","description":"Last user that updated the exclusion","default":""},"created_by":{"type":["string","null"],"title":"Created by","description":"User that created the exclusion","default":""},"updated_by_fullname":{"type":["string","null"],"title":"Updated by full name","description":"Last user full name that updated the exclusion","default":""},"created_by_fullname":{"type":["string","null"],"title":"Created by full name","description":"User full name that created the exclusion","default":""}}}}}}},"tags":["Exclusions"],"operationId":"api.v2.oneview.get.exclusion"},"put":{"description":"Update an exclusion by the exclusion ID","summary":"Update one exclusions","security":[{"client_credentials":["write"]},{"user_permissions":["exclusions.edit"]}],"status":{"outage":["auth","ov"]},"parameters":[{"name":"id","required":true,"in":"path","description":"Valid UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"Payload for creating one exclusion","description":"Payload to send when creating a new exclusion.","examples":[{"exclusion_type":5,"exclusion_value":"something","policy_ids":["36376136326434342D613164382D346633622D616335662D623566383435323264303730","39313561336334612D333933382D343530332D623937332D613737643238623038613132"],"exploit_protection":false,"malware_protection":true,"ransomware_protection":false,"website_protection":false,"comment":"hello","suspicious_activity":false,"account_level":false,"enabled":true}],"required":["exclusion_value","exclusion_type","policy_ids","exploit_protection","malware_protection","ransomware_protection","website_protection","suspicious_activity","account_level","enabled","comment","etag"],"properties":{"exclusion_value":{"type":"string","title":"Value","description":"Value of this exclusion","default":"","examples":["string"]},"exclusion_type":{"type":"integer","title":"The exclusion_type schema","description":"1: Exclusion for file path, 2: Exclusion for folder path, 3: Exclusion for wildcard path, 4: Exclusion for registry, 5: Exclusion for file extensions, 6: Exclusion for web domain, 7: Exclusion for web IP, 8: Exclusion for Web Monitoring, 13: Exclusion for hash, 14: Exclusion for command line","default":1,"enum":[1,2,3,4,5,6,7,8,13,14],"examples":[1,2,3,4,5,6,7,8,13,14]},"policy_ids":{"type":"array","title":"Policies identifier","description":"If its not account level, specify policy to apply this exclusion to","examples":[["string"]],"items":{"type":"string"}},"exploit_protection":{"type":"boolean","title":"Exploit Protection","description":"Whether this exclusion applies for exploit protection.","default":false,"examples":[true]},"malware_protection":{"type":"boolean","title":"Malware Protection","description":"Whether this exclusion applies for malware protection.","default":false,"examples":[true]},"ransomware_protection":{"type":"boolean","title":"Ransomware Protection","description":"Whether this exclusion applies for ransomware protection.","default":false,"examples":[true]},"website_protection":{"type":"boolean","title":"Website protection","description":"Whether this exclusion applies for website protection.","default":false,"examples":[true]},"suspicious_activity":{"type":"boolean","title":"Suspicious activity","description":"Whether this exclusion applies for suspicious activity","default":false,"examples":[true]},"account_level":{"type":"boolean","title":"Account level","description":"Whether to apply this exclusion to all policies","default":true,"examples":[true]},"enabled":{"type":"boolean","title":"Enabled","description":"Boolean indicating whether this exclusion is enabled or not","default":false,"examples":[true]},"comment":{"type":"string","title":"Comment","description":"A comment about this exclusion","default":"","examples":["string"]},"etag":{"type":"string","title":"Update tag","description":"etags are identifiers that change on every update. Their use is to prevent race conditions when multiple clients are modifying the same resource. Supply this tag empty when creating a exclusion. When updating, you need to fetch the latest value by GETting an exclusion. You should always get the current etag before trying to modify a resource that has an etag property.","default":"","examples":[""]}},"if":{"properties":{"enabled":{"const":true}}},"then":{"errorMessage":"should have at least one apply protection property set to true","anyOf":[{"properties":{"exploit_protection":{"const":true}},"required":["exploit_protection"]},{"properties":{"malware_protection":{"const":true}},"required":["malware_protection"]},{"properties":{"ransomware_protection":{"const":true}},"required":["ransomware_protection"]},{"properties":{"website_protection":{"const":true}},"required":["website_protection"]},{"properties":{"suspicious_activity":{"const":true}},"required":["suspicious_activity"]}]},"errorMessage":{"if":"if enabled is true"}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"Properties of one exclusion","description":"Properties of one exclusion","additionalProperties":false,"examples":[{"exclusion_value":"exclude","exclusion_type":5,"policy_ids":["36376136326434342D613164382D346633622D616335662D623566383435323264303730","39313561336334612D333933382D343530332D623937332D613737643238623038613132"],"exploit_protection":false,"malware_protection":true,"ransomware_protection":false,"website_protection":false,"suspicious_activity":false,"account_level":false,"enabled":true,"comment":"hello","etag":"ebf2778dfcf61a83053160ce2bfeb6c5","exclusion_id":"61656333653261372D653539662D346666652D393239622D323465646236386266353332","updated_by":"rrais@yopmail.com","updated_at":"2020-05-26T11:14:54.302+0000","created_by":"rrais@yopmail.com","created_at":"2020-05-26T11:14:54.302+0000"}],"required":["exclusion_value","exclusion_type","policy_ids","exploit_protection","malware_protection","ransomware_protection","website_protection","suspicious_activity","account_level","enabled","comment","etag","exclusion_id","updated_at","created_at"],"properties":{"exclusion_value":{"type":"string","title":"Value","description":"Value of this exclusion","default":"","examples":["string"]},"exclusion_type":{"type":"integer","title":"The exclusion_type schema","description":"1: Exclusion for file path, 2: Exclusion for folder path, 3: Exclusion for wildcard path, 4: Exclusion for registry, 5: Exclusion for file extensions, 6: Exclusion for web domain, 7: Exclusion for web IP, 8: Exclusion for Web Monitoring, 13: Exclusion for hash, 14: Exclusion for command line","default":1,"enum":[1,2,3,4,5,6,7,8,13,14],"examples":[1]},"policy_ids":{"type":"array","title":"Policies identifier","description":"If its not account level, specify policy to apply this exclusion to","examples":[["string"]],"items":{"type":"string"}},"exploit_protection":{"type":"boolean","title":"Exploit Protection","description":"Whether this exclusion applies for exploit protection.","default":false,"examples":[true]},"malware_protection":{"type":"boolean","title":"Malware Protection","description":"Whether this exclusion applies for malware protection.","default":false,"examples":[true]},"ransomware_protection":{"type":"boolean","title":"Ransomware Protection","description":"Whether this exclusion applies for ransomware protection.","default":false,"examples":[true]},"website_protection":{"type":"boolean","title":"Website protection","description":"Whether this exclusion applies for website protection.","default":false,"examples":[true]},"suspicious_activity":{"type":"boolean","title":"Suspicious activity","description":"Whether this exclusion applies for suspicious activity","default":false,"examples":[true]},"account_level":{"type":"boolean","title":"Account level","description":"Whether to apply this exclusion to all policies","default":true,"examples":[true]},"enabled":{"type":"boolean","title":"Enabled","description":"Boolean indicating whether this exclusion is enabled or not","default":false,"examples":[true]},"comment":{"type":"string","title":"Comment","description":"A comment about this exclusion","default":"","examples":["string"]},"etag":{"type":"string","title":"Update tag","description":"etags are identifiers that change on every update. Their use is to prevent race conditions when multiple clients are modifying the same resource. Supply this tag empty when creating a exclusion. When updating, you need to fetch the latest value by GETting an exclusion. You should always get the current etag before trying to modify a resource that has an etag property.","default":"","examples":[""]},"exclusion_id":{"type":"string","title":"ID of the exclusion","description":"Use this identifier for REST operations.","default":"","examples":["61656333653261372D653539662D346666652D393239622D323465646236386266353332"]},"updated_at":{"type":["string","null"],"title":"Updated at","description":"Last time this exclusion was updated.","default":"","examples":["2020-05-26T11:14:54.302+0000"]},"created_at":{"type":["string","null"],"title":"Created at","description":"When this exclusion was created","default":"","examples":["2020-05-26T11:14:54.302+0000"]},"updated_by":{"type":["string","null"],"title":"Updated by","description":"Last user that updated the exclusion","default":""},"created_by":{"type":["string","null"],"title":"Created by","description":"User that created the exclusion","default":""},"updated_by_fullname":{"type":["string","null"],"title":"Updated by full name","description":"Last user full name that updated the exclusion","default":""},"created_by_fullname":{"type":["string","null"],"title":"Created by full name","description":"User full name that created the exclusion","default":""}}}}}}},"tags":["Exclusions"],"operationId":"api.v2.oneview.update.exclusion"}},"/oneview/v1/accounts/{account_id}/groups/{id}":{"delete":{"description":"Delete group by the Group id.","summary":"Delete group by its id","security":[{"client_credentials":["write"]},{"user_permissions":["groups.delete"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":true,"in":"path","description":"ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"Successful response"}},"tags":["Groups"],"operationId":"api.rmm.delete.groups"},"get":{"description":"Get group by the Group id.","summary":"Get group by id","security":[{"client_credentials":["read"]},{"user_permissions":["groups.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":true,"in":"path","description":"ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Group","additionalProperties":true,"properties":{"id":{"type":"string","title":"The Id of the group"},"account_id":{"type":"string","title":"The account id to which this group belong"},"name":{"type":"string","title":"The neame of the group"},"machines_count":{"type":"integer","title":"Count of machines"},"policy_id":{"type":"string","title":"Policy id associated to the group"},"policy_name":{"type":"string","title":"Policy name"},"updated_at":{"type":"string","title":"Updated at","examples":["2017-04-06T20:26:07.345213Z"]},"is_default":{"type":"boolean","title":"Default"},"schedule_ids":{"type":"array","title":"Array of schedule ids","items":{"type":"string","title":"Schedule Id"}},"parent_id":{"type":"string","title":"Parent id"},"root_id":{"type":"string","title":"Root id"},"ou_object_id":{"type":["string","null"],"title":"Ou object id"},"child_group_count":{"type":"integer","title":"Child group count"}}}}}}},"tags":["Groups"],"operationId":"api.rmm.getbyid.groups"},"put":{"description":"Update group.","summary":"Update group","security":[{"client_credentials":["write"]},{"user_permissions":["groups.edit"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":true,"in":"path","description":"ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Group Save","description":"Payload for creating a group","required":["name","policy_id"],"properties":{"name":{"type":"string","title":"Name"},"policy_id":{"type":"string","title":"Policy Id","examples":["575ec9d1-9ade-4a2b-98cd-d6b5e5ea63d7"]},"parent_id":{"type":"string","title":"Parent Id","description":"Id of parent group."},"schedule_ids":{"type":"array","title":"Schedule IDs this group should be assigned to","description":"Schedule IDs this group should be assigned to","items":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","title":"The schedule ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Group","additionalProperties":true,"properties":{"id":{"type":"string","title":"The Id of the group"},"account_id":{"type":"string","title":"The account id to which this group belong"},"name":{"type":"string","title":"The neame of the group"},"machines_count":{"type":"integer","title":"Count of machines"},"policy_id":{"type":"string","title":"Policy id associated to the group"},"policy_name":{"type":"string","title":"Policy name"},"updated_at":{"type":"string","title":"Updated at","examples":["2017-04-06T20:26:07.345213Z"]},"is_default":{"type":"boolean","title":"Default"},"schedule_ids":{"type":"array","title":"Array of schedule ids","items":{"type":"string","title":"Schedule Id"}},"parent_id":{"type":"string","title":"Parent id"},"root_id":{"type":"string","title":"Root id"},"ou_object_id":{"type":["string","null"],"title":"Ou object id"},"child_group_count":{"type":"integer","title":"Child group count"}}}}}}},"tags":["Groups"],"operationId":"api.rmm.put.groups"}},"/oneview/v1/accounts/{account_id}/groups":{"get":{"description":"Get all groups in an account.","summary":"Get all groups","security":[{"client_credentials":["read"]},{"user_permissions":["groups.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}},{"name":"name","required":false,"in":"query","description":"Filter by group name","schema":{"type":"string"}},{"name":"parent_id","required":false,"in":"query","description":"For filtering by parent group ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"filter_by_parent_id","required":false,"in":"query","description":"Set this to 'true' when parent_id has been set.","schema":{"type":"string"}},{"name":"next_cursor","required":false,"in":"query","description":"The pagination cursor for next set of results. For further documentation, check Pagination section.","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Collection of groups","required":["groups","total_count","next_cursor"],"properties":{"groups":{"type":"array","title":"Groups","items":{"type":"object","title":"Group","additionalProperties":true,"properties":{"id":{"type":"string","title":"The Id of the group"},"account_id":{"type":"string","title":"The account id to which this group belong"},"name":{"type":"string","title":"The neame of the group"},"machines_count":{"type":"integer","title":"Count of machines"},"policy_id":{"type":"string","title":"Policy id associated to the group"},"policy_name":{"type":"string","title":"Policy name"},"updated_at":{"type":"string","title":"Updated at","examples":["2017-04-06T20:26:07.345213Z"]},"is_default":{"type":"boolean","title":"Default"},"schedule_ids":{"type":"array","title":"Array of schedule ids","items":{"type":"string","title":"Schedule Id"}},"parent_id":{"type":"string","title":"Parent id"},"root_id":{"type":"string","title":"Root id"},"ou_object_id":{"type":["string","null"],"title":"Ou object id"},"child_group_count":{"type":"integer","title":"Child group count"}}}},"total_count":{"type":"integer","title":"Total Count","description":"Total count of results."},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}}}}},"tags":["Groups"],"operationId":"api.rmm.get.groups"},"post":{"description":"Create group.","summary":"Create group","security":[{"client_credentials":["write"]},{"user_permissions":["groups.create"]}],"status":{"outage":["auth"]},"parameters":[{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Group Save","description":"Payload for creating a group","required":["name","policy_id"],"properties":{"name":{"type":"string","title":"Name"},"policy_id":{"type":"string","title":"Policy Id","examples":["575ec9d1-9ade-4a2b-98cd-d6b5e5ea63d7"]},"parent_id":{"type":"string","title":"Parent Id","description":"Id of parent group."},"schedule_ids":{"type":"array","title":"Schedule IDs this group should be assigned to","description":"Schedule IDs this group should be assigned to","items":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","title":"The schedule ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Group","additionalProperties":true,"properties":{"id":{"type":"string","title":"The Id of the group"},"account_id":{"type":"string","title":"The account id to which this group belong"},"name":{"type":"string","title":"The neame of the group"},"machines_count":{"type":"integer","title":"Count of machines"},"policy_id":{"type":"string","title":"Policy id associated to the group"},"policy_name":{"type":"string","title":"Policy name"},"updated_at":{"type":"string","title":"Updated at","examples":["2017-04-06T20:26:07.345213Z"]},"is_default":{"type":"boolean","title":"Default"},"schedule_ids":{"type":"array","title":"Array of schedule ids","items":{"type":"string","title":"Schedule Id"}},"parent_id":{"type":"string","title":"Parent id"},"root_id":{"type":"string","title":"Root id"},"ou_object_id":{"type":["string","null"],"title":"Ou object id"},"child_group_count":{"type":"integer","title":"Child group count"}}}}}}},"tags":["Groups"],"operationId":"api.rmm.post.groups"}},"/oneview/v1/accounts/groups":{"post":{"description":"Filter groups across accounts","summary":"Filter groups across accounts","security":[{"client_credentials":["read"]},{"user_permissions":["groups.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Filter groups for multiple account ids","required":["account_ids"],"properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}},"name":{"type":"string","title":"Filter by group name"},"parent_id":{"type":"string","title":"For filtering by parent group ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"filter_by_parent_id":{"type":"string","title":"Set this to 'true' when parent_id has been set.","examples":["true"]},"page_size":{"type":"number","title":"The size of the page","minimum":1,"default":100,"maximum":2000},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Get all groups for multiple account ids","examples":[{"groups":[{"id":"string","account_id":"string","name":"string","machines_count":0,"policy_id":"string","policy_name":"string","updated_at":"2017-04-06T20:26:07.345213Z","is_default":true,"schedule_ids":["string"],"parent_id":"string","root_id":"string","ou_object_id":null,"child_group_count":0}],"total_count":1}],"properties":{"groups":{"type":"array","title":"Groups","items":{"type":"object","title":"Group","additionalProperties":true,"properties":{"id":{"type":"string","title":"The Id of the group"},"account_id":{"type":"string","title":"The account id to which this group belong"},"name":{"type":"string","title":"The neame of the group"},"machines_count":{"type":"integer","title":"Count of machines"},"policy_id":{"type":"string","title":"Policy id associated to the group"},"policy_name":{"type":"string","title":"Policy name"},"updated_at":{"type":"string","title":"Updated at","examples":["2017-04-06T20:26:07.345213Z"]},"is_default":{"type":"boolean","title":"Default"},"schedule_ids":{"type":"array","title":"Array of schedule ids","items":{"type":"string","title":"Schedule Id"}},"parent_id":{"type":"string","title":"Parent id"},"root_id":{"type":"string","title":"Root id"},"ou_object_id":{"type":["string","null"],"title":"Ou object id"},"child_group_count":{"type":"integer","title":"Child group count"}}}},"total_count":{"type":"number","title":"Total count"},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}},"additionalProperties":false}}}}},"tags":["Groups"],"operationId":"api.v2.rmm.search.groups"}},"/oneview/v1/groups/{id}/machines":{"post":{"description":"Use this endpoint to move machines in a group.\nThis API endpoint allows you to specify queries instead of explicitly specifying endpoint ids. See example for more details.\n\nTo assign all your `Mac Os` endpoints across two of your manages sites to a group, and on all your endpoints for a certain account with policy matching the string `serious policy`, use the following body:\n\n```json\n \"groups\": [{ \n \"account_ids\": [\"\", \"\"],\n \"os_info.os_platform\": \"Mac Os\"\n }, {\n \"account_ids\": [\"\"],\n \"policy_name\": \"serious policy\" \n }]\n```\nThe constraints accepted are the same accepted by the search endpoints route. Refer to `POST -> /endpoints` for more information about the constraints accepted.\n\nYou can also send a mix of explicit endpoint ids and queries in the same request: \n```json\n \"endpoints\": [{ \"id\": \"\", \"account_id\": \"\" }],\n \"groups\": [{ \n \"account_ids\": [\"\", \"\"],\n \"os_info.os_platform\": \"Mac Os\"\n }, {\n \"account_ids\": [\"\"],\n \"policy_name\": \"serious policy\" \n }]\n```\n","summary":"Assign endpoints to a group across accounts","security":[{"client_credentials":["write"]},{"user_permissions":["endpoints.performActions"]}],"status":{"outage":["auth","search_stateful"]},"parameters":[{"name":"id","required":true,"in":"path","description":"Valid UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Update groups in bulks","required":["endpoints","groups"],"properties":{"endpoints":{"type":"array","title":"Endpoints","items":{"type":"object","title":"Endpoint items","required":["id","account_id"],"properties":{"id":{"type":"string","title":"machine id (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"account_id":{"type":"string","title":"account id (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}},"groups":{"type":"array","title":"Groups","items":{"type":"object","title":"List of queries to select endpoints","allOf":[{"type":"object","title":"Search endpoints request. Leading wildcards are not supported for constraint fields without '.keyword' suffix.","required":["account_ids"],"properties":{"has_alerts":{"type":"boolean","title":"Indicates whether the endpoint needs attention"},"name_multi_search":{"type":"string","title":"Search either alias, host name of fully qualified host name"},"alerts.codes":{"type":"string","title":"Alert codes"},"is_software_update_available":{"type":"boolean","title":"Indicates whether the agent has an available update"},"protection_status":{"type":"string","title":"Protection status of the endpoint(s)","pattern":"(^$|protected|scan_only|unprotected|unknown|pending|mobile_protection)"},"is_isolated":{"type":"boolean","title":"Indicates whether the endpoints are isolated or not"},"suspicious_activity_found":{"type":"boolean","title":"Filter the search to the endpoints that have open suspicious activities"},"reboot_required":{"type":"boolean","title":"Filter the search to the endpoints needing a reboot"},"infection_found":{"type":"boolean","title":"Filter the search to the endpoints with one or more security threats found"},"policy_id":{"type":"string","title":"Filter the search to the endpoints with specified policy (id)"},"policy_name":{"type":"string","title":"Filter the search to the endpoints with specified policy (name)"},"policy_etag":{"type":"string","title":"Filter the search to the endpoints with specified policy etag"},"domain_name":{"type":"string","title":"Filter the search to the endpoints with specified domain name"},"engine_version":{"type":"string","title":"Filter the search to the endpoints with specified engine version"},"last_user":{"type":"string","title":"Last user that logged into the machine"},"last_user.keyword":{"type":"string","title":"Last user that logged into the machine (exact match). This 'contains' type search will look for the exact match anywhere in the field."},"alias":{"type":"string","title":"Aliases for the machine"},"plugins.siem.reboot_reason":{"type":"string","title":"Filter the search to the endpoints with specified reboot reason, as reported by the SIEM plugin"},"plugins.siem.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified SIEM plugin version"},"plugins.siem.alerts.codes":{"type":"string","title":"Filter the search to the endpoints with specified SIEM alerts"},"plugins.browser_phishing_protection.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified Browser Phishing Protection plugin version"},"plugins.browser_phishing_protection.alerts.codes":{"type":"string","title":"Filter the search to the endpoints with specified Browser Phishing Protection alerts"},"plugins.incident_response.reboot_reason":{"type":"string","title":"Filter the search to the endpoints with specified reboot reason, as reported by IR plugin"},"plugins.incident_response.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified IR plugin version"},"plugins.incident_response.alerts.codes":{"type":"string","title":"Filter the search to the endpoints with specified IR plugin alerts"},"plugins.endpoint_detection_and_response.reboot_reason":{"type":"string","title":"Filter the search to the endpoints with specified reboot reason, as reported by EDR plugin"},"plugins.endpoint_detection_and_response.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified EDR plugin version"},"plugins.endpoint_detection_and_response.alerts.codes":{"type":"string","title":"Filter the search to the endpoints with specified EDR plugin alerts"},"plugins.endpoint_protection.reboot_reason":{"type":"string","title":"Filter the search to the endpoints with specified reboot reason, as reported by EP plugin"},"plugins.endpoint_protection.update_package_version":{"type":"string","title":"Filter the search to the endpoints with specified EP update package version"},"plugins.endpoint_protection.component_package_version":{"type":"string","title":"Filter the search to the endpoints with specified EP component package version"},"plugins.endpoint_protection.sdk_version":{"type":"string","title":"Filter the search to the endpoints with specified EP SDK version"},"plugins.endpoint_protection.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified EP plugin version"},"plugins.endpoint_protection.alerts.codes":{"type":"string","title":"Filter the search to the endpoints with specified EP plugin alerts"},"plugins.asset_manager.reboot_reason":{"type":"string","title":"Filter the search to the endpoints with specified reboot reason, as reported by asset manager plugin"},"plugins.asset_manager.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified asset manager plugin version"},"plugins.asset_manager.alerts.codes":{"type":"string","title":"Filter the search to the endpoints with specified asset manager alerts"},"fully_qualified_host_name":{"type":"string","title":"Filter the search to the endpoints with specified, fully qualified host name"},"host_name":{"type":"string","title":"Filter the search to the endpoints with specified host name"},"os_info.os_release_name":{"type":"string","title":"Filter the search to the endpoints with specified release name of OS"},"os_info.os_release_name.keyword":{"type":"string","title":"Filter the search to the endpoints with specified release name of OS"},"os_info.os_architecture":{"type":"string","title":"Filter the search to the endpoints with specified OS architecture"},"os_info.os_platform":{"type":"string","title":"Filter the search to the endpoints with specified OS"},"os_info.os_version":{"type":"string","title":"Filter the search to the endpoints with specified OS version"},"os_info.os_type":{"type":"string","title":"Filter the search to the endpoints with specified OS type"},"nics.description":{"type":"string","title":"Filter the search to the endpoints with specified NICS description"},"nics.mac_address":{"type":"string","title":"Filter the search to the endpoints with specified NICS MAC address"},"nics.ips":{"type":"string","title":"Filter the search to the endpoints with specified ips"},"group_name.keyword":{"type":"string","title":"Filter the search to the endpoints belonging to the specified group's name. This 'contains' type search will look for the exact match anywhere in the field."},"policy_name.keyword":{"type":"string","title":"Filter the search to the endpoints assigned to the specified policy's name. This 'contains' type search will look for the exact match anywhere in the field."},"host_name.keyword":{"type":"string","title":"Filter the search to the endpoints that have the specified host's name. This 'contains' type search will look for the exact match anywhere in the field."},"fully_qualified_host_name.keyword":{"type":"string","title":"Filter the search to the endpoints that have the specified, fully_qualified_host's name. This 'contains' type search will look for the exact match anywhere in the field."},"engine_version.keyword":{"type":"string","title":"Filter the search by specified engine version."},"engine_version_gt":{"type":"string","title":"Filter the search by engine version greater than specified value."},"engine_version_gte":{"type":"string","title":"Filter the search by engine version greater than or equal to specified value."},"engine_version_lt":{"type":"string","title":"Filter the search by engine version less than specified value."},"engine_version_lte":{"type":"string","title":"Filter the search by engine version less than or equal to specified value."},"domain_name.keyword":{"type":"string","title":"Filter the search by domain name. This 'contains' type search will look for the exact match anywhere in the field."},"group_id":{"type":"string","title":"Filter the search by group id"},"group_name":{"type":"string","title":"Filter the search by group's name"},"source_location.city":{"type":"string","title":"Source location city filter"},"source_location.country":{"type":"string","title":"Source location country filter"},"source_location.country_iso":{"type":"string","title":"Source location country_iso filter"},"source_location.continent":{"type":"string","title":"Source location continent filter"},"source_location.time_zone":{"type":"string","title":"Source location time_zone filter"},"source_location.postal_code":{"type":"string","title":"Source location postal_code filter"},"source_location.subdivisions":{"type":"string","title":"Source location subdivisions filter"},"source_location.is_anonymous_proxy":{"type":"boolean","title":"Source location is_anonymous_proxy filter"},"machine_ip":{"type":"string","title":"machine_ip filter"},"serial_number":{"type":"string","title":"Serial number filter"},"serial_number.keyword":{"type":"string","title":"Serial number filter"},"object_guid":{"type":"string","title":"object_guid filter"},"is_deleted":{"type":"boolean","default":false,"nullable":true,"title":"is_deleted filter"},"vulnerabilities_found_total_gt":{"type":"number","title":"vulnerabilities_found_total_gt"},"vulnerabilities_found_total_lt":{"type":"number","title":"vulnerabilities_found_total_lt"},"vulnerabilities_found_total_gte":{"type":"number","title":"vulnerabilities_found_total_gte"},"vulnerabilities_found_total_lte":{"type":"number","title":"vulnerabilities_found_total_lte"},"connected":{"type":"boolean","title":"connected"},"sort_field":{"type":"string","title":"Sort field","enum":["at","nics.ips","nics.mac_address","nics.description","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","host_name","fully_qualified_host_name","plugins.asset_manager.plugin_version","plugins.asset_manager.reboot_reason","plugins.endpoint_protection.plugin_version","plugins.endpoint_protection.sdk_version","plugins.endpoint_protection.component_package_version","plugins.endpoint_protection.update_package_version","plugins.endpoint_protection.reboot_reason","plugins.endpoint_detection_and_response.plugin_version","plugins.endpoint_detection_and_response.reboot_reason","plugins.incident_response.plugin_version","plugins.incident_response.reboot_reason","plugins.siem.plugin_version","plugins.browser_phishing_protection.plugin_version","plugins.siem.reboot_reason","engine_version","domain_name","policy_etag","account_id","group_id","root_group_id","group_name","policy_name","policy_id","deleted_at","created_at","marked_for_deletion","is_deleted","last_day_seen","last_scanned_at","last_user","tags.alias","name_multi_search","machine_ip","serial_number","object_guid","vulnerabilities_found.critical","vulnerabilities_found.high","vulnerabilities_found.medium","vulnerabilities_found.low","vulnerabilities_found.none","vulnerabilities_found.total","os_patches_available","last_assets_scan_at","connected"]},"multi_sort":{"type":"array","title":"The multi_sort schema","items":{"type":"object","title":"Sort field and direction","properties":{"field":{"type":"string","title":"Sort field","enum":["at","nics.ips","nics.mac_address","nics.description","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","host_name","fully_qualified_host_name","plugins.asset_manager.plugin_version","plugins.asset_manager.reboot_reason","plugins.endpoint_protection.plugin_version","plugins.endpoint_protection.sdk_version","plugins.endpoint_protection.component_package_version","plugins.endpoint_protection.update_package_version","plugins.endpoint_protection.reboot_reason","plugins.endpoint_detection_and_response.plugin_version","plugins.endpoint_detection_and_response.reboot_reason","plugins.incident_response.plugin_version","plugins.incident_response.reboot_reason","plugins.siem.plugin_version","plugins.browser_phishing_protection.plugin_version","plugins.siem.reboot_reason","engine_version","domain_name","policy_etag","account_id","group_id","root_group_id","group_name","policy_name","policy_id","deleted_at","created_at","marked_for_deletion","is_deleted","last_day_seen","last_scanned_at","last_user","tags.alias","name_multi_search","machine_ip","serial_number","object_guid","vulnerabilities_found.critical","vulnerabilities_found.high","vulnerabilities_found.medium","vulnerabilities_found.low","vulnerabilities_found.none","vulnerabilities_found.total","os_patches_available","last_assets_scan_at","connected"]},"direction":{"type":"string","title":"Direction","enum":["asc","desc"]},"missing":{"type":"string","title":"Missing values sorting","enum":["_first","_last"]}}}},"populate":{"type":"object","title":"Specify whether you need to populate the server's response with additional data, like account info or last task","properties":{"last_job":{"type":"boolean","title":"The last_job data"},"account":{"type":"boolean","title":"The account data"},"platform":{"type":"boolean","title":"Specify the platform on OS release name aggregation"}}},"page_size":{"type":"number","title":"The page size. If you just need to aggregate, set it to 0","minimum":0,"maximum":2000},"aggregations":{"type":"array","title":"The fields onto which you can perform aggregations","default":[],"items":{"type":"string","title":"The Items Schema","enum":["has_alerts","infected","suspicious","scan_needed","reboot_required","check-in_status","isolated","protection_status","os_info.os_release_name","nics.ips","nics.mac_address","nics.description","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","host_name","fully_qualified_host_name","plugins.asset_manager.plugin_version","plugins.asset_manager.reboot_reason","plugins.asset_manager.alerts.codes","plugins.endpoint_protection.plugin_version","plugins.endpoint_protection.sdk_version","plugins.endpoint_protection.alerts.codes","plugins.endpoint_protection.component_package_version","plugins.endpoint_protection.update_package_version","plugins.endpoint_protection.reboot_reason","plugins.endpoint_detection_and_response.plugin_version","plugins.endpoint_detection_and_response.reboot_reason","plugins.endpoint_detection_and_response.alerts.codes","plugins.incident_response.plugin_version","plugins.incident_response.reboot_reason","plugins.incident_response.alerts.codes","plugins.siem.plugin_version","plugins.siem.reboot_reason","plugins.siem.alerts.codes","engine_version","domain_name","policy_etag","account_id","group_id","root_group_id","group_name","policy_name","policy_id","is_deleted","is_software_update_available","machine_ip","serial_number","object_guid"]}},"account_ids":{"type":"array","title":"The account_ids against which you want to run the search. This field is mandatory, and you need to explicitly set all the account_ids in which you want to search endpoints","items":{"type":"string","title":"The Items Schema (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}},"sort_order":{"type":"string","title":"Whether sorting should be ascending or descending","enum":["asc","desc"]},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]},"at_after":{"type":"string","title":"At after cursor (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"at_before":{"type":"string","title":"At before cursor (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"last_day_seen_before":{"type":"string","title":"ISO date string. Results include endpoints that have last connected before the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"last_scan_before":{"type":"string","title":"ISO date string. Results include endpoints that have been scanned before the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"last_scan_after":{"type":"string","title":"ISO date string. Results include endpoints that have been scanned after the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"last_day_seen_after":{"type":"string","title":"ISO date string. Results include endpoints that have last connected after the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"marked_for_deletion_after":{"type":"string","title":"ISO date string. Results include endpoints that have been marked for deletion after the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"marked_for_deletion_before":{"type":"string","title":"ISO date string. Results include endpoints that have been marked for deletion before the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"deleted_at_after":{"type":"string","title":"ISO date string. Results include endpoints that have been deleted after the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"deleted_at_before":{"type":"string","title":"ISO date string. Results include endpoints that have been deleted before the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"created_at_after":{"type":"string","title":"ISO date string. Results include endpoints that have been deleted after the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"created_at_before":{"type":"string","title":"ISO date string. Results include endpoints that have been deleted before the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"last_assets_scan_at_after":{"type":"string","title":"Last asset scan after cursor (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"last_assets_scan_at_before":{"type":"string","title":"Last asset scan before cursor (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"aggregate_by_account":{"type":"boolean","title":"Indicates whether aggregations should be scoped by account"}}}]}}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"The Delete Endpoints Bulk Body 200 Schema","required":["moved"],"properties":{"moved":{"type":"array","title":"IDs of the deleted endpoint","items":{"type":"string","title":"Endpoint ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}},"errors":{"type":"array","title":"tasks not performed","items":{"type":"object","title":"Endpoint ID","additionalProperties":true,"properties":{"id":{"type":"string","title":"Machine ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"account_id":{"type":"string","title":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"account_ids":{"type":"array","title":"Account IDs","items":{"type":"string","title":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}}}}}}}},"tags":["Groups"],"operationId":"api.v2.rmm.post.groups.bulk"}},"/oneview/v1/accounts/{account_id}/installers":{"get":{"description":"Endpoint software can be installed in the following ways:\n\n- Active Directory (AD) Group Policy\n- System Center Configuration Manager (SCCM)\n- Third-party deployment tools\n- Manually on the endpoints\n- Discovery & Deployment Tool\n- Once the installation is complete, the endpoints display in the Nebula console.\n\nTo retrieve account-specific installers, use the following API endpoints. The response includes a download URL for all the available installers. These download URLs expire in one hour.\n\nThe available installers are:\n\n| Name | Description |\n| ----------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |\n| win_msi | This .msi installation package is lightweight. It includes the 32-bit Endpoint Agent, but does not include the .NET framework or other required software. |\n| x64_msi | This .msi installation package is lightweight. It includes the 64-bit Endpoint Agent, but does not include the .NET framework or other required software. |\n| ea2_arm_msi | This .msi installation package is for Windows ARM devices running Windows 11. It includes the ARM Endpoint Agent and .NET 8 runtime. |\n| ea2_x64_msi | This .msi installation package is for the Endpoint Agent version 2. It includes the 64-bit Endpoint Agent and .NET 8 runtime. |\n| ea2_x86_msi | This .msi installation package is for the Endpoint Agent version 2. It includes the 32-bit Endpoint Agent and .NET 8 runtime. |\n| mac_os | macOS 11 Big Sur to macOS 27 Golden Gate. This .pkg installer package includes the Endpoint Agent. |\n\nPlease note: the hash fields remain to not change the response, however they will be empty strings. This is due to a change in installer generation.\nIf you require the installer's hash, check the response header under 'x-amz-meta-x-checksum-sha256'.\nwin_full and win_web have been deprecated but will remain in the response.\n","summary":"Retrieve installers's links","security":[{"client_credentials":["read"]},{"user_permissions":["endpoints.install"]}],"status":{"outage":["auth"]},"parameters":[{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Get all installers for a managed nebula account","properties":{"win_msi":{"type":"object","title":"Details about the installer","properties":{"url":{"type":"string","title":"The Download URL. Will expire after 60 seconds"},"link":{"type":"string","title":"Non expirable download links"},"md5":{"type":"string","title":"Checksum"},"sha256":{"type":"string","title":"Checksum"},"version":{"type":"string","title":"The version of this installer"}}},"x64_msi":{"type":"object","title":"Details about the installer","properties":{"url":{"type":"string","title":"The Download URL. Will expire after 60 seconds"},"link":{"type":"string","title":"Non expirable download links"},"md5":{"type":"string","title":"Checksum"},"sha256":{"type":"string","title":"Checksum"},"version":{"type":"string","title":"The version of this installer"}}},"win_web":{"type":"object","title":"Details about the installer","properties":{"url":{"type":"string","title":"The Download URL. Will expire after 60 seconds"},"link":{"type":"string","title":"Non expirable download links"},"md5":{"type":"string","title":"Checksum"},"sha256":{"type":"string","title":"Checksum"},"version":{"type":"string","title":"The version of this installer"}}},"win_full":{"type":"object","title":"Details about the installer","properties":{"url":{"type":"string","title":"The Download URL. Will expire after 60 seconds"},"link":{"type":"string","title":"Non expirable download links"},"md5":{"type":"string","title":"Checksum"},"sha256":{"type":"string","title":"Checksum"},"version":{"type":"string","title":"The version of this installer"}}},"mac_os":{"type":"object","title":"Details about the installer","properties":{"url":{"type":"string","title":"The Download URL. Will expire after 60 seconds"},"link":{"type":"string","title":"Non expirable download links"},"md5":{"type":"string","title":"Checksum"},"sha256":{"type":"string","title":"Checksum"},"version":{"type":"string","title":"The version of this installer"}}},"ea2_arm_msi":{"type":"object","title":"Details about the installer","properties":{"url":{"type":"string","title":"The Download URL. Will expire after 60 seconds"},"link":{"type":"string","title":"Non expirable download links"},"md5":{"type":"string","title":"Checksum"},"sha256":{"type":"string","title":"Checksum"},"version":{"type":"string","title":"The version of this installer"}}},"ea2_x64_msi":{"type":"object","title":"Details about the installer","properties":{"url":{"type":"string","title":"The Download URL. Will expire after 60 seconds"},"link":{"type":"string","title":"Non expirable download links"},"md5":{"type":"string","title":"Checksum"},"sha256":{"type":"string","title":"Checksum"},"version":{"type":"string","title":"The version of this installer"}}},"ea2_x86_msi":{"type":"object","title":"Details about the installer","properties":{"url":{"type":"string","title":"The Download URL. Will expire after 60 seconds"},"link":{"type":"string","title":"Non expirable download links"},"md5":{"type":"string","title":"Checksum"},"sha256":{"type":"string","title":"Checksum"},"version":{"type":"string","title":"The version of this installer"}}},"ea2_legacy_x64_msi":{"type":"object","title":"Details about the installer","properties":{"url":{"type":"string","title":"The Download URL. Will expire after 60 seconds"},"link":{"type":"string","title":"Non expirable download links"},"md5":{"type":"string","title":"Checksum"},"sha256":{"type":"string","title":"Checksum"},"version":{"type":"string","title":"The version of this installer"}}},"ea2_legacy_x86_msi":{"type":"object","title":"Details about the installer","properties":{"url":{"type":"string","title":"The Download URL. Will expire after 60 seconds"},"link":{"type":"string","title":"Non expirable download links"},"md5":{"type":"string","title":"Checksum"},"sha256":{"type":"string","title":"Checksum"},"version":{"type":"string","title":"The version of this installer"}}}}}}}}},"tags":["Installers"],"operationId":"api.rmm.get.installers"}},"/oneview/v1/accounts/{account_id}/parent_jobs/{correlation_id}/children":{"delete":{"description":"Cancel children jobs by correlation ID across multiple accounts.","summary":"Cancel children jobs","security":[{"client_credentials":["execute"]},{"user_permissions":["tasks.manage"]}],"status":{"outage":["auth"]},"parameters":[{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"correlation_id","required":true,"in":"path","description":"Correlation ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Cancel children jobs request body.","properties":{"constraints":{"type":"array","title":"Child Jobs Constraints","items":{"title":"Child Jobs Constraints","type":"object","oneOf":[{"title":"String (Equals, Not Equals) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"type":"string","title":"Child Jobs UID String Fields","enum":["id","issued_by","source_id","reissue_id","machine_id","group_id","cancelled_by"]},{"title":"Child Jobs Simple String Fields","type":"string","enum":["command","issued_by_name","issued_by_email","machine_name"]},{"type":"string","title":"Child Jobs Enum Number Fields","enum":["status"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["equals","not_equals"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}},"case_insensitive":{"type":"boolean","default":false}},"if":{"properties":{"field":{"type":"string","title":"Child Jobs UID String Fields","enum":["id","issued_by","source_id","reissue_id","machine_id","group_id","cancelled_by"]}}},"then":{"properties":{"value":{"type":["string","array"],"format":"uuid","items":{"type":"string","format":"uuid"}}}}},{"title":"String (Contains, Not Contains) Constraints","required":["operator","value"],"properties":{"field":{"title":"Child Jobs Simple String Fields","type":"string","enum":["command","issued_by_name","issued_by_email","machine_name"]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["contains","not_contains"]},"value":{"type":"string","title":"Value to search"},"case_insensitive":{"type":"boolean","default":false}}},{"title":"Date (start, end) Constraints","properties":{"field":{"type":"string","title":"Child Jobs Date Fields","enum":["created_at","expires_at","updated_at"]}},"oneOf":[{"minProperties":1,"title":"Specify Date Range","not":{"anyOf":[{"required":["operator"]},{"required":["value"]}]},"properties":{"start":{"type":"string","format":"date-time","title":"Start Date"},"end":{"type":"string","format":"date-time","title":"End Date"}}},{"title":"Specify Exact Date","not":{"anyOf":[{"required":["start"]},{"required":["end"]}]},"required":["operator","value"],"properties":{"operator":{"type":"string","enum":["equals"]},"value":{"type":["string","array"],"format":"date-time","title":"Value to search","items":{"format":"date-time"}}}}]}]}}}}}}},"responses":{"200":{"description":"Successful response"}},"tags":["Jobs"],"operationId":"api.v2.rmm.delete.parent_jobs.children"},"post":{"description":"Search children jobs by correlation ID across multiple accounts.","summary":"Search children jobs","security":[{"client_credentials":["read"]},{"user_permissions":["tasks.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"correlation_id","required":true,"in":"path","description":"Correlation ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Search children jobs across multiple accounts request body.","properties":{"sort_field":{"type":"string","title":"Child Jobs Sort Fields","enum":["created_at","expires_at","command","issued_by_name","issued_by_email","updated_at"]},"sort_order":{"type":"string","title":"Whether sorting should be ascending or descending","enum":["asc","desc"],"default":"desc"},"page_size":{"type":"number","title":"The page size","minimum":0,"maximum":2000},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]},"constraints":{"type":"array","title":"Child Jobs Constraints","items":{"title":"Child Jobs Constraints","type":"object","oneOf":[{"title":"String (Equals, Not Equals) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"type":"string","title":"Child Jobs UID String Fields","enum":["id","issued_by","source_id","reissue_id","machine_id","group_id","cancelled_by"]},{"title":"Child Jobs Simple String Fields","type":"string","enum":["command","issued_by_name","issued_by_email","machine_name"]},{"type":"string","title":"Child Jobs Enum Number Fields","enum":["status"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["equals","not_equals"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}},"case_insensitive":{"type":"boolean","default":false}},"if":{"properties":{"field":{"type":"string","title":"Child Jobs UID String Fields","enum":["id","issued_by","source_id","reissue_id","machine_id","group_id","cancelled_by"]}}},"then":{"properties":{"value":{"type":["string","array"],"format":"uuid","items":{"type":"string","format":"uuid"}}}}},{"title":"String (Contains, Not Contains) Constraints","required":["operator","value"],"properties":{"field":{"title":"Child Jobs Simple String Fields","type":"string","enum":["command","issued_by_name","issued_by_email","machine_name"]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["contains","not_contains"]},"value":{"type":"string","title":"Value to search"},"case_insensitive":{"type":"boolean","default":false}}},{"title":"Date (start, end) Constraints","properties":{"field":{"type":"string","title":"Child Jobs Date Fields","enum":["created_at","expires_at","updated_at"]}},"oneOf":[{"minProperties":1,"title":"Specify Date Range","not":{"anyOf":[{"required":["operator"]},{"required":["value"]}]},"properties":{"start":{"type":"string","format":"date-time","title":"Start Date"},"end":{"type":"string","format":"date-time","title":"End Date"}}},{"title":"Specify Exact Date","not":{"anyOf":[{"required":["start"]},{"required":["end"]}]},"required":["operator","value"],"properties":{"operator":{"type":"string","enum":["equals"]},"value":{"type":["string","array"],"format":"date-time","title":"Value to search","items":{"format":"date-time"}}}}]}]}},"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Search children jobs response body.","properties":{"counts":{"type":"object","title":"Counts","properties":{"endpoints":{"type":"integer","title":"Number of related endpoints"},"accounts":{"type":"integer","title":"Number of related accounts"},"total":{"type":"integer","title":"Total number of child jobs"}},"allOf":[{"type":"object","title":"Job status counts.","required":["created","sent","received","processing","timed_out","success","expired","cancelled","failed"],"properties":{"created":{"type":"integer","title":"Number of jobs with created status"},"sent":{"type":"integer","title":"Number of jobs with sent status"},"received":{"type":"integer","title":"Number of jobs with received status"},"processing":{"type":"integer","title":"Number of jobs with processing status"},"timed_out":{"type":"integer","title":"Number of jobs with timed_out status"},"success":{"type":"integer","title":"Number of jobs with success status"},"expired":{"type":"integer","title":"Number of jobs with expired status"},"cancelled":{"type":"integer","title":"Number of jobs with cancelled status"},"failed":{"type":"integer","title":"Number of jobs with failed status"}}}]},"jobs":{"type":"array","items":{"type":"object","additionalProperties":false,"properties":{"id":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","title":"The job ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"account_id":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","title":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"machine_id":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","title":"The machine ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"machine_name":{"type":"string","title":"The machine name"},"command":{"type":"string","title":"Command name"},"issued_at":{"type":"string","format":"date-time","title":"The issue date"},"issued_by_email":{"type":"string","title":"The email of the user who issued the job"},"issued_by_name":{"type":"string","title":"The name of the user who issued the job"},"issued_by":{"type":"string","nullable":true,"title":"The id of the user who issued the job (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"cancelled_by":{"type":"string","nullable":true,"pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","title":"The id of the user who cancelled the job (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"cancelled_by_name":{"type":"string","nullable":true,"title":"User who cancelled the job","examples":["John Doe"]},"expires_at":{"type":"string","format":"date-time","title":"The expire date"},"updated_at":{"type":"string","format":"date-time","title":"The last update date"},"state":{"type":"number","enum":[0,1,2,4,8,16,32,64,128,256],"title":"Filter job status. 0:UNKNOWN_STATUS, 1:CREATED, 2:SENT, 4:RECEIVED, 8:STARTED, 16:TIMED_OUT, 32:COMPLETED, 64:EXPIRED, 128:FAILED, 256:CANCELLED"},"reason":{"type":"string","nullable":true,"title":"The reason for the job cancellation","examples":["Unsupported feature for this OS version."]},"data":{"type":"string","title":"JSON stringified additional data"},"correlation_id":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","title":"Correlation ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}},"total_count":{"type":"integer","title":"Total Count","description":"Total count of results."},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}},"required":["jobs","next_cursor","counts"]}}}}},"tags":["Jobs"],"operationId":"api.rmm.post.parent_jobs.children"}},"/oneview/v1/jobs/bulk":{"delete":{"description":"Cancel pending jobs across accounts","summary":"Cancel pending jobs across accounts","security":[{"client_credentials":["execute"]},{"user_permissions":["tasks.manage"]}],"status":{"outage":["auth","search_stateful"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Cancel Jobs","anyOf":[{"required":["job_ids"]},{"required":["machine_ids"]},{"required":["groups"]}],"properties":{"job_ids":{"type":"array","title":"The Job IDs Schema","items":{"type":"string","title":"Job ID","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}},"machine_ids":{"type":"array","title":"The Machine IDs Schema","items":{"type":"string","title":"Machine ID","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}},"groups":{"type":"array","title":"Machines","items":{"type":"object","title":"List of queries to select endpoints","allOf":[{"type":"object","allOf":[{"properties":{"constraints":{"type":"array"},"aggregations":{"items":{"type":"string","title":"Endpoint aggregation fields","enum":["has_alerts","infected","suspicious","scan_needed","reboot_required","check-in_status","isolated","protection_status","agent.os_info.os_release_name","agent.nics.ips","agent.nics.mac_address","agent.nics.description","agent.os_info.os_type","agent.os_info.os_version","agent.os_info.os_platform","agent.os_info.os_architecture","agent.host_name","agent.fully_qualified_host_name","agent.plugins.asset_manager.plugin_version","agent.plugins.asset_manager.reboot_reason","agent.plugins.asset_manager.alerts.codes","agent.plugins.endpoint_protection.plugin_version","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.alerts.codes","agent.plugins.endpoint_protection.component_package_version","agent.plugins.endpoint_protection.update_package_version","agent.plugins.endpoint_protection.reboot_reason","agent.plugins.endpoint_detection_and_response.plugin_version","agent.plugins.endpoint_detection_and_response.reboot_reason","agent.plugins.endpoint_detection_and_response.alerts.codes","agent.plugins.incident_response.plugin_version","agent.plugins.incident_response.reboot_reason","agent.plugins.incident_response.alerts.codes","agent.plugins.siem.plugin_version","agent.plugins.siem.reboot_reason","agent.plugins.siem.alerts.codes","agent.plugins.browser_phishing_protection.plugin_version","agent.plugins.browser_phishing_protection.alerts.codes","agent.engine_version","agent.domain_name","agent.policy_etag","machine.account_id","machine.group_id","machine.root_group_id","machine.group_name","machine.policy_name","machine.policy_id","machine.is_deleted","is_software_update_available","agent.machine_ip","agent.object_guid","agent.serial_number","stats.assets.encryption_status","inactive_and_unknown"]}},"sort_field":{"type":"string","title":"Endpoint sort fields","enum":["agent.at","agent.nics.ips","agent.nics.mac_address","agent.nics.description","agent.os_info.os_type","agent.os_info.os_version","agent.os_info.os_platform","agent.os_info.os_architecture","agent.os_info.os_release_name","agent.host_name","agent.fully_qualified_host_name","agent.plugins.asset_manager.plugin_version","agent.plugins.asset_manager.reboot_reason","agent.plugins.endpoint_protection.plugin_version","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.plugins.endpoint_protection.update_package_version","agent.plugins.endpoint_protection.reboot_reason","agent.plugins.endpoint_detection_and_response.plugin_version","agent.plugins.endpoint_detection_and_response.reboot_reason","agent.plugins.incident_response.plugin_version","agent.plugins.incident_response.reboot_reason","agent.plugins.siem.plugin_version","agent.plugins.siem.reboot_reason","agent.plugins.browser_phishing_protection.plugin_version","agent.engine_version","agent.domain_name","agent.policy_etag","machine.account_id","machine.account.name","machine.group_id","machine.root_group_id","machine.group_name","machine.policy_name","machine.policy_id","machine.deleted_at","machine.created_at","machine.marked_for_deletion","machine.is_deleted","machine.last_day_seen","machine.last_scanned_at","agent.last_user","machine.tags.alias","display_name","name_multi_search","agent.machine_ip","agent.serial_number","agent.object_guid","stats.assets.vulnerabilities_found.critical","stats.assets.vulnerabilities_found.high","stats.assets.vulnerabilities_found.medium","stats.assets.vulnerabilities_found.low","stats.assets.vulnerabilities_found.none","stats.assets.vulnerabilities_found.total","stats.assets.os_patches_available","stats.assets.last_scanned_at","connected","agent.active_directory.user.display_name","agent.active_directory.user.sam_account_name","agent.active_directory.user.ou","agent.active_directory.machine.display_name","agent.active_directory.machine.ou","agent.active_directory.machine.sam_account_name","stats.assets.encryption_status","machine.suspicious_activity_count","machine.infection_count"]}}},{"type":"object","title":"Base Search Schema","properties":{"aggregations":{"type":"array","title":"The fields onto which you can perform aggregations","items":{"type":"string","title":"The Items Schema"}},"page_size":{"type":"number","title":"The page size. If you just need to aggregate, set it to 0","minimum":0,"maximum":2000},"sort_field":{"title":"Sort Fields","type":"string"},"sort_order":{"type":"string","title":"Whether sorting should be ascending or descending","enum":["asc","desc"]},"aggregate_by_account":{"type":"boolean","title":"Indicates whether aggregations should be scoped by account"},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}],"definitions":{"constraint":{"oneOf":[{"title":"Endpoint Constraints","type":"object","required":["field"],"anyOf":[{"title":"String (Equals, Not Equals) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"title":"Agent Simple String Fields","type":"string","enum":["agent.nics.mac_address","agent.nics.description","agent.os_info.os_version","agent.os_info.os_release_name","agent.os_info.os_architecture","agent.plugins.asset_manager.plugin_version","agent.plugins.asset_manager.alerts.codes","agent.plugins.endpoint_protection.plugin_version","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.plugins.endpoint_protection.update_package_version","agent.plugins.endpoint_protection.alerts.codes","agent.plugins.endpoint_detection_and_response.plugin_version","agent.plugins.endpoint_detection_and_response.alerts.codes","agent.plugins.incident_response.plugin_version","agent.plugins.incident_response.update_package_version","agent.plugins.incident_response.alerts.codes","agent.plugins.siem.plugin_version","agent.plugins.siem.alerts.codes","agent.plugins.browser_phishing_protection.plugin_version","agent.plugins.browser_phishing_protection.alerts.codes","agent.engine_version","agent.source_location.city","agent.source_location.country","agent.source_location.subdivisions","agent.source_location.time_zone","agent.domain_name","agent.alias","agent.policy_etag","agent.serial_number","agent.available_software_updates.sdk_version.currentVersion","agent.available_software_updates.sdk_version.newVersion","agent.alerts.codes","agent.host_name","agent.fully_qualified_host_name","agent.object_guid","agent.last_user","agent.active_directory.user.display_name","agent.active_directory.user.ou","agent.active_directory.user.ou.path","agent.active_directory.user.sam_account_name","agent.active_directory.machine.display_name","agent.active_directory.machine.ou","agent.active_directory.machine.ou.path","agent.active_directory.machine.sam_account_name"]},{"title":"Agent Enum String Fields","type":"string","enum":["agent.os_info.os_type","agent.os_info.os_platform"]},{"title":"Machine UID String Fields","type":"string","enum":["machine.id","machine.group_id","machine.root_group_id","machine.policy_id"]},{"title":"Machine Simple String Fields","type":"string","enum":["protection_status","machine.tags.alias","machine.reboot_required_reason","machine.group_name","machine.policy_name","stats.assets.encryption_status"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["equals","not_equals"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}}},"if":{"properties":{"field":{"title":"Machine UID String Fields","type":"string","enum":["machine.id","machine.group_id","machine.root_group_id","machine.policy_id"]}}},"then":{"properties":{"value":{"type":["string","array"],"format":"uuid","items":{"type":"string","format":"uuid"}}}}},{"title":"String (Contains, Not Contains) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"title":"Machine Simple String Fields","type":"string","enum":["protection_status","machine.tags.alias","machine.reboot_required_reason","machine.group_name","machine.policy_name","stats.assets.encryption_status"]},{"title":"Agent Simple String Fields","type":"string","enum":["agent.nics.mac_address","agent.nics.description","agent.os_info.os_version","agent.os_info.os_release_name","agent.os_info.os_architecture","agent.plugins.asset_manager.plugin_version","agent.plugins.asset_manager.alerts.codes","agent.plugins.endpoint_protection.plugin_version","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.plugins.endpoint_protection.update_package_version","agent.plugins.endpoint_protection.alerts.codes","agent.plugins.endpoint_detection_and_response.plugin_version","agent.plugins.endpoint_detection_and_response.alerts.codes","agent.plugins.incident_response.plugin_version","agent.plugins.incident_response.update_package_version","agent.plugins.incident_response.alerts.codes","agent.plugins.siem.plugin_version","agent.plugins.siem.alerts.codes","agent.plugins.browser_phishing_protection.plugin_version","agent.plugins.browser_phishing_protection.alerts.codes","agent.engine_version","agent.source_location.city","agent.source_location.country","agent.source_location.subdivisions","agent.source_location.time_zone","agent.domain_name","agent.alias","agent.policy_etag","agent.serial_number","agent.available_software_updates.sdk_version.currentVersion","agent.available_software_updates.sdk_version.newVersion","agent.alerts.codes","agent.host_name","agent.fully_qualified_host_name","agent.object_guid","agent.last_user","agent.active_directory.user.display_name","agent.active_directory.user.ou","agent.active_directory.user.ou.path","agent.active_directory.user.sam_account_name","agent.active_directory.machine.display_name","agent.active_directory.machine.ou","agent.active_directory.machine.ou.path","agent.active_directory.machine.sam_account_name"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["contains","not_contains"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}}}},{"title":"Boolean (Equals) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"title":"Agent Boolean Fields","type":"string","enum":["agent.is_software_update_available","agent.has_alerts"]},{"title":"Machine Boolean Fields","type":"string","enum":["machine.is_deleted","machine.isolated","connected"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["equals"]},"value":{"title":"Value to search. Must be true or false","type":"boolean"}}},{"title":"Number Constraints (gt, gte, lt, lte, equals)","properties":{"field":{"type":"string","oneOf":[{"title":"Agent Number Fields","type":"string","enum":["agent.started_at_offset","agent.plugins.asset_manager.reboot_reasons","agent.plugins.endpoint_protection.reboot_reasons","agent.plugins.endpoint_detection_and_response.reboot_reasons","agent.plugins.incident_response.reboot_reasons","agent.plugins.siem.reboot_reasons","agent.os_version_major","agent.os_version_minor"]},{"title":"Machine Number Fields","type":"string","enum":["machine.suspicious_activity_count","machine.infection_count","machine.reboot_required","stats.assets.vulnerabilities_found.total","stats.assets.os_patches_available","stats.assets.vulnerabilities_found.critical","stats.assets.vulnerabilities_found.high","stats.assets.vulnerabilities_found.medium","stats.assets.vulnerabilities_found.low"]}]}},"oneOf":[{"minProperties":1,"title":"Specify Number Range","not":{"anyOf":[{"required":["operator"]},{"required":["value"]}]},"properties":{"gt":{"type":"number","title":"Greater than"},"lt":{"type":"number","title":"Less than"},"gte":{"type":"number","title":"Greater than or equals"},"lte":{"type":"number","title":"Less than or equals"}}},{"title":"Specify Exact Number","not":{"anyOf":[{"required":["gt"]},{"required":["lt"]},{"required":["gte"]},{"required":["lte"]}]},"required":["operator","value"],"properties":{"operator":{"type":"string","enum":["equals"]},"value":{"type":["number","array"],"title":"Value to search","items":{"type":"number"}}}}]},{"title":"Date (start, end) Constraints","properties":{"field":{"oneOf":[{"title":"Agent Date Fields","type":"string","enum":["agent.at","agent.started_at_local"]},{"title":"Machine Date Fields","type":"string","enum":["machine.deleted_at","machine.last_day_seen","machine.last_scanned_at","machine.created_at","stats.assets.last_scanned_at"]}]}},"oneOf":[{"minProperties":1,"title":"Specify Date Range","not":{"anyOf":[{"required":["operator"]},{"required":["value"]}]},"properties":{"start":{"type":"string","format":"date-time","title":"Start Date"},"end":{"type":"string","format":"date-time","title":"End Date"}}},{"title":"Specify Exact Date","not":{"anyOf":[{"required":["start"]},{"required":["end"]}]},"required":["operator","value"],"properties":{"operator":{"type":"string","enum":["equals"]},"value":{"type":["string","array"],"format":"date-time","title":"Value to search","items":{"format":"date-time"}}}}]},{"title":"IP Constraints","properties":{"field":{"oneOf":[{"title":"Agent IP Fields","type":"string","enum":["agent.nics.ips","agent.machine_ip"]}]},"operator":{"type":"string","enum":["ip"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}}}},{"title":"MWB Version Constraints (gt, gte, lt, lte, equals)","required":["operator"],"properties":{"field":{"type":"string","oneOf":[{"title":"Agent MWB Version fields","type":"string","enum":["agent.engine_version"]}]},"operator":{"type":"string","enum":["mwb_version"]}},"oneOf":[{"minProperties":1,"title":"Specify Version Range","not":{"anyOf":[{"required":["value"]}]},"properties":{"gt":{"type":"string","title":"Greater than"},"lt":{"type":"string","title":"Less than"},"gte":{"type":"string","title":"Greater than or equals"},"lte":{"type":"string","title":"Less than or equals"}}},{"title":"Specify Exact Version","not":{"anyOf":[{"required":["gt"]},{"required":["lt"]},{"required":["gte"]},{"required":["lte"]}]},"required":["value"],"properties":{"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}}}}]},{"title":"Field Exists/Not Exists Constraints","required":["operator"],"properties":{"field":{"type":"string","oneOf":[{"title":"Agent Simple String Fields","type":"string","enum":["agent.nics.mac_address","agent.nics.description","agent.os_info.os_version","agent.os_info.os_release_name","agent.os_info.os_architecture","agent.plugins.asset_manager.plugin_version","agent.plugins.asset_manager.alerts.codes","agent.plugins.endpoint_protection.plugin_version","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.plugins.endpoint_protection.update_package_version","agent.plugins.endpoint_protection.alerts.codes","agent.plugins.endpoint_detection_and_response.plugin_version","agent.plugins.endpoint_detection_and_response.alerts.codes","agent.plugins.incident_response.plugin_version","agent.plugins.incident_response.update_package_version","agent.plugins.incident_response.alerts.codes","agent.plugins.siem.plugin_version","agent.plugins.siem.alerts.codes","agent.plugins.browser_phishing_protection.plugin_version","agent.plugins.browser_phishing_protection.alerts.codes","agent.engine_version","agent.source_location.city","agent.source_location.country","agent.source_location.subdivisions","agent.source_location.time_zone","agent.domain_name","agent.alias","agent.policy_etag","agent.serial_number","agent.available_software_updates.sdk_version.currentVersion","agent.available_software_updates.sdk_version.newVersion","agent.alerts.codes","agent.host_name","agent.fully_qualified_host_name","agent.object_guid","agent.last_user","agent.active_directory.user.display_name","agent.active_directory.user.ou","agent.active_directory.user.ou.path","agent.active_directory.user.sam_account_name","agent.active_directory.machine.display_name","agent.active_directory.machine.ou","agent.active_directory.machine.ou.path","agent.active_directory.machine.sam_account_name"]},{"title":"Agent Enum String Fields","type":"string","enum":["agent.os_info.os_type","agent.os_info.os_platform"]},{"title":"Machine UID String Fields","type":"string","enum":["machine.id","machine.group_id","machine.root_group_id","machine.policy_id"]},{"title":"Machine Simple String Fields","type":"string","enum":["protection_status","machine.tags.alias","machine.reboot_required_reason","machine.group_name","machine.policy_name","stats.assets.encryption_status"]},{"title":"Agent IP Fields","type":"string","enum":["agent.nics.ips","agent.machine_ip"]},{"title":"Agent Number Fields","type":"string","enum":["agent.started_at_offset","agent.plugins.asset_manager.reboot_reasons","agent.plugins.endpoint_protection.reboot_reasons","agent.plugins.endpoint_detection_and_response.reboot_reasons","agent.plugins.incident_response.reboot_reasons","agent.plugins.siem.reboot_reasons","agent.os_version_major","agent.os_version_minor"]},{"title":"Machine Number Fields","type":"string","enum":["machine.suspicious_activity_count","machine.infection_count","machine.reboot_required","stats.assets.vulnerabilities_found.total","stats.assets.os_patches_available","stats.assets.vulnerabilities_found.critical","stats.assets.vulnerabilities_found.high","stats.assets.vulnerabilities_found.medium","stats.assets.vulnerabilities_found.low"]},{"title":"Agent Boolean Fields","type":"string","enum":["agent.is_software_update_available","agent.has_alerts"]},{"title":"Machine Boolean Fields","type":"string","enum":["machine.is_deleted","machine.isolated","connected"]},{"title":"Machine Date Fields","type":"string","enum":["machine.deleted_at","machine.last_day_seen","machine.last_scanned_at","machine.created_at","stats.assets.last_scanned_at"]},{"title":"Agent Date Fields","type":"string","enum":["agent.at","agent.started_at_local"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["exists","not_exists"]}}}]},null]},"compound_constraint":{"allOf":[{"type":"object","anyOf":[{"required":["anyOf"]},{"required":["noneOf"]},{"required":["allOf"]}],"properties":{"allOf":{"type":"array","minItems":1,"uniqueItems":true,"items":{"type":"object"}},"anyOf":{"type":"array","minItems":1,"uniqueItems":true,"items":{"type":"object"}},"noneOf":{"type":"array","minItems":1,"uniqueItems":true,"items":{"type":"object"}}}},{"properties":{"allOf":{"type":"array"},"anyOf":{"type":"array"},"noneOf":{"type":"array"}},"anyOf":[{"required":["allOf"]},{"required":["anyOf"]},{"required":["noneOf"]}]}]}}}]}}}}}}},"responses":{"200":{"description":"Successful response"}},"tags":["Jobs"],"operationId":"api.v2.rmm.delete.jobs.bulk"},"post":{"description":"Use this endpoint to issue a job across multiple accounts you manage.\nThis API endpoint allows you to specify queries instead of explicitly specifying endpoint ids. See example for more details.\n\nSee `Issue a job` for the commands list\n\nJobs are issued asynchronously and processed by endpoint agents when they get online. If you want to get notifications about the progress of a job, create a subscription to the `job_status_change` webhook event.\n\n\n## Command specific data\nYou can customize each command using specific settings. Supply those command-specific settings in the `data` parameter.\n\n### command.threat.quarantine.restore\nRestore item from quarantine. Specify one or more detection ids\n```json\n{\"restore_items\":[\"7021ebec-b7b8-49b3-8709-f36bf5002c30\"]}\n```\n\n### command.threat.quarantine.remove\nDelete item from quarantine. Specify one or more detection ids\n```json\n{\"delete_items\":[\"7021ebec-b7b8-49b3-8709-f36bf5002c30\"]}\n```\n\n### command.threat.scan\n\nIf you want to just report detections:\n```json\n{\"scan_settings\":{\"type\":\"ThreatScan\",\"remove\":false}}\n```\n\nIf you want to quarantine detected items:\n```json\n{\"scan_settings\":{\"type\":\"ThreatScan\",\"remove\":true}}\n```\n\n### command.edr.isolation\nSpecify the extent of your isolation. Can be any combination of `desktop`, `network`, or `process`.\n```json\n{\"desktop\":true,\"network\":true,\"process\":true}\n```\n\n## examples\n```json\n{\n \"endpoints\": [{ \"id\": \"\", \"account_id\": \"\" }]\n}\n```\nIf you want to issue a job on all your `Mac Os` endpoints across two of your manages sites, and on all your endpoints for a certain account with policy matching the string `serious policy`, do the following:\n\n```json\n \"groups\": [{\n \"account_ids\": [\"\", \"\"],\n \"os_info.os_platform\": \"Mac Os\"\n }, {\n \"account_ids\": [\"\"],\n \"policy_name\": \"serious policy\"\n }]\n```\nThe constraints accepted are the same accepted by the search endpoints route. Refer to `POST -> /endpoints` for more information about the constraints accepted.\n\nYou can also send a mix of explicit endpoint ids and queries in the same request:\n```json\n \"endpoints\": [{ \"id\": \"\", \"account_id\": \"\" }],\n \"groups\": [{\n \"account_ids\": [\"\", \"\"],\n \"os_info.os_platform\": \"Mac Os\"\n }, {\n \"account_ids\": [\"\"],\n \"policy_name\": \"serious policy\"\n }]\n```\nThe response includes the explicit ids on which the job was issued.\n","summary":"Bulk issue jobs across accounts","security":[{"client_credentials":["execute"]},{"user_permissions":["tasks.manage"]}],"status":{"outage":["auth","search_stateful"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"The Post Isolate Request Body Schema","required":["endpoints","groups","command"],"properties":{"command":{"type":"string","title":"Command"},"requires_connected":{"type":"boolean","title":"Whether a connection needs to be initiated before issuing this jobs (i.e. active response shell)"},"data":{"type":"object","title":"Data","properties":{"scan_settings":{"type":"object","title":"Scan settings","properties":{"type":{"type":"string","title":"Type","enum":["CustomScan","ThreatScan","HyperScan"]},"remove":{"type":"boolean","title":"Remove"}}},"enable_shuriken":{"type":"boolean","title":"Enable shuriken"},"allow_postpone_reboot":{"type":"boolean","title":"Allow postpone reboot"},"type":{"type":"string","title":"Type"},"scan_path_from_list_file":{"type":"boolean","title":"Scan path from list file"},"scan_path":{"type":"string","title":"Scan path"},"add_scan_paths":{"type":"array","title":"Add scan paths","items":{"type":"string","title":"Add scan paths items"}},"no_archive":{"type":"boolean","title":"No archive"},"ark":{"type":"boolean","title":"Ark"},"remove":{"type":"boolean","title":"Remove"},"no_reboot":{"type":"boolean","title":"No reboot"},"reboot_delay":{"type":"integer","title":"Reboot delay"},"reboot_delay_rrule":{"type":"string","title":"Reboot delay rrule"},"reboot_message":{"type":"string","title":"Reboot message"},"pum_detection":{"type":"string","title":"Pum detection"},"pup_detection":{"type":"string","title":"Pup detection"},"scan_memory":{"type":"boolean","title":"Scan memory"},"scan_registry":{"type":"boolean","title":"Scan registry"},"scan_startup":{"type":"boolean","title":"Scan startup"},"scan_file_system":{"type":"boolean","title":"Scan file system"},"scan_priority":{"type":"string","title":"Scan priority"},"scan_fixed_drives":{"type":"boolean","title":"Scan fixed drives"},"exclusions":{"type":"array","title":"Exclusions","items":{"type":"object","title":"Exclusion items","additionalProperties":true,"properties":{"value":{"type":"string","title":"Value"},"type":{"type":"string","title":"Type"},"exclude_from":{"type":"object","title":"Exclude from","properties":{"exploit_protection":{"type":["boolean","null"],"title":"Exploit protection"},"malware_protection":{"type":["boolean","null"],"title":"Malware protection"},"ransomware_protection":{"type":["boolean","null"],"title":"Ransomware protection"},"suspicious_activity":{"type":["boolean","null"],"title":"Suspicious activity"},"website_protection":{"type":["boolean","null"],"title":"Website protection"}}}}}},"allow_postpone":{"type":["boolean","number"],"title":"Asset Reboot allow postpone"},"delay_in_seconds":{"type":"number","title":"Asset Reboot delay"},"message":{"type":"string","title":"Asset Reboot message"},"reasons":{"type":"number","title":"Asset Reboot reason: 0 RebootStatusClear, 1 RebootStatusDOR, 2 RebootStatusInstall, 3 RebootStatusUpgrade, 4 RebootStatusUnknown"},"restore_items":{"type":"array","title":"Detection IDs to restore from quarantine","items":{"type":"string","title":"Detection ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260653e4fa4f"]}},"delete_items":{"type":"array","title":"Detection IDs to delete from quarantine","items":{"type":"string","title":"Detection ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260653e4fa4f"]}},"application_name":{"type":"string","examples":["Chrome"]},"current_version":{"type":"string","examples":["96.0.4664.45"]},"new_version":{"type":"string","examples":["97.0.2103.01"]},"product":{"type":"number","product":[41]},"vendor":{"type":"string","examples":["Google"]},"architecture":{"type":"string","examples":["x86"]},"language":{"type":"string","examples":["tr-TR"]},"patches":{"type":"array","title":"Options for command.asset.patch","items":{"type":"object","properties":{"category":{"type":"string","examples":["feature_pack"]},"product":{"type":"string","examples":["Silverlight"]},"severity":{"type":"string","examples":["critical"]},"title":{"type":"string","examples":["Microsoft Silverlight (KB4481252)"]},"vendor":{"type":"string","examples":["Microsoft Corporation"]}}}}}},"endpoints":{"type":"array","title":"Machine IDs","items":{"type":"object","title":"Machine IDs items","required":["id","account_id"],"properties":{"id":{"type":"string","title":"Endpoint ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"account_id":{"type":"string","title":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}},"groups":{"type":"array","title":"Machine IDs","items":{"type":"object","title":"List of queries to select endpoints","allOf":[{"type":"object","title":"Search endpoints request. Leading wildcards are not supported for constraint fields without '.keyword' suffix.","required":["account_ids"],"properties":{"has_alerts":{"type":"boolean","title":"Indicates whether the endpoint needs attention"},"name_multi_search":{"type":"string","title":"Search either alias, host name of fully qualified host name"},"alerts.codes":{"type":"string","title":"Alert codes"},"is_software_update_available":{"type":"boolean","title":"Indicates whether the agent has an available update"},"protection_status":{"type":"string","title":"Protection status of the endpoint(s)","pattern":"(^$|protected|scan_only|unprotected|unknown|pending|mobile_protection)"},"is_isolated":{"type":"boolean","title":"Indicates whether the endpoints are isolated or not"},"suspicious_activity_found":{"type":"boolean","title":"Filter the search to the endpoints that have open suspicious activities"},"reboot_required":{"type":"boolean","title":"Filter the search to the endpoints needing a reboot"},"infection_found":{"type":"boolean","title":"Filter the search to the endpoints with one or more security threats found"},"policy_id":{"type":"string","title":"Filter the search to the endpoints with specified policy (id)"},"policy_name":{"type":"string","title":"Filter the search to the endpoints with specified policy (name)"},"policy_etag":{"type":"string","title":"Filter the search to the endpoints with specified policy etag"},"domain_name":{"type":"string","title":"Filter the search to the endpoints with specified domain name"},"engine_version":{"type":"string","title":"Filter the search to the endpoints with specified engine version"},"last_user":{"type":"string","title":"Last user that logged into the machine"},"last_user.keyword":{"type":"string","title":"Last user that logged into the machine (exact match). This 'contains' type search will look for the exact match anywhere in the field."},"alias":{"type":"string","title":"Aliases for the machine"},"plugins.siem.reboot_reason":{"type":"string","title":"Filter the search to the endpoints with specified reboot reason, as reported by the SIEM plugin"},"plugins.siem.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified SIEM plugin version"},"plugins.siem.alerts.codes":{"type":"string","title":"Filter the search to the endpoints with specified SIEM alerts"},"plugins.browser_phishing_protection.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified Browser Phishing Protection plugin version"},"plugins.browser_phishing_protection.alerts.codes":{"type":"string","title":"Filter the search to the endpoints with specified Browser Phishing Protection alerts"},"plugins.incident_response.reboot_reason":{"type":"string","title":"Filter the search to the endpoints with specified reboot reason, as reported by IR plugin"},"plugins.incident_response.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified IR plugin version"},"plugins.incident_response.alerts.codes":{"type":"string","title":"Filter the search to the endpoints with specified IR plugin alerts"},"plugins.endpoint_detection_and_response.reboot_reason":{"type":"string","title":"Filter the search to the endpoints with specified reboot reason, as reported by EDR plugin"},"plugins.endpoint_detection_and_response.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified EDR plugin version"},"plugins.endpoint_detection_and_response.alerts.codes":{"type":"string","title":"Filter the search to the endpoints with specified EDR plugin alerts"},"plugins.endpoint_protection.reboot_reason":{"type":"string","title":"Filter the search to the endpoints with specified reboot reason, as reported by EP plugin"},"plugins.endpoint_protection.update_package_version":{"type":"string","title":"Filter the search to the endpoints with specified EP update package version"},"plugins.endpoint_protection.component_package_version":{"type":"string","title":"Filter the search to the endpoints with specified EP component package version"},"plugins.endpoint_protection.sdk_version":{"type":"string","title":"Filter the search to the endpoints with specified EP SDK version"},"plugins.endpoint_protection.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified EP plugin version"},"plugins.endpoint_protection.alerts.codes":{"type":"string","title":"Filter the search to the endpoints with specified EP plugin alerts"},"plugins.asset_manager.reboot_reason":{"type":"string","title":"Filter the search to the endpoints with specified reboot reason, as reported by asset manager plugin"},"plugins.asset_manager.plugin_version":{"type":"string","title":"Filter the search to the endpoints with specified asset manager plugin version"},"plugins.asset_manager.alerts.codes":{"type":"string","title":"Filter the search to the endpoints with specified asset manager alerts"},"fully_qualified_host_name":{"type":"string","title":"Filter the search to the endpoints with specified, fully qualified host name"},"host_name":{"type":"string","title":"Filter the search to the endpoints with specified host name"},"os_info.os_release_name":{"type":"string","title":"Filter the search to the endpoints with specified release name of OS"},"os_info.os_release_name.keyword":{"type":"string","title":"Filter the search to the endpoints with specified release name of OS"},"os_info.os_architecture":{"type":"string","title":"Filter the search to the endpoints with specified OS architecture"},"os_info.os_platform":{"type":"string","title":"Filter the search to the endpoints with specified OS"},"os_info.os_version":{"type":"string","title":"Filter the search to the endpoints with specified OS version"},"os_info.os_type":{"type":"string","title":"Filter the search to the endpoints with specified OS type"},"nics.description":{"type":"string","title":"Filter the search to the endpoints with specified NICS description"},"nics.mac_address":{"type":"string","title":"Filter the search to the endpoints with specified NICS MAC address"},"nics.ips":{"type":"string","title":"Filter the search to the endpoints with specified ips"},"group_name.keyword":{"type":"string","title":"Filter the search to the endpoints belonging to the specified group's name. This 'contains' type search will look for the exact match anywhere in the field."},"policy_name.keyword":{"type":"string","title":"Filter the search to the endpoints assigned to the specified policy's name. This 'contains' type search will look for the exact match anywhere in the field."},"host_name.keyword":{"type":"string","title":"Filter the search to the endpoints that have the specified host's name. This 'contains' type search will look for the exact match anywhere in the field."},"fully_qualified_host_name.keyword":{"type":"string","title":"Filter the search to the endpoints that have the specified, fully_qualified_host's name. This 'contains' type search will look for the exact match anywhere in the field."},"engine_version.keyword":{"type":"string","title":"Filter the search by specified engine version."},"engine_version_gt":{"type":"string","title":"Filter the search by engine version greater than specified value."},"engine_version_gte":{"type":"string","title":"Filter the search by engine version greater than or equal to specified value."},"engine_version_lt":{"type":"string","title":"Filter the search by engine version less than specified value."},"engine_version_lte":{"type":"string","title":"Filter the search by engine version less than or equal to specified value."},"domain_name.keyword":{"type":"string","title":"Filter the search by domain name. This 'contains' type search will look for the exact match anywhere in the field."},"group_id":{"type":"string","title":"Filter the search by group id"},"group_name":{"type":"string","title":"Filter the search by group's name"},"source_location.city":{"type":"string","title":"Source location city filter"},"source_location.country":{"type":"string","title":"Source location country filter"},"source_location.country_iso":{"type":"string","title":"Source location country_iso filter"},"source_location.continent":{"type":"string","title":"Source location continent filter"},"source_location.time_zone":{"type":"string","title":"Source location time_zone filter"},"source_location.postal_code":{"type":"string","title":"Source location postal_code filter"},"source_location.subdivisions":{"type":"string","title":"Source location subdivisions filter"},"source_location.is_anonymous_proxy":{"type":"boolean","title":"Source location is_anonymous_proxy filter"},"machine_ip":{"type":"string","title":"machine_ip filter"},"serial_number":{"type":"string","title":"Serial number filter"},"serial_number.keyword":{"type":"string","title":"Serial number filter"},"object_guid":{"type":"string","title":"object_guid filter"},"is_deleted":{"type":"boolean","default":false,"nullable":true,"title":"is_deleted filter"},"vulnerabilities_found_total_gt":{"type":"number","title":"vulnerabilities_found_total_gt"},"vulnerabilities_found_total_lt":{"type":"number","title":"vulnerabilities_found_total_lt"},"vulnerabilities_found_total_gte":{"type":"number","title":"vulnerabilities_found_total_gte"},"vulnerabilities_found_total_lte":{"type":"number","title":"vulnerabilities_found_total_lte"},"connected":{"type":"boolean","title":"connected"},"sort_field":{"type":"string","title":"Sort field","enum":["at","nics.ips","nics.mac_address","nics.description","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","host_name","fully_qualified_host_name","plugins.asset_manager.plugin_version","plugins.asset_manager.reboot_reason","plugins.endpoint_protection.plugin_version","plugins.endpoint_protection.sdk_version","plugins.endpoint_protection.component_package_version","plugins.endpoint_protection.update_package_version","plugins.endpoint_protection.reboot_reason","plugins.endpoint_detection_and_response.plugin_version","plugins.endpoint_detection_and_response.reboot_reason","plugins.incident_response.plugin_version","plugins.incident_response.reboot_reason","plugins.siem.plugin_version","plugins.browser_phishing_protection.plugin_version","plugins.siem.reboot_reason","engine_version","domain_name","policy_etag","account_id","group_id","root_group_id","group_name","policy_name","policy_id","deleted_at","created_at","marked_for_deletion","is_deleted","last_day_seen","last_scanned_at","last_user","tags.alias","name_multi_search","machine_ip","serial_number","object_guid","vulnerabilities_found.critical","vulnerabilities_found.high","vulnerabilities_found.medium","vulnerabilities_found.low","vulnerabilities_found.none","vulnerabilities_found.total","os_patches_available","last_assets_scan_at","connected"]},"multi_sort":{"type":"array","title":"The multi_sort schema","items":{"type":"object","title":"Sort field and direction","properties":{"field":{"type":"string","title":"Sort field","enum":["at","nics.ips","nics.mac_address","nics.description","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","host_name","fully_qualified_host_name","plugins.asset_manager.plugin_version","plugins.asset_manager.reboot_reason","plugins.endpoint_protection.plugin_version","plugins.endpoint_protection.sdk_version","plugins.endpoint_protection.component_package_version","plugins.endpoint_protection.update_package_version","plugins.endpoint_protection.reboot_reason","plugins.endpoint_detection_and_response.plugin_version","plugins.endpoint_detection_and_response.reboot_reason","plugins.incident_response.plugin_version","plugins.incident_response.reboot_reason","plugins.siem.plugin_version","plugins.browser_phishing_protection.plugin_version","plugins.siem.reboot_reason","engine_version","domain_name","policy_etag","account_id","group_id","root_group_id","group_name","policy_name","policy_id","deleted_at","created_at","marked_for_deletion","is_deleted","last_day_seen","last_scanned_at","last_user","tags.alias","name_multi_search","machine_ip","serial_number","object_guid","vulnerabilities_found.critical","vulnerabilities_found.high","vulnerabilities_found.medium","vulnerabilities_found.low","vulnerabilities_found.none","vulnerabilities_found.total","os_patches_available","last_assets_scan_at","connected"]},"direction":{"type":"string","title":"Direction","enum":["asc","desc"]},"missing":{"type":"string","title":"Missing values sorting","enum":["_first","_last"]}}}},"populate":{"type":"object","title":"Specify whether you need to populate the server's response with additional data, like account info or last task","properties":{"last_job":{"type":"boolean","title":"The last_job data"},"account":{"type":"boolean","title":"The account data"},"platform":{"type":"boolean","title":"Specify the platform on OS release name aggregation"}}},"page_size":{"type":"number","title":"The page size. If you just need to aggregate, set it to 0","minimum":0,"maximum":2000},"aggregations":{"type":"array","title":"The fields onto which you can perform aggregations","default":[],"items":{"type":"string","title":"The Items Schema","enum":["has_alerts","infected","suspicious","scan_needed","reboot_required","check-in_status","isolated","protection_status","os_info.os_release_name","nics.ips","nics.mac_address","nics.description","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","host_name","fully_qualified_host_name","plugins.asset_manager.plugin_version","plugins.asset_manager.reboot_reason","plugins.asset_manager.alerts.codes","plugins.endpoint_protection.plugin_version","plugins.endpoint_protection.sdk_version","plugins.endpoint_protection.alerts.codes","plugins.endpoint_protection.component_package_version","plugins.endpoint_protection.update_package_version","plugins.endpoint_protection.reboot_reason","plugins.endpoint_detection_and_response.plugin_version","plugins.endpoint_detection_and_response.reboot_reason","plugins.endpoint_detection_and_response.alerts.codes","plugins.incident_response.plugin_version","plugins.incident_response.reboot_reason","plugins.incident_response.alerts.codes","plugins.siem.plugin_version","plugins.siem.reboot_reason","plugins.siem.alerts.codes","engine_version","domain_name","policy_etag","account_id","group_id","root_group_id","group_name","policy_name","policy_id","is_deleted","is_software_update_available","machine_ip","serial_number","object_guid"]}},"account_ids":{"type":"array","title":"The account_ids against which you want to run the search. This field is mandatory, and you need to explicitly set all the account_ids in which you want to search endpoints","items":{"type":"string","title":"The Items Schema (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}},"sort_order":{"type":"string","title":"Whether sorting should be ascending or descending","enum":["asc","desc"]},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]},"at_after":{"type":"string","title":"At after cursor (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"at_before":{"type":"string","title":"At before cursor (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"last_day_seen_before":{"type":"string","title":"ISO date string. Results include endpoints that have last connected before the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"last_scan_before":{"type":"string","title":"ISO date string. Results include endpoints that have been scanned before the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"last_scan_after":{"type":"string","title":"ISO date string. Results include endpoints that have been scanned after the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"last_day_seen_after":{"type":"string","title":"ISO date string. Results include endpoints that have last connected after the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"marked_for_deletion_after":{"type":"string","title":"ISO date string. Results include endpoints that have been marked for deletion after the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"marked_for_deletion_before":{"type":"string","title":"ISO date string. Results include endpoints that have been marked for deletion before the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"deleted_at_after":{"type":"string","title":"ISO date string. Results include endpoints that have been deleted after the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"deleted_at_before":{"type":"string","title":"ISO date string. Results include endpoints that have been deleted before the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"created_at_after":{"type":"string","title":"ISO date string. Results include endpoints that have been deleted after the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"created_at_before":{"type":"string","title":"ISO date string. Results include endpoints that have been deleted before the specified date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"last_assets_scan_at_after":{"type":"string","title":"Last asset scan after cursor (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"last_assets_scan_at_before":{"type":"string","title":"Last asset scan before cursor (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"aggregate_by_account":{"type":"boolean","title":"Indicates whether aggregations should be scoped by account"}}}]}},"relay_state":{"type":"string","title":"Relay state"},"correlation_id":{"type":"string","title":"Correlation ID of the job (Parent job ID). Could be used to find related child jobs.","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"source_id":{"type":"string","title":"Source ID for relating the new parent job to an existing parent job without add them as children of that parent job.","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}}},"responses":{"201":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Create job response","required":["jobs","total_count"],"properties":{"jobs":{"type":"array","title":"List of jobs","items":{"type":"object","title":"Job items","required":["machine_id","job_id"],"properties":{"machine_id":{"type":"string","title":"The ID of the endpoint onto which the job was issued (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"job_id":{"type":"string","title":"The ID of the job. You can use this ID to retrieve additional informations about the job and track its progress, as well as use it as a reference to handle webhooks notifications (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}},"errors":{"type":"array","title":"tasks not performed","items":{"type":"object","title":"Endpoint ID","additionalProperties":true,"properties":{"id":{"type":"string","title":"Machine ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"account_id":{"type":"string","title":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"account_ids":{"type":"array","title":"Account IDs","items":{"type":"string","title":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}},"total_count":{"type":"integer","title":"The total number of issued jobs"},"correlation_id":{"type":"string","title":"Correlation ID of the job (Parent job ID). Could be used to find related child jobs.","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}}}},"tags":["Jobs"],"operationId":"api.v2.rmm.post.jobs.bulk"}},"/oneview/v1/accounts/{account_id}/parent_jobs":{"delete":{"description":"Cancel parent jobs.","summary":"Cancel parent jobs","security":[{"client_credentials":["execute"]},{"user_permissions":["tasks.manage"]}],"status":{"outage":["auth","search_stateful"]},"parameters":[{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Cancel Jobs","required":["correlation_ids"],"properties":{"correlation_ids":{"type":"array","title":"The Parent Job IDs Schema","items":{"type":"string","title":"Parent Job ID","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}}}},"responses":{"200":{"description":"Successful response"}},"tags":["Jobs"],"operationId":"api.v2.rmm.delete.parent_jobs"},"post":{"description":"Search parent jobs across multiple accounts.","summary":"Search parent jobs","security":[{"client_credentials":["read"]},{"user_permissions":["tasks.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Search parent jobs across multiple accounts request body.","properties":{"sort_field":{"type":"string","title":"Parent Jobs Sort Fields","enum":["created_at","expires_at","source_id","command","issued_by","issued_by_name","issued_by_email","accounts","endpoints","created","sent","received","processing","timed_out","success","expired","cancelled","failed","is_complete"]},"sort_order":{"type":"string","title":"Whether sorting should be ascending or descending","enum":["asc","desc"],"default":"desc"},"page_size":{"type":"number","title":"The page size","minimum":0,"maximum":2000},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]},"constraints":{"type":"array","title":"Parent Jobs Constraints","items":{"title":"Parent Jobs Constraints","type":"object","oneOf":[{"title":"String (Equals, Not Equals) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"type":"string","title":"Parent Jobs UID String Fields","enum":["correlation_id","issued_by","source_id","machine_id","group_id"]},{"title":"Parent Jobs Simple String Fields","type":"string","enum":["command","issued_by_name","issued_by_email"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["equals","not_equals"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}},"case_insensitive":{"type":"boolean","default":false}},"if":{"properties":{"field":{"type":"string","title":"Parent Jobs UID String Fields","enum":["correlation_id","issued_by","source_id","machine_id","group_id"]}}},"then":{"properties":{"value":{"type":["string","array"],"format":"uuid","items":{"type":"string","format":"uuid"}}}}},{"title":"String (Contains, Not Contains) Constraints","required":["operator","value"],"properties":{"field":{"title":"Parent Jobs Simple String Fields","type":"string","enum":["command","issued_by_name","issued_by_email"]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["contains","not_contains"]},"value":{"type":"string","title":"Value to search"},"case_insensitive":{"type":"boolean","default":false}}},{"title":"Boolean (Equals) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"type":"string","title":"Parent Jobs Boolean Fields","enum":["is_complete"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["equals"]},"value":{"title":"Value to search. Must be true or false","type":"boolean"}}},{"title":"Date (start, end) Constraints","properties":{"field":{"type":"string","title":"Parent Jobs Date Fields","enum":["created_at","expires_at"]}},"oneOf":[{"minProperties":1,"title":"Specify Date Range","not":{"anyOf":[{"required":["operator"]},{"required":["value"]}]},"properties":{"start":{"type":"string","format":"date-time","title":"Start Date"},"end":{"type":"string","format":"date-time","title":"End Date"}}},{"title":"Specify Exact Date","not":{"anyOf":[{"required":["start"]},{"required":["end"]}]},"required":["operator","value"],"properties":{"operator":{"type":"string","enum":["equals"]},"value":{"type":["string","array"],"format":"date-time","title":"Value to search","items":{"format":"date-time"}}}}]},{"title":"Number Constraints (gt, gte, lt, lte, equals)","properties":{"field":{"type":"string","oneOf":[{"title":"Parent Jobs Number Fields","type":"string","enum":["created","sent","received","processing","timed_out","success","expired","cancelled","failed"]}]}},"oneOf":[{"minProperties":1,"title":"Specify Number Range","not":{"anyOf":[{"required":["operator"]},{"required":["value"]}]},"properties":{"gt":{"type":"number","title":"Greater than"},"lt":{"type":"number","title":"Less than"},"gte":{"type":"number","title":"Greater than or equals"},"lte":{"type":"number","title":"Less than or equals"}}},{"title":"Specify Exact Number","not":{"anyOf":[{"required":["gt"]},{"required":["lt"]},{"required":["gte"]},{"required":["lte"]}]},"required":["operator","value"],"properties":{"operator":{"type":"string","enum":["equals","not_equals"]},"value":{"type":["number","array"],"title":"Value to search","items":{"type":"number"}}}}]}]}},"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Search parent jobs response body.","required":["jobs","total_count","next_cursor"],"properties":{"jobs":{"type":"array","items":{"type":"object","properties":{"correlation_id":{"type":"string","nullable":true,"pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","title":"Correlation ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"account_id":{"type":"string","nullable":true,"pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","title":"The account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"source_id":{"type":"string","nullable":true,"pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","title":"The account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"account_name":{"type":"string","title":"The account name"},"created_at":{"type":"string","format":"date-time","title":"The expire date"},"expires_at":{"type":"string","format":"date-time","title":"The expire date"},"command":{"type":"string","title":"Command name"},"issued_by":{"type":"string","nullable":true,"title":"The id of the user who issued the job (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"issued_by_name":{"type":"string","nullable":true,"title":"The name of the user who issued the job"},"issued_by_email":{"type":"string","nullable":true,"title":"The email of the user who issued the job"},"is_complete":{"type":"boolean","title":"Status if job is completed."},"machine_id":{"type":"string","title":"Endpoint ID (if job is associated with one endpoint)."},"machine_name":{"type":"string","title":"Endpoint name (if job is associated with one endpoint)."},"endpoints":{"type":"number","title":"Number of endpoints related to current parent job."},"accounts":{"type":"number","title":"Number of related accounts."}},"allOf":[{"type":"object","title":"Job status counts.","required":["created","sent","received","processing","timed_out","success","expired","cancelled","failed"],"properties":{"created":{"type":"integer","title":"Number of jobs with created status"},"sent":{"type":"integer","title":"Number of jobs with sent status"},"received":{"type":"integer","title":"Number of jobs with received status"},"processing":{"type":"integer","title":"Number of jobs with processing status"},"timed_out":{"type":"integer","title":"Number of jobs with timed_out status"},"success":{"type":"integer","title":"Number of jobs with success status"},"expired":{"type":"integer","title":"Number of jobs with expired status"},"cancelled":{"type":"integer","title":"Number of jobs with cancelled status"},"failed":{"type":"integer","title":"Number of jobs with failed status"}}}]}},"total_count":{"type":"integer","title":"Total Count","description":"Total count of results."},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}}}}},"tags":["Jobs"],"operationId":"api.rmm.post.parent_jobs"}},"/oneview/v1/accounts/{account_id}/parent_jobs/{correlation_id}/children/summary":{"post":{"description":"Get children jobs summary by correlation ID across multiple accounts.","summary":"Get children jobs summary","security":[{"client_credentials":["read"]},{"user_permissions":["tasks.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"correlation_id","required":true,"in":"path","description":"Correlation ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Get child jobs summary across multiple accounts request body.","properties":{"constraints":{"type":"array","title":"Child Jobs Constraints","items":{"title":"Child Jobs Constraints","type":"object","oneOf":[{"title":"String (Equals, Not Equals) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"type":"string","title":"Child Jobs UID String Fields","enum":["id","issued_by","source_id","reissue_id","machine_id","group_id","cancelled_by"]},{"title":"Child Jobs Simple String Fields","type":"string","enum":["command","issued_by_name","issued_by_email","machine_name"]},{"type":"string","title":"Child Jobs Enum Number Fields","enum":["status"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["equals","not_equals"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}},"case_insensitive":{"type":"boolean","default":false}},"if":{"properties":{"field":{"type":"string","title":"Child Jobs UID String Fields","enum":["id","issued_by","source_id","reissue_id","machine_id","group_id","cancelled_by"]}}},"then":{"properties":{"value":{"type":["string","array"],"format":"uuid","items":{"type":"string","format":"uuid"}}}}},{"title":"String (Contains, Not Contains) Constraints","required":["operator","value"],"properties":{"field":{"title":"Child Jobs Simple String Fields","type":"string","enum":["command","issued_by_name","issued_by_email","machine_name"]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["contains","not_contains"]},"value":{"type":"string","title":"Value to search"},"case_insensitive":{"type":"boolean","default":false}}},{"title":"Date (start, end) Constraints","properties":{"field":{"type":"string","title":"Child Jobs Date Fields","enum":["created_at","expires_at","updated_at"]}},"oneOf":[{"minProperties":1,"title":"Specify Date Range","not":{"anyOf":[{"required":["operator"]},{"required":["value"]}]},"properties":{"start":{"type":"string","format":"date-time","title":"Start Date"},"end":{"type":"string","format":"date-time","title":"End Date"}}},{"title":"Specify Exact Date","not":{"anyOf":[{"required":["start"]},{"required":["end"]}]},"required":["operator","value"],"properties":{"operator":{"type":"string","enum":["equals"]},"value":{"type":["string","array"],"format":"date-time","title":"Value to search","items":{"format":"date-time"}}}}]}]}},"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Get child jobs summary across multiple accounts response body.","required":["endpoints","accounts","total"],"properties":{"endpoints":{"type":"integer","title":"Number of related endpoints"},"accounts":{"type":"integer","title":"Number of related accounts"},"total":{"type":"integer","title":"Total number of child jobs"}},"allOf":[{"type":"object","title":"Job status counts.","required":["created","sent","received","processing","timed_out","success","expired","cancelled","failed"],"properties":{"created":{"type":"integer","title":"Number of jobs with created status"},"sent":{"type":"integer","title":"Number of jobs with sent status"},"received":{"type":"integer","title":"Number of jobs with received status"},"processing":{"type":"integer","title":"Number of jobs with processing status"},"timed_out":{"type":"integer","title":"Number of jobs with timed_out status"},"success":{"type":"integer","title":"Number of jobs with success status"},"expired":{"type":"integer","title":"Number of jobs with expired status"},"cancelled":{"type":"integer","title":"Number of jobs with cancelled status"},"failed":{"type":"integer","title":"Number of jobs with failed status"}}}]}}}}},"tags":["Jobs"],"operationId":"api.rmm.post.parent_jobs.children.summary"}},"/oneview/v1/jobs/export":{"post":{"description":"Export jobs data. You can export across multiple accounts. Specify your interested fields and the output format.\n\nSupported output formats: csv, xlsx, json.\n\n## Settings\n\n| Name | Description |\n|------|-------------|\n| groups | List of queries. The constraints accepted are the same accepted by the search jobs route. Refer to `POST -> /jobs/search` for more information about the constraints accepted. |\n| download | If set to true, the server will set the `Content-Disposition` header using the `filename` and `format` |\n| select | Which fields to select, and which field name to map to. See request schema for allowed values |\n| type | Output encoding (for `csv` and `json` format) |\n| filename | Name of the file to be set in `Content-Disposition` header if `download` = true |\n\n\n\n","summary":"Export jobs","security":[{"client_credentials":["execute"]},{"user_permissions":["tasks.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Export request","allOf":[{"type":"object","title":"Export request","required":["groups","select","format"],"properties":{"format":{"type":"string","title":"The output file","enum":["csv","xlsx","html","ods","txt","rtf","json"]},"download":{"type":"boolean","title":"Whether to instruct the client to download the response as a file. Only clients like browsers are supported"},"type":{"type":"string","title":"The format of the output","enum":["string","base64","binary"]},"select":{"type":"array","title":"Which fields to select from the response","items":{"type":"object","title":"Field","required":["field","newField"],"properties":{"newField":{"type":"string","title":"the new value"},"field":{"type":"string","title":"The response field to map to a new value","enum":["id","correlation_id","account_id","account_name","command","data","expires_at","issued_at","issued_by","issued_by_email","issued_by_name","cancelled_by","reason","machine_id","machine_name","status","updated_at","relay_state","tags.alias","data.scan_settings.remove","data.scan_settings.type"]},"mapValues":{"type":"object","title":"Rename values","description":"Only string values are mapped, but numbers and booleans will be cast as strings. If a value is not defined it will not be changed","additionalProperties":{"type":["string","number","boolean"]}}}}},"groups":{"type":"array","title":"List of search queries","items":{"type":"object","title":"List of queries to fetch jobs. Refer to the search jobs endpoint","allOf":[{"type":"object","title":"Search jobs request.","properties":{"id":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","title":"Filter the search by a single job ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"command":{"title":"Filter the search by endpoint name command name","oneOf":[{"type":"string","enum":["command.asset.reboot","command.asset.refresh","command.bfp.rules.delete","command.service.diag","command.edr.fileupload","command.edr.unlock.force","command.edr.isolation","command.edr.lock","command.sequence.remediate","command.edr.unlock","command.logging.level.set","command.threat.quarantine.remove","command.threat.quarantine.restore","command.threat.scan","command.threat.scan.remediate","command.policy.refresh","command.protection.update.now","command.service.restart","command.machine.update.now","command.machine.plugin.updateparts","command.edr.restore","command.threat.remediate","command.engine.changeaccounttoken","command.asset.patch","command.asset.updatesoftware","command.asset.uninstallsoftware","command.ars.newconn"]},{"type":"array","items":{"type":"string","enum":["command.asset.reboot","command.asset.refresh","command.bfp.rules.delete","command.service.diag","command.edr.fileupload","command.edr.unlock.force","command.edr.isolation","command.edr.lock","command.sequence.remediate","command.edr.unlock","command.logging.level.set","command.threat.quarantine.remove","command.threat.quarantine.restore","command.threat.scan","command.threat.scan.remediate","command.policy.refresh","command.protection.update.now","command.service.restart","command.machine.update.now","command.machine.plugin.updateparts","command.edr.restore","command.threat.remediate","command.engine.changeaccounttoken","command.asset.patch","command.asset.updatesoftware","command.asset.uninstallsoftware","command.ars.newconn"]},"minItems":1,"uniqueItems":true}],"examples":["command.asset.refresh"]},"endpoint":{"type":"string","title":"Filter the search by endpoint name.","description":"Search for occurrences of the given value in the host_name fully_qualified_host_name and alias"},"machine_id":{"title":"Filter the search Machine Id (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","oneOf":[{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},{"type":"array","items":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"minItems":1,"uniqueItems":true}]},"colleraltion_id":{"type":"string","title":"Filter the search Correlation Id (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","oneOf":[{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},{"type":"array","items":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"minItems":1,"uniqueItems":true}]},"issued_by":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","title":"Filter the search by the id of the user who issued the job (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"issued_by_email":{"type":"string","title":"Filter the search by the email of the user who issued the job. Contains operator."},"cancelled_by":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","title":"Filter the search by the id of the user who cancelled the job (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"issued_at_before":{"type":"string","format":"date-time","title":"Results include jobs that have been issued before the specified date"},"issued_at_after":{"type":"string","format":"date-time","title":"Results include jobs that have been issued after the specified date"},"expires_at_before":{"type":"string","format":"date-time","title":"Results include jobs that expire before the specified date"},"expires_at_after":{"type":"string","format":"date-time","title":"Results include jobs that expire after the specified date"},"status":{"type":"number","title":"Filter the search by status. You can also select multiple statuses using their sum","description":"1:CREATED, 2:SENT, 4:RECEIVED, 8:STARTED, 16:TIMED_OUT, 32:COMPLETED, 64:EXPIRED, 128:FAILED, 256:CANCELLED","minimum":1,"maximum":511},"sort_field":{"type":"string","title":"Sort field","default":"issued_at","enum":["command","issued_by","issued_at","expires_at","status","machine_name","account_name"]},"sort_order":{"type":"string","title":"Sorting direction","default":"asc","enum":["asc","desc"]},"page_size":{"type":"number","title":"The size of the page","minimum":1,"default":100,"maximum":2000},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]},"populate":{"type":"object","title":"The populate object Schema","properties":{"online":{"type":"boolean","title":"Populate the results with endpoint online/offline status"}}}}}]}}}}],"properties":{"groups":{"type":"array","title":"List of search queries","items":{"type":"object","required":["account_ids"],"title":"List of queries to fetch endpoints. Refer to the search jobs endpoint (sorting and pagination are ignored)","allOf":[{"type":"object","title":"Search jobs request.","properties":{"id":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","title":"Filter the search by a single job ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"command":{"title":"Filter the search by endpoint name command name","oneOf":[{"type":"string","enum":["command.asset.reboot","command.asset.refresh","command.bfp.rules.delete","command.service.diag","command.edr.fileupload","command.edr.unlock.force","command.edr.isolation","command.edr.lock","command.sequence.remediate","command.edr.unlock","command.logging.level.set","command.threat.quarantine.remove","command.threat.quarantine.restore","command.threat.scan","command.threat.scan.remediate","command.policy.refresh","command.protection.update.now","command.service.restart","command.machine.update.now","command.machine.plugin.updateparts","command.edr.restore","command.threat.remediate","command.engine.changeaccounttoken","command.asset.patch","command.asset.updatesoftware","command.asset.uninstallsoftware","command.ars.newconn"]},{"type":"array","items":{"type":"string","enum":["command.asset.reboot","command.asset.refresh","command.bfp.rules.delete","command.service.diag","command.edr.fileupload","command.edr.unlock.force","command.edr.isolation","command.edr.lock","command.sequence.remediate","command.edr.unlock","command.logging.level.set","command.threat.quarantine.remove","command.threat.quarantine.restore","command.threat.scan","command.threat.scan.remediate","command.policy.refresh","command.protection.update.now","command.service.restart","command.machine.update.now","command.machine.plugin.updateparts","command.edr.restore","command.threat.remediate","command.engine.changeaccounttoken","command.asset.patch","command.asset.updatesoftware","command.asset.uninstallsoftware","command.ars.newconn"]},"minItems":1,"uniqueItems":true}],"examples":["command.asset.refresh"]},"endpoint":{"type":"string","title":"Filter the search by endpoint name.","description":"Search for occurrences of the given value in the host_name fully_qualified_host_name and alias"},"machine_id":{"title":"Filter the search Machine Id (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","oneOf":[{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},{"type":"array","items":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"minItems":1,"uniqueItems":true}]},"colleraltion_id":{"type":"string","title":"Filter the search Correlation Id (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","oneOf":[{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},{"type":"array","items":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"minItems":1,"uniqueItems":true}]},"issued_by":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","title":"Filter the search by the id of the user who issued the job (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"issued_by_email":{"type":"string","title":"Filter the search by the email of the user who issued the job. Contains operator."},"cancelled_by":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","title":"Filter the search by the id of the user who cancelled the job (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"issued_at_before":{"type":"string","format":"date-time","title":"Results include jobs that have been issued before the specified date"},"issued_at_after":{"type":"string","format":"date-time","title":"Results include jobs that have been issued after the specified date"},"expires_at_before":{"type":"string","format":"date-time","title":"Results include jobs that expire before the specified date"},"expires_at_after":{"type":"string","format":"date-time","title":"Results include jobs that expire after the specified date"},"status":{"type":"number","title":"Filter the search by status. You can also select multiple statuses using their sum","description":"1:CREATED, 2:SENT, 4:RECEIVED, 8:STARTED, 16:TIMED_OUT, 32:COMPLETED, 64:EXPIRED, 128:FAILED, 256:CANCELLED","minimum":1,"maximum":511},"sort_field":{"type":"string","title":"Sort field","default":"issued_at","enum":["command","issued_by","issued_at","expires_at","status","machine_name","account_name"]},"sort_order":{"type":"string","title":"Sorting direction","default":"asc","enum":["asc","desc"]},"page_size":{"type":"number","title":"The size of the page","minimum":1,"default":100,"maximum":2000},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]},"populate":{"type":"object","title":"The populate object Schema","properties":{"online":{"type":"boolean","title":"Populate the results with endpoint online/offline status"}}}}},{"type":"object","required":["account_ids"],"properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]}}}}}}},"responses":{"200":{"description":"Successful response"}},"tags":["Jobs"],"operationId":"api.v2.rmm.post.export.jobs"}},"/oneview/v1/accounts/{account_id}/jobs/{id}":{"get":{"description":"Get a job and its full information by its job ID.","summary":"Get details about a job","security":[{"client_credentials":["read"]},{"user_permissions":["tasks.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":true,"in":"path","description":"Valid UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"account_id","required":false,"in":"path","description":"Valid account UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Job by ID response","required":["id","machine_id","machine_name","command","issued_at","issued_by_email","issued_by_name","issued_by","expires_at","updated_at","state"],"properties":{"id":{"type":"string","title":"ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"machine_id":{"type":"string","title":"Machine ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"machine_name":{"type":"string","title":"Machine name"},"command":{"type":"string","title":"Command"},"issued_at":{"type":"string","title":"Issued at (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^\\d{4}-[0-1]\\d-[0-3]\\d[(t|T)\\s](?:[0-2]\\d:[0-5]\\d:[0-5]\\d|23:59:60)(?:\\.\\d+)?(?:(z|Z)|[+-]\\d{2}:\\d{2})$","examples":["2020-03-23T17:23:17.860482Z"]},"issued_by_email":{"type":"string","title":"Issued by email"},"issued_by_name":{"type":"string","title":"The Issued_by_name Schema"},"issued_by":{"type":"string","title":"Issued by user ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"expires_at":{"type":"string","title":"Expires at (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^\\d{4}-[0-1]\\d-[0-3]\\d[(t|T)\\s](?:[0-2]\\d:[0-5]\\d:[0-5]\\d|23:59:60)(?:\\.\\d+)?(?:(z|Z)|[+-]\\d{2}:\\d{2})$","examples":["2020-03-23T17:23:17.860482Z"]},"updated_at":{"type":"string","title":"Updated at","examples":["2020-03-23T17:23:17.860482Z"]},"state":{"type":"string","title":"State (Ex. \"COMPLETED\")","pattern":"^PENDING|STARTED|TIMED_OUT|COMPLETED|EXPIRED|FAILED|CANCELLED$","examples":["COMPLETED"]},"relay_state":{"type":"string","title":"Relay state"},"scan_id":{"type":"string","title":"Scan ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}}}},"tags":["Jobs"],"operationId":"api.v2.rmm.get.jobs.id"}},"/oneview/v1/accounts/{account_id}/parent_jobs/{correlation_id}":{"get":{"description":"Get parent job by ID across multiple accounts.","summary":"Get parent job by ID","security":[{"client_credentials":["read"]},{"user_permissions":["tasks.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"correlation_id","required":true,"in":"path","description":"Correlation ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Get parent jobs response body.","required":[],"properties":{"correlation_id":{"type":["string","null"],"pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","title":"Correlation ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"account_id":{"type":["string","null"],"pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","title":"The account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"source_id":{"type":["string","null"],"pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","title":"The account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"account_name":{"type":"string","title":"The account name"},"created_at":{"type":"string","format":"date-time","title":"The expire date"},"expires_at":{"type":"string","format":"date-time","title":"The expire date"},"command":{"type":"string","title":"Command name"},"issued_by":{"type":"string","nullable":true,"pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","title":"The id of the user who issued the job (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"issued_by_name":{"type":["string","null"],"title":"The name of the user who issued the job"},"issued_by_email":{"type":["string","null"],"title":"The email of the user who issued the job"},"is_complete":{"type":"boolean","title":"Status if job is completed."},"endpoints":{"type":"number","title":"Number of endpoints related to current parent job."},"accounts":{"type":"number","title":"Number of related accounts."}},"allOf":[{"type":"object","title":"Job status counts.","required":["created","sent","received","processing","timed_out","success","expired","cancelled","failed"],"properties":{"created":{"type":"integer","title":"Number of jobs with created status"},"sent":{"type":"integer","title":"Number of jobs with sent status"},"received":{"type":"integer","title":"Number of jobs with received status"},"processing":{"type":"integer","title":"Number of jobs with processing status"},"timed_out":{"type":"integer","title":"Number of jobs with timed_out status"},"success":{"type":"integer","title":"Number of jobs with success status"},"expired":{"type":"integer","title":"Number of jobs with expired status"},"cancelled":{"type":"integer","title":"Number of jobs with cancelled status"},"failed":{"type":"integer","title":"Number of jobs with failed status"}}}]}}}}},"tags":["Jobs"],"operationId":"api.rmm.get.parent_jobs"}},"/oneview/v1/accounts/{account_id}/jobs":{"post":{"description":"Use this endpoint to issue a job on one or more of your endpoints within an account\n\nPossible `command`s are:\n\n| Name | Description |\n|------|-------------|\n| command.threat.scan | Issue a scan on the target endpoint (machine) |\n| command.asset.reboot | Reboot an endpoint |\n| command.service.restart | Restart the endpoint agent |\n| command.protection.update.now | Check for protection updates |\n| command.machine.update.now | Check for software updates |\n| command.asset.refresh | Refresh asset information about an endpoint |\n| command.edr.isolation | Isolate a machine |\n| command.threat.quarantine.remove | Delete item from quarantine |\n| command.threat.quarantine.restore | Restore item from quarantine |\n| command.bfp.rules.delete | Delete Active Block Rules |\n| command.service.diag | Generate Diagnostic Logs |\n| command.edr.fileupload | File Upload for Analysis |\n| command.edr.unlock.force | Force Remove Endpoint Isolation |\n| command.edr.lock | Isolating Endpoint |\n| command.sequence.remediate | Remediated Endpoint |\n| command.edr.unlock | Remove Endpoint Isolation |\n| command.logging.level.set | Endpoint Logging Level Changed |\n| command.threat.scan.remediate | Remediate Endpoint |\n| command.policy.refresh | Refresh Policy |\n| command.machine.plugin.updateparts | Install Software Updates |\n| command.asset.patch | Install Software Patch |\n| command.asset.updatesoftware | Install Software Update |\n| command.asset.uninstallsoftware | Uninstall Software |\n\nJobs are issued asynchronously and processed by endpoint agents when they get online. If you want to get notifications about the progress of a job, create a subscription to the `job_status_change` webhook event.\n\n\n## Command specific data\nYou can customize each command using specific settings. Supply those command-specific settings in the `data` parameter.\n\n### command.threat.quarantine.restore\nRestore item from quarantine. Specify one or more detection ids\n```json\n{\"restore_items\":[\"7021ebec-b7b8-49b3-8709-f36bf5002c30\"]}\n```\n\n### command.threat.quarantine.remove\nDelete item from quarantine. Specify one or more detection ids\n```json\n{\"delete_items\":[\"7021ebec-b7b8-49b3-8709-f36bf5002c30\"]}\n```\n\n### command.threat.scan\n\nIf you want to just report detections:\n```json\n{\"scan_settings\":{\"type\":\"ThreatScan\",\"remove\":false}}\n```\n\nIf you want to quarantine detected items:\n```json\n{\"scan_settings\":{\"type\":\"ThreatScan\",\"remove\":true}}\n```\n\n### command.edr.isolation\nSpecify the extent of your isolation. Can be any combination of `desktop`, `network`, or `process`.\n```json\n{\"desktop\":true,\"network\":true,\"process\":true}\n```\n\n### command.asset.patch\nInstall Software Patch\n```json\n{\n \"patches\": [\n {\n \"category\": \"feature_pack\",\n \"product\": \"Silverlight\",\n \"severity\": \"critical\",\n \"title\": \"Microsoft Silverlight (KB4481252)\",\n \"vendor\": \"Microsoft Corporation\"\n }\n ]\n}\n```\n\n### command.asset.updatesoftware\nInstall Software Update\n```json\n{\n \"application_name\": \"Chrome\",\n \"current_version\": \"96.0.4664.45\",\n \"new_version\": \"97.0.2103.01\",\n \"product\": 41,\n \"vendor\": \"Google\",\n \"architecture\": \"x86\",\n \"language\": \"en-US\"\n}\n```\n\n### command.asset.uninstallsoftware\nUninstall Software. Send a list of product_signature\n```json\n{\n \"applications\": [42,1024]\n}\n```\n\n## Important considerations about this endpoint\nFor performance reasons, if you supply more than 100 endpoint ids (`machine_ids`), you will not receive the list of job ids in the response. If you need to track the issued jobs, batch endpoints in groups smaller than 100 items.\n","summary":"Issue a job","security":[{"client_credentials":["execute"]},{"user_permissions":["tasks.manage"]}],"status":{"outage":["auth"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Add job to queue payload","required":["machine_ids","command"],"properties":{"machine_ids":{"type":"array","title":"Endpoint IDs","items":{"type":"string","title":"Endpoint ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}},"relay_state":{"type":"string","title":"Relay state"},"requires_connected":{"type":"boolean","title":"Whether a connection needs to be initiated before issuing this jobs (i.e. active response shell)"},"command":{"type":"string","title":"Command"},"data":{"type":"object","title":"Data","properties":{"scan_settings":{"type":"object","title":"Scan settings","properties":{"type":{"type":"string","title":"Type","enum":["CustomScan","ThreatScan","HyperScan"]},"remove":{"type":["boolean","string"],"title":"Remove"}}},"enable_shuriken":{"type":"boolean","title":"Enable shuriken"},"allow_postpone_reboot":{"type":"boolean","title":"Allow postpone reboot"},"type":{"type":"string","title":"Type"},"scan_path_from_list_file":{"type":"boolean","title":"Scan path from list file"},"scan_path":{"type":"string","title":"Scan path"},"add_scan_paths":{"type":"array","title":"Add scan paths","items":{"type":"string","title":"Add scan paths items"}},"no_archive":{"type":"boolean","title":"No archive"},"ark":{"type":"boolean","title":"Ark"},"remove":{"type":"boolean","title":"Remove"},"no_reboot":{"type":"boolean","title":"No reboot"},"reboot_delay":{"type":"integer","title":"Reboot delay"},"reboot_delay_rrule":{"type":"string","title":"Reboot delay rrule"},"reboot_message":{"type":"string","title":"Reboot message"},"pum_detection":{"type":"string","title":"Pum detection"},"pup_detection":{"type":"string","title":"Pup detection"},"scan_memory":{"type":"boolean","title":"Scan memory"},"scan_registry":{"type":"boolean","title":"Scan registry"},"scan_startup":{"type":"boolean","title":"Scan startup"},"scan_file_system":{"type":"boolean","title":"Scan file system"},"scan_priority":{"type":"string","title":"Scan priority"},"scan_fixed_drives":{"type":"boolean","title":"Scan fixed drives"},"exclusions":{"type":"array","title":"Exclusions","items":{"type":"object","title":"Items","additionalProperties":true,"properties":{"value":{"type":"string","title":"Value"},"type":{"type":"string","title":"Type"},"exclude_from":{"type":"object","title":"Exclude from","properties":{"exploit_protection":{"type":["boolean","null"],"title":"Exploit protection"},"malware_protection":{"type":["boolean","null"],"title":"Malware protection"},"ransomware_protection":{"type":["boolean","null"],"title":"Ransomware protection"},"suspicious_activity":{"type":["boolean","null"],"title":"Suspicious activity"},"website_protection":{"type":["boolean","null"],"title":"Website protection"}}}}}},"allow_postpone":{"type":["boolean","number"],"title":"Asset Reboot allow postpone"},"delay_in_seconds":{"type":"number","title":"Asset Reboot delay"},"message":{"type":"string","title":"Asset Reboot message"},"reasons":{"type":"number","title":"Asset Reboot reason: 0 RebootStatusClear, 1 RebootStatusDOR, 2 RebootStatusInstall, 3 RebootStatusUpgrade, 4 RebootStatusUnknown"},"restore_items":{"type":"array","title":"Detection IDs to restore from quarantine","items":{"type":"string","title":"Detection ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260653e4fa4f"]}},"delete_items":{"type":"array","title":"Detection IDs to delete from quarantine","items":{"type":"string","title":"Detection ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260653e4fa4f"]}},"application_name":{"type":"string","examples":["Chrome"]},"current_version":{"type":"string","examples":["96.0.4664.45"]},"new_version":{"type":"string","examples":["97.0.2103.01"]},"product":{"type":"number","product":[41]},"vendor":{"type":"string","examples":["Google"]},"architecture":{"type":"string","examples":["x86"]},"language":{"type":"string","examples":["tr-TR"]},"patches":{"type":"array","title":"Options for command.asset.patch","items":{"type":"object","properties":{"category":{"type":"string","examples":["feature_pack"]},"product":{"type":"string","examples":["Silverlight"]},"severity":{"type":"string","examples":["critical"]},"title":{"type":"string","examples":["Microsoft Silverlight (KB4481252)"]},"vendor":{"type":"string","examples":["Microsoft Corporation"]}}}}}},"correlation_id":{"type":"string","title":"Correlation ID of the job (Parent job ID). Could be used to find related child jobs.","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"source_id":{"type":"string","title":"Source ID for relating the new parent job to an existing parent job without add them as children of that parent job.","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Add job to queue response","required":["jobs","total_count"],"properties":{"jobs":{"type":"array","title":"Jobs","items":{"type":"object","title":"Jobs items","required":["machine_id","job_id"],"properties":{"machine_id":{"type":"string","title":"The ID of the endpoint onto which the job was issued (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"job_id":{"type":"string","title":"The ID of the job. You can use this ID to retrieve additional information about the job and track its progress, as well as use it as a reference to handle webhooks notifications (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}},"total_count":{"type":"integer","title":"The total number of issued jobs"},"correlation_id":{"type":"string","title":"Correlation ID of the job (Parent job ID). Could be used to find related child jobs.","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}}}},"tags":["Jobs"],"operationId":"api.v2.rmm.post.jobs"}},"/oneview/v1/accounts/{account_id}/jobs/quarantine/bulk":{"post":{"description":"Placeholder. Please extend this","summary":"Placeholder. Please extend this","deprecated":false,"security":[{"client_credentials":["execute"]},{"user_permissions":["tasks.manage"]}],"status":{"outage":["auth","search_stateful"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"title":"Issue Quarantine Jobs Bulk Request","properties":{"command":{"type":"string","enum":["command.threat.quarantine.remove","command.threat.quarantine.restore"]},"groups":{"type":"array","items":{"type":"object","title":"Search quarantine","properties":{"fields":{"type":"array","title":"Specify which fields will be included in the response","items":{"enum":["trace_id","scan_id","machine_id","machine_name","group_id","group_name","policy_id","policy_name","account_id","account_name","parent_account_id","detection_id","correlation_hash","scanned_at","scanned_at_offset_seconds","reported_at","resource_created_at","resource_modified_at","threat_name","type","path","category","is_rtp_stream_event","updated_at","cleaned_at","parent_detection_id","rule_id","md5","sha256","online","auto_removal_at"],"type":"string"},"default":["trace_id","scan_id","machine_id","account_id"]},"sort_field":{"type":"string","title":"Sort field","enum":["scanned_at","auto_removal_at"],"default":"scanned_at"},"sort_order":{"type":"string","title":"Whether sorting should be ascending or descending","enum":["asc","desc"],"default":"desc"},"page_size":{"type":"number","title":"The page size","minimum":0,"maximum":2000},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]},"constraints":{"type":"array","title":"Quarantine constraints","items":{"title":"Quarantine Constraints","type":"object","oneOf":[{"title":"String (Equals, Not Equals) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"type":"string","title":"Quarantine UID String Fields","enum":["id","scan_id","machine_id","detection_id","parent_detection_id","account_id"]},{"title":"Quarantine Simple String Fields","type":"string","enum":["correlation_hash","threat_name","machine_name","path","md5","sha256","scanned_at_offset_seconds","trace_id","rule_id"]},{"type":"string","title":"Quarantine Enum String Fields","enum":["type","category"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["equals","not_equals"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}},"case_insensitive":{"type":"boolean","default":false}},"if":{"properties":{"field":{"type":"string","title":"Quarantine UID String Fields","enum":["id","scan_id","machine_id","detection_id","parent_detection_id","account_id"]}}},"then":{"properties":{"value":{"type":["string","array"],"format":"uuid","items":{"type":"string","format":"uuid"}}}}},{"title":"String (Contains, Not Contains) Constraints","required":["operator","value"],"properties":{"field":{"title":"Quarantine Simple String Fields","type":"string","enum":["correlation_hash","threat_name","machine_name","path","md5","sha256","scanned_at_offset_seconds","trace_id","rule_id"]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["contains","not_contains"]},"value":{"type":"string","title":"Value to search"},"case_insensitive":{"type":"boolean","default":false}}},{"title":"Boolean (Equals) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"type":"string","title":"Quarantine Boolean Fields","enum":["is_rtp_stream_event"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["equals"]},"value":{"title":"Value to search. Must be true or false","type":"boolean"}}},{"title":"Date (start, end) Constraints","properties":{"field":{"type":"string","title":"Quarantine Date Fields","enum":["scanned_at","reported_at","cleaned_at","updated_at","resource_created_at","resource_modified_at","auto_removal_at"]}},"oneOf":[{"minProperties":1,"title":"Specify Date Range","not":{"anyOf":[{"required":["operator"]},{"required":["value"]}]},"properties":{"start":{"type":"string","format":"date-time","title":"Start Date"},"end":{"type":"string","format":"date-time","title":"End Date"}}},{"title":"Specify Exact Date","not":{"anyOf":[{"required":["start"]},{"required":["end"]}]},"required":["operator","value"],"properties":{"operator":{"type":"string","enum":["equals"]},"value":{"type":["string","array"],"format":"date-time","title":"Value to search","items":{"format":"date-time"}}}}]}]}}}}},"delete_items":{"type":"array"},"restore_items":{"type":"array"}},"if":{"properties":{"command":{"const":"command.threat.quarantine.remove"}}},"then":{"not":{"required":["restore_items"]}},"else":{"not":{"required":["delete_items"]}},"required":["command"],"definitions":{"quarantine_item":{"type":"object","required":["detection_id","machine_id","account_id"],"properties":{"detection_id":{"type":"string","description":"Detection ID"},"machine_id":{"type":"string","description":"Machine ID"},"account_id":{"type":"string","description":"Account ID"}}}}}}}},"responses":{"201":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Issue quarantine job response","required":["jobs","total_count"],"properties":{"jobs":{"type":"array","title":"List of jobs","items":{"type":"object","title":"Job items","required":["machine_id","job_id"],"properties":{"machine_id":{"type":"string","title":"The ID of the endpoint onto which the job was issued (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","format":"uuid"},"job_id":{"type":["string","null"],"title":"The ID of the job. You can use this ID to retrieve additional informations about the job and track its progress, as well as use it as a reference to handle webhooks notifications (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")"}}}},"errors":{"type":"array","title":"tasks not performed","items":{"type":"string","title":"Endpoint ID"}},"total_count":{"type":"integer","title":"The total number of issued jobs"},"processed_items":{"type":"integer","title":"The total number of quarantined items processed"},"correlation_id":{"type":"string","title":"Correlation ID of the job (Parent job ID). Could be used to find related child jobs.","format":"uuid"}}}}}}},"tags":["Jobs"],"operationId":"api.v2.rmm.post.quarantine.jobs.bulk"}},"/oneview/v1/accounts/{account_id}/parent_jobs/export":{"post":{"description":"Export parent jobs.","summary":"Export parent jobs","security":[{"client_credentials":["execute"]},{"user_permissions":["tasks.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Export request","required":["select","format","groups"],"properties":{"groups":{"type":"array","items":{"type":"object","properties":{"constraints":{"type":"array","title":"Parent Jobs constraints","items":{"title":"Parent Jobs Constraints","type":"object","oneOf":[{"title":"String (Equals, Not Equals) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"type":"string","title":"Parent Jobs UID String Fields","enum":["correlation_id","issued_by","source_id","machine_id","group_id"]},{"title":"Parent Jobs Simple String Fields","type":"string","enum":["command","issued_by_name","issued_by_email"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["equals","not_equals"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}},"case_insensitive":{"type":"boolean","default":false}},"if":{"properties":{"field":{"type":"string","title":"Parent Jobs UID String Fields","enum":["correlation_id","issued_by","source_id","machine_id","group_id"]}}},"then":{"properties":{"value":{"type":["string","array"],"format":"uuid","items":{"type":"string","format":"uuid"}}}}},{"title":"String (Contains, Not Contains) Constraints","required":["operator","value"],"properties":{"field":{"title":"Parent Jobs Simple String Fields","type":"string","enum":["command","issued_by_name","issued_by_email"]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["contains","not_contains"]},"value":{"type":"string","title":"Value to search"},"case_insensitive":{"type":"boolean","default":false}}},{"title":"Boolean (Equals) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"type":"string","title":"Parent Jobs Boolean Fields","enum":["is_complete"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["equals"]},"value":{"title":"Value to search. Must be true or false","type":"boolean"}}},{"title":"Date (start, end) Constraints","properties":{"field":{"type":"string","title":"Parent Jobs Date Fields","enum":["created_at","expires_at"]}},"oneOf":[{"minProperties":1,"title":"Specify Date Range","not":{"anyOf":[{"required":["operator"]},{"required":["value"]}]},"properties":{"start":{"type":"string","format":"date-time","title":"Start Date"},"end":{"type":"string","format":"date-time","title":"End Date"}}},{"title":"Specify Exact Date","not":{"anyOf":[{"required":["start"]},{"required":["end"]}]},"required":["operator","value"],"properties":{"operator":{"type":"string","enum":["equals"]},"value":{"type":["string","array"],"format":"date-time","title":"Value to search","items":{"format":"date-time"}}}}]},{"title":"Number Constraints (gt, gte, lt, lte, equals)","properties":{"field":{"type":"string","oneOf":[{"title":"Parent Jobs Number Fields","type":"string","enum":["created","sent","received","processing","timed_out","success","expired","cancelled","failed"]}]}},"oneOf":[{"minProperties":1,"title":"Specify Number Range","not":{"anyOf":[{"required":["operator"]},{"required":["value"]}]},"properties":{"gt":{"type":"number","title":"Greater than"},"lt":{"type":"number","title":"Less than"},"gte":{"type":"number","title":"Greater than or equals"},"lte":{"type":"number","title":"Less than or equals"}}},{"title":"Specify Exact Number","not":{"anyOf":[{"required":["gt"]},{"required":["lt"]},{"required":["gte"]},{"required":["lte"]}]},"required":["operator","value"],"properties":{"operator":{"type":"string","enum":["equals","not_equals"]},"value":{"type":["number","array"],"title":"Value to search","items":{"type":"number"}}}}]}]}}}}},"format":{"type":"string","title":"The output file","enum":["csv","xlsx","html","ods","txt","rtf","json"]},"download":{"type":"boolean","title":"Whether to instruct the client to download the response as a file. Only clients like browsers are supported"},"filename":{"type":"string","title":"The name of the output file if download is set to true"},"type":{"type":"string","title":"The encoding of the output","enum":["string","base64","binary"],"default":"string"},"select":{"type":"array","title":"Which fields to select from the response","items":{"type":"object","title":"Field","properties":{"newField":{"type":"string","title":"the new value"},"field":{"type":"string","title":"The response field to map to a new value","enum":["correlation_id","account_id","account_name","source_id","created_at","expires_at","command","issued_by","issued_by_name","issued_by_email","machine_id","machine_name","is_complete","endpoints","accounts","created","sent","received","processing","timed_out","success","expired","failed","cancelled"]},"mapValues":{"type":"object","title":"Map values to new values"}}}}}}}}},"responses":{"200":{"description":"Successful response"}},"tags":["Jobs"],"operationId":"api.rmm.post.parent_jobs.export"}},"/oneview/v1/accounts/{account_id}/parent_jobs/summary":{"post":{"description":"Get parent jobs summary across multiple accounts.","summary":"Get parent jobs summary","security":[{"client_credentials":["read"]},{"user_permissions":["tasks.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Get parent jobs summary across multiple accounts request body. ","properties":{"constraints":{"type":"array","title":"Parent Jobs Constraints","items":{"title":"Parent Jobs Constraints","type":"object","oneOf":[{"title":"String (Equals, Not Equals) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"type":"string","title":"Parent Jobs UID String Fields","enum":["correlation_id","issued_by","source_id","machine_id","group_id"]},{"title":"Parent Jobs Simple String Fields","type":"string","enum":["command","issued_by_name","issued_by_email"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["equals","not_equals"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}},"case_insensitive":{"type":"boolean","default":false}},"if":{"properties":{"field":{"type":"string","title":"Parent Jobs UID String Fields","enum":["correlation_id","issued_by","source_id","machine_id","group_id"]}}},"then":{"properties":{"value":{"type":["string","array"],"format":"uuid","items":{"type":"string","format":"uuid"}}}}},{"title":"String (Contains, Not Contains) Constraints","required":["operator","value"],"properties":{"field":{"title":"Parent Jobs Simple String Fields","type":"string","enum":["command","issued_by_name","issued_by_email"]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["contains","not_contains"]},"value":{"type":"string","title":"Value to search"},"case_insensitive":{"type":"boolean","default":false}}},{"title":"Boolean (Equals) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"type":"string","title":"Parent Jobs Boolean Fields","enum":["is_complete"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["equals"]},"value":{"title":"Value to search. Must be true or false","type":"boolean"}}},{"title":"Date (start, end) Constraints","properties":{"field":{"type":"string","title":"Parent Jobs Date Fields","enum":["created_at","expires_at"]}},"oneOf":[{"minProperties":1,"title":"Specify Date Range","not":{"anyOf":[{"required":["operator"]},{"required":["value"]}]},"properties":{"start":{"type":"string","format":"date-time","title":"Start Date"},"end":{"type":"string","format":"date-time","title":"End Date"}}},{"title":"Specify Exact Date","not":{"anyOf":[{"required":["start"]},{"required":["end"]}]},"required":["operator","value"],"properties":{"operator":{"type":"string","enum":["equals"]},"value":{"type":["string","array"],"format":"date-time","title":"Value to search","items":{"format":"date-time"}}}}]},{"title":"Number Constraints (gt, gte, lt, lte, equals)","properties":{"field":{"type":"string","oneOf":[{"title":"Parent Jobs Number Fields","type":"string","enum":["created","sent","received","processing","timed_out","success","expired","cancelled","failed"]}]}},"oneOf":[{"minProperties":1,"title":"Specify Number Range","not":{"anyOf":[{"required":["operator"]},{"required":["value"]}]},"properties":{"gt":{"type":"number","title":"Greater than"},"lt":{"type":"number","title":"Less than"},"gte":{"type":"number","title":"Greater than or equals"},"lte":{"type":"number","title":"Less than or equals"}}},{"title":"Specify Exact Number","not":{"anyOf":[{"required":["gt"]},{"required":["lt"]},{"required":["gte"]},{"required":["lte"]}]},"required":["operator","value"],"properties":{"operator":{"type":"string","enum":["equals","not_equals"]},"value":{"type":["number","array"],"title":"Value to search","items":{"type":"number"}}}}]}]}},"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Get parent jobs summary response across multiple account response body.","required":["parent_jobs","parent_completed_jobs","total"],"properties":{"parent_jobs":{"type":"integer","title":"Number of parent jobs"},"parent_completed_jobs":{"type":"integer","title":"Number of parent completed jobs"},"total":{"type":"integer","title":"Total number of child jobs"}},"allOf":[{"type":"object","title":"Job status counts.","required":["created","sent","received","processing","timed_out","success","expired","cancelled","failed"],"properties":{"created":{"type":"integer","title":"Number of jobs with created status"},"sent":{"type":"integer","title":"Number of jobs with sent status"},"received":{"type":"integer","title":"Number of jobs with received status"},"processing":{"type":"integer","title":"Number of jobs with processing status"},"timed_out":{"type":"integer","title":"Number of jobs with timed_out status"},"success":{"type":"integer","title":"Number of jobs with success status"},"expired":{"type":"integer","title":"Number of jobs with expired status"},"cancelled":{"type":"integer","title":"Number of jobs with cancelled status"},"failed":{"type":"integer","title":"Number of jobs with failed status"}}}]}}}}},"tags":["Jobs"],"operationId":"api.rmm.post.parent_jobs.summary"}},"/oneview/v1/accounts/{account_id}/parent_jobs/{correlation_id}/children/reissue":{"post":{"description":"Reissue children jobs.","summary":"Reissue children jobs","security":[{"client_credentials":["execute"]},{"user_permissions":["tasks.manage"]}],"status":{"outage":["auth"]},"parameters":[{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"correlation_id","required":true,"in":"path","description":"Correlation ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Reissue children jobs request body.","properties":{"constraints":{"type":"array","title":"Child Jobs Constraints","items":{"title":"Child Jobs Constraints","type":"object","oneOf":[{"title":"String (Equals, Not Equals) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"type":"string","title":"Child Jobs UID String Fields","enum":["id","issued_by","source_id","reissue_id","machine_id","group_id","cancelled_by"]},{"title":"Child Jobs Simple String Fields","type":"string","enum":["command","issued_by_name","issued_by_email","machine_name"]},{"type":"string","title":"Child Jobs Enum Number Fields","enum":["status"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["equals","not_equals"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}},"case_insensitive":{"type":"boolean","default":false}},"if":{"properties":{"field":{"type":"string","title":"Child Jobs UID String Fields","enum":["id","issued_by","source_id","reissue_id","machine_id","group_id","cancelled_by"]}}},"then":{"properties":{"value":{"type":["string","array"],"format":"uuid","items":{"type":"string","format":"uuid"}}}}},{"title":"String (Contains, Not Contains) Constraints","required":["operator","value"],"properties":{"field":{"title":"Child Jobs Simple String Fields","type":"string","enum":["command","issued_by_name","issued_by_email","machine_name"]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["contains","not_contains"]},"value":{"type":"string","title":"Value to search"},"case_insensitive":{"type":"boolean","default":false}}},{"title":"Date (start, end) Constraints","properties":{"field":{"type":"string","title":"Child Jobs Date Fields","enum":["created_at","expires_at","updated_at"]}},"oneOf":[{"minProperties":1,"title":"Specify Date Range","not":{"anyOf":[{"required":["operator"]},{"required":["value"]}]},"properties":{"start":{"type":"string","format":"date-time","title":"Start Date"},"end":{"type":"string","format":"date-time","title":"End Date"}}},{"title":"Specify Exact Date","not":{"anyOf":[{"required":["start"]},{"required":["end"]}]},"required":["operator","value"],"properties":{"operator":{"type":"string","enum":["equals"]},"value":{"type":["string","array"],"format":"date-time","title":"Value to search","items":{"format":"date-time"}}}}]}]}}}}}}},"responses":{"200":{"description":"Successful response"}},"tags":["Jobs"],"operationId":"api.v2.rmm.reissue.parent_jobs.children"}},"/oneview/v1/accounts/{account_id}/parent_jobs/reissue":{"post":{"description":"Reissue jobs by correlation IDs.","summary":"Reissue jobs by correlation IDs","security":[{"client_credentials":["execute"]},{"user_permissions":["tasks.manage"]}],"status":{"outage":["auth","search_stateful"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Cancel Jobs","required":["correlation_ids"],"properties":{"correlation_ids":{"type":"array","title":"The Parent Job IDs Schema","items":{"type":"string","title":"Parent Job ID","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}}}},"responses":{"201":{"description":"response schema","content":{"application/json":{"schema":{"title":"Reissue parent jobs requst body.","type":"object","required":["success","total_count"],"properties":{"success":{"type":"array","items":{"correlation_id":{"type":"string","format":"uuid"},"jobs":{"type":"array","items":{"type":"object","properties":{"job_id":{"type":"string","format":"uuid"},"account_id":{"type":"string","format":"uuid"},"machine_id":{"type":"string","format":"uuid"}},"required":["job_id","machine_id"]}}}},"errors":{"type":"array","items":{"type":"object","properties":{"job_id":{"type":"string"},"machine_id":{"type":"string","format":"uuid"},"correlation_id":{"type":"string","format":"uuid"},"account_id":{"type":"string","format":"uuid"}},"required":["job_id","machine_id"]}},"total_count":{"type":"integer","title":"The total number of issued jobs"}},"additionalProperties":false}}}}},"tags":["Jobs"],"operationId":"api.v2.rmm.reissue.parent_jobs"}},"/oneview/v1/jobs/search":{"post":{"description":"Search jobs across all your managed accounts. The search will be scoped to the account_ids you specify in the request body.","summary":"Search jobs","security":[{"client_credentials":["read"]},{"user_permissions":["tasks.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"allOf":[{"type":"object","title":"Search jobs request.","properties":{"id":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","title":"Filter the search by a single job ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"command":{"title":"Filter the search by endpoint name command name","oneOf":[{"type":"string","enum":["command.asset.reboot","command.asset.refresh","command.bfp.rules.delete","command.service.diag","command.edr.fileupload","command.edr.unlock.force","command.edr.isolation","command.edr.lock","command.sequence.remediate","command.edr.unlock","command.logging.level.set","command.threat.quarantine.remove","command.threat.quarantine.restore","command.threat.scan","command.threat.scan.remediate","command.policy.refresh","command.protection.update.now","command.service.restart","command.machine.update.now","command.machine.plugin.updateparts","command.edr.restore","command.threat.remediate","command.engine.changeaccounttoken","command.asset.patch","command.asset.updatesoftware","command.asset.uninstallsoftware","command.ars.newconn"]},{"type":"array","items":{"type":"string","enum":["command.asset.reboot","command.asset.refresh","command.bfp.rules.delete","command.service.diag","command.edr.fileupload","command.edr.unlock.force","command.edr.isolation","command.edr.lock","command.sequence.remediate","command.edr.unlock","command.logging.level.set","command.threat.quarantine.remove","command.threat.quarantine.restore","command.threat.scan","command.threat.scan.remediate","command.policy.refresh","command.protection.update.now","command.service.restart","command.machine.update.now","command.machine.plugin.updateparts","command.edr.restore","command.threat.remediate","command.engine.changeaccounttoken","command.asset.patch","command.asset.updatesoftware","command.asset.uninstallsoftware","command.ars.newconn"]},"minItems":1,"uniqueItems":true}],"examples":["command.asset.refresh"]},"endpoint":{"type":"string","title":"Filter the search by endpoint name.","description":"Search for occurrences of the given value in the host_name fully_qualified_host_name and alias"},"machine_id":{"title":"Filter the search Machine Id (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","oneOf":[{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},{"type":"array","items":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"minItems":1,"uniqueItems":true}]},"colleraltion_id":{"type":"string","title":"Filter the search Correlation Id (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","oneOf":[{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},{"type":"array","items":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"minItems":1,"uniqueItems":true}]},"issued_by":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","title":"Filter the search by the id of the user who issued the job (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"issued_by_email":{"type":"string","title":"Filter the search by the email of the user who issued the job. Contains operator."},"cancelled_by":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","title":"Filter the search by the id of the user who cancelled the job (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"issued_at_before":{"type":"string","format":"date-time","title":"Results include jobs that have been issued before the specified date"},"issued_at_after":{"type":"string","format":"date-time","title":"Results include jobs that have been issued after the specified date"},"expires_at_before":{"type":"string","format":"date-time","title":"Results include jobs that expire before the specified date"},"expires_at_after":{"type":"string","format":"date-time","title":"Results include jobs that expire after the specified date"},"status":{"type":"number","title":"Filter the search by status. You can also select multiple statuses using their sum","description":"1:CREATED, 2:SENT, 4:RECEIVED, 8:STARTED, 16:TIMED_OUT, 32:COMPLETED, 64:EXPIRED, 128:FAILED, 256:CANCELLED","minimum":1,"maximum":511},"sort_field":{"type":"string","title":"Sort field","default":"issued_at","enum":["command","issued_by","issued_at","expires_at","status","machine_name","account_name"]},"sort_order":{"type":"string","title":"Sorting direction","default":"asc","enum":["asc","desc"]},"page_size":{"type":"number","title":"The size of the page","minimum":1,"default":100,"maximum":2000},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]},"populate":{"type":"object","title":"The populate object Schema","properties":{"online":{"type":"boolean","title":"Populate the results with endpoint online/offline status"}}}}},{"type":"object","required":["account_ids"],"properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Search jobs result","properties":{"jobs":{"type":"array","items":{"type":"object","additionalProperties":false,"properties":{"id":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","title":"The job ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"account_id":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","title":"The account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"account_name":{"type":"string","title":"The account name"},"command":{"type":"string","title":"Command name"},"data":{"type":"string","title":"JSON stringified additional data"},"expires_at":{"type":"string","format":"date-time","title":"The expire date"},"issued_at":{"type":"string","format":"date-time","title":"The issue date"},"issued_by":{"type":"string","nullable":true,"pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","title":"The id of the user who issued the job (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"issued_by_email":{"type":"string","title":"The email of the user who issued the job"},"issued_by_name":{"type":"string","title":"The name of the user who issued the job"},"cancelled_by":{"type":"string","nullable":true,"pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","title":"The id of the user who cancelled the job (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"cancelled_by_email":{"type":"string","nullable":true,"title":"The email of the user who cancelled the job"},"cancelled_by_name":{"type":"string","nullable":true,"title":"The name of the user who cancelled the job"},"machine_id":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","title":"The machine ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"machine_name":{"type":"string","title":"The machine name"},"status":{"type":"number","enum":[0,1,2,4,8,16,32,64,128,256],"title":"Filter job status. 0:UNKNOWN_STATUS, 1:CREATED, 2:SENT, 4:RECEIVED, 8:STARTED, 16:TIMED_OUT, 32:COMPLETED, 64:EXPIRED, 128:FAILED, 256:CANCELLED"},"updated_at":{"type":"string","format":"date-time","title":"The last update date"},"reason":{"type":"string","nullable":true,"title":"Reason of cancellation or failure"},"relay_state":{"type":"string","title":"Relay state"},"tags":{"type":"object","properties":{"alias":{"type":"string","title":"Alias"}}},"online":{"type":"boolean","title":"Endpoint connection status (populated only if the populate is set)"}}}},"total_count":{"type":"integer","title":"Total Count","description":"Total count of results."},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}},"required":["jobs","next_cursor"]}}}}},"tags":["Jobs"],"operationId":"api.v2.rmm.search.jobs"}},"/oneview/v1/jobs/search-groupby":{"post":{"description":"Search jobs grouped by a specific field across all your managed account.","summary":"Search jobs groupBy","security":[{"client_credentials":["read"]},{"user_permissions":["tasks.view"]}],"status":{"incident":["read_nebula_data"],"outage":["auth"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"allOf":[{"type":"object","title":"The Post Jobs Search GroupBy Request Schema","required":["group_by"],"allOf":[{"type":"object","title":"Search jobs request.","properties":{"id":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","title":"Filter the search by a single job ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"command":{"title":"Filter the search by endpoint name command name","oneOf":[{"type":"string","enum":["command.asset.reboot","command.asset.refresh","command.bfp.rules.delete","command.service.diag","command.edr.fileupload","command.edr.unlock.force","command.edr.isolation","command.edr.lock","command.sequence.remediate","command.edr.unlock","command.logging.level.set","command.threat.quarantine.remove","command.threat.quarantine.restore","command.threat.scan","command.threat.scan.remediate","command.policy.refresh","command.protection.update.now","command.service.restart","command.machine.update.now","command.machine.plugin.updateparts","command.edr.restore","command.threat.remediate","command.engine.changeaccounttoken","command.asset.patch","command.asset.updatesoftware","command.asset.uninstallsoftware","command.ars.newconn"]},{"type":"array","items":{"type":"string","enum":["command.asset.reboot","command.asset.refresh","command.bfp.rules.delete","command.service.diag","command.edr.fileupload","command.edr.unlock.force","command.edr.isolation","command.edr.lock","command.sequence.remediate","command.edr.unlock","command.logging.level.set","command.threat.quarantine.remove","command.threat.quarantine.restore","command.threat.scan","command.threat.scan.remediate","command.policy.refresh","command.protection.update.now","command.service.restart","command.machine.update.now","command.machine.plugin.updateparts","command.edr.restore","command.threat.remediate","command.engine.changeaccounttoken","command.asset.patch","command.asset.updatesoftware","command.asset.uninstallsoftware","command.ars.newconn"]},"minItems":1,"uniqueItems":true}],"examples":["command.asset.refresh"]},"endpoint":{"type":"string","title":"Filter the search by endpoint name.","description":"Search for occurrences of the given value in the host_name fully_qualified_host_name and alias"},"machine_id":{"title":"Filter the search Machine Id (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","oneOf":[{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},{"type":"array","items":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"minItems":1,"uniqueItems":true}]},"colleraltion_id":{"type":"string","title":"Filter the search Correlation Id (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","oneOf":[{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},{"type":"array","items":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"minItems":1,"uniqueItems":true}]},"issued_by":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","title":"Filter the search by the id of the user who issued the job (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"issued_by_email":{"type":"string","title":"Filter the search by the email of the user who issued the job. Contains operator."},"cancelled_by":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","title":"Filter the search by the id of the user who cancelled the job (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"issued_at_before":{"type":"string","format":"date-time","title":"Results include jobs that have been issued before the specified date"},"issued_at_after":{"type":"string","format":"date-time","title":"Results include jobs that have been issued after the specified date"},"expires_at_before":{"type":"string","format":"date-time","title":"Results include jobs that expire before the specified date"},"expires_at_after":{"type":"string","format":"date-time","title":"Results include jobs that expire after the specified date"},"status":{"type":"number","title":"Filter the search by status. You can also select multiple statuses using their sum","description":"1:CREATED, 2:SENT, 4:RECEIVED, 8:STARTED, 16:TIMED_OUT, 32:COMPLETED, 64:EXPIRED, 128:FAILED, 256:CANCELLED","minimum":1,"maximum":511},"sort_field":{"type":"string","title":"Sort field","default":"issued_at","enum":["command","issued_by","issued_at","expires_at","status","machine_name","account_name"]},"sort_order":{"type":"string","title":"Sorting direction","default":"asc","enum":["asc","desc"]},"page_size":{"type":"number","title":"The size of the page","minimum":1,"default":100,"maximum":2000},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]},"populate":{"type":"object","title":"The populate object Schema","properties":{"online":{"type":"boolean","title":"Populate the results with endpoint online/offline status"}}}}}],"properties":{"group_by":{"type":"string","title":"The field to group by","description":"Note: timestamp fields could have repeated values in pagination, if the interval between timestamps is less that 1 second","enum":["id","account_id","account_name","command","expires_at","issued_at","issued_by","issued_by_email","issued_by_name","cancelled_by","machine_id","machine_name","status","updated_at","relay_state"]}}},{"type":"object","required":["account_ids"],"properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"The Post Assets Search GroupBy Response Schema","required":["results","next_cursor"],"properties":{"results":{"type":"array","title":"The distinct values of the group_by field","default":[],"items":{"type":"object","required":["value","total"],"properties":{"value":{"title":"Value of the groupBy field","type":["string","number"]},"machine_name":{"title":"Machine name. It will be displayed when grouping by machine_id","type":"string"},"account_name":{"title":"Account name. It will be displayed when grouping by account_id","type":"string"},"issued_by_name":{"title":"User name. It will be displayed when grouping by issued_by","type":"string"},"issued_by_email":{"title":"User mail. It will be displayed when grouping by issued_by","type":"string"},"total":{"title":"Total count of the elements in the group","type":"number"}}}},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}}}}},"tags":["Jobs"],"operationId":"api.v2.rmm.search.jobs.group"}},"/oneview/v1/policies":{"post":{"description":"Create new Policy","summary":"Create new policy","security":[{"client_credentials":["write"]},{"user_permissions":["policies.create"]}],"status":{"outage":["auth","ov"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"Create a policy","description":"The payload for creating a new policy","examples":[{"policy_name":"Example Policy","etag":"","so_scan_contents_of_compressed_folders":true,"so_detect_signature_less_anomalous_files":true,"so_treat_potentially_unwanted_programs_as_malware":true,"so_treat_potentially_unwanted_modifications_as_malware":true,"so_scan_priority":"high","rtp_web_protection":true,"rtp_exploit_protection":true,"rtp_malware_protection":true,"rtp_behavior_protection":true,"sam_allow_behavioral_monitoring":true,"sam_allow_for_rollback_of_files":true,"sam_lock_unlock_endpoint":true,"sam_isolation_title":"Malware or suspicious application behavior has been detected on this computer.","sam_isolation_message":"Your system has been locked by the IT Department. Please contact the Helpdesk for further information.","sam_rollback_timeframe":48,"sam_rollback_file_size":"54MB","sam_rollback_file_size_server":"100MB","sam_rollback_quota":30,"as_scan_rootkits":true,"as_enable_restart":true,"as_postpone_reboot":true,"as_reboot_delay":{"frequency":"HOURLY","interval":"3"},"as_reboot_message":"In order to completely quarantine the detected threat(s), your computer must be restarted.","as_pause_software_updates":false,"as_pause_software_updates_until":null,"as_delay_protection_updates":180,"as_uninstall_password":"e'5.12/Fx]ny","as_auto_service_updates":true,"deny_edit":false,"eio_allow_run_threat_scan":true,"win_action_center":"default","eio_display_rtp_events":true,"eio_limit_endpoint_agent_control":false,"eio_show_threat_scan_shortcuts":false,"eio_show_tray_icon":true,"eio_show_windows_contextmenu":true,"expire_endpoints":0,"is_default":false,"sam_icon_to_display_custom_message_screen":null,"startup_options":{"timeout":60000,"toggle_on":false},"rdp_settings":{"action":"BLOCK","allowed_failed_attempts":5,"exclude_private_networks":false,"minutes_between_failed_attempts":5,"minutes_to_block":5,"protected_protocols":[{"enabled":false,"name":"RDP","ports":[3389]}]}}],"required":["policy_name","etag","so_scan_contents_of_compressed_folders","so_detect_signature_less_anomalous_files","so_treat_potentially_unwanted_programs_as_malware","so_treat_potentially_unwanted_modifications_as_malware","so_scan_priority","rtp_web_protection","rtp_exploit_protection","rtp_malware_protection","rtp_behavior_protection","sam_allow_behavioral_monitoring","sam_allow_for_rollback_of_files","sam_lock_unlock_endpoint","sam_isolation_title","sam_isolation_message","sam_rollback_timeframe","sam_rollback_file_size","sam_rollback_file_size_server","sam_rollback_quota","as_scan_rootkits","as_enable_restart","as_postpone_reboot","as_reboot_delay","as_reboot_message","as_pause_software_updates","as_delay_protection_updates","as_uninstall_password","as_service_process_protection","win_action_center","startup_options","rdp_settings"],"additionalProperties":true,"properties":{"policy_name":{"type":"string","title":"Name of the Policy","description":"Friendly name for the policy.","default":"","examples":["Example Policy"]},"etag":{"type":"string","title":"Update tag","description":"etags are identifiers that change on every update. Their use is to prevent race conditions when multiple clients are modifying the same resource. Supply this tag empty when creating a policy. When updating, you need to fetch the latest value by GETting a policy. You should always get the current etag before trying to modify a resource that has an etag property.","default":"","examples":[""]},"so_scan_contents_of_compressed_folders":{"type":"boolean","title":"Scan the contents of compressed archives","description":"Scan the contents of compressed archives (e.g. .zip, .rar, etc.). Applies to Threat scans only (Windows only)","default":false,"examples":[true]},"so_detect_signature_less_anomalous_files":{"type":"boolean","title":"Detect signature-less anomalous files","description":"Detect signature-less anomalous files. Applies to Threat scans only (Windows only)","default":false,"examples":[true]},"so_treat_potentially_unwanted_programs_as_malware":{"type":"boolean","title":"PUPs","description":"Treat Potentially Unwanted Programs (PUPs) as malware (Applies to Threat Scans, Hyper Scans, and Real-Time Protection events)","default":false,"examples":[true]},"so_treat_potentially_unwanted_modifications_as_malware":{"type":"boolean","title":"PUMs","description":"Treat Potentially Unwanted Modifications (PUMs) as malware (Applies to Threat Scans, Hyper Scans, and Real-Time Protection events). Windows only.","default":false,"examples":[true]},"so_scan_priority":{"type":"string","title":"CPU priority for scans","description":"Maximum allocation of CPU resources for scans. Mac only","default":"low","examples":["high","medium","low"],"enum":["high","medium","low"]},"rtp_web_protection":{"type":"boolean","title":"The rtp_web_protection schema","default":false,"examples":[true]},"rtp_exploit_protection":{"type":"boolean","title":"Exploit Protection (Real-Time Protections)","description":"Exploit Protection (Real-Time Protections). windows only","default":false,"examples":[true]},"rtp_malware_protection":{"type":"boolean","title":"Malware protection","description":"Malware protection.","default":false,"examples":[true]},"rtp_behavior_protection":{"type":"boolean","title":"Behavior protection","description":"Behavior protection (windows only)","default":false,"examples":[true]},"sam_allow_behavioral_monitoring":{"type":"boolean","title":"Behavioral Monitoring","description":"Allow Behavioral Monitoring for Suspicious Activity on endpoints (Suspicious activity monitoring)","default":false,"examples":[true]},"sam_allow_for_rollback_of_files":{"type":"boolean","title":"Rollback","description":"Allow for Rollback of files modified by any Suspicious Activity","default":false,"examples":[true]},"sam_lock_unlock_endpoint":{"type":"boolean","title":"Endpoint isolation","description":"Allow for locking and unlocking endpoints through isolation.","default":false,"examples":[true]},"sam_isolation_title":{"type":"string","title":"The sam_isolation_title schema","default":"","examples":["Malware or suspicious application behavior has been detected on this computer."]},"sam_isolation_message":{"type":"string","title":"The sam_isolation_message schema","default":"","examples":["Your system has been locked by the IT Department. Please contact the Helpdesk for further information."]},"sam_rollback_timeframe":{"type":"integer","title":"Rollback timeframe","description":"Number of hours to extend the rollback timeframe","default":0,"examples":[48]},"sam_rollback_file_size":{"type":"string","title":"Rollback filesize","description":"Size of rollback file. See examples for correct format.","default":"","examples":["54MB"]},"sam_rollback_file_size_server":{"type":"string","title":"Rollback filesize for servers","description":"Size of rollback file on servers. See examples for correct format.","default":"","examples":["100MB"]},"sam_rollback_quota":{"type":"number","title":"Rollback free disk space quota","description":"Percentage of rollback free disk space quota. From 10 to 70","default":30,"examples":[30]},"sam_icon_to_display_custom_message_screen":{"type":["string","null"],"title":"Endpoint isolation icon","description":"Icon to display on customer message screen (BMP 150x150)","default":null,"examples":["https://nebula-isolation-images-mb-qa.s3.amazonaws.com/92cc3972-f302-48f1-8cf4-fdf552dcbed1"]},"as_scan_rootkits":{"type":"boolean","title":"Scan rootkits","description":"Scan rootkits","default":false,"examples":[true]},"as_enable_restart":{"type":"boolean","title":"Enable restart","description":"Enable restart","default":false,"examples":[true]},"as_postpone_reboot":{"type":"boolean","title":"Postpone reboot","description":"Postpone reboot","default":false,"examples":[true]},"as_reboot_delay":{"type":"object","title":"Reboot delay","description":"Reboot delay","examples":[{"frequency":"HOURLY","interval":"3"}],"required":["frequency","interval"],"properties":{"frequency":{"type":"string","title":"Frequency","description":"","default":"","examples":["HOURLY"]},"interval":{"type":"string","title":"Interval","description":"","default":"","examples":["3"]}}},"as_reboot_message":{"type":"string","title":"Reboot message","description":"Message to show on Endpoint agent.","default":"","examples":["In order to completely quarantine the detected threat(s), your computer must be restarted."]},"as_pause_software_updates":{"type":"boolean","title":"Pause software updates","description":"Windows only. Software updates can be paused up to 30 days.","default":false,"examples":[true]},"as_pause_software_updates_until":{"type":["string","null"],"format":"date-time","title":"Pause software updates until date","description":"Windows only. If as_pause_software_updates=true, Software updates will be paused until the specified date.","default":null,"examples":[null]},"as_delay_protection_updates":{"type":"integer","title":"Delay protection updates","description":"In minutes","default":0,"examples":[180]},"as_uninstall_password":{"type":"string","title":"Tamper protection","description":"Require password to unistall endpoint agent.","default":"","examples":["e'5.12/Fx]ny"]},"as_auto_service_updates":{"type":"boolean","title":"Auto service updates","description":"Automatically download and install ThreatDown application updates.","default":true,"examples":[true]},"win_action_center":{"type":"string","enum":["default","always","never"],"title":"Windows Action Center","description":"Determine how ThreatDown Endpoint Protection should be registered on the endpoints.","default":"default","examples":["default"]},"deny_edit":{"type":"boolean","title":"Deny Edit","default":false,"examples":[false]},"eio_allow_run_threat_scan":{"type":"boolean","title":"User threat scan","description":"Allow users to run a threat scan (all threats will be quarantined automatically)","default":true,"examples":[true]},"eio_display_rtp_events":{"type":"boolean","title":"eio_limit_endpoint_agent_control","description":"Display real-time protection notifications","default":true,"examples":[true]},"eio_limit_endpoint_agent_control":{"type":"boolean","title":"Limit endpoint agent interactions","description":"Allow only administrator level users to interact with the ThreatDown tray","default":false,"examples":[false]},"eio_show_threat_scan_shortcuts":{"type":"boolean","title":"User threat scan","description":"Show ThreatDown shortcuts on start menu and desktop to run threat scans ","default":false,"examples":[false]},"eio_show_tray_icon":{"type":"boolean","title":"Show icon in notification area","description":"Show Malwarebytes icon in notification area","default":true,"examples":[true]},"eio_show_windows_contextmenu":{"type":"boolean","title":"Context menu scans","description":"Show ThreatDown option in context menus","default":true,"examples":[true]},"is_default":{"type":"boolean","title":"true if it is the default policy","default":false,"examples":[false]},"expire_endpoints":{"type":"number","title":"Expire endpoints","default":0,"examples":[0]},"startup_options":{"type":["object","null"],"properties":{"timeout":{"type":"integer"},"toggle_on":{"type":"boolean"}}},"monitoring_options":{"type":"object","properties":{"enabled":{"type":"boolean","title":"Enable suspicious activity monitoring","default":false,"examples":[true,false]}}},"rdp_settings":{"type":"object","properties":{"action":{"type":"string"},"allowed_failed_attempts":{"type":"integer"},"exclude_private_networks":{"type":"boolean"},"minutes_between_failed_attempts":{"type":"integer"},"minutes_to_block":{"type":"integer"},"protected_protocols":{"type":"array","items":{"type":"object","properties":{"enabled":{"type":"boolean"},"name":{"type":"string","title":"Protocol Name","examples":["RDP","FTP","IMAP","MSSQL","POP3","SMTP","SSH"],"enum":["RDP","FTP","IMAP","MSSQL","POP3","SMTP","SSH"]},"ports":{"type":"array","items":{"type":"integer","minimum":1,"maximum":65535}}}}}}},"as_service_process_protection":{"title":"Service and process protection policy","description":"Prevent ThreatDown services and processes from being stopped (Windows 10 only)","type":"boolean","default":true,"examples":[true,false]},"secret_allow_site_override":{"type":"boolean","title":"Allow secret override"}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"Policy","description":"Properties of the policy object","examples":[{"policy_name":"EPP New policy","etag":"f7e45ed2f43b9200a7dfa50ca44035c7","so_scan_contents_of_compressed_folders":true,"so_detect_signature_less_anomalous_files":true,"so_treat_potentially_unwanted_programs_as_malware":true,"so_treat_potentially_unwanted_modifications_as_malware":true,"so_scan_priority":"high","rtp_web_protection":true,"rtp_exploit_protection":true,"rtp_malware_protection":true,"rtp_behavior_protection":true,"sam_allow_behavioral_monitoring":false,"sam_allow_for_rollback_of_files":true,"sam_lock_unlock_endpoint":false,"sam_isolation_title":"Malware or suspicious application behavior has been detected on this computer.","sam_isolation_message":"Your system has been locked by the IT Department. Please contact the Helpdesk for further information.","sam_rollback_timeframe":48,"sam_rollback_file_size":"20MB","sam_rollback_file_size_server":"100MB","sam_rollback_quota":30,"as_scan_rootkits":false,"as_enable_restart":false,"as_postpone_reboot":true,"as_reboot_delay":{"frequency":"HOURLY","interval":1},"as_reboot_message":"In order to completely quarantine the detected threat(s), your computer must be restarted.","as_pause_software_updates":true,"as_delay_protection_updates":-1,"as_uninstall_password":"","as_service_process_protection":true,"as_auto_service_updates":true,"policy_id":"39313561336334612D333933382D343530332D623937332D613737643238623038613132","updated_by":"example@domain.com","update_at":"2020-04-21T22:18:01.937+0000","created_by":"example@domain.com","created_at":"2020-04-21T22:18:01.937+0000","updated_by_fullname":"Saif Test","created_by_fullname":"Saif Test","is_default":true,"deny_edit":false,"sites":["849337a3-962c-4187-8667-67f769378726"],"as_pause_software_updates_until":null,"sam_icon_to_display_custom_message_screen":null,"exclusions":[{"exclusion_value":"C:\\Windows\\Foo\\Bar.exe","exclusion_type":1,"policy_ids":[],"exploit_protection":false,"malware_protection":true,"ransomware_protection":true,"website_protection":false,"suspicious_activity":true,"account_level":true,"enabled":true,"comment":"dwadaw","etag":"d5381975fcf77e55264e40d64af455a7","exclusion_id":"61646536343938322D303164652D343932362D623535322D636339366431383433373332","updated_by":null,"updated_at":null,"created_by":null,"created_at":null,"updated_by_fullname":null,"created_by_fullname":null}],"win_action_center":"default","startup_options":{"timeout":60000,"toggle_on":false},"rdp_settings":{"action":"BLOCK","allowed_failed_attempts":5,"exclude_private_networks":false,"minutes_between_failed_attempts":5,"minutes_to_block":5,"protected_protocols":[{"enabled":false,"name":"RDP","ports":[3389]}]}}],"required":["policy_name","etag","so_scan_contents_of_compressed_folders","so_detect_signature_less_anomalous_files","so_treat_potentially_unwanted_programs_as_malware","so_treat_potentially_unwanted_modifications_as_malware","so_scan_priority","rtp_web_protection","rtp_exploit_protection","rtp_malware_protection","rtp_behavior_protection","sam_allow_behavioral_monitoring","sam_allow_for_rollback_of_files","sam_lock_unlock_endpoint","sam_isolation_title","sam_isolation_message","sam_rollback_timeframe","sam_rollback_file_size","sam_rollback_file_size_server","sam_rollback_quota","as_scan_rootkits","as_enable_restart","as_postpone_reboot","as_reboot_delay","as_reboot_message","as_pause_software_updates","as_delay_protection_updates","as_uninstall_password","as_service_process_protection","policy_id","update_at","created_at","is_default","win_action_center","startup_options","rdp_settings"],"properties":{"policy_name":{"type":"string","title":"Name of the Policy","description":"Friendly name for the policy.","default":"","examples":["Example Policy"]},"etag":{"type":"string","title":"Update tag","description":"etags are identifiers that change on every update. Their use is to prevent race conditions when multiple clients are modifying the same resource. Supply this tag empty when creating a policy. When updating, you need to fetch the latest value by GETting a policy. You should always get the current etag before trying to modify a resource that has an etag property.","examples":[""]},"so_scan_contents_of_compressed_folders":{"type":"boolean","title":"Scan the contents of compressed archives","description":"Scan the contents of compressed archives (e.g. .zip, .rar, etc.). Applies to Threat scans only (Windows only)","default":false,"examples":[true]},"so_detect_signature_less_anomalous_files":{"type":"boolean","title":"Detect signature-less anomalous files","description":"Detect signature-less anomalous files. Applies to Threat scans only (Windows only)","default":false,"examples":[true]},"so_treat_potentially_unwanted_programs_as_malware":{"type":"boolean","title":"PUPs","description":"Treat Potentially Unwanted Programs (PUPs) as malware (Applies to Threat Scans, Hyper Scans, and Real-Time Protection events)","default":false,"examples":[true]},"so_treat_potentially_unwanted_modifications_as_malware":{"type":"boolean","title":"PUMs","description":"Treat Potentially Unwanted Modifications (PUMs) as malware (Applies to Threat Scans, Hyper Scans, and Real-Time Protection events). Windows only.","default":false,"examples":[true]},"so_scan_priority":{"type":"string","title":"CPU priority for scans","description":"Maximum allocation of CPU resources for scans. Mac only","default":"low","examples":["high","medium","low"],"enum":["high","medium","low"]},"rtp_web_protection":{"type":"boolean","title":"Real time web protection","description":"Web protection (Real-Time Protections). windows only","default":false,"examples":[true]},"rtp_exploit_protection":{"type":"boolean","title":"Real time exploit protection","description":"Exploit protection","default":false,"examples":[true]},"rtp_malware_protection":{"type":"boolean","title":"Malware protection","description":"Malware protection.","default":false,"examples":[true]},"rtp_behavior_protection":{"type":"boolean","title":"Behavior protection","description":"Behavior protection (windows only)","default":false,"examples":[true]},"sam_allow_behavioral_monitoring":{"type":"boolean","title":"Behavioral Monitoring","description":"Allow Behavioral Monitoring for Suspicious Activity on endpoints (Suspicious activity monitoring)","default":false,"examples":[true]},"sam_allow_for_rollback_of_files":{"type":"boolean","title":"Rollback","description":"Allow for Rollback of files modified by any Suspicious Activity","default":false,"examples":[true]},"sam_lock_unlock_endpoint":{"type":"boolean","title":"Endpoint isolation","description":"Allow for locking and unlocking endpoints through isolation.","default":false,"examples":[true]},"sam_isolation_title":{"type":"string","title":"The sam_isolation_title schema","default":"","examples":["Malware or suspicious application behavior has been detected on this computer."]},"sam_isolation_message":{"type":"string","title":"The sam_isolation_message schema","default":"","examples":["Your system has been locked by the IT Department. Please contact the Helpdesk for further information."]},"sam_rollback_timeframe":{"type":"integer","title":"Rollback timeframe","description":"Number of hours to extend the rollback timeframe","default":0,"examples":[48]},"sam_rollback_file_size":{"type":"string","title":"Rollback filesize","description":"Size of rollback file. See examples for correct format.","default":"","examples":["54MB"]},"sam_rollback_file_size_server":{"type":"string","title":"Rollback filesize for servers","description":"Size of rollback file on servers. See examples for correct format.","default":"","examples":["100MB"]},"sam_rollback_quota":{"type":"number","title":"Rollback free disk space quota","description":"Percentage of rollback free disk space quota. From 10 to 70","default":30,"examples":[30]},"sam_icon_to_display_custom_message_screen":{"type":["string","null"],"title":"Endpoint isolation icon","description":"Icon to display on customer message screen (BMP 150x150)","examples":["https://nebula-isolation-images-mb-qa.s3.amazonaws.com/92cc3972-f302-48f1-8cf4-fdf552dcbed1"]},"as_scan_rootkits":{"type":"boolean","title":"Scan rootkits","description":"Scan rootkits","default":false,"examples":[true]},"as_enable_restart":{"type":"boolean","title":"Enable restart","description":"Enable restart","default":false,"examples":[true]},"as_postpone_reboot":{"type":"boolean","title":"Postpone reboot","description":"Postpone reboot","default":false,"examples":[true]},"as_reboot_delay":{"type":"object","title":"Reboot delay","description":"Reboot delay","examples":[{"frequency":"HOURLY","interval":3}],"required":["frequency","interval"],"properties":{"frequency":{"type":"string","title":"Frequency","description":"","default":"","examples":["HOURLY"]},"interval":{"type":"number","title":"Interval","description":"","default":0,"examples":[3]}}},"as_reboot_message":{"type":"string","title":"Reboot message","description":"Message to show on Endpoint agent.","default":"","examples":["In order to completely quarantine the detected threat(s), your computer must be restarted."]},"as_pause_software_updates":{"type":"boolean","title":"Pause software updates","description":"Windows only. Software updates can be paused up to 30 days.","default":false,"examples":[true]},"as_pause_software_updates_until":{"type":["string","null"],"format":"date-time","title":"Pause software updates until date","description":"Windows only. If as_pause_software_updates=true, Software updates will be paused until the specified date.","default":null,"examples":[null]},"as_delay_protection_updates":{"type":["integer","null"],"title":"Delay protection updates","description":"In minutes","default":0,"examples":[180]},"as_uninstall_password":{"type":["string","null"],"title":"Tamper protection","description":"Require password to unistall endpoint agent.","default":"","examples":["e'5.12/Fx]ny"]},"as_auto_service_updates":{"type":"boolean","title":"Auto service updates","description":"Automatically download and install ThreatDown application updates.","default":true,"examples":[true]},"policy_id":{"type":"string","title":"Id","description":"Unique identifier of this policiy","default":"","examples":["39313561336334612D333933382D343530332D623937332D613737643238623038613132"]},"update_at":{"type":"string","title":"Updated at","description":"When this policy was updated","default":"","examples":["2020-04-21T22:18:01.937+0000"]},"created_at":{"type":"string","title":"Create at","description":"When this policy was creates","default":"","examples":["2020-04-21T22:18:01.937+0000"]},"is_default":{"type":"boolean","title":"Default","description":"Whether this is set as default policy (see promote endpoint)","default":false,"examples":[true]},"sites":{"type":"array","title":"Sites","description":"List of sites to which this policy is associated","examples":[["849337a3-962c-4187-8667-67f769378726"]],"items":{"type":"string"}},"exclusions":{"type":"array","title":"Exclusions","description":"List of exclusions associated with this policy","examples":[[{"exclusion_value":"C:\\Windows\\Foo\\Bar.exe","exclusion_type":1,"policy_ids":[],"exploit_protection":false,"malware_protection":true,"ransomware_protection":true,"website_protection":false,"suspicious_activity":true,"account_level":true,"enabled":true,"comment":"dwadaw","etag":"d5381975fcf77e55264e40d64af455a7","exclusion_id":"61646536343938322D303164652D343932362D623535322D636339366431383433373332","updated_by":null,"updated_at":null,"created_by":null,"created_at":null,"updated_by_fullname":null,"created_by_fullname":null}]],"items":{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"Properties of one exclusion","description":"Properties of one exclusion","additionalProperties":false,"examples":[{"exclusion_value":"exclude","exclusion_type":5,"policy_ids":["36376136326434342D613164382D346633622D616335662D623566383435323264303730","39313561336334612D333933382D343530332D623937332D613737643238623038613132"],"exploit_protection":false,"malware_protection":true,"ransomware_protection":false,"website_protection":false,"suspicious_activity":false,"account_level":false,"enabled":true,"comment":"hello","etag":"ebf2778dfcf61a83053160ce2bfeb6c5","exclusion_id":"61656333653261372D653539662D346666652D393239622D323465646236386266353332","updated_by":"rrais@yopmail.com","updated_at":"2020-05-26T11:14:54.302+0000","created_by":"rrais@yopmail.com","created_at":"2020-05-26T11:14:54.302+0000"}],"required":["exclusion_value","exclusion_type","policy_ids","exploit_protection","malware_protection","ransomware_protection","website_protection","suspicious_activity","account_level","enabled","comment","etag","exclusion_id","updated_at","created_at"],"properties":{"exclusion_value":{"type":"string","title":"Value","description":"Value of this exclusion","default":"","examples":["string"]},"exclusion_type":{"type":"integer","title":"The exclusion_type schema","description":"1: Exclusion for file path, 2: Exclusion for folder path, 3: Exclusion for wildcard path, 4: Exclusion for registry, 5: Exclusion for file extensions, 6: Exclusion for web domain, 7: Exclusion for web IP, 8: Exclusion for Web Monitoring, 13: Exclusion for hash, 14: Exclusion for command line","default":1,"enum":[1,2,3,4,5,6,7,8,13,14],"examples":[1]},"policy_ids":{"type":"array","title":"Policies identifier","description":"If its not account level, specify policy to apply this exclusion to","examples":[["string"]],"items":{"type":"string"}},"exploit_protection":{"type":"boolean","title":"Exploit Protection","description":"Whether this exclusion applies for exploit protection.","default":false,"examples":[true]},"malware_protection":{"type":"boolean","title":"Malware Protection","description":"Whether this exclusion applies for malware protection.","default":false,"examples":[true]},"ransomware_protection":{"type":"boolean","title":"Ransomware Protection","description":"Whether this exclusion applies for ransomware protection.","default":false,"examples":[true]},"website_protection":{"type":"boolean","title":"Website protection","description":"Whether this exclusion applies for website protection.","default":false,"examples":[true]},"suspicious_activity":{"type":"boolean","title":"Suspicious activity","description":"Whether this exclusion applies for suspicious activity","default":false,"examples":[true]},"account_level":{"type":"boolean","title":"Account level","description":"Whether to apply this exclusion to all policies","default":true,"examples":[true]},"enabled":{"type":"boolean","title":"Enabled","description":"Boolean indicating whether this exclusion is enabled or not","default":false,"examples":[true]},"comment":{"type":"string","title":"Comment","description":"A comment about this exclusion","default":"","examples":["string"]},"etag":{"type":"string","title":"Update tag","description":"etags are identifiers that change on every update. Their use is to prevent race conditions when multiple clients are modifying the same resource. Supply this tag empty when creating a exclusion. When updating, you need to fetch the latest value by GETting an exclusion. You should always get the current etag before trying to modify a resource that has an etag property.","default":"","examples":[""]},"exclusion_id":{"type":"string","title":"ID of the exclusion","description":"Use this identifier for REST operations.","default":"","examples":["61656333653261372D653539662D346666652D393239622D323465646236386266353332"]},"updated_at":{"type":["string","null"],"title":"Updated at","description":"Last time this exclusion was updated.","default":"","examples":["2020-05-26T11:14:54.302+0000"]},"created_at":{"type":["string","null"],"title":"Created at","description":"When this exclusion was created","default":"","examples":["2020-05-26T11:14:54.302+0000"]},"updated_by":{"type":["string","null"],"title":"Updated by","description":"Last user that updated the exclusion","default":""},"created_by":{"type":["string","null"],"title":"Created by","description":"User that created the exclusion","default":""},"updated_by_fullname":{"type":["string","null"],"title":"Updated by full name","description":"Last user full name that updated the exclusion","default":""},"created_by_fullname":{"type":["string","null"],"title":"Created by full name","description":"User full name that created the exclusion","default":""}}}},"win_action_center":{"type":["string","null"],"enum":["default","always","never",null],"title":"Windows Action Center","description":"Determine how ThreatDown Endpoint Protection should be registered on the endpoints.","default":"default","examples":["default"]},"deny_edit":{"type":"boolean","title":"Deny Edit","default":false,"examples":[false]},"eio_allow_run_threat_scan":{"type":["boolean","null"],"title":"User threat scan","description":"Allow users to run a threat scan (all threats will be quarantined automatically)","examples":[true]},"eio_display_rtp_events":{"type":["boolean","null"],"title":"eio_display_rtp_events","description":"Display real-time protection notifications","examples":[true]},"eio_limit_endpoint_agent_control":{"type":["boolean","null"],"title":"Limit endpoint agent interactions","description":"Allow only administrator level users to interact with the ThreatDown tray","examples":[false]},"eio_show_threat_scan_shortcuts":{"type":["boolean","null"],"title":"User threat scan","description":"Show ThreatDown shortcuts on start menu and desktop to run threat scans ","examples":[false]},"eio_show_tray_icon":{"type":"boolean","title":"Show icon in notification area","description":"Show Malwarebytes icon in notification area","examples":[true]},"eio_show_windows_contextmenu":{"type":["boolean","null"],"title":"Context menu scans","description":"Show ThreatDown option in context menus","examples":[true]},"expire_endpoints":{"type":"number","title":"Expire endpoints","examples":[0]},"startup_options":{"type":["object","null"],"properties":{"timeout":{"type":"integer"},"toggle_on":{"type":"boolean"}}},"rdp_settings":{"type":"object","properties":{"action":{"type":"string"},"allowed_failed_attempts":{"type":"integer"},"exclude_private_networks":{"type":"boolean"},"minutes_between_failed_attempts":{"type":"integer"},"minutes_to_block":{"type":"integer"},"protected_protocols":{"type":"array","items":{"type":"object","properties":{"enabled":{"type":"boolean"},"name":{"type":"string"},"ports":{"type":"array","items":{"type":"integer"}}}}}}},"as_service_process_protection":{"title":"Service and process protection policy","description":"Prevent ThreatDown services and processes from being stopped (Windows 10 only)","type":"boolean","default":true,"examples":[true,false]},"secret_allow_site_override":{"type":"boolean","title":"Allow secret override"}}}}}}},"tags":["Policies"],"operationId":"api.v2.oneview.create.policy"},"get":{"description":"Get all policies","summary":"Get all policies","security":[{"client_credentials":["read"]},{"user_permissions":["policies.view"]}],"status":{"outage":["auth","ov"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"Policies response schema","description":"The expected response when getting all policies","properties":{"policies":{"type":"array","items":{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"Policy","description":"Properties of the policy object","examples":[{"policy_name":"EPP New policy","etag":"f7e45ed2f43b9200a7dfa50ca44035c7","so_scan_contents_of_compressed_folders":true,"so_detect_signature_less_anomalous_files":true,"so_treat_potentially_unwanted_programs_as_malware":true,"so_treat_potentially_unwanted_modifications_as_malware":true,"so_scan_priority":"high","rtp_web_protection":true,"rtp_exploit_protection":true,"rtp_malware_protection":true,"rtp_behavior_protection":true,"sam_allow_behavioral_monitoring":false,"sam_allow_for_rollback_of_files":true,"sam_lock_unlock_endpoint":false,"sam_isolation_title":"Malware or suspicious application behavior has been detected on this computer.","sam_isolation_message":"Your system has been locked by the IT Department. Please contact the Helpdesk for further information.","sam_rollback_timeframe":48,"sam_rollback_file_size":"20MB","sam_rollback_file_size_server":"100MB","sam_rollback_quota":30,"as_scan_rootkits":false,"as_enable_restart":false,"as_postpone_reboot":true,"as_reboot_delay":{"frequency":"HOURLY","interval":1},"as_reboot_message":"In order to completely quarantine the detected threat(s), your computer must be restarted.","as_pause_software_updates":true,"as_delay_protection_updates":-1,"as_uninstall_password":"","as_service_process_protection":true,"as_auto_service_updates":true,"policy_id":"39313561336334612D333933382D343530332D623937332D613737643238623038613132","updated_by":"example@domain.com","update_at":"2020-04-21T22:18:01.937+0000","created_by":"example@domain.com","created_at":"2020-04-21T22:18:01.937+0000","updated_by_fullname":"Saif Test","created_by_fullname":"Saif Test","is_default":true,"deny_edit":false,"sites":["849337a3-962c-4187-8667-67f769378726"],"as_pause_software_updates_until":null,"sam_icon_to_display_custom_message_screen":null,"exclusions":[{"exclusion_value":"C:\\Windows\\Foo\\Bar.exe","exclusion_type":1,"policy_ids":[],"exploit_protection":false,"malware_protection":true,"ransomware_protection":true,"website_protection":false,"suspicious_activity":true,"account_level":true,"enabled":true,"comment":"dwadaw","etag":"d5381975fcf77e55264e40d64af455a7","exclusion_id":"61646536343938322D303164652D343932362D623535322D636339366431383433373332","updated_by":null,"updated_at":null,"created_by":null,"created_at":null,"updated_by_fullname":null,"created_by_fullname":null}],"win_action_center":"default","startup_options":{"timeout":60000,"toggle_on":false},"rdp_settings":{"action":"BLOCK","allowed_failed_attempts":5,"exclude_private_networks":false,"minutes_between_failed_attempts":5,"minutes_to_block":5,"protected_protocols":[{"enabled":false,"name":"RDP","ports":[3389]}]}}],"required":["policy_name","etag","so_scan_contents_of_compressed_folders","so_detect_signature_less_anomalous_files","so_treat_potentially_unwanted_programs_as_malware","so_treat_potentially_unwanted_modifications_as_malware","so_scan_priority","rtp_web_protection","rtp_exploit_protection","rtp_malware_protection","rtp_behavior_protection","sam_allow_behavioral_monitoring","sam_allow_for_rollback_of_files","sam_lock_unlock_endpoint","sam_isolation_title","sam_isolation_message","sam_rollback_timeframe","sam_rollback_file_size","sam_rollback_file_size_server","sam_rollback_quota","as_scan_rootkits","as_enable_restart","as_postpone_reboot","as_reboot_delay","as_reboot_message","as_pause_software_updates","as_delay_protection_updates","as_uninstall_password","as_service_process_protection","policy_id","update_at","created_at","is_default","win_action_center","startup_options","rdp_settings"],"properties":{"policy_name":{"type":"string","title":"Name of the Policy","description":"Friendly name for the policy.","default":"","examples":["Example Policy"]},"etag":{"type":"string","title":"Update tag","description":"etags are identifiers that change on every update. Their use is to prevent race conditions when multiple clients are modifying the same resource. Supply this tag empty when creating a policy. When updating, you need to fetch the latest value by GETting a policy. You should always get the current etag before trying to modify a resource that has an etag property.","examples":[""]},"so_scan_contents_of_compressed_folders":{"type":"boolean","title":"Scan the contents of compressed archives","description":"Scan the contents of compressed archives (e.g. .zip, .rar, etc.). Applies to Threat scans only (Windows only)","default":false,"examples":[true]},"so_detect_signature_less_anomalous_files":{"type":"boolean","title":"Detect signature-less anomalous files","description":"Detect signature-less anomalous files. Applies to Threat scans only (Windows only)","default":false,"examples":[true]},"so_treat_potentially_unwanted_programs_as_malware":{"type":"boolean","title":"PUPs","description":"Treat Potentially Unwanted Programs (PUPs) as malware (Applies to Threat Scans, Hyper Scans, and Real-Time Protection events)","default":false,"examples":[true]},"so_treat_potentially_unwanted_modifications_as_malware":{"type":"boolean","title":"PUMs","description":"Treat Potentially Unwanted Modifications (PUMs) as malware (Applies to Threat Scans, Hyper Scans, and Real-Time Protection events). Windows only.","default":false,"examples":[true]},"so_scan_priority":{"type":"string","title":"CPU priority for scans","description":"Maximum allocation of CPU resources for scans. Mac only","default":"low","examples":["high","medium","low"],"enum":["high","medium","low"]},"rtp_web_protection":{"type":"boolean","title":"Real time web protection","description":"Web protection (Real-Time Protections). windows only","default":false,"examples":[true]},"rtp_exploit_protection":{"type":"boolean","title":"Real time exploit protection","description":"Exploit protection","default":false,"examples":[true]},"rtp_malware_protection":{"type":"boolean","title":"Malware protection","description":"Malware protection.","default":false,"examples":[true]},"rtp_behavior_protection":{"type":"boolean","title":"Behavior protection","description":"Behavior protection (windows only)","default":false,"examples":[true]},"sam_allow_behavioral_monitoring":{"type":"boolean","title":"Behavioral Monitoring","description":"Allow Behavioral Monitoring for Suspicious Activity on endpoints (Suspicious activity monitoring)","default":false,"examples":[true]},"sam_allow_for_rollback_of_files":{"type":"boolean","title":"Rollback","description":"Allow for Rollback of files modified by any Suspicious Activity","default":false,"examples":[true]},"sam_lock_unlock_endpoint":{"type":"boolean","title":"Endpoint isolation","description":"Allow for locking and unlocking endpoints through isolation.","default":false,"examples":[true]},"sam_isolation_title":{"type":"string","title":"The sam_isolation_title schema","default":"","examples":["Malware or suspicious application behavior has been detected on this computer."]},"sam_isolation_message":{"type":"string","title":"The sam_isolation_message schema","default":"","examples":["Your system has been locked by the IT Department. Please contact the Helpdesk for further information."]},"sam_rollback_timeframe":{"type":"integer","title":"Rollback timeframe","description":"Number of hours to extend the rollback timeframe","default":0,"examples":[48]},"sam_rollback_file_size":{"type":"string","title":"Rollback filesize","description":"Size of rollback file. See examples for correct format.","default":"","examples":["54MB"]},"sam_rollback_file_size_server":{"type":"string","title":"Rollback filesize for servers","description":"Size of rollback file on servers. See examples for correct format.","default":"","examples":["100MB"]},"sam_rollback_quota":{"type":"number","title":"Rollback free disk space quota","description":"Percentage of rollback free disk space quota. From 10 to 70","default":30,"examples":[30]},"sam_icon_to_display_custom_message_screen":{"type":["string","null"],"title":"Endpoint isolation icon","description":"Icon to display on customer message screen (BMP 150x150)","examples":["https://nebula-isolation-images-mb-qa.s3.amazonaws.com/92cc3972-f302-48f1-8cf4-fdf552dcbed1"]},"as_scan_rootkits":{"type":"boolean","title":"Scan rootkits","description":"Scan rootkits","default":false,"examples":[true]},"as_enable_restart":{"type":"boolean","title":"Enable restart","description":"Enable restart","default":false,"examples":[true]},"as_postpone_reboot":{"type":"boolean","title":"Postpone reboot","description":"Postpone reboot","default":false,"examples":[true]},"as_reboot_delay":{"type":"object","title":"Reboot delay","description":"Reboot delay","examples":[{"frequency":"HOURLY","interval":3}],"required":["frequency","interval"],"properties":{"frequency":{"type":"string","title":"Frequency","description":"","default":"","examples":["HOURLY"]},"interval":{"type":"number","title":"Interval","description":"","default":0,"examples":[3]}}},"as_reboot_message":{"type":"string","title":"Reboot message","description":"Message to show on Endpoint agent.","default":"","examples":["In order to completely quarantine the detected threat(s), your computer must be restarted."]},"as_pause_software_updates":{"type":"boolean","title":"Pause software updates","description":"Windows only. Software updates can be paused up to 30 days.","default":false,"examples":[true]},"as_pause_software_updates_until":{"type":["string","null"],"format":"date-time","title":"Pause software updates until date","description":"Windows only. If as_pause_software_updates=true, Software updates will be paused until the specified date.","default":null,"examples":[null]},"as_delay_protection_updates":{"type":["integer","null"],"title":"Delay protection updates","description":"In minutes","default":0,"examples":[180]},"as_uninstall_password":{"type":["string","null"],"title":"Tamper protection","description":"Require password to unistall endpoint agent.","default":"","examples":["e'5.12/Fx]ny"]},"as_auto_service_updates":{"type":"boolean","title":"Auto service updates","description":"Automatically download and install ThreatDown application updates.","default":true,"examples":[true]},"policy_id":{"type":"string","title":"Id","description":"Unique identifier of this policiy","default":"","examples":["39313561336334612D333933382D343530332D623937332D613737643238623038613132"]},"update_at":{"type":"string","title":"Updated at","description":"When this policy was updated","default":"","examples":["2020-04-21T22:18:01.937+0000"]},"created_at":{"type":"string","title":"Create at","description":"When this policy was creates","default":"","examples":["2020-04-21T22:18:01.937+0000"]},"is_default":{"type":"boolean","title":"Default","description":"Whether this is set as default policy (see promote endpoint)","default":false,"examples":[true]},"sites":{"type":"array","title":"Sites","description":"List of sites to which this policy is associated","examples":[["849337a3-962c-4187-8667-67f769378726"]],"items":{"type":"string"}},"exclusions":{"type":"array","title":"Exclusions","description":"List of exclusions associated with this policy","examples":[[{"exclusion_value":"C:\\Windows\\Foo\\Bar.exe","exclusion_type":1,"policy_ids":[],"exploit_protection":false,"malware_protection":true,"ransomware_protection":true,"website_protection":false,"suspicious_activity":true,"account_level":true,"enabled":true,"comment":"dwadaw","etag":"d5381975fcf77e55264e40d64af455a7","exclusion_id":"61646536343938322D303164652D343932362D623535322D636339366431383433373332","updated_by":null,"updated_at":null,"created_by":null,"created_at":null,"updated_by_fullname":null,"created_by_fullname":null}]],"items":{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"Properties of one exclusion","description":"Properties of one exclusion","additionalProperties":false,"examples":[{"exclusion_value":"exclude","exclusion_type":5,"policy_ids":["36376136326434342D613164382D346633622D616335662D623566383435323264303730","39313561336334612D333933382D343530332D623937332D613737643238623038613132"],"exploit_protection":false,"malware_protection":true,"ransomware_protection":false,"website_protection":false,"suspicious_activity":false,"account_level":false,"enabled":true,"comment":"hello","etag":"ebf2778dfcf61a83053160ce2bfeb6c5","exclusion_id":"61656333653261372D653539662D346666652D393239622D323465646236386266353332","updated_by":"rrais@yopmail.com","updated_at":"2020-05-26T11:14:54.302+0000","created_by":"rrais@yopmail.com","created_at":"2020-05-26T11:14:54.302+0000"}],"required":["exclusion_value","exclusion_type","policy_ids","exploit_protection","malware_protection","ransomware_protection","website_protection","suspicious_activity","account_level","enabled","comment","etag","exclusion_id","updated_at","created_at"],"properties":{"exclusion_value":{"type":"string","title":"Value","description":"Value of this exclusion","default":"","examples":["string"]},"exclusion_type":{"type":"integer","title":"The exclusion_type schema","description":"1: Exclusion for file path, 2: Exclusion for folder path, 3: Exclusion for wildcard path, 4: Exclusion for registry, 5: Exclusion for file extensions, 6: Exclusion for web domain, 7: Exclusion for web IP, 8: Exclusion for Web Monitoring, 13: Exclusion for hash, 14: Exclusion for command line","default":1,"enum":[1,2,3,4,5,6,7,8,13,14],"examples":[1]},"policy_ids":{"type":"array","title":"Policies identifier","description":"If its not account level, specify policy to apply this exclusion to","examples":[["string"]],"items":{"type":"string"}},"exploit_protection":{"type":"boolean","title":"Exploit Protection","description":"Whether this exclusion applies for exploit protection.","default":false,"examples":[true]},"malware_protection":{"type":"boolean","title":"Malware Protection","description":"Whether this exclusion applies for malware protection.","default":false,"examples":[true]},"ransomware_protection":{"type":"boolean","title":"Ransomware Protection","description":"Whether this exclusion applies for ransomware protection.","default":false,"examples":[true]},"website_protection":{"type":"boolean","title":"Website protection","description":"Whether this exclusion applies for website protection.","default":false,"examples":[true]},"suspicious_activity":{"type":"boolean","title":"Suspicious activity","description":"Whether this exclusion applies for suspicious activity","default":false,"examples":[true]},"account_level":{"type":"boolean","title":"Account level","description":"Whether to apply this exclusion to all policies","default":true,"examples":[true]},"enabled":{"type":"boolean","title":"Enabled","description":"Boolean indicating whether this exclusion is enabled or not","default":false,"examples":[true]},"comment":{"type":"string","title":"Comment","description":"A comment about this exclusion","default":"","examples":["string"]},"etag":{"type":"string","title":"Update tag","description":"etags are identifiers that change on every update. Their use is to prevent race conditions when multiple clients are modifying the same resource. Supply this tag empty when creating a exclusion. When updating, you need to fetch the latest value by GETting an exclusion. You should always get the current etag before trying to modify a resource that has an etag property.","default":"","examples":[""]},"exclusion_id":{"type":"string","title":"ID of the exclusion","description":"Use this identifier for REST operations.","default":"","examples":["61656333653261372D653539662D346666652D393239622D323465646236386266353332"]},"updated_at":{"type":["string","null"],"title":"Updated at","description":"Last time this exclusion was updated.","default":"","examples":["2020-05-26T11:14:54.302+0000"]},"created_at":{"type":["string","null"],"title":"Created at","description":"When this exclusion was created","default":"","examples":["2020-05-26T11:14:54.302+0000"]},"updated_by":{"type":["string","null"],"title":"Updated by","description":"Last user that updated the exclusion","default":""},"created_by":{"type":["string","null"],"title":"Created by","description":"User that created the exclusion","default":""},"updated_by_fullname":{"type":["string","null"],"title":"Updated by full name","description":"Last user full name that updated the exclusion","default":""},"created_by_fullname":{"type":["string","null"],"title":"Created by full name","description":"User full name that created the exclusion","default":""}}}},"win_action_center":{"type":["string","null"],"enum":["default","always","never",null],"title":"Windows Action Center","description":"Determine how ThreatDown Endpoint Protection should be registered on the endpoints.","default":"default","examples":["default"]},"deny_edit":{"type":"boolean","title":"Deny Edit","default":false,"examples":[false]},"eio_allow_run_threat_scan":{"type":["boolean","null"],"title":"User threat scan","description":"Allow users to run a threat scan (all threats will be quarantined automatically)","examples":[true]},"eio_display_rtp_events":{"type":["boolean","null"],"title":"eio_display_rtp_events","description":"Display real-time protection notifications","examples":[true]},"eio_limit_endpoint_agent_control":{"type":["boolean","null"],"title":"Limit endpoint agent interactions","description":"Allow only administrator level users to interact with the ThreatDown tray","examples":[false]},"eio_show_threat_scan_shortcuts":{"type":["boolean","null"],"title":"User threat scan","description":"Show ThreatDown shortcuts on start menu and desktop to run threat scans ","examples":[false]},"eio_show_tray_icon":{"type":"boolean","title":"Show icon in notification area","description":"Show Malwarebytes icon in notification area","examples":[true]},"eio_show_windows_contextmenu":{"type":["boolean","null"],"title":"Context menu scans","description":"Show ThreatDown option in context menus","examples":[true]},"expire_endpoints":{"type":"number","title":"Expire endpoints","examples":[0]},"startup_options":{"type":["object","null"],"properties":{"timeout":{"type":"integer"},"toggle_on":{"type":"boolean"}}},"rdp_settings":{"type":"object","properties":{"action":{"type":"string"},"allowed_failed_attempts":{"type":"integer"},"exclude_private_networks":{"type":"boolean"},"minutes_between_failed_attempts":{"type":"integer"},"minutes_to_block":{"type":"integer"},"protected_protocols":{"type":"array","items":{"type":"object","properties":{"enabled":{"type":"boolean"},"name":{"type":"string"},"ports":{"type":"array","items":{"type":"integer"}}}}}}},"as_service_process_protection":{"title":"Service and process protection policy","description":"Prevent ThreatDown services and processes from being stopped (Windows 10 only)","type":"boolean","default":true,"examples":[true,false]},"secret_allow_site_override":{"type":"boolean","title":"Allow secret override"}}}}}}}}}},"tags":["Policies"],"operationId":"api.v2.oneview.get-all.policy"}},"/oneview/v1/policies/{id}/default":{"put":{"description":"Mark policy as default","summary":"Set default","security":[{"client_credentials":["write"]},{"user_permissions":["policies.edit"]}],"status":{"outage":["auth","ov"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"Policy","description":"Properties of the policy object","examples":[{"policy_name":"EPP New policy","etag":"f7e45ed2f43b9200a7dfa50ca44035c7","so_scan_contents_of_compressed_folders":true,"so_detect_signature_less_anomalous_files":true,"so_treat_potentially_unwanted_programs_as_malware":true,"so_treat_potentially_unwanted_modifications_as_malware":true,"so_scan_priority":"high","rtp_web_protection":true,"rtp_exploit_protection":true,"rtp_malware_protection":true,"rtp_behavior_protection":true,"sam_allow_behavioral_monitoring":false,"sam_allow_for_rollback_of_files":true,"sam_lock_unlock_endpoint":false,"sam_isolation_title":"Malware or suspicious application behavior has been detected on this computer.","sam_isolation_message":"Your system has been locked by the IT Department. Please contact the Helpdesk for further information.","sam_rollback_timeframe":48,"sam_rollback_file_size":"20MB","sam_rollback_file_size_server":"100MB","sam_rollback_quota":30,"as_scan_rootkits":false,"as_enable_restart":false,"as_postpone_reboot":true,"as_reboot_delay":{"frequency":"HOURLY","interval":1},"as_reboot_message":"In order to completely quarantine the detected threat(s), your computer must be restarted.","as_pause_software_updates":true,"as_delay_protection_updates":-1,"as_uninstall_password":"","as_service_process_protection":true,"as_auto_service_updates":true,"policy_id":"39313561336334612D333933382D343530332D623937332D613737643238623038613132","updated_by":"example@domain.com","update_at":"2020-04-21T22:18:01.937+0000","created_by":"example@domain.com","created_at":"2020-04-21T22:18:01.937+0000","updated_by_fullname":"Saif Test","created_by_fullname":"Saif Test","is_default":true,"deny_edit":false,"sites":["849337a3-962c-4187-8667-67f769378726"],"as_pause_software_updates_until":null,"sam_icon_to_display_custom_message_screen":null,"exclusions":[{"exclusion_value":"C:\\Windows\\Foo\\Bar.exe","exclusion_type":1,"policy_ids":[],"exploit_protection":false,"malware_protection":true,"ransomware_protection":true,"website_protection":false,"suspicious_activity":true,"account_level":true,"enabled":true,"comment":"dwadaw","etag":"d5381975fcf77e55264e40d64af455a7","exclusion_id":"61646536343938322D303164652D343932362D623535322D636339366431383433373332","updated_by":null,"updated_at":null,"created_by":null,"created_at":null,"updated_by_fullname":null,"created_by_fullname":null}],"win_action_center":"default","startup_options":{"timeout":60000,"toggle_on":false},"rdp_settings":{"action":"BLOCK","allowed_failed_attempts":5,"exclude_private_networks":false,"minutes_between_failed_attempts":5,"minutes_to_block":5,"protected_protocols":[{"enabled":false,"name":"RDP","ports":[3389]}]}}],"required":["policy_name","etag","so_scan_contents_of_compressed_folders","so_detect_signature_less_anomalous_files","so_treat_potentially_unwanted_programs_as_malware","so_treat_potentially_unwanted_modifications_as_malware","so_scan_priority","rtp_web_protection","rtp_exploit_protection","rtp_malware_protection","rtp_behavior_protection","sam_allow_behavioral_monitoring","sam_allow_for_rollback_of_files","sam_lock_unlock_endpoint","sam_isolation_title","sam_isolation_message","sam_rollback_timeframe","sam_rollback_file_size","sam_rollback_file_size_server","sam_rollback_quota","as_scan_rootkits","as_enable_restart","as_postpone_reboot","as_reboot_delay","as_reboot_message","as_pause_software_updates","as_delay_protection_updates","as_uninstall_password","as_service_process_protection","policy_id","update_at","created_at","is_default","win_action_center","startup_options","rdp_settings"],"properties":{"policy_name":{"type":"string","title":"Name of the Policy","description":"Friendly name for the policy.","default":"","examples":["Example Policy"]},"etag":{"type":"string","title":"Update tag","description":"etags are identifiers that change on every update. Their use is to prevent race conditions when multiple clients are modifying the same resource. Supply this tag empty when creating a policy. When updating, you need to fetch the latest value by GETting a policy. You should always get the current etag before trying to modify a resource that has an etag property.","examples":[""]},"so_scan_contents_of_compressed_folders":{"type":"boolean","title":"Scan the contents of compressed archives","description":"Scan the contents of compressed archives (e.g. .zip, .rar, etc.). Applies to Threat scans only (Windows only)","default":false,"examples":[true]},"so_detect_signature_less_anomalous_files":{"type":"boolean","title":"Detect signature-less anomalous files","description":"Detect signature-less anomalous files. Applies to Threat scans only (Windows only)","default":false,"examples":[true]},"so_treat_potentially_unwanted_programs_as_malware":{"type":"boolean","title":"PUPs","description":"Treat Potentially Unwanted Programs (PUPs) as malware (Applies to Threat Scans, Hyper Scans, and Real-Time Protection events)","default":false,"examples":[true]},"so_treat_potentially_unwanted_modifications_as_malware":{"type":"boolean","title":"PUMs","description":"Treat Potentially Unwanted Modifications (PUMs) as malware (Applies to Threat Scans, Hyper Scans, and Real-Time Protection events). Windows only.","default":false,"examples":[true]},"so_scan_priority":{"type":"string","title":"CPU priority for scans","description":"Maximum allocation of CPU resources for scans. Mac only","default":"low","examples":["high","medium","low"],"enum":["high","medium","low"]},"rtp_web_protection":{"type":"boolean","title":"Real time web protection","description":"Web protection (Real-Time Protections). windows only","default":false,"examples":[true]},"rtp_exploit_protection":{"type":"boolean","title":"Real time exploit protection","description":"Exploit protection","default":false,"examples":[true]},"rtp_malware_protection":{"type":"boolean","title":"Malware protection","description":"Malware protection.","default":false,"examples":[true]},"rtp_behavior_protection":{"type":"boolean","title":"Behavior protection","description":"Behavior protection (windows only)","default":false,"examples":[true]},"sam_allow_behavioral_monitoring":{"type":"boolean","title":"Behavioral Monitoring","description":"Allow Behavioral Monitoring for Suspicious Activity on endpoints (Suspicious activity monitoring)","default":false,"examples":[true]},"sam_allow_for_rollback_of_files":{"type":"boolean","title":"Rollback","description":"Allow for Rollback of files modified by any Suspicious Activity","default":false,"examples":[true]},"sam_lock_unlock_endpoint":{"type":"boolean","title":"Endpoint isolation","description":"Allow for locking and unlocking endpoints through isolation.","default":false,"examples":[true]},"sam_isolation_title":{"type":"string","title":"The sam_isolation_title schema","default":"","examples":["Malware or suspicious application behavior has been detected on this computer."]},"sam_isolation_message":{"type":"string","title":"The sam_isolation_message schema","default":"","examples":["Your system has been locked by the IT Department. Please contact the Helpdesk for further information."]},"sam_rollback_timeframe":{"type":"integer","title":"Rollback timeframe","description":"Number of hours to extend the rollback timeframe","default":0,"examples":[48]},"sam_rollback_file_size":{"type":"string","title":"Rollback filesize","description":"Size of rollback file. See examples for correct format.","default":"","examples":["54MB"]},"sam_rollback_file_size_server":{"type":"string","title":"Rollback filesize for servers","description":"Size of rollback file on servers. See examples for correct format.","default":"","examples":["100MB"]},"sam_rollback_quota":{"type":"number","title":"Rollback free disk space quota","description":"Percentage of rollback free disk space quota. From 10 to 70","default":30,"examples":[30]},"sam_icon_to_display_custom_message_screen":{"type":["string","null"],"title":"Endpoint isolation icon","description":"Icon to display on customer message screen (BMP 150x150)","examples":["https://nebula-isolation-images-mb-qa.s3.amazonaws.com/92cc3972-f302-48f1-8cf4-fdf552dcbed1"]},"as_scan_rootkits":{"type":"boolean","title":"Scan rootkits","description":"Scan rootkits","default":false,"examples":[true]},"as_enable_restart":{"type":"boolean","title":"Enable restart","description":"Enable restart","default":false,"examples":[true]},"as_postpone_reboot":{"type":"boolean","title":"Postpone reboot","description":"Postpone reboot","default":false,"examples":[true]},"as_reboot_delay":{"type":"object","title":"Reboot delay","description":"Reboot delay","examples":[{"frequency":"HOURLY","interval":3}],"required":["frequency","interval"],"properties":{"frequency":{"type":"string","title":"Frequency","description":"","default":"","examples":["HOURLY"]},"interval":{"type":"number","title":"Interval","description":"","default":0,"examples":[3]}}},"as_reboot_message":{"type":"string","title":"Reboot message","description":"Message to show on Endpoint agent.","default":"","examples":["In order to completely quarantine the detected threat(s), your computer must be restarted."]},"as_pause_software_updates":{"type":"boolean","title":"Pause software updates","description":"Windows only. Software updates can be paused up to 30 days.","default":false,"examples":[true]},"as_pause_software_updates_until":{"type":["string","null"],"format":"date-time","title":"Pause software updates until date","description":"Windows only. If as_pause_software_updates=true, Software updates will be paused until the specified date.","default":null,"examples":[null]},"as_delay_protection_updates":{"type":["integer","null"],"title":"Delay protection updates","description":"In minutes","default":0,"examples":[180]},"as_uninstall_password":{"type":["string","null"],"title":"Tamper protection","description":"Require password to unistall endpoint agent.","default":"","examples":["e'5.12/Fx]ny"]},"as_auto_service_updates":{"type":"boolean","title":"Auto service updates","description":"Automatically download and install ThreatDown application updates.","default":true,"examples":[true]},"policy_id":{"type":"string","title":"Id","description":"Unique identifier of this policiy","default":"","examples":["39313561336334612D333933382D343530332D623937332D613737643238623038613132"]},"update_at":{"type":"string","title":"Updated at","description":"When this policy was updated","default":"","examples":["2020-04-21T22:18:01.937+0000"]},"created_at":{"type":"string","title":"Create at","description":"When this policy was creates","default":"","examples":["2020-04-21T22:18:01.937+0000"]},"is_default":{"type":"boolean","title":"Default","description":"Whether this is set as default policy (see promote endpoint)","default":false,"examples":[true]},"sites":{"type":"array","title":"Sites","description":"List of sites to which this policy is associated","examples":[["849337a3-962c-4187-8667-67f769378726"]],"items":{"type":"string"}},"exclusions":{"type":"array","title":"Exclusions","description":"List of exclusions associated with this policy","examples":[[{"exclusion_value":"C:\\Windows\\Foo\\Bar.exe","exclusion_type":1,"policy_ids":[],"exploit_protection":false,"malware_protection":true,"ransomware_protection":true,"website_protection":false,"suspicious_activity":true,"account_level":true,"enabled":true,"comment":"dwadaw","etag":"d5381975fcf77e55264e40d64af455a7","exclusion_id":"61646536343938322D303164652D343932362D623535322D636339366431383433373332","updated_by":null,"updated_at":null,"created_by":null,"created_at":null,"updated_by_fullname":null,"created_by_fullname":null}]],"items":{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"Properties of one exclusion","description":"Properties of one exclusion","additionalProperties":false,"examples":[{"exclusion_value":"exclude","exclusion_type":5,"policy_ids":["36376136326434342D613164382D346633622D616335662D623566383435323264303730","39313561336334612D333933382D343530332D623937332D613737643238623038613132"],"exploit_protection":false,"malware_protection":true,"ransomware_protection":false,"website_protection":false,"suspicious_activity":false,"account_level":false,"enabled":true,"comment":"hello","etag":"ebf2778dfcf61a83053160ce2bfeb6c5","exclusion_id":"61656333653261372D653539662D346666652D393239622D323465646236386266353332","updated_by":"rrais@yopmail.com","updated_at":"2020-05-26T11:14:54.302+0000","created_by":"rrais@yopmail.com","created_at":"2020-05-26T11:14:54.302+0000"}],"required":["exclusion_value","exclusion_type","policy_ids","exploit_protection","malware_protection","ransomware_protection","website_protection","suspicious_activity","account_level","enabled","comment","etag","exclusion_id","updated_at","created_at"],"properties":{"exclusion_value":{"type":"string","title":"Value","description":"Value of this exclusion","default":"","examples":["string"]},"exclusion_type":{"type":"integer","title":"The exclusion_type schema","description":"1: Exclusion for file path, 2: Exclusion for folder path, 3: Exclusion for wildcard path, 4: Exclusion for registry, 5: Exclusion for file extensions, 6: Exclusion for web domain, 7: Exclusion for web IP, 8: Exclusion for Web Monitoring, 13: Exclusion for hash, 14: Exclusion for command line","default":1,"enum":[1,2,3,4,5,6,7,8,13,14],"examples":[1]},"policy_ids":{"type":"array","title":"Policies identifier","description":"If its not account level, specify policy to apply this exclusion to","examples":[["string"]],"items":{"type":"string"}},"exploit_protection":{"type":"boolean","title":"Exploit Protection","description":"Whether this exclusion applies for exploit protection.","default":false,"examples":[true]},"malware_protection":{"type":"boolean","title":"Malware Protection","description":"Whether this exclusion applies for malware protection.","default":false,"examples":[true]},"ransomware_protection":{"type":"boolean","title":"Ransomware Protection","description":"Whether this exclusion applies for ransomware protection.","default":false,"examples":[true]},"website_protection":{"type":"boolean","title":"Website protection","description":"Whether this exclusion applies for website protection.","default":false,"examples":[true]},"suspicious_activity":{"type":"boolean","title":"Suspicious activity","description":"Whether this exclusion applies for suspicious activity","default":false,"examples":[true]},"account_level":{"type":"boolean","title":"Account level","description":"Whether to apply this exclusion to all policies","default":true,"examples":[true]},"enabled":{"type":"boolean","title":"Enabled","description":"Boolean indicating whether this exclusion is enabled or not","default":false,"examples":[true]},"comment":{"type":"string","title":"Comment","description":"A comment about this exclusion","default":"","examples":["string"]},"etag":{"type":"string","title":"Update tag","description":"etags are identifiers that change on every update. Their use is to prevent race conditions when multiple clients are modifying the same resource. Supply this tag empty when creating a exclusion. When updating, you need to fetch the latest value by GETting an exclusion. You should always get the current etag before trying to modify a resource that has an etag property.","default":"","examples":[""]},"exclusion_id":{"type":"string","title":"ID of the exclusion","description":"Use this identifier for REST operations.","default":"","examples":["61656333653261372D653539662D346666652D393239622D323465646236386266353332"]},"updated_at":{"type":["string","null"],"title":"Updated at","description":"Last time this exclusion was updated.","default":"","examples":["2020-05-26T11:14:54.302+0000"]},"created_at":{"type":["string","null"],"title":"Created at","description":"When this exclusion was created","default":"","examples":["2020-05-26T11:14:54.302+0000"]},"updated_by":{"type":["string","null"],"title":"Updated by","description":"Last user that updated the exclusion","default":""},"created_by":{"type":["string","null"],"title":"Created by","description":"User that created the exclusion","default":""},"updated_by_fullname":{"type":["string","null"],"title":"Updated by full name","description":"Last user full name that updated the exclusion","default":""},"created_by_fullname":{"type":["string","null"],"title":"Created by full name","description":"User full name that created the exclusion","default":""}}}},"win_action_center":{"type":["string","null"],"enum":["default","always","never",null],"title":"Windows Action Center","description":"Determine how ThreatDown Endpoint Protection should be registered on the endpoints.","default":"default","examples":["default"]},"deny_edit":{"type":"boolean","title":"Deny Edit","default":false,"examples":[false]},"eio_allow_run_threat_scan":{"type":["boolean","null"],"title":"User threat scan","description":"Allow users to run a threat scan (all threats will be quarantined automatically)","examples":[true]},"eio_display_rtp_events":{"type":["boolean","null"],"title":"eio_display_rtp_events","description":"Display real-time protection notifications","examples":[true]},"eio_limit_endpoint_agent_control":{"type":["boolean","null"],"title":"Limit endpoint agent interactions","description":"Allow only administrator level users to interact with the ThreatDown tray","examples":[false]},"eio_show_threat_scan_shortcuts":{"type":["boolean","null"],"title":"User threat scan","description":"Show ThreatDown shortcuts on start menu and desktop to run threat scans ","examples":[false]},"eio_show_tray_icon":{"type":"boolean","title":"Show icon in notification area","description":"Show Malwarebytes icon in notification area","examples":[true]},"eio_show_windows_contextmenu":{"type":["boolean","null"],"title":"Context menu scans","description":"Show ThreatDown option in context menus","examples":[true]},"expire_endpoints":{"type":"number","title":"Expire endpoints","examples":[0]},"startup_options":{"type":["object","null"],"properties":{"timeout":{"type":"integer"},"toggle_on":{"type":"boolean"}}},"rdp_settings":{"type":"object","properties":{"action":{"type":"string"},"allowed_failed_attempts":{"type":"integer"},"exclude_private_networks":{"type":"boolean"},"minutes_between_failed_attempts":{"type":"integer"},"minutes_to_block":{"type":"integer"},"protected_protocols":{"type":"array","items":{"type":"object","properties":{"enabled":{"type":"boolean"},"name":{"type":"string"},"ports":{"type":"array","items":{"type":"integer"}}}}}}},"as_service_process_protection":{"title":"Service and process protection policy","description":"Prevent ThreatDown services and processes from being stopped (Windows 10 only)","type":"boolean","default":true,"examples":[true,false]},"secret_allow_site_override":{"type":"boolean","title":"Allow secret override"}}}}}}},"tags":["Policies"],"operationId":"api.v2.oneview.default.policy"}},"/oneview/v1/policies/{id}":{"delete":{"description":"Delete policy. by its id","summary":"Delete policy","security":[{"client_credentials":["write"]},{"user_permissions":["policies.delete"]}],"status":{"outage":["auth","ov"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{},"tags":["Policies"],"operationId":"api.v2.oneview.delete.policy"},"get":{"description":"Get one policy by its id","summary":"Get policy","security":[{"client_credentials":["read"]},{"user_permissions":["policies.view"]}],"status":{"outage":["auth","ov"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"Policy","description":"Properties of the policy object","examples":[{"policy_name":"EPP New policy","etag":"f7e45ed2f43b9200a7dfa50ca44035c7","so_scan_contents_of_compressed_folders":true,"so_detect_signature_less_anomalous_files":true,"so_treat_potentially_unwanted_programs_as_malware":true,"so_treat_potentially_unwanted_modifications_as_malware":true,"so_scan_priority":"high","rtp_web_protection":true,"rtp_exploit_protection":true,"rtp_malware_protection":true,"rtp_behavior_protection":true,"sam_allow_behavioral_monitoring":false,"sam_allow_for_rollback_of_files":true,"sam_lock_unlock_endpoint":false,"sam_isolation_title":"Malware or suspicious application behavior has been detected on this computer.","sam_isolation_message":"Your system has been locked by the IT Department. Please contact the Helpdesk for further information.","sam_rollback_timeframe":48,"sam_rollback_file_size":"20MB","sam_rollback_file_size_server":"100MB","sam_rollback_quota":30,"as_scan_rootkits":false,"as_enable_restart":false,"as_postpone_reboot":true,"as_reboot_delay":{"frequency":"HOURLY","interval":1},"as_reboot_message":"In order to completely quarantine the detected threat(s), your computer must be restarted.","as_pause_software_updates":true,"as_delay_protection_updates":-1,"as_uninstall_password":"","as_service_process_protection":true,"as_auto_service_updates":true,"policy_id":"39313561336334612D333933382D343530332D623937332D613737643238623038613132","updated_by":"example@domain.com","update_at":"2020-04-21T22:18:01.937+0000","created_by":"example@domain.com","created_at":"2020-04-21T22:18:01.937+0000","updated_by_fullname":"Saif Test","created_by_fullname":"Saif Test","is_default":true,"deny_edit":false,"sites":["849337a3-962c-4187-8667-67f769378726"],"as_pause_software_updates_until":null,"sam_icon_to_display_custom_message_screen":null,"exclusions":[{"exclusion_value":"C:\\Windows\\Foo\\Bar.exe","exclusion_type":1,"policy_ids":[],"exploit_protection":false,"malware_protection":true,"ransomware_protection":true,"website_protection":false,"suspicious_activity":true,"account_level":true,"enabled":true,"comment":"dwadaw","etag":"d5381975fcf77e55264e40d64af455a7","exclusion_id":"61646536343938322D303164652D343932362D623535322D636339366431383433373332","updated_by":null,"updated_at":null,"created_by":null,"created_at":null,"updated_by_fullname":null,"created_by_fullname":null}],"win_action_center":"default","startup_options":{"timeout":60000,"toggle_on":false},"rdp_settings":{"action":"BLOCK","allowed_failed_attempts":5,"exclude_private_networks":false,"minutes_between_failed_attempts":5,"minutes_to_block":5,"protected_protocols":[{"enabled":false,"name":"RDP","ports":[3389]}]}}],"required":["policy_name","etag","so_scan_contents_of_compressed_folders","so_detect_signature_less_anomalous_files","so_treat_potentially_unwanted_programs_as_malware","so_treat_potentially_unwanted_modifications_as_malware","so_scan_priority","rtp_web_protection","rtp_exploit_protection","rtp_malware_protection","rtp_behavior_protection","sam_allow_behavioral_monitoring","sam_allow_for_rollback_of_files","sam_lock_unlock_endpoint","sam_isolation_title","sam_isolation_message","sam_rollback_timeframe","sam_rollback_file_size","sam_rollback_file_size_server","sam_rollback_quota","as_scan_rootkits","as_enable_restart","as_postpone_reboot","as_reboot_delay","as_reboot_message","as_pause_software_updates","as_delay_protection_updates","as_uninstall_password","as_service_process_protection","policy_id","update_at","created_at","is_default","win_action_center","startup_options","rdp_settings"],"properties":{"policy_name":{"type":"string","title":"Name of the Policy","description":"Friendly name for the policy.","default":"","examples":["Example Policy"]},"etag":{"type":"string","title":"Update tag","description":"etags are identifiers that change on every update. Their use is to prevent race conditions when multiple clients are modifying the same resource. Supply this tag empty when creating a policy. When updating, you need to fetch the latest value by GETting a policy. You should always get the current etag before trying to modify a resource that has an etag property.","examples":[""]},"so_scan_contents_of_compressed_folders":{"type":"boolean","title":"Scan the contents of compressed archives","description":"Scan the contents of compressed archives (e.g. .zip, .rar, etc.). Applies to Threat scans only (Windows only)","default":false,"examples":[true]},"so_detect_signature_less_anomalous_files":{"type":"boolean","title":"Detect signature-less anomalous files","description":"Detect signature-less anomalous files. Applies to Threat scans only (Windows only)","default":false,"examples":[true]},"so_treat_potentially_unwanted_programs_as_malware":{"type":"boolean","title":"PUPs","description":"Treat Potentially Unwanted Programs (PUPs) as malware (Applies to Threat Scans, Hyper Scans, and Real-Time Protection events)","default":false,"examples":[true]},"so_treat_potentially_unwanted_modifications_as_malware":{"type":"boolean","title":"PUMs","description":"Treat Potentially Unwanted Modifications (PUMs) as malware (Applies to Threat Scans, Hyper Scans, and Real-Time Protection events). Windows only.","default":false,"examples":[true]},"so_scan_priority":{"type":"string","title":"CPU priority for scans","description":"Maximum allocation of CPU resources for scans. Mac only","default":"low","examples":["high","medium","low"],"enum":["high","medium","low"]},"rtp_web_protection":{"type":"boolean","title":"Real time web protection","description":"Web protection (Real-Time Protections). windows only","default":false,"examples":[true]},"rtp_exploit_protection":{"type":"boolean","title":"Real time exploit protection","description":"Exploit protection","default":false,"examples":[true]},"rtp_malware_protection":{"type":"boolean","title":"Malware protection","description":"Malware protection.","default":false,"examples":[true]},"rtp_behavior_protection":{"type":"boolean","title":"Behavior protection","description":"Behavior protection (windows only)","default":false,"examples":[true]},"sam_allow_behavioral_monitoring":{"type":"boolean","title":"Behavioral Monitoring","description":"Allow Behavioral Monitoring for Suspicious Activity on endpoints (Suspicious activity monitoring)","default":false,"examples":[true]},"sam_allow_for_rollback_of_files":{"type":"boolean","title":"Rollback","description":"Allow for Rollback of files modified by any Suspicious Activity","default":false,"examples":[true]},"sam_lock_unlock_endpoint":{"type":"boolean","title":"Endpoint isolation","description":"Allow for locking and unlocking endpoints through isolation.","default":false,"examples":[true]},"sam_isolation_title":{"type":"string","title":"The sam_isolation_title schema","default":"","examples":["Malware or suspicious application behavior has been detected on this computer."]},"sam_isolation_message":{"type":"string","title":"The sam_isolation_message schema","default":"","examples":["Your system has been locked by the IT Department. Please contact the Helpdesk for further information."]},"sam_rollback_timeframe":{"type":"integer","title":"Rollback timeframe","description":"Number of hours to extend the rollback timeframe","default":0,"examples":[48]},"sam_rollback_file_size":{"type":"string","title":"Rollback filesize","description":"Size of rollback file. See examples for correct format.","default":"","examples":["54MB"]},"sam_rollback_file_size_server":{"type":"string","title":"Rollback filesize for servers","description":"Size of rollback file on servers. See examples for correct format.","default":"","examples":["100MB"]},"sam_rollback_quota":{"type":"number","title":"Rollback free disk space quota","description":"Percentage of rollback free disk space quota. From 10 to 70","default":30,"examples":[30]},"sam_icon_to_display_custom_message_screen":{"type":["string","null"],"title":"Endpoint isolation icon","description":"Icon to display on customer message screen (BMP 150x150)","examples":["https://nebula-isolation-images-mb-qa.s3.amazonaws.com/92cc3972-f302-48f1-8cf4-fdf552dcbed1"]},"as_scan_rootkits":{"type":"boolean","title":"Scan rootkits","description":"Scan rootkits","default":false,"examples":[true]},"as_enable_restart":{"type":"boolean","title":"Enable restart","description":"Enable restart","default":false,"examples":[true]},"as_postpone_reboot":{"type":"boolean","title":"Postpone reboot","description":"Postpone reboot","default":false,"examples":[true]},"as_reboot_delay":{"type":"object","title":"Reboot delay","description":"Reboot delay","examples":[{"frequency":"HOURLY","interval":3}],"required":["frequency","interval"],"properties":{"frequency":{"type":"string","title":"Frequency","description":"","default":"","examples":["HOURLY"]},"interval":{"type":"number","title":"Interval","description":"","default":0,"examples":[3]}}},"as_reboot_message":{"type":"string","title":"Reboot message","description":"Message to show on Endpoint agent.","default":"","examples":["In order to completely quarantine the detected threat(s), your computer must be restarted."]},"as_pause_software_updates":{"type":"boolean","title":"Pause software updates","description":"Windows only. Software updates can be paused up to 30 days.","default":false,"examples":[true]},"as_pause_software_updates_until":{"type":["string","null"],"format":"date-time","title":"Pause software updates until date","description":"Windows only. If as_pause_software_updates=true, Software updates will be paused until the specified date.","default":null,"examples":[null]},"as_delay_protection_updates":{"type":["integer","null"],"title":"Delay protection updates","description":"In minutes","default":0,"examples":[180]},"as_uninstall_password":{"type":["string","null"],"title":"Tamper protection","description":"Require password to unistall endpoint agent.","default":"","examples":["e'5.12/Fx]ny"]},"as_auto_service_updates":{"type":"boolean","title":"Auto service updates","description":"Automatically download and install ThreatDown application updates.","default":true,"examples":[true]},"policy_id":{"type":"string","title":"Id","description":"Unique identifier of this policiy","default":"","examples":["39313561336334612D333933382D343530332D623937332D613737643238623038613132"]},"update_at":{"type":"string","title":"Updated at","description":"When this policy was updated","default":"","examples":["2020-04-21T22:18:01.937+0000"]},"created_at":{"type":"string","title":"Create at","description":"When this policy was creates","default":"","examples":["2020-04-21T22:18:01.937+0000"]},"is_default":{"type":"boolean","title":"Default","description":"Whether this is set as default policy (see promote endpoint)","default":false,"examples":[true]},"sites":{"type":"array","title":"Sites","description":"List of sites to which this policy is associated","examples":[["849337a3-962c-4187-8667-67f769378726"]],"items":{"type":"string"}},"exclusions":{"type":"array","title":"Exclusions","description":"List of exclusions associated with this policy","examples":[[{"exclusion_value":"C:\\Windows\\Foo\\Bar.exe","exclusion_type":1,"policy_ids":[],"exploit_protection":false,"malware_protection":true,"ransomware_protection":true,"website_protection":false,"suspicious_activity":true,"account_level":true,"enabled":true,"comment":"dwadaw","etag":"d5381975fcf77e55264e40d64af455a7","exclusion_id":"61646536343938322D303164652D343932362D623535322D636339366431383433373332","updated_by":null,"updated_at":null,"created_by":null,"created_at":null,"updated_by_fullname":null,"created_by_fullname":null}]],"items":{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"Properties of one exclusion","description":"Properties of one exclusion","additionalProperties":false,"examples":[{"exclusion_value":"exclude","exclusion_type":5,"policy_ids":["36376136326434342D613164382D346633622D616335662D623566383435323264303730","39313561336334612D333933382D343530332D623937332D613737643238623038613132"],"exploit_protection":false,"malware_protection":true,"ransomware_protection":false,"website_protection":false,"suspicious_activity":false,"account_level":false,"enabled":true,"comment":"hello","etag":"ebf2778dfcf61a83053160ce2bfeb6c5","exclusion_id":"61656333653261372D653539662D346666652D393239622D323465646236386266353332","updated_by":"rrais@yopmail.com","updated_at":"2020-05-26T11:14:54.302+0000","created_by":"rrais@yopmail.com","created_at":"2020-05-26T11:14:54.302+0000"}],"required":["exclusion_value","exclusion_type","policy_ids","exploit_protection","malware_protection","ransomware_protection","website_protection","suspicious_activity","account_level","enabled","comment","etag","exclusion_id","updated_at","created_at"],"properties":{"exclusion_value":{"type":"string","title":"Value","description":"Value of this exclusion","default":"","examples":["string"]},"exclusion_type":{"type":"integer","title":"The exclusion_type schema","description":"1: Exclusion for file path, 2: Exclusion for folder path, 3: Exclusion for wildcard path, 4: Exclusion for registry, 5: Exclusion for file extensions, 6: Exclusion for web domain, 7: Exclusion for web IP, 8: Exclusion for Web Monitoring, 13: Exclusion for hash, 14: Exclusion for command line","default":1,"enum":[1,2,3,4,5,6,7,8,13,14],"examples":[1]},"policy_ids":{"type":"array","title":"Policies identifier","description":"If its not account level, specify policy to apply this exclusion to","examples":[["string"]],"items":{"type":"string"}},"exploit_protection":{"type":"boolean","title":"Exploit Protection","description":"Whether this exclusion applies for exploit protection.","default":false,"examples":[true]},"malware_protection":{"type":"boolean","title":"Malware Protection","description":"Whether this exclusion applies for malware protection.","default":false,"examples":[true]},"ransomware_protection":{"type":"boolean","title":"Ransomware Protection","description":"Whether this exclusion applies for ransomware protection.","default":false,"examples":[true]},"website_protection":{"type":"boolean","title":"Website protection","description":"Whether this exclusion applies for website protection.","default":false,"examples":[true]},"suspicious_activity":{"type":"boolean","title":"Suspicious activity","description":"Whether this exclusion applies for suspicious activity","default":false,"examples":[true]},"account_level":{"type":"boolean","title":"Account level","description":"Whether to apply this exclusion to all policies","default":true,"examples":[true]},"enabled":{"type":"boolean","title":"Enabled","description":"Boolean indicating whether this exclusion is enabled or not","default":false,"examples":[true]},"comment":{"type":"string","title":"Comment","description":"A comment about this exclusion","default":"","examples":["string"]},"etag":{"type":"string","title":"Update tag","description":"etags are identifiers that change on every update. Their use is to prevent race conditions when multiple clients are modifying the same resource. Supply this tag empty when creating a exclusion. When updating, you need to fetch the latest value by GETting an exclusion. You should always get the current etag before trying to modify a resource that has an etag property.","default":"","examples":[""]},"exclusion_id":{"type":"string","title":"ID of the exclusion","description":"Use this identifier for REST operations.","default":"","examples":["61656333653261372D653539662D346666652D393239622D323465646236386266353332"]},"updated_at":{"type":["string","null"],"title":"Updated at","description":"Last time this exclusion was updated.","default":"","examples":["2020-05-26T11:14:54.302+0000"]},"created_at":{"type":["string","null"],"title":"Created at","description":"When this exclusion was created","default":"","examples":["2020-05-26T11:14:54.302+0000"]},"updated_by":{"type":["string","null"],"title":"Updated by","description":"Last user that updated the exclusion","default":""},"created_by":{"type":["string","null"],"title":"Created by","description":"User that created the exclusion","default":""},"updated_by_fullname":{"type":["string","null"],"title":"Updated by full name","description":"Last user full name that updated the exclusion","default":""},"created_by_fullname":{"type":["string","null"],"title":"Created by full name","description":"User full name that created the exclusion","default":""}}}},"win_action_center":{"type":["string","null"],"enum":["default","always","never",null],"title":"Windows Action Center","description":"Determine how ThreatDown Endpoint Protection should be registered on the endpoints.","default":"default","examples":["default"]},"deny_edit":{"type":"boolean","title":"Deny Edit","default":false,"examples":[false]},"eio_allow_run_threat_scan":{"type":["boolean","null"],"title":"User threat scan","description":"Allow users to run a threat scan (all threats will be quarantined automatically)","examples":[true]},"eio_display_rtp_events":{"type":["boolean","null"],"title":"eio_display_rtp_events","description":"Display real-time protection notifications","examples":[true]},"eio_limit_endpoint_agent_control":{"type":["boolean","null"],"title":"Limit endpoint agent interactions","description":"Allow only administrator level users to interact with the ThreatDown tray","examples":[false]},"eio_show_threat_scan_shortcuts":{"type":["boolean","null"],"title":"User threat scan","description":"Show ThreatDown shortcuts on start menu and desktop to run threat scans ","examples":[false]},"eio_show_tray_icon":{"type":"boolean","title":"Show icon in notification area","description":"Show Malwarebytes icon in notification area","examples":[true]},"eio_show_windows_contextmenu":{"type":["boolean","null"],"title":"Context menu scans","description":"Show ThreatDown option in context menus","examples":[true]},"expire_endpoints":{"type":"number","title":"Expire endpoints","examples":[0]},"startup_options":{"type":["object","null"],"properties":{"timeout":{"type":"integer"},"toggle_on":{"type":"boolean"}}},"rdp_settings":{"type":"object","properties":{"action":{"type":"string"},"allowed_failed_attempts":{"type":"integer"},"exclude_private_networks":{"type":"boolean"},"minutes_between_failed_attempts":{"type":"integer"},"minutes_to_block":{"type":"integer"},"protected_protocols":{"type":"array","items":{"type":"object","properties":{"enabled":{"type":"boolean"},"name":{"type":"string"},"ports":{"type":"array","items":{"type":"integer"}}}}}}},"as_service_process_protection":{"title":"Service and process protection policy","description":"Prevent ThreatDown services and processes from being stopped (Windows 10 only)","type":"boolean","default":true,"examples":[true,false]},"secret_allow_site_override":{"type":"boolean","title":"Allow secret override"}}}}}}},"tags":["Policies"],"operationId":"api.v2.oneview.get.policy"},"put":{"description":"Update policy. by its id","summary":"Update policy","security":[{"client_credentials":["write"]},{"user_permissions":["policies.edit"]}],"status":{"outage":["auth","ov"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"Create a policy","description":"The payload for creating a new policy","examples":[{"policy_name":"Example Policy","etag":"","so_scan_contents_of_compressed_folders":true,"so_detect_signature_less_anomalous_files":true,"so_treat_potentially_unwanted_programs_as_malware":true,"so_treat_potentially_unwanted_modifications_as_malware":true,"so_scan_priority":"high","rtp_web_protection":true,"rtp_exploit_protection":true,"rtp_malware_protection":true,"rtp_behavior_protection":true,"sam_allow_behavioral_monitoring":true,"sam_allow_for_rollback_of_files":true,"sam_lock_unlock_endpoint":true,"sam_isolation_title":"Malware or suspicious application behavior has been detected on this computer.","sam_isolation_message":"Your system has been locked by the IT Department. Please contact the Helpdesk for further information.","sam_rollback_timeframe":48,"sam_rollback_file_size":"54MB","sam_rollback_file_size_server":"100MB","sam_rollback_quota":30,"as_scan_rootkits":true,"as_enable_restart":true,"as_postpone_reboot":true,"as_reboot_delay":{"frequency":"HOURLY","interval":"3"},"as_reboot_message":"In order to completely quarantine the detected threat(s), your computer must be restarted.","as_pause_software_updates":false,"as_pause_software_updates_until":null,"as_delay_protection_updates":180,"as_uninstall_password":"e'5.12/Fx]ny","as_auto_service_updates":true,"deny_edit":false,"eio_allow_run_threat_scan":true,"win_action_center":"default","eio_display_rtp_events":true,"eio_limit_endpoint_agent_control":false,"eio_show_threat_scan_shortcuts":false,"eio_show_tray_icon":true,"eio_show_windows_contextmenu":true,"expire_endpoints":0,"is_default":false,"sam_icon_to_display_custom_message_screen":null,"startup_options":{"timeout":60000,"toggle_on":false},"rdp_settings":{"action":"BLOCK","allowed_failed_attempts":5,"exclude_private_networks":false,"minutes_between_failed_attempts":5,"minutes_to_block":5,"protected_protocols":[{"enabled":false,"name":"RDP","ports":[3389]}]}}],"required":["policy_name","etag","so_scan_contents_of_compressed_folders","so_detect_signature_less_anomalous_files","so_treat_potentially_unwanted_programs_as_malware","so_treat_potentially_unwanted_modifications_as_malware","so_scan_priority","rtp_web_protection","rtp_exploit_protection","rtp_malware_protection","rtp_behavior_protection","sam_allow_behavioral_monitoring","sam_allow_for_rollback_of_files","sam_lock_unlock_endpoint","sam_isolation_title","sam_isolation_message","sam_rollback_timeframe","sam_rollback_file_size","sam_rollback_file_size_server","sam_rollback_quota","as_scan_rootkits","as_enable_restart","as_postpone_reboot","as_reboot_delay","as_reboot_message","as_pause_software_updates","as_delay_protection_updates","as_uninstall_password","as_service_process_protection","win_action_center","startup_options","rdp_settings"],"additionalProperties":true,"properties":{"policy_name":{"type":"string","title":"Name of the Policy","description":"Friendly name for the policy.","default":"","examples":["Example Policy"]},"etag":{"type":"string","title":"Update tag","description":"etags are identifiers that change on every update. Their use is to prevent race conditions when multiple clients are modifying the same resource. Supply this tag empty when creating a policy. When updating, you need to fetch the latest value by GETting a policy. You should always get the current etag before trying to modify a resource that has an etag property.","default":"","examples":[""]},"so_scan_contents_of_compressed_folders":{"type":"boolean","title":"Scan the contents of compressed archives","description":"Scan the contents of compressed archives (e.g. .zip, .rar, etc.). Applies to Threat scans only (Windows only)","default":false,"examples":[true]},"so_detect_signature_less_anomalous_files":{"type":"boolean","title":"Detect signature-less anomalous files","description":"Detect signature-less anomalous files. Applies to Threat scans only (Windows only)","default":false,"examples":[true]},"so_treat_potentially_unwanted_programs_as_malware":{"type":"boolean","title":"PUPs","description":"Treat Potentially Unwanted Programs (PUPs) as malware (Applies to Threat Scans, Hyper Scans, and Real-Time Protection events)","default":false,"examples":[true]},"so_treat_potentially_unwanted_modifications_as_malware":{"type":"boolean","title":"PUMs","description":"Treat Potentially Unwanted Modifications (PUMs) as malware (Applies to Threat Scans, Hyper Scans, and Real-Time Protection events). Windows only.","default":false,"examples":[true]},"so_scan_priority":{"type":"string","title":"CPU priority for scans","description":"Maximum allocation of CPU resources for scans. Mac only","default":"low","examples":["high","medium","low"],"enum":["high","medium","low"]},"rtp_web_protection":{"type":"boolean","title":"The rtp_web_protection schema","default":false,"examples":[true]},"rtp_exploit_protection":{"type":"boolean","title":"Exploit Protection (Real-Time Protections)","description":"Exploit Protection (Real-Time Protections). windows only","default":false,"examples":[true]},"rtp_malware_protection":{"type":"boolean","title":"Malware protection","description":"Malware protection.","default":false,"examples":[true]},"rtp_behavior_protection":{"type":"boolean","title":"Behavior protection","description":"Behavior protection (windows only)","default":false,"examples":[true]},"sam_allow_behavioral_monitoring":{"type":"boolean","title":"Behavioral Monitoring","description":"Allow Behavioral Monitoring for Suspicious Activity on endpoints (Suspicious activity monitoring)","default":false,"examples":[true]},"sam_allow_for_rollback_of_files":{"type":"boolean","title":"Rollback","description":"Allow for Rollback of files modified by any Suspicious Activity","default":false,"examples":[true]},"sam_lock_unlock_endpoint":{"type":"boolean","title":"Endpoint isolation","description":"Allow for locking and unlocking endpoints through isolation.","default":false,"examples":[true]},"sam_isolation_title":{"type":"string","title":"The sam_isolation_title schema","default":"","examples":["Malware or suspicious application behavior has been detected on this computer."]},"sam_isolation_message":{"type":"string","title":"The sam_isolation_message schema","default":"","examples":["Your system has been locked by the IT Department. Please contact the Helpdesk for further information."]},"sam_rollback_timeframe":{"type":"integer","title":"Rollback timeframe","description":"Number of hours to extend the rollback timeframe","default":0,"examples":[48]},"sam_rollback_file_size":{"type":"string","title":"Rollback filesize","description":"Size of rollback file. See examples for correct format.","default":"","examples":["54MB"]},"sam_rollback_file_size_server":{"type":"string","title":"Rollback filesize for servers","description":"Size of rollback file on servers. See examples for correct format.","default":"","examples":["100MB"]},"sam_rollback_quota":{"type":"number","title":"Rollback free disk space quota","description":"Percentage of rollback free disk space quota. From 10 to 70","default":30,"examples":[30]},"sam_icon_to_display_custom_message_screen":{"type":["string","null"],"title":"Endpoint isolation icon","description":"Icon to display on customer message screen (BMP 150x150)","default":null,"examples":["https://nebula-isolation-images-mb-qa.s3.amazonaws.com/92cc3972-f302-48f1-8cf4-fdf552dcbed1"]},"as_scan_rootkits":{"type":"boolean","title":"Scan rootkits","description":"Scan rootkits","default":false,"examples":[true]},"as_enable_restart":{"type":"boolean","title":"Enable restart","description":"Enable restart","default":false,"examples":[true]},"as_postpone_reboot":{"type":"boolean","title":"Postpone reboot","description":"Postpone reboot","default":false,"examples":[true]},"as_reboot_delay":{"type":"object","title":"Reboot delay","description":"Reboot delay","examples":[{"frequency":"HOURLY","interval":"3"}],"required":["frequency","interval"],"properties":{"frequency":{"type":"string","title":"Frequency","description":"","default":"","examples":["HOURLY"]},"interval":{"type":"string","title":"Interval","description":"","default":"","examples":["3"]}}},"as_reboot_message":{"type":"string","title":"Reboot message","description":"Message to show on Endpoint agent.","default":"","examples":["In order to completely quarantine the detected threat(s), your computer must be restarted."]},"as_pause_software_updates":{"type":"boolean","title":"Pause software updates","description":"Windows only. Software updates can be paused up to 30 days.","default":false,"examples":[true]},"as_pause_software_updates_until":{"type":["string","null"],"format":"date-time","title":"Pause software updates until date","description":"Windows only. If as_pause_software_updates=true, Software updates will be paused until the specified date.","default":null,"examples":[null]},"as_delay_protection_updates":{"type":"integer","title":"Delay protection updates","description":"In minutes","default":0,"examples":[180]},"as_uninstall_password":{"type":"string","title":"Tamper protection","description":"Require password to unistall endpoint agent.","default":"","examples":["e'5.12/Fx]ny"]},"as_auto_service_updates":{"type":"boolean","title":"Auto service updates","description":"Automatically download and install ThreatDown application updates.","default":true,"examples":[true]},"win_action_center":{"type":"string","enum":["default","always","never"],"title":"Windows Action Center","description":"Determine how ThreatDown Endpoint Protection should be registered on the endpoints.","default":"default","examples":["default"]},"deny_edit":{"type":"boolean","title":"Deny Edit","default":false,"examples":[false]},"eio_allow_run_threat_scan":{"type":"boolean","title":"User threat scan","description":"Allow users to run a threat scan (all threats will be quarantined automatically)","default":true,"examples":[true]},"eio_display_rtp_events":{"type":"boolean","title":"eio_limit_endpoint_agent_control","description":"Display real-time protection notifications","default":true,"examples":[true]},"eio_limit_endpoint_agent_control":{"type":"boolean","title":"Limit endpoint agent interactions","description":"Allow only administrator level users to interact with the ThreatDown tray","default":false,"examples":[false]},"eio_show_threat_scan_shortcuts":{"type":"boolean","title":"User threat scan","description":"Show ThreatDown shortcuts on start menu and desktop to run threat scans ","default":false,"examples":[false]},"eio_show_tray_icon":{"type":"boolean","title":"Show icon in notification area","description":"Show Malwarebytes icon in notification area","default":true,"examples":[true]},"eio_show_windows_contextmenu":{"type":"boolean","title":"Context menu scans","description":"Show ThreatDown option in context menus","default":true,"examples":[true]},"is_default":{"type":"boolean","title":"true if it is the default policy","default":false,"examples":[false]},"expire_endpoints":{"type":"number","title":"Expire endpoints","default":0,"examples":[0]},"startup_options":{"type":["object","null"],"properties":{"timeout":{"type":"integer"},"toggle_on":{"type":"boolean"}}},"monitoring_options":{"type":"object","properties":{"enabled":{"type":"boolean","title":"Enable suspicious activity monitoring","default":false,"examples":[true,false]}}},"rdp_settings":{"type":"object","properties":{"action":{"type":"string"},"allowed_failed_attempts":{"type":"integer"},"exclude_private_networks":{"type":"boolean"},"minutes_between_failed_attempts":{"type":"integer"},"minutes_to_block":{"type":"integer"},"protected_protocols":{"type":"array","items":{"type":"object","properties":{"enabled":{"type":"boolean"},"name":{"type":"string","title":"Protocol Name","examples":["RDP","FTP","IMAP","MSSQL","POP3","SMTP","SSH"],"enum":["RDP","FTP","IMAP","MSSQL","POP3","SMTP","SSH"]},"ports":{"type":"array","items":{"type":"integer","minimum":1,"maximum":65535}}}}}}},"as_service_process_protection":{"title":"Service and process protection policy","description":"Prevent ThreatDown services and processes from being stopped (Windows 10 only)","type":"boolean","default":true,"examples":[true,false]},"secret_allow_site_override":{"type":"boolean","title":"Allow secret override"}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"Policy","description":"Properties of the policy object","examples":[{"policy_name":"EPP New policy","etag":"f7e45ed2f43b9200a7dfa50ca44035c7","so_scan_contents_of_compressed_folders":true,"so_detect_signature_less_anomalous_files":true,"so_treat_potentially_unwanted_programs_as_malware":true,"so_treat_potentially_unwanted_modifications_as_malware":true,"so_scan_priority":"high","rtp_web_protection":true,"rtp_exploit_protection":true,"rtp_malware_protection":true,"rtp_behavior_protection":true,"sam_allow_behavioral_monitoring":false,"sam_allow_for_rollback_of_files":true,"sam_lock_unlock_endpoint":false,"sam_isolation_title":"Malware or suspicious application behavior has been detected on this computer.","sam_isolation_message":"Your system has been locked by the IT Department. Please contact the Helpdesk for further information.","sam_rollback_timeframe":48,"sam_rollback_file_size":"20MB","sam_rollback_file_size_server":"100MB","sam_rollback_quota":30,"as_scan_rootkits":false,"as_enable_restart":false,"as_postpone_reboot":true,"as_reboot_delay":{"frequency":"HOURLY","interval":1},"as_reboot_message":"In order to completely quarantine the detected threat(s), your computer must be restarted.","as_pause_software_updates":true,"as_delay_protection_updates":-1,"as_uninstall_password":"","as_service_process_protection":true,"as_auto_service_updates":true,"policy_id":"39313561336334612D333933382D343530332D623937332D613737643238623038613132","updated_by":"example@domain.com","update_at":"2020-04-21T22:18:01.937+0000","created_by":"example@domain.com","created_at":"2020-04-21T22:18:01.937+0000","updated_by_fullname":"Saif Test","created_by_fullname":"Saif Test","is_default":true,"deny_edit":false,"sites":["849337a3-962c-4187-8667-67f769378726"],"as_pause_software_updates_until":null,"sam_icon_to_display_custom_message_screen":null,"exclusions":[{"exclusion_value":"C:\\Windows\\Foo\\Bar.exe","exclusion_type":1,"policy_ids":[],"exploit_protection":false,"malware_protection":true,"ransomware_protection":true,"website_protection":false,"suspicious_activity":true,"account_level":true,"enabled":true,"comment":"dwadaw","etag":"d5381975fcf77e55264e40d64af455a7","exclusion_id":"61646536343938322D303164652D343932362D623535322D636339366431383433373332","updated_by":null,"updated_at":null,"created_by":null,"created_at":null,"updated_by_fullname":null,"created_by_fullname":null}],"win_action_center":"default","startup_options":{"timeout":60000,"toggle_on":false},"rdp_settings":{"action":"BLOCK","allowed_failed_attempts":5,"exclude_private_networks":false,"minutes_between_failed_attempts":5,"minutes_to_block":5,"protected_protocols":[{"enabled":false,"name":"RDP","ports":[3389]}]}}],"required":["policy_name","etag","so_scan_contents_of_compressed_folders","so_detect_signature_less_anomalous_files","so_treat_potentially_unwanted_programs_as_malware","so_treat_potentially_unwanted_modifications_as_malware","so_scan_priority","rtp_web_protection","rtp_exploit_protection","rtp_malware_protection","rtp_behavior_protection","sam_allow_behavioral_monitoring","sam_allow_for_rollback_of_files","sam_lock_unlock_endpoint","sam_isolation_title","sam_isolation_message","sam_rollback_timeframe","sam_rollback_file_size","sam_rollback_file_size_server","sam_rollback_quota","as_scan_rootkits","as_enable_restart","as_postpone_reboot","as_reboot_delay","as_reboot_message","as_pause_software_updates","as_delay_protection_updates","as_uninstall_password","as_service_process_protection","policy_id","update_at","created_at","is_default","win_action_center","startup_options","rdp_settings"],"properties":{"policy_name":{"type":"string","title":"Name of the Policy","description":"Friendly name for the policy.","default":"","examples":["Example Policy"]},"etag":{"type":"string","title":"Update tag","description":"etags are identifiers that change on every update. Their use is to prevent race conditions when multiple clients are modifying the same resource. Supply this tag empty when creating a policy. When updating, you need to fetch the latest value by GETting a policy. You should always get the current etag before trying to modify a resource that has an etag property.","examples":[""]},"so_scan_contents_of_compressed_folders":{"type":"boolean","title":"Scan the contents of compressed archives","description":"Scan the contents of compressed archives (e.g. .zip, .rar, etc.). Applies to Threat scans only (Windows only)","default":false,"examples":[true]},"so_detect_signature_less_anomalous_files":{"type":"boolean","title":"Detect signature-less anomalous files","description":"Detect signature-less anomalous files. Applies to Threat scans only (Windows only)","default":false,"examples":[true]},"so_treat_potentially_unwanted_programs_as_malware":{"type":"boolean","title":"PUPs","description":"Treat Potentially Unwanted Programs (PUPs) as malware (Applies to Threat Scans, Hyper Scans, and Real-Time Protection events)","default":false,"examples":[true]},"so_treat_potentially_unwanted_modifications_as_malware":{"type":"boolean","title":"PUMs","description":"Treat Potentially Unwanted Modifications (PUMs) as malware (Applies to Threat Scans, Hyper Scans, and Real-Time Protection events). Windows only.","default":false,"examples":[true]},"so_scan_priority":{"type":"string","title":"CPU priority for scans","description":"Maximum allocation of CPU resources for scans. Mac only","default":"low","examples":["high","medium","low"],"enum":["high","medium","low"]},"rtp_web_protection":{"type":"boolean","title":"Real time web protection","description":"Web protection (Real-Time Protections). windows only","default":false,"examples":[true]},"rtp_exploit_protection":{"type":"boolean","title":"Real time exploit protection","description":"Exploit protection","default":false,"examples":[true]},"rtp_malware_protection":{"type":"boolean","title":"Malware protection","description":"Malware protection.","default":false,"examples":[true]},"rtp_behavior_protection":{"type":"boolean","title":"Behavior protection","description":"Behavior protection (windows only)","default":false,"examples":[true]},"sam_allow_behavioral_monitoring":{"type":"boolean","title":"Behavioral Monitoring","description":"Allow Behavioral Monitoring for Suspicious Activity on endpoints (Suspicious activity monitoring)","default":false,"examples":[true]},"sam_allow_for_rollback_of_files":{"type":"boolean","title":"Rollback","description":"Allow for Rollback of files modified by any Suspicious Activity","default":false,"examples":[true]},"sam_lock_unlock_endpoint":{"type":"boolean","title":"Endpoint isolation","description":"Allow for locking and unlocking endpoints through isolation.","default":false,"examples":[true]},"sam_isolation_title":{"type":"string","title":"The sam_isolation_title schema","default":"","examples":["Malware or suspicious application behavior has been detected on this computer."]},"sam_isolation_message":{"type":"string","title":"The sam_isolation_message schema","default":"","examples":["Your system has been locked by the IT Department. Please contact the Helpdesk for further information."]},"sam_rollback_timeframe":{"type":"integer","title":"Rollback timeframe","description":"Number of hours to extend the rollback timeframe","default":0,"examples":[48]},"sam_rollback_file_size":{"type":"string","title":"Rollback filesize","description":"Size of rollback file. See examples for correct format.","default":"","examples":["54MB"]},"sam_rollback_file_size_server":{"type":"string","title":"Rollback filesize for servers","description":"Size of rollback file on servers. See examples for correct format.","default":"","examples":["100MB"]},"sam_rollback_quota":{"type":"number","title":"Rollback free disk space quota","description":"Percentage of rollback free disk space quota. From 10 to 70","default":30,"examples":[30]},"sam_icon_to_display_custom_message_screen":{"type":["string","null"],"title":"Endpoint isolation icon","description":"Icon to display on customer message screen (BMP 150x150)","examples":["https://nebula-isolation-images-mb-qa.s3.amazonaws.com/92cc3972-f302-48f1-8cf4-fdf552dcbed1"]},"as_scan_rootkits":{"type":"boolean","title":"Scan rootkits","description":"Scan rootkits","default":false,"examples":[true]},"as_enable_restart":{"type":"boolean","title":"Enable restart","description":"Enable restart","default":false,"examples":[true]},"as_postpone_reboot":{"type":"boolean","title":"Postpone reboot","description":"Postpone reboot","default":false,"examples":[true]},"as_reboot_delay":{"type":"object","title":"Reboot delay","description":"Reboot delay","examples":[{"frequency":"HOURLY","interval":3}],"required":["frequency","interval"],"properties":{"frequency":{"type":"string","title":"Frequency","description":"","default":"","examples":["HOURLY"]},"interval":{"type":"number","title":"Interval","description":"","default":0,"examples":[3]}}},"as_reboot_message":{"type":"string","title":"Reboot message","description":"Message to show on Endpoint agent.","default":"","examples":["In order to completely quarantine the detected threat(s), your computer must be restarted."]},"as_pause_software_updates":{"type":"boolean","title":"Pause software updates","description":"Windows only. Software updates can be paused up to 30 days.","default":false,"examples":[true]},"as_pause_software_updates_until":{"type":["string","null"],"format":"date-time","title":"Pause software updates until date","description":"Windows only. If as_pause_software_updates=true, Software updates will be paused until the specified date.","default":null,"examples":[null]},"as_delay_protection_updates":{"type":["integer","null"],"title":"Delay protection updates","description":"In minutes","default":0,"examples":[180]},"as_uninstall_password":{"type":["string","null"],"title":"Tamper protection","description":"Require password to unistall endpoint agent.","default":"","examples":["e'5.12/Fx]ny"]},"as_auto_service_updates":{"type":"boolean","title":"Auto service updates","description":"Automatically download and install ThreatDown application updates.","default":true,"examples":[true]},"policy_id":{"type":"string","title":"Id","description":"Unique identifier of this policiy","default":"","examples":["39313561336334612D333933382D343530332D623937332D613737643238623038613132"]},"update_at":{"type":"string","title":"Updated at","description":"When this policy was updated","default":"","examples":["2020-04-21T22:18:01.937+0000"]},"created_at":{"type":"string","title":"Create at","description":"When this policy was creates","default":"","examples":["2020-04-21T22:18:01.937+0000"]},"is_default":{"type":"boolean","title":"Default","description":"Whether this is set as default policy (see promote endpoint)","default":false,"examples":[true]},"sites":{"type":"array","title":"Sites","description":"List of sites to which this policy is associated","examples":[["849337a3-962c-4187-8667-67f769378726"]],"items":{"type":"string"}},"exclusions":{"type":"array","title":"Exclusions","description":"List of exclusions associated with this policy","examples":[[{"exclusion_value":"C:\\Windows\\Foo\\Bar.exe","exclusion_type":1,"policy_ids":[],"exploit_protection":false,"malware_protection":true,"ransomware_protection":true,"website_protection":false,"suspicious_activity":true,"account_level":true,"enabled":true,"comment":"dwadaw","etag":"d5381975fcf77e55264e40d64af455a7","exclusion_id":"61646536343938322D303164652D343932362D623535322D636339366431383433373332","updated_by":null,"updated_at":null,"created_by":null,"created_at":null,"updated_by_fullname":null,"created_by_fullname":null}]],"items":{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"Properties of one exclusion","description":"Properties of one exclusion","additionalProperties":false,"examples":[{"exclusion_value":"exclude","exclusion_type":5,"policy_ids":["36376136326434342D613164382D346633622D616335662D623566383435323264303730","39313561336334612D333933382D343530332D623937332D613737643238623038613132"],"exploit_protection":false,"malware_protection":true,"ransomware_protection":false,"website_protection":false,"suspicious_activity":false,"account_level":false,"enabled":true,"comment":"hello","etag":"ebf2778dfcf61a83053160ce2bfeb6c5","exclusion_id":"61656333653261372D653539662D346666652D393239622D323465646236386266353332","updated_by":"rrais@yopmail.com","updated_at":"2020-05-26T11:14:54.302+0000","created_by":"rrais@yopmail.com","created_at":"2020-05-26T11:14:54.302+0000"}],"required":["exclusion_value","exclusion_type","policy_ids","exploit_protection","malware_protection","ransomware_protection","website_protection","suspicious_activity","account_level","enabled","comment","etag","exclusion_id","updated_at","created_at"],"properties":{"exclusion_value":{"type":"string","title":"Value","description":"Value of this exclusion","default":"","examples":["string"]},"exclusion_type":{"type":"integer","title":"The exclusion_type schema","description":"1: Exclusion for file path, 2: Exclusion for folder path, 3: Exclusion for wildcard path, 4: Exclusion for registry, 5: Exclusion for file extensions, 6: Exclusion for web domain, 7: Exclusion for web IP, 8: Exclusion for Web Monitoring, 13: Exclusion for hash, 14: Exclusion for command line","default":1,"enum":[1,2,3,4,5,6,7,8,13,14],"examples":[1]},"policy_ids":{"type":"array","title":"Policies identifier","description":"If its not account level, specify policy to apply this exclusion to","examples":[["string"]],"items":{"type":"string"}},"exploit_protection":{"type":"boolean","title":"Exploit Protection","description":"Whether this exclusion applies for exploit protection.","default":false,"examples":[true]},"malware_protection":{"type":"boolean","title":"Malware Protection","description":"Whether this exclusion applies for malware protection.","default":false,"examples":[true]},"ransomware_protection":{"type":"boolean","title":"Ransomware Protection","description":"Whether this exclusion applies for ransomware protection.","default":false,"examples":[true]},"website_protection":{"type":"boolean","title":"Website protection","description":"Whether this exclusion applies for website protection.","default":false,"examples":[true]},"suspicious_activity":{"type":"boolean","title":"Suspicious activity","description":"Whether this exclusion applies for suspicious activity","default":false,"examples":[true]},"account_level":{"type":"boolean","title":"Account level","description":"Whether to apply this exclusion to all policies","default":true,"examples":[true]},"enabled":{"type":"boolean","title":"Enabled","description":"Boolean indicating whether this exclusion is enabled or not","default":false,"examples":[true]},"comment":{"type":"string","title":"Comment","description":"A comment about this exclusion","default":"","examples":["string"]},"etag":{"type":"string","title":"Update tag","description":"etags are identifiers that change on every update. Their use is to prevent race conditions when multiple clients are modifying the same resource. Supply this tag empty when creating a exclusion. When updating, you need to fetch the latest value by GETting an exclusion. You should always get the current etag before trying to modify a resource that has an etag property.","default":"","examples":[""]},"exclusion_id":{"type":"string","title":"ID of the exclusion","description":"Use this identifier for REST operations.","default":"","examples":["61656333653261372D653539662D346666652D393239622D323465646236386266353332"]},"updated_at":{"type":["string","null"],"title":"Updated at","description":"Last time this exclusion was updated.","default":"","examples":["2020-05-26T11:14:54.302+0000"]},"created_at":{"type":["string","null"],"title":"Created at","description":"When this exclusion was created","default":"","examples":["2020-05-26T11:14:54.302+0000"]},"updated_by":{"type":["string","null"],"title":"Updated by","description":"Last user that updated the exclusion","default":""},"created_by":{"type":["string","null"],"title":"Created by","description":"User that created the exclusion","default":""},"updated_by_fullname":{"type":["string","null"],"title":"Updated by full name","description":"Last user full name that updated the exclusion","default":""},"created_by_fullname":{"type":["string","null"],"title":"Created by full name","description":"User full name that created the exclusion","default":""}}}},"win_action_center":{"type":["string","null"],"enum":["default","always","never",null],"title":"Windows Action Center","description":"Determine how ThreatDown Endpoint Protection should be registered on the endpoints.","default":"default","examples":["default"]},"deny_edit":{"type":"boolean","title":"Deny Edit","default":false,"examples":[false]},"eio_allow_run_threat_scan":{"type":["boolean","null"],"title":"User threat scan","description":"Allow users to run a threat scan (all threats will be quarantined automatically)","examples":[true]},"eio_display_rtp_events":{"type":["boolean","null"],"title":"eio_display_rtp_events","description":"Display real-time protection notifications","examples":[true]},"eio_limit_endpoint_agent_control":{"type":["boolean","null"],"title":"Limit endpoint agent interactions","description":"Allow only administrator level users to interact with the ThreatDown tray","examples":[false]},"eio_show_threat_scan_shortcuts":{"type":["boolean","null"],"title":"User threat scan","description":"Show ThreatDown shortcuts on start menu and desktop to run threat scans ","examples":[false]},"eio_show_tray_icon":{"type":"boolean","title":"Show icon in notification area","description":"Show Malwarebytes icon in notification area","examples":[true]},"eio_show_windows_contextmenu":{"type":["boolean","null"],"title":"Context menu scans","description":"Show ThreatDown option in context menus","examples":[true]},"expire_endpoints":{"type":"number","title":"Expire endpoints","examples":[0]},"startup_options":{"type":["object","null"],"properties":{"timeout":{"type":"integer"},"toggle_on":{"type":"boolean"}}},"rdp_settings":{"type":"object","properties":{"action":{"type":"string"},"allowed_failed_attempts":{"type":"integer"},"exclude_private_networks":{"type":"boolean"},"minutes_between_failed_attempts":{"type":"integer"},"minutes_to_block":{"type":"integer"},"protected_protocols":{"type":"array","items":{"type":"object","properties":{"enabled":{"type":"boolean"},"name":{"type":"string"},"ports":{"type":"array","items":{"type":"integer"}}}}}}},"as_service_process_protection":{"title":"Service and process protection policy","description":"Prevent ThreatDown services and processes from being stopped (Windows 10 only)","type":"boolean","default":true,"examples":[true,false]},"secret_allow_site_override":{"type":"boolean","title":"Allow secret override"}}}}}}},"tags":["Policies"],"operationId":"api.v2.oneview.update.policy"}},"/oneview/v1/policies/{id}/secret":{"get":{"description":"Get policy tamper protection password","summary":"Get policy tamper protection password","security":[{"client_credentials":["read"]},{"user_permissions":["tamperProtection.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":true,"in":"path","description":"Policy ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Response of policy tamper protection secret","properties":{"secret":{"type":"string","title":"Secret of policy tamper protection"}}}}}}},"tags":["Policies"],"operationId":"api.v2.oneview.get-secret.policy"},"post":{"description":"Set policy tamper protection password","summary":"Set policy tamper protection password","security":[{"client_credentials":["write"]},{"user_permissions":["tamperProtection.manage"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":true,"in":"path","description":"Policy ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Change Secret","required":["secret"],"properties":{"secret":{"type":"string","title":"New tamper protection secret for the policy"}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Response of policy tamper protection secret","properties":{"secret":{"type":"string","title":"Secret of policy tamper protection"}}}}}}},"tags":["Policies"],"operationId":"api.v2.oneview.post-secret.policy"}},"/oneview/v1/sites/{siteId}/policies/{id}/tamper-protection":{"get":{"description":"Returns the effective tamper protection level (off, policy or site) for a policy resolved in the context of a specific site, along with the site override flag and presence indicators. The level is resolved against the site (child account) where the machine is installed, since a global policy can be owned by a parent account but the applied secret lives on the site. Use this before an uninstall to determine whether a passwordless uninstall is possible and, if not, which secret to retrieve. No secret value is returned.","summary":"Get policy effective tamper protection level","security":[{"client_credentials":["read"]},{"user_permissions":["tamperProtection.view"]}],"status":{"outage":["auth","ov"]},"parameters":[{"name":"siteId","required":true,"in":"path","description":"Valid OneView site ID (Ex. \"30616562663436302D643733312D346238622D623338332D613031343538363566383333\")","schema":{"type":"string","pattern":"^[A-Fa-f0-9]+$"}},{"name":"id","required":true,"in":"path","description":"Valid OneView policy ID (Ex. \"30616562663436302D643733312D346238622D623338332D613031343538363566383333\")","schema":{"type":"string","pattern":"^[A-Fa-f0-9]+$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"Policy effective tamper protection status","description":"The effective tamper protection level for a policy resolved in the context of a specific site (its child account), along with the override flag and presence indicators. No secret value is returned.","examples":[{"level":"site","secret_allow_site_override":true,"policy_secret_set":true,"site_secret_set":true}],"properties":{"level":{"type":"string","enum":["off","policy","site"],"title":"Effective tamper protection level","description":"The effective tamper protection level. 'off' means a passwordless uninstall is possible, 'policy' means the policy secret applies, 'site' means the site (account) level secret applies."},"secret_allow_site_override":{"type":"boolean","title":"Allow site override","description":"Whether the policy permits a site account secret to override the policy secret."},"policy_secret_set":{"type":"boolean","title":"Policy secret set","description":"Whether the policy has a tamper protection secret configured."},"site_secret_set":{"type":"boolean","title":"Site secret set","description":"Whether the resolving account has a site level tamper protection secret configured."}},"required":["level","secret_allow_site_override","policy_secret_set","site_secret_set"]}}}}},"tags":["Policies"],"operationId":"api.v2.oneview.get-tamper-protection.policy"}},"/oneview/v1/policies/{id}/promote":{"put":{"description":"Assign policies to site accounts","summary":"Assign to accounts","security":[{"client_credentials":["write"]},{"user_permissions":["policies.edit"]}],"status":{"outage":["auth","ov"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"Promote policy","description":"Payload for promoting one policy","examples":[{"account_ids":["string"]}],"required":["account_ids"],"properties":{"account_ids":{"type":"array","title":"Account ids","description":"Associate this policy to one of your accounts. One account is created once you add a valid subscription for one of your customers","default":[],"examples":[["string"]],"items":{"type":"string"}}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"Policy","description":"Properties of the policy object","examples":[{"policy_name":"EPP New policy","etag":"f7e45ed2f43b9200a7dfa50ca44035c7","so_scan_contents_of_compressed_folders":true,"so_detect_signature_less_anomalous_files":true,"so_treat_potentially_unwanted_programs_as_malware":true,"so_treat_potentially_unwanted_modifications_as_malware":true,"so_scan_priority":"high","rtp_web_protection":true,"rtp_exploit_protection":true,"rtp_malware_protection":true,"rtp_behavior_protection":true,"sam_allow_behavioral_monitoring":false,"sam_allow_for_rollback_of_files":true,"sam_lock_unlock_endpoint":false,"sam_isolation_title":"Malware or suspicious application behavior has been detected on this computer.","sam_isolation_message":"Your system has been locked by the IT Department. Please contact the Helpdesk for further information.","sam_rollback_timeframe":48,"sam_rollback_file_size":"20MB","sam_rollback_file_size_server":"100MB","sam_rollback_quota":30,"as_scan_rootkits":false,"as_enable_restart":false,"as_postpone_reboot":true,"as_reboot_delay":{"frequency":"HOURLY","interval":1},"as_reboot_message":"In order to completely quarantine the detected threat(s), your computer must be restarted.","as_pause_software_updates":true,"as_delay_protection_updates":-1,"as_uninstall_password":"","as_service_process_protection":true,"as_auto_service_updates":true,"policy_id":"39313561336334612D333933382D343530332D623937332D613737643238623038613132","updated_by":"example@domain.com","update_at":"2020-04-21T22:18:01.937+0000","created_by":"example@domain.com","created_at":"2020-04-21T22:18:01.937+0000","updated_by_fullname":"Saif Test","created_by_fullname":"Saif Test","is_default":true,"deny_edit":false,"sites":["849337a3-962c-4187-8667-67f769378726"],"as_pause_software_updates_until":null,"sam_icon_to_display_custom_message_screen":null,"exclusions":[{"exclusion_value":"C:\\Windows\\Foo\\Bar.exe","exclusion_type":1,"policy_ids":[],"exploit_protection":false,"malware_protection":true,"ransomware_protection":true,"website_protection":false,"suspicious_activity":true,"account_level":true,"enabled":true,"comment":"dwadaw","etag":"d5381975fcf77e55264e40d64af455a7","exclusion_id":"61646536343938322D303164652D343932362D623535322D636339366431383433373332","updated_by":null,"updated_at":null,"created_by":null,"created_at":null,"updated_by_fullname":null,"created_by_fullname":null}],"win_action_center":"default","startup_options":{"timeout":60000,"toggle_on":false},"rdp_settings":{"action":"BLOCK","allowed_failed_attempts":5,"exclude_private_networks":false,"minutes_between_failed_attempts":5,"minutes_to_block":5,"protected_protocols":[{"enabled":false,"name":"RDP","ports":[3389]}]}}],"required":["policy_name","etag","so_scan_contents_of_compressed_folders","so_detect_signature_less_anomalous_files","so_treat_potentially_unwanted_programs_as_malware","so_treat_potentially_unwanted_modifications_as_malware","so_scan_priority","rtp_web_protection","rtp_exploit_protection","rtp_malware_protection","rtp_behavior_protection","sam_allow_behavioral_monitoring","sam_allow_for_rollback_of_files","sam_lock_unlock_endpoint","sam_isolation_title","sam_isolation_message","sam_rollback_timeframe","sam_rollback_file_size","sam_rollback_file_size_server","sam_rollback_quota","as_scan_rootkits","as_enable_restart","as_postpone_reboot","as_reboot_delay","as_reboot_message","as_pause_software_updates","as_delay_protection_updates","as_uninstall_password","as_service_process_protection","policy_id","update_at","created_at","is_default","win_action_center","startup_options","rdp_settings"],"properties":{"policy_name":{"type":"string","title":"Name of the Policy","description":"Friendly name for the policy.","default":"","examples":["Example Policy"]},"etag":{"type":"string","title":"Update tag","description":"etags are identifiers that change on every update. Their use is to prevent race conditions when multiple clients are modifying the same resource. Supply this tag empty when creating a policy. When updating, you need to fetch the latest value by GETting a policy. You should always get the current etag before trying to modify a resource that has an etag property.","examples":[""]},"so_scan_contents_of_compressed_folders":{"type":"boolean","title":"Scan the contents of compressed archives","description":"Scan the contents of compressed archives (e.g. .zip, .rar, etc.). Applies to Threat scans only (Windows only)","default":false,"examples":[true]},"so_detect_signature_less_anomalous_files":{"type":"boolean","title":"Detect signature-less anomalous files","description":"Detect signature-less anomalous files. Applies to Threat scans only (Windows only)","default":false,"examples":[true]},"so_treat_potentially_unwanted_programs_as_malware":{"type":"boolean","title":"PUPs","description":"Treat Potentially Unwanted Programs (PUPs) as malware (Applies to Threat Scans, Hyper Scans, and Real-Time Protection events)","default":false,"examples":[true]},"so_treat_potentially_unwanted_modifications_as_malware":{"type":"boolean","title":"PUMs","description":"Treat Potentially Unwanted Modifications (PUMs) as malware (Applies to Threat Scans, Hyper Scans, and Real-Time Protection events). Windows only.","default":false,"examples":[true]},"so_scan_priority":{"type":"string","title":"CPU priority for scans","description":"Maximum allocation of CPU resources for scans. Mac only","default":"low","examples":["high","medium","low"],"enum":["high","medium","low"]},"rtp_web_protection":{"type":"boolean","title":"Real time web protection","description":"Web protection (Real-Time Protections). windows only","default":false,"examples":[true]},"rtp_exploit_protection":{"type":"boolean","title":"Real time exploit protection","description":"Exploit protection","default":false,"examples":[true]},"rtp_malware_protection":{"type":"boolean","title":"Malware protection","description":"Malware protection.","default":false,"examples":[true]},"rtp_behavior_protection":{"type":"boolean","title":"Behavior protection","description":"Behavior protection (windows only)","default":false,"examples":[true]},"sam_allow_behavioral_monitoring":{"type":"boolean","title":"Behavioral Monitoring","description":"Allow Behavioral Monitoring for Suspicious Activity on endpoints (Suspicious activity monitoring)","default":false,"examples":[true]},"sam_allow_for_rollback_of_files":{"type":"boolean","title":"Rollback","description":"Allow for Rollback of files modified by any Suspicious Activity","default":false,"examples":[true]},"sam_lock_unlock_endpoint":{"type":"boolean","title":"Endpoint isolation","description":"Allow for locking and unlocking endpoints through isolation.","default":false,"examples":[true]},"sam_isolation_title":{"type":"string","title":"The sam_isolation_title schema","default":"","examples":["Malware or suspicious application behavior has been detected on this computer."]},"sam_isolation_message":{"type":"string","title":"The sam_isolation_message schema","default":"","examples":["Your system has been locked by the IT Department. Please contact the Helpdesk for further information."]},"sam_rollback_timeframe":{"type":"integer","title":"Rollback timeframe","description":"Number of hours to extend the rollback timeframe","default":0,"examples":[48]},"sam_rollback_file_size":{"type":"string","title":"Rollback filesize","description":"Size of rollback file. See examples for correct format.","default":"","examples":["54MB"]},"sam_rollback_file_size_server":{"type":"string","title":"Rollback filesize for servers","description":"Size of rollback file on servers. See examples for correct format.","default":"","examples":["100MB"]},"sam_rollback_quota":{"type":"number","title":"Rollback free disk space quota","description":"Percentage of rollback free disk space quota. From 10 to 70","default":30,"examples":[30]},"sam_icon_to_display_custom_message_screen":{"type":["string","null"],"title":"Endpoint isolation icon","description":"Icon to display on customer message screen (BMP 150x150)","examples":["https://nebula-isolation-images-mb-qa.s3.amazonaws.com/92cc3972-f302-48f1-8cf4-fdf552dcbed1"]},"as_scan_rootkits":{"type":"boolean","title":"Scan rootkits","description":"Scan rootkits","default":false,"examples":[true]},"as_enable_restart":{"type":"boolean","title":"Enable restart","description":"Enable restart","default":false,"examples":[true]},"as_postpone_reboot":{"type":"boolean","title":"Postpone reboot","description":"Postpone reboot","default":false,"examples":[true]},"as_reboot_delay":{"type":"object","title":"Reboot delay","description":"Reboot delay","examples":[{"frequency":"HOURLY","interval":3}],"required":["frequency","interval"],"properties":{"frequency":{"type":"string","title":"Frequency","description":"","default":"","examples":["HOURLY"]},"interval":{"type":"number","title":"Interval","description":"","default":0,"examples":[3]}}},"as_reboot_message":{"type":"string","title":"Reboot message","description":"Message to show on Endpoint agent.","default":"","examples":["In order to completely quarantine the detected threat(s), your computer must be restarted."]},"as_pause_software_updates":{"type":"boolean","title":"Pause software updates","description":"Windows only. Software updates can be paused up to 30 days.","default":false,"examples":[true]},"as_pause_software_updates_until":{"type":["string","null"],"format":"date-time","title":"Pause software updates until date","description":"Windows only. If as_pause_software_updates=true, Software updates will be paused until the specified date.","default":null,"examples":[null]},"as_delay_protection_updates":{"type":["integer","null"],"title":"Delay protection updates","description":"In minutes","default":0,"examples":[180]},"as_uninstall_password":{"type":["string","null"],"title":"Tamper protection","description":"Require password to unistall endpoint agent.","default":"","examples":["e'5.12/Fx]ny"]},"as_auto_service_updates":{"type":"boolean","title":"Auto service updates","description":"Automatically download and install ThreatDown application updates.","default":true,"examples":[true]},"policy_id":{"type":"string","title":"Id","description":"Unique identifier of this policiy","default":"","examples":["39313561336334612D333933382D343530332D623937332D613737643238623038613132"]},"update_at":{"type":"string","title":"Updated at","description":"When this policy was updated","default":"","examples":["2020-04-21T22:18:01.937+0000"]},"created_at":{"type":"string","title":"Create at","description":"When this policy was creates","default":"","examples":["2020-04-21T22:18:01.937+0000"]},"is_default":{"type":"boolean","title":"Default","description":"Whether this is set as default policy (see promote endpoint)","default":false,"examples":[true]},"sites":{"type":"array","title":"Sites","description":"List of sites to which this policy is associated","examples":[["849337a3-962c-4187-8667-67f769378726"]],"items":{"type":"string"}},"exclusions":{"type":"array","title":"Exclusions","description":"List of exclusions associated with this policy","examples":[[{"exclusion_value":"C:\\Windows\\Foo\\Bar.exe","exclusion_type":1,"policy_ids":[],"exploit_protection":false,"malware_protection":true,"ransomware_protection":true,"website_protection":false,"suspicious_activity":true,"account_level":true,"enabled":true,"comment":"dwadaw","etag":"d5381975fcf77e55264e40d64af455a7","exclusion_id":"61646536343938322D303164652D343932362D623535322D636339366431383433373332","updated_by":null,"updated_at":null,"created_by":null,"created_at":null,"updated_by_fullname":null,"created_by_fullname":null}]],"items":{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"Properties of one exclusion","description":"Properties of one exclusion","additionalProperties":false,"examples":[{"exclusion_value":"exclude","exclusion_type":5,"policy_ids":["36376136326434342D613164382D346633622D616335662D623566383435323264303730","39313561336334612D333933382D343530332D623937332D613737643238623038613132"],"exploit_protection":false,"malware_protection":true,"ransomware_protection":false,"website_protection":false,"suspicious_activity":false,"account_level":false,"enabled":true,"comment":"hello","etag":"ebf2778dfcf61a83053160ce2bfeb6c5","exclusion_id":"61656333653261372D653539662D346666652D393239622D323465646236386266353332","updated_by":"rrais@yopmail.com","updated_at":"2020-05-26T11:14:54.302+0000","created_by":"rrais@yopmail.com","created_at":"2020-05-26T11:14:54.302+0000"}],"required":["exclusion_value","exclusion_type","policy_ids","exploit_protection","malware_protection","ransomware_protection","website_protection","suspicious_activity","account_level","enabled","comment","etag","exclusion_id","updated_at","created_at"],"properties":{"exclusion_value":{"type":"string","title":"Value","description":"Value of this exclusion","default":"","examples":["string"]},"exclusion_type":{"type":"integer","title":"The exclusion_type schema","description":"1: Exclusion for file path, 2: Exclusion for folder path, 3: Exclusion for wildcard path, 4: Exclusion for registry, 5: Exclusion for file extensions, 6: Exclusion for web domain, 7: Exclusion for web IP, 8: Exclusion for Web Monitoring, 13: Exclusion for hash, 14: Exclusion for command line","default":1,"enum":[1,2,3,4,5,6,7,8,13,14],"examples":[1]},"policy_ids":{"type":"array","title":"Policies identifier","description":"If its not account level, specify policy to apply this exclusion to","examples":[["string"]],"items":{"type":"string"}},"exploit_protection":{"type":"boolean","title":"Exploit Protection","description":"Whether this exclusion applies for exploit protection.","default":false,"examples":[true]},"malware_protection":{"type":"boolean","title":"Malware Protection","description":"Whether this exclusion applies for malware protection.","default":false,"examples":[true]},"ransomware_protection":{"type":"boolean","title":"Ransomware Protection","description":"Whether this exclusion applies for ransomware protection.","default":false,"examples":[true]},"website_protection":{"type":"boolean","title":"Website protection","description":"Whether this exclusion applies for website protection.","default":false,"examples":[true]},"suspicious_activity":{"type":"boolean","title":"Suspicious activity","description":"Whether this exclusion applies for suspicious activity","default":false,"examples":[true]},"account_level":{"type":"boolean","title":"Account level","description":"Whether to apply this exclusion to all policies","default":true,"examples":[true]},"enabled":{"type":"boolean","title":"Enabled","description":"Boolean indicating whether this exclusion is enabled or not","default":false,"examples":[true]},"comment":{"type":"string","title":"Comment","description":"A comment about this exclusion","default":"","examples":["string"]},"etag":{"type":"string","title":"Update tag","description":"etags are identifiers that change on every update. Their use is to prevent race conditions when multiple clients are modifying the same resource. Supply this tag empty when creating a exclusion. When updating, you need to fetch the latest value by GETting an exclusion. You should always get the current etag before trying to modify a resource that has an etag property.","default":"","examples":[""]},"exclusion_id":{"type":"string","title":"ID of the exclusion","description":"Use this identifier for REST operations.","default":"","examples":["61656333653261372D653539662D346666652D393239622D323465646236386266353332"]},"updated_at":{"type":["string","null"],"title":"Updated at","description":"Last time this exclusion was updated.","default":"","examples":["2020-05-26T11:14:54.302+0000"]},"created_at":{"type":["string","null"],"title":"Created at","description":"When this exclusion was created","default":"","examples":["2020-05-26T11:14:54.302+0000"]},"updated_by":{"type":["string","null"],"title":"Updated by","description":"Last user that updated the exclusion","default":""},"created_by":{"type":["string","null"],"title":"Created by","description":"User that created the exclusion","default":""},"updated_by_fullname":{"type":["string","null"],"title":"Updated by full name","description":"Last user full name that updated the exclusion","default":""},"created_by_fullname":{"type":["string","null"],"title":"Created by full name","description":"User full name that created the exclusion","default":""}}}},"win_action_center":{"type":["string","null"],"enum":["default","always","never",null],"title":"Windows Action Center","description":"Determine how ThreatDown Endpoint Protection should be registered on the endpoints.","default":"default","examples":["default"]},"deny_edit":{"type":"boolean","title":"Deny Edit","default":false,"examples":[false]},"eio_allow_run_threat_scan":{"type":["boolean","null"],"title":"User threat scan","description":"Allow users to run a threat scan (all threats will be quarantined automatically)","examples":[true]},"eio_display_rtp_events":{"type":["boolean","null"],"title":"eio_display_rtp_events","description":"Display real-time protection notifications","examples":[true]},"eio_limit_endpoint_agent_control":{"type":["boolean","null"],"title":"Limit endpoint agent interactions","description":"Allow only administrator level users to interact with the ThreatDown tray","examples":[false]},"eio_show_threat_scan_shortcuts":{"type":["boolean","null"],"title":"User threat scan","description":"Show ThreatDown shortcuts on start menu and desktop to run threat scans ","examples":[false]},"eio_show_tray_icon":{"type":"boolean","title":"Show icon in notification area","description":"Show Malwarebytes icon in notification area","examples":[true]},"eio_show_windows_contextmenu":{"type":["boolean","null"],"title":"Context menu scans","description":"Show ThreatDown option in context menus","examples":[true]},"expire_endpoints":{"type":"number","title":"Expire endpoints","examples":[0]},"startup_options":{"type":["object","null"],"properties":{"timeout":{"type":"integer"},"toggle_on":{"type":"boolean"}}},"rdp_settings":{"type":"object","properties":{"action":{"type":"string"},"allowed_failed_attempts":{"type":"integer"},"exclude_private_networks":{"type":"boolean"},"minutes_between_failed_attempts":{"type":"integer"},"minutes_to_block":{"type":"integer"},"protected_protocols":{"type":"array","items":{"type":"object","properties":{"enabled":{"type":"boolean"},"name":{"type":"string"},"ports":{"type":"array","items":{"type":"integer"}}}}}}},"as_service_process_protection":{"title":"Service and process protection policy","description":"Prevent ThreatDown services and processes from being stopped (Windows 10 only)","type":"boolean","default":true,"examples":[true,false]},"secret_allow_site_override":{"type":"boolean","title":"Allow secret override"}}}}}}},"tags":["Policies"],"operationId":"api.v2.oneview.promote.policy"}},"/oneview/v1/accounts/{account_id}/schedules/{id}":{"delete":{"description":"Delete a schedule by its schedule id.","summary":"Delete a schedule","security":[{"client_credentials":["read","write"]},{"user_permissions":["schedules.delete"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":true,"in":"path","description":"ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"Successful response"}},"tags":["Schedules"],"operationId":"api.rmm.delete.schedules"},"get":{"description":"Get schedule by the schedule id.","summary":"Get schedule by id","security":[{"client_credentials":["read"]},{"user_permissions":["schedules.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":true,"in":"path","description":"ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Schedule Response","properties":{"id":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","title":"Id (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"name":{"type":"string","title":"Name"},"etag":{"type":"string","title":"ETAG","description":"etags are identifiers that change on every update. Their use is to prevent race conditions when multiple clients are modifying the same resource. Supply this tag empty when creating a schedule. When updating, you need to fetch the latest value by GETting a schedule. You should always get the current etag before trying to modify a resource that has an etag property."},"command":{"type":"string","title":"Command","examples":["command.threat.scan","command.asset.refresh"]},"rrule":{"type":"string","title":"Frequency and start date","examples":["FREQ=DAILY;INTERVAL=1;DTSTART=20200313T000100"]},"enabled":{"type":"boolean","title":"Enabled","default":true},"splay":{"type":"integer","title":"Splay","description":"Time randomization window in minutes. Delays task execution by a random amount within this range to distribute load across endpoints.","default":5,"minimum":0},"command_data":{"type":"object","additionalProperties":true,"title":"Command data","examples":[{"schedule_for_windows":true,"scan_settings":{"pum_detection":"Detect","scan_registry":true,"type":"CustomScan","no_archive":false,"fixed_drive":true,"scan_path":"","ark":true,"scan_startup":true,"pup_detection":"Detect","scan_memory":true,"remove":true},"mac_scan_settings":{"remove":true,"pup_detection":"Ignore"},"schedule_for_mac":true}],"properties":{"schedule_for_mac":{"type":"boolean","title":"Schedule for Mac"},"schedule_for_windows":{"type":"boolean","title":"Schedule for Windows"},"scan_settings":{"type":"object","additionalProperties":true,"title":"Scan settings","properties":{"type":{"type":"string","title":"Scan method","enum":["CustomScan","ThreatScan","HyperScan"],"examples":["CustomScan","ThreatScan","HyperScan"]},"remove":{"type":"boolean","title":"Remove"},"scan_path":{"type":"string","title":"Scan path"},"scan_memory":{"type":"boolean","title":"Scan memory objects","default":true},"scan_registry":{"type":"boolean","title":"Scan registry"},"scan_startup":{"type":"boolean","title":"Scan startup"},"fixed_drive":{"type":"boolean","title":"Scan all local drives on endpoints"},"no_archive":{"type":"boolean","title":"Do not scan archives"},"ark":{"type":"boolean","title":"Scan for rootkits"},"pup_detection":{"type":"string","title":"Potentially Unwanted Programs, treat as malware","examples":["Detect","Ignore"]},"pum_detection":{"type":"string","title":"Potentially Unwanted Modifications, treat as malware.","examples":["Detect","Ignore"]}}},"mac_scan_settings":{"type":"object","additionalProperties":true,"title":"Mac scan settings","properties":{"remove":{"type":"boolean","title":"Quarantine found threats automatically"},"pup_detection":{"type":"string","title":"Treat detections as malware.","examples":["Detect","Ignore"]}}}}},"group_ids":{"type":"array","title":"Collection of Group IDs","items":{"type":"string","title":"Group ids"}}}}}}}},"tags":["Schedules"],"operationId":"api.rmm.get.schedule.id"},"put":{"description":"Update schedule. You must use \"add groups for schedule\" to update group route.","summary":"Update schedule","security":[{"client_credentials":["read","write"]},{"user_permissions":["schedules.edit"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":true,"in":"path","description":"ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Update schedule","required":["etag"],"properties":{"etag":{"type":"string","title":"Etag","description":"etags are identifiers that change on every update. Their use is to prevent race conditions when multiple clients are modifying the same resource. Supply this tag empty when creating a schedule. When updating, you need to fetch the latest value by GETting a schedule. You should always get the current etag before trying to modify a resource that has an etag property."},"name":{"type":"string","title":"Name"},"command":{"type":"string","title":"Command","examples":["command.threat.scan","command.asset.refresh"]},"rrule":{"type":"string","title":"Frequency and start date","examples":["FREQ=DAILY;INTERVAL=1;DTSTART=20200313T000100"]},"enabled":{"type":"boolean","title":"Command is enabled","default":true},"splay":{"type":"integer","title":"Splay","description":"Time randomization window in minutes. Delays task execution by a random amount within this range to distribute load across endpoints.","default":5,"minimum":0},"command_data":{"type":"object","additionalProperties":true,"title":"Command data","examples":[{"schedule_for_windows":true,"scan_settings":{"pum_detection":"Detect","scan_registry":true,"type":"CustomScan","no_archive":false,"fixed_drive":true,"scan_path":"","ark":true,"scan_startup":true,"pup_detection":"Detect","scan_memory":true,"remove":true},"mac_scan_settings":{"remove":true,"pup_detection":"Ignore"},"schedule_for_mac":true}],"properties":{"schedule_for_mac":{"type":"boolean","title":"Schedule for Mac"},"schedule_for_windows":{"type":"boolean","title":"Schedule for Windows"},"scan_settings":{"type":"object","additionalProperties":true,"title":"Scan settings","properties":{"type":{"type":"string","title":"Scan method","enum":["CustomScan","ThreatScan","HyperScan"],"examples":["CustomScan","ThreatScan","HyperScan"]},"remove":{"type":"boolean","title":"Remove"},"scan_path":{"type":"string","title":"Scan path"},"scan_memory":{"type":"boolean","title":"Scan memory objects","default":true},"scan_registry":{"type":"boolean","title":"Scan registry"},"scan_startup":{"type":"boolean","title":"Scan startup"},"fixed_drive":{"type":"boolean","title":"Scan all local drives on endpoints"},"no_archive":{"type":"boolean","title":"Do not scan archives"},"ark":{"type":"boolean","title":"Scan for rootkits"},"pup_detection":{"type":"string","title":"Potentially Unwanted Programs, treat as malware","enum":["Detect","Ignore"]},"pum_detection":{"type":"string","title":"Potentially Unwanted Modifications, treat as malware.","enum":["Detect","Ignore"]}}},"mac_scan_settings":{"type":"object","additionalProperties":true,"title":"Mac scan settings","properties":{"remove":{"type":"boolean","title":"Quarantine found threats automatically"},"pup_detection":{"type":"string","title":"Treat detections as malware.","enum":["Detect","Ignore"]},"scan_path":{"type":"array","title":"Scan path","items":{"type":"string","minLength":1}},"fixed_drive":{"type":"boolean","title":"Scan all local drives on endpoints"}}}}}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Schedule Response","properties":{"id":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","title":"Id (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"name":{"type":"string","title":"Name"},"etag":{"type":"string","title":"ETAG","description":"etags are identifiers that change on every update. Their use is to prevent race conditions when multiple clients are modifying the same resource. Supply this tag empty when creating a schedule. When updating, you need to fetch the latest value by GETting a schedule. You should always get the current etag before trying to modify a resource that has an etag property."},"command":{"type":"string","title":"Command","examples":["command.threat.scan","command.asset.refresh"]},"rrule":{"type":"string","title":"Frequency and start date","examples":["FREQ=DAILY;INTERVAL=1;DTSTART=20200313T000100"]},"enabled":{"type":"boolean","title":"Enabled","default":true},"splay":{"type":"integer","title":"Splay","description":"Time randomization window in minutes. Delays task execution by a random amount within this range to distribute load across endpoints.","default":5,"minimum":0},"command_data":{"type":"object","additionalProperties":true,"title":"Command data","examples":[{"schedule_for_windows":true,"scan_settings":{"pum_detection":"Detect","scan_registry":true,"type":"CustomScan","no_archive":false,"fixed_drive":true,"scan_path":"","ark":true,"scan_startup":true,"pup_detection":"Detect","scan_memory":true,"remove":true},"mac_scan_settings":{"remove":true,"pup_detection":"Ignore"},"schedule_for_mac":true}],"properties":{"schedule_for_mac":{"type":"boolean","title":"Schedule for Mac"},"schedule_for_windows":{"type":"boolean","title":"Schedule for Windows"},"scan_settings":{"type":"object","additionalProperties":true,"title":"Scan settings","properties":{"type":{"type":"string","title":"Scan method","enum":["CustomScan","ThreatScan","HyperScan"],"examples":["CustomScan","ThreatScan","HyperScan"]},"remove":{"type":"boolean","title":"Remove"},"scan_path":{"type":"string","title":"Scan path"},"scan_memory":{"type":"boolean","title":"Scan memory objects","default":true},"scan_registry":{"type":"boolean","title":"Scan registry"},"scan_startup":{"type":"boolean","title":"Scan startup"},"fixed_drive":{"type":"boolean","title":"Scan all local drives on endpoints"},"no_archive":{"type":"boolean","title":"Do not scan archives"},"ark":{"type":"boolean","title":"Scan for rootkits"},"pup_detection":{"type":"string","title":"Potentially Unwanted Programs, treat as malware","examples":["Detect","Ignore"]},"pum_detection":{"type":"string","title":"Potentially Unwanted Modifications, treat as malware.","examples":["Detect","Ignore"]}}},"mac_scan_settings":{"type":"object","additionalProperties":true,"title":"Mac scan settings","properties":{"remove":{"type":"boolean","title":"Quarantine found threats automatically"},"pup_detection":{"type":"string","title":"Treat detections as malware.","examples":["Detect","Ignore"]}}}}},"group_ids":{"type":"array","title":"Collection of Group IDs","items":{"type":"string","title":"Group ids"}}}}}}}},"tags":["Schedules"],"operationId":"api.rmm.put.schedule"}},"/oneview/v1/accounts/{account_id}/schedules":{"get":{"description":"Get schedules. You must create a separate request \"Get schedule by id\" to get the assigned groups of a schedule.","summary":"Get schedules","security":[{"client_credentials":["read"]},{"user_permissions":["schedules.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}},{"name":"next_cursor","required":false,"in":"query","description":"The pagination cursor for next set of results. For further documentation, check Pagination section.","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Collection of schedules","required":["schedules","total_count","next_cursor"],"properties":{"schedules":{"type":"array","title":"Schedules","items":{"type":"object","additionalProperties":true,"title":"Schedule Response","properties":{"id":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","title":"Id (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"name":{"type":"string","title":"Name"},"etag":{"type":"string","title":"ETAG","description":"etags are identifiers that change on every update. Their use is to prevent race conditions when multiple clients are modifying the same resource. Supply this tag empty when creating a schedule. When updating, you need to fetch the latest value by GETting a schedule. You should always get the current etag before trying to modify a resource that has an etag property."},"command":{"type":"string","title":"Command","examples":["command.threat.scan","command.asset.refresh"]},"rrule":{"type":"string","title":"Frequency and start date","examples":["FREQ=DAILY;INTERVAL=1;DTSTART=20200313T000100"]},"enabled":{"type":"boolean","title":"Enabled","default":true},"splay":{"type":"integer","title":"Splay","description":"Time randomization window in minutes. Delays task execution by a random amount within this range to distribute load across endpoints.","default":5,"minimum":0},"command_data":{"type":"object","additionalProperties":true,"title":"Command data","examples":[{"schedule_for_windows":true,"scan_settings":{"pum_detection":"Detect","scan_registry":true,"type":"CustomScan","no_archive":false,"fixed_drive":true,"scan_path":"","ark":true,"scan_startup":true,"pup_detection":"Detect","scan_memory":true,"remove":true},"mac_scan_settings":{"remove":true,"pup_detection":"Ignore"},"schedule_for_mac":true}],"properties":{"schedule_for_mac":{"type":"boolean","title":"Schedule for Mac"},"schedule_for_windows":{"type":"boolean","title":"Schedule for Windows"},"scan_settings":{"type":"object","additionalProperties":true,"title":"Scan settings","properties":{"type":{"type":"string","title":"Scan method","enum":["CustomScan","ThreatScan","HyperScan"],"examples":["CustomScan","ThreatScan","HyperScan"]},"remove":{"type":"boolean","title":"Remove"},"scan_path":{"type":"string","title":"Scan path"},"scan_memory":{"type":"boolean","title":"Scan memory objects","default":true},"scan_registry":{"type":"boolean","title":"Scan registry"},"scan_startup":{"type":"boolean","title":"Scan startup"},"fixed_drive":{"type":"boolean","title":"Scan all local drives on endpoints"},"no_archive":{"type":"boolean","title":"Do not scan archives"},"ark":{"type":"boolean","title":"Scan for rootkits"},"pup_detection":{"type":"string","title":"Potentially Unwanted Programs, treat as malware","examples":["Detect","Ignore"]},"pum_detection":{"type":"string","title":"Potentially Unwanted Modifications, treat as malware.","examples":["Detect","Ignore"]}}},"mac_scan_settings":{"type":"object","additionalProperties":true,"title":"Mac scan settings","properties":{"remove":{"type":"boolean","title":"Quarantine found threats automatically"},"pup_detection":{"type":"string","title":"Treat detections as malware.","examples":["Detect","Ignore"]}}}}},"group_ids":{"type":"array","title":"Collection of Group IDs","items":{"type":"string","title":"Group ids"}}}}},"total_count":{"type":"integer","title":"Total Count","description":"Total count of results."},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}}}}},"tags":["Schedules"],"operationId":"api.rmm.get.schedules"},"post":{"description":"Create schedule. you must use \"Add groups for schedule\" to add a group route.","summary":"Create schedule","security":[{"client_credentials":["read","write"]},{"user_permissions":["schedules.create"]}],"status":{"outage":["auth"]},"parameters":[{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Create schedule","properties":{"name":{"type":"string","title":"Name"},"command":{"type":"string","title":"Command","examples":["command.threat.scan","command.asset.refresh"]},"rrule":{"type":"string","title":"Frequency and start date","examples":["FREQ=DAILY;INTERVAL=1;DTSTART=20200313T000100"]},"enabled":{"type":"boolean","title":"Command is enabled","default":true},"splay":{"type":"integer","title":"Splay","description":"Time randomization window in minutes. Delays task execution by a random amount within this range to distribute load across endpoints.","default":5,"minimum":0},"command_data":{"type":"object","additionalProperties":true,"title":"Command data","examples":[{"schedule_for_windows":true,"scan_settings":{"pum_detection":"Detect","scan_registry":true,"type":"CustomScan","no_archive":false,"fixed_drive":true,"scan_path":"","ark":true,"scan_startup":true,"pup_detection":"Detect","scan_memory":true,"remove":true},"mac_scan_settings":{"remove":true,"pup_detection":"Ignore"},"schedule_for_mac":true}],"properties":{"schedule_for_mac":{"type":"boolean","title":"Schedule for Mac"},"schedule_for_windows":{"type":"boolean","title":"Schedule for Windows"},"scan_settings":{"type":"object","additionalProperties":true,"title":"Scan settings","properties":{"type":{"type":"string","title":"Scan method","enum":["CustomScan","ThreatScan","HyperScan"],"examples":["CustomScan","ThreatScan","HyperScan"]},"remove":{"type":"boolean","title":"Remove"},"scan_path":{"type":"string","title":"Scan path"},"scan_memory":{"type":"boolean","title":"Scan memory objects","default":true},"scan_registry":{"type":"boolean","title":"Scan registry"},"scan_startup":{"type":"boolean","title":"Scan startup"},"fixed_drive":{"type":"boolean","title":"Scan all local drives on endpoints"},"no_archive":{"type":"boolean","title":"Do not scan archives"},"ark":{"type":"boolean","title":"Scan for rootkits"},"pup_detection":{"type":"string","title":"Potentially Unwanted Programs, treat as malware","enum":["Detect","Ignore"]},"pum_detection":{"type":"string","title":"Potentially Unwanted Modifications, treat as malware.","enum":["Detect","Ignore"]}}},"mac_scan_settings":{"type":"object","additionalProperties":true,"title":"Mac scan settings","properties":{"remove":{"type":"boolean","title":"Quarantine found threats automatically"},"pup_detection":{"type":"string","title":"Treat detections as malware.","enum":["Detect","Ignore"]},"scan_path":{"type":"array","title":"Scan path","items":{"type":"string","minLength":1}},"fixed_drive":{"type":"boolean","title":"Scan all local drives on endpoints"}}}}}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Schedule Response","properties":{"id":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","title":"Id (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"name":{"type":"string","title":"Name"},"etag":{"type":"string","title":"ETAG","description":"etags are identifiers that change on every update. Their use is to prevent race conditions when multiple clients are modifying the same resource. Supply this tag empty when creating a schedule. When updating, you need to fetch the latest value by GETting a schedule. You should always get the current etag before trying to modify a resource that has an etag property."},"command":{"type":"string","title":"Command","examples":["command.threat.scan","command.asset.refresh"]},"rrule":{"type":"string","title":"Frequency and start date","examples":["FREQ=DAILY;INTERVAL=1;DTSTART=20200313T000100"]},"enabled":{"type":"boolean","title":"Enabled","default":true},"splay":{"type":"integer","title":"Splay","description":"Time randomization window in minutes. Delays task execution by a random amount within this range to distribute load across endpoints.","default":5,"minimum":0},"command_data":{"type":"object","additionalProperties":true,"title":"Command data","examples":[{"schedule_for_windows":true,"scan_settings":{"pum_detection":"Detect","scan_registry":true,"type":"CustomScan","no_archive":false,"fixed_drive":true,"scan_path":"","ark":true,"scan_startup":true,"pup_detection":"Detect","scan_memory":true,"remove":true},"mac_scan_settings":{"remove":true,"pup_detection":"Ignore"},"schedule_for_mac":true}],"properties":{"schedule_for_mac":{"type":"boolean","title":"Schedule for Mac"},"schedule_for_windows":{"type":"boolean","title":"Schedule for Windows"},"scan_settings":{"type":"object","additionalProperties":true,"title":"Scan settings","properties":{"type":{"type":"string","title":"Scan method","enum":["CustomScan","ThreatScan","HyperScan"],"examples":["CustomScan","ThreatScan","HyperScan"]},"remove":{"type":"boolean","title":"Remove"},"scan_path":{"type":"string","title":"Scan path"},"scan_memory":{"type":"boolean","title":"Scan memory objects","default":true},"scan_registry":{"type":"boolean","title":"Scan registry"},"scan_startup":{"type":"boolean","title":"Scan startup"},"fixed_drive":{"type":"boolean","title":"Scan all local drives on endpoints"},"no_archive":{"type":"boolean","title":"Do not scan archives"},"ark":{"type":"boolean","title":"Scan for rootkits"},"pup_detection":{"type":"string","title":"Potentially Unwanted Programs, treat as malware","examples":["Detect","Ignore"]},"pum_detection":{"type":"string","title":"Potentially Unwanted Modifications, treat as malware.","examples":["Detect","Ignore"]}}},"mac_scan_settings":{"type":"object","additionalProperties":true,"title":"Mac scan settings","properties":{"remove":{"type":"boolean","title":"Quarantine found threats automatically"},"pup_detection":{"type":"string","title":"Treat detections as malware.","examples":["Detect","Ignore"]}}}}},"group_ids":{"type":"array","title":"Collection of Group IDs","items":{"type":"string","title":"Group ids"}}}}}}}},"tags":["Schedules"],"operationId":"api.rmm.post.schedule"}},"/oneview/v1/accounts/schedules":{"post":{"description":"Get schedules of multiple accounts","summary":"Get schedules of multiple accounts","security":[{"client_credentials":["read"]},{"user_permissions":["schedules.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Get schedules for multiple account ids","required":["account_ids"],"properties":{"account_ids":{"type":"array","minItems":1,"title":"The account ids","items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}},"page_size":{"type":"number","title":"The size of the page","minimum":1,"default":100,"maximum":2000},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Get all schedules for multiple account ids","examples":[{"schedules":[{"id":"string","name":"string","etag":"string","command":"command.threat.scan","rrule":"FREQ=DAILY;INTERVAL=1;DTSTART=20200313T000100","enabled":true,"command_data":{"schedule_for_windows":true,"scan_settings":{"pum_detection":"Detect","scan_registry":true,"type":"CustomScan","no_archive":false,"fixed_drive":true,"scan_path":"","ark":true,"scan_startup":true,"pup_detection":"Detect","scan_memory":true,"remove":true},"mac_scan_settings":{"remove":true,"pup_detection":"Ignore"},"schedule_for_mac":true},"group_ids":["string"]}],"total_count":1}],"properties":{"schedules":{"type":"array","title":"Schedules","items":{"type":"object","additionalProperties":true,"title":"Schedule Response","properties":{"id":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","title":"Id (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"name":{"type":"string","title":"Name"},"etag":{"type":"string","title":"ETAG","description":"etags are identifiers that change on every update. Their use is to prevent race conditions when multiple clients are modifying the same resource. Supply this tag empty when creating a schedule. When updating, you need to fetch the latest value by GETting a schedule. You should always get the current etag before trying to modify a resource that has an etag property."},"command":{"type":"string","title":"Command","examples":["command.threat.scan","command.asset.refresh"]},"rrule":{"type":"string","title":"Frequency and start date","examples":["FREQ=DAILY;INTERVAL=1;DTSTART=20200313T000100"]},"enabled":{"type":"boolean","title":"Enabled","default":true},"splay":{"type":"integer","title":"Splay","description":"Time randomization window in minutes. Delays task execution by a random amount within this range to distribute load across endpoints.","default":5,"minimum":0},"command_data":{"type":"object","additionalProperties":true,"title":"Command data","examples":[{"schedule_for_windows":true,"scan_settings":{"pum_detection":"Detect","scan_registry":true,"type":"CustomScan","no_archive":false,"fixed_drive":true,"scan_path":"","ark":true,"scan_startup":true,"pup_detection":"Detect","scan_memory":true,"remove":true},"mac_scan_settings":{"remove":true,"pup_detection":"Ignore"},"schedule_for_mac":true}],"properties":{"schedule_for_mac":{"type":"boolean","title":"Schedule for Mac"},"schedule_for_windows":{"type":"boolean","title":"Schedule for Windows"},"scan_settings":{"type":"object","additionalProperties":true,"title":"Scan settings","properties":{"type":{"type":"string","title":"Scan method","enum":["CustomScan","ThreatScan","HyperScan"],"examples":["CustomScan","ThreatScan","HyperScan"]},"remove":{"type":"boolean","title":"Remove"},"scan_path":{"type":"string","title":"Scan path"},"scan_memory":{"type":"boolean","title":"Scan memory objects","default":true},"scan_registry":{"type":"boolean","title":"Scan registry"},"scan_startup":{"type":"boolean","title":"Scan startup"},"fixed_drive":{"type":"boolean","title":"Scan all local drives on endpoints"},"no_archive":{"type":"boolean","title":"Do not scan archives"},"ark":{"type":"boolean","title":"Scan for rootkits"},"pup_detection":{"type":"string","title":"Potentially Unwanted Programs, treat as malware","examples":["Detect","Ignore"]},"pum_detection":{"type":"string","title":"Potentially Unwanted Modifications, treat as malware.","examples":["Detect","Ignore"]}}},"mac_scan_settings":{"type":"object","additionalProperties":true,"title":"Mac scan settings","properties":{"remove":{"type":"boolean","title":"Quarantine found threats automatically"},"pup_detection":{"type":"string","title":"Treat detections as malware.","examples":["Detect","Ignore"]}}}}},"group_ids":{"type":"array","title":"Collection of Group IDs","items":{"type":"string","title":"Group ids"}}}}},"total_count":{"type":"number","title":"Total count"},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}},"additionalProperties":false}}}}},"tags":["Schedules"],"operationId":"api.v2.rmm.search.schedules"}},"/oneview/v1/accounts/{account_id}/schedules/{id}/groups":{"put":{"description":"Add groups to a schedule.","summary":"Add groups for schedule","security":[{"client_credentials":["read","write"]},{"user_permissions":["schedules.edit"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":true,"in":"path","description":"ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Group IDs","required":["group_ids"],"properties":{"group_ids":{"type":"array","title":"Collection of Group IDs","items":{"type":"string","title":"UUID of Group","examples":["dc5e6ceb-e57f-4bf3-8b6d-df1d369be279"]}}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Schedule Response","properties":{"id":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","title":"Id (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"name":{"type":"string","title":"Name"},"etag":{"type":"string","title":"ETAG","description":"etags are identifiers that change on every update. Their use is to prevent race conditions when multiple clients are modifying the same resource. Supply this tag empty when creating a schedule. When updating, you need to fetch the latest value by GETting a schedule. You should always get the current etag before trying to modify a resource that has an etag property."},"command":{"type":"string","title":"Command","examples":["command.threat.scan","command.asset.refresh"]},"rrule":{"type":"string","title":"Frequency and start date","examples":["FREQ=DAILY;INTERVAL=1;DTSTART=20200313T000100"]},"enabled":{"type":"boolean","title":"Enabled","default":true},"splay":{"type":"integer","title":"Splay","description":"Time randomization window in minutes. Delays task execution by a random amount within this range to distribute load across endpoints.","default":5,"minimum":0},"command_data":{"type":"object","additionalProperties":true,"title":"Command data","examples":[{"schedule_for_windows":true,"scan_settings":{"pum_detection":"Detect","scan_registry":true,"type":"CustomScan","no_archive":false,"fixed_drive":true,"scan_path":"","ark":true,"scan_startup":true,"pup_detection":"Detect","scan_memory":true,"remove":true},"mac_scan_settings":{"remove":true,"pup_detection":"Ignore"},"schedule_for_mac":true}],"properties":{"schedule_for_mac":{"type":"boolean","title":"Schedule for Mac"},"schedule_for_windows":{"type":"boolean","title":"Schedule for Windows"},"scan_settings":{"type":"object","additionalProperties":true,"title":"Scan settings","properties":{"type":{"type":"string","title":"Scan method","enum":["CustomScan","ThreatScan","HyperScan"],"examples":["CustomScan","ThreatScan","HyperScan"]},"remove":{"type":"boolean","title":"Remove"},"scan_path":{"type":"string","title":"Scan path"},"scan_memory":{"type":"boolean","title":"Scan memory objects","default":true},"scan_registry":{"type":"boolean","title":"Scan registry"},"scan_startup":{"type":"boolean","title":"Scan startup"},"fixed_drive":{"type":"boolean","title":"Scan all local drives on endpoints"},"no_archive":{"type":"boolean","title":"Do not scan archives"},"ark":{"type":"boolean","title":"Scan for rootkits"},"pup_detection":{"type":"string","title":"Potentially Unwanted Programs, treat as malware","examples":["Detect","Ignore"]},"pum_detection":{"type":"string","title":"Potentially Unwanted Modifications, treat as malware.","examples":["Detect","Ignore"]}}},"mac_scan_settings":{"type":"object","additionalProperties":true,"title":"Mac scan settings","properties":{"remove":{"type":"boolean","title":"Quarantine found threats automatically"},"pup_detection":{"type":"string","title":"Treat detections as malware.","examples":["Detect","Ignore"]}}}}},"group_ids":{"type":"array","title":"Collection of Group IDs","items":{"type":"string","title":"Group ids"}}}}}}}},"tags":["Schedules"],"operationId":"api.rmm.put.schedule.groupids"}},"/oneview/v1/sites/{id}/subscriptions":{"post":{"description":"Use this endpoint to create a subscription for one of your manages site. After creating one subscription, your customer's data will be populated with an `account_id` field that you can use for security's management apis, like detections, endpoints and jobs.\n\n## Available catalog codes\n\n| Catalog Code | Description |\n| ---------------- | ------------------------------------------- |\n| BUS-CLOUD-IR-01 | ThreatDown Incident Response |\n| BUS-CLOUD-EPP-01 | ThreatDown Endpoint Protection |\n| BUS-CLOUD-EPR-01 | ThreatDown Endpoint Protection And Response |\n","summary":"Create subscription","deprecated":true,"security":[{"client_credentials":["write"]},{"user_permissions":["sites.manage"]}],"status":{"outage":["auth","ov"]},"parameters":[{"name":"id","required":true,"in":"path","description":"Valid OneView site ID (Ex. \"30616562663436302D643733312D346238622D623338332D613031343538363566383333\")","schema":{"type":"string","pattern":"^[A-Fa-f0-9]+$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"The root schema","description":"The root schema comprises the entire JSON document.","examples":[{"catalog_code":"BUS-CLOUD-EPP-01","volume_purchased":7,"term_length":365,"term_type":"utility"}],"required":["catalog_code","volume_purchased","term_length","term_type"],"additionalProperties":true,"properties":{"catalog_code":{"type":"string","title":"The catalog_code schema","description":"Product associated with this subscription","default":"","enum":["BUS-CLOUD-EPP-01","BUS-CLOUD-EPR-01","BUS-CLOUD-IR-01","BUS-CLOUD-EPP-SER-01","BUS-CLOUD-EDR-SER-01"],"examples":["BUS-CLOUD-EPR-01"]},"volume_purchased":{"type":"integer","title":"Number of seats purchased","description":"Amount of seats allocated for this subscription","default":0,"examples":[0]},"term_length":{"type":"integer","title":"Length of duration","description":"Length in days of the duration of the subscription","default":0,"examples":[0]},"term_type":{"type":"string","title":"The term_type schema","description":"Type of term for this subscription.","default":"utility","emum":["utility","cloud_evaluation"],"examples":["string"]},"billing_duration":{"type":["string","null"],"title":"The billing_duration schema","description":"Recurrence of billing","default":"monthly","enum":["monthly","annual"],"examples":["monthly"]},"billing_date":{"type":"integer","title":"The billing_date schema","default":0,"examples":[0]}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"Payload returned when getting a subscription","description":"get subscription response","examples":[{"catalog_name":"ThreatDown Incident Response","catalog_code":"BUS-CLOUD-IR-01","volume_purchased":1,"volume_used":0,"status":"active","term_type":"utility","term_ends_on":"2022-01-16","original_start_date":"2020-05-25T23:59:59.999+00:00","term_length":730,"reset_count":"0","billing_duration":"monthly","billing_date":0,"version":"4759e32b938b86c20682f9e245fd885d","timestamp":"2020-05-25T11:49:41.063"}],"required":["catalog_name","catalog_code","volume_purchased","volume_used","status","term_type","term_ends_on","original_start_date","term_length","reset_count"],"properties":{"catalog_name":{"type":"string","title":"Catalog name","description":"Friendly name indicating the purchased catalog","default":"","examples":["ThreatDown Incident Response"]},"catalog_code":{"type":"string","title":"Catalog code","description":"Product associated with this subscription. Some of the possible values: BUS-CLOUD-IR-01, BUS-CLOUD-EPR-01, BUS-CLOUD-IR-01, BUS-CLOUD-EPP-SER-01, BUS-CLOUD-EDR-SER-01"},"volume_purchased":{"type":"integer","title":"Number of seats purchased","description":"Amount of seats allocated for this subscription","default":0,"examples":[0]},"volume_used":{"type":"integer","title":"Seats used","description":"Amount of seats in use for this subscription","default":0,"examples":[0]},"status":{"type":"string","title":"Status","description":"Status of this subscription. 'active' when active.","default":"","examples":["active"]},"term_type":{"type":"string","title":"The term_type schema","description":"Type of term for this subscription.","default":"utility","emum":["utility","cloud_evaluation"],"examples":["string"]},"term_ends_on":{"type":"string","title":"End of term","description":"When the subscription expires. in format YYYY-mm-dd","default":"","examples":["2022-01-16"]},"original_start_date":{"type":"string","title":"Start of term","description":"A timestamp of creation date for this subscription.","default":"","examples":["2020-05-25T23:59:59.999+00:00"]},"term_length":{"type":"integer","title":"Duration","description":"Duration of subscription in days.","default":0,"examples":[730]},"reset_count":{"type":"string","title":"Reset count","description":"How many time the subscription was reset","default":"","examples":["0"]},"billing_duration":{"type":["string","null"],"title":"The billing_duration schema","description":"Recurrence of billing","examples":["monthly","annual","Usage","Upfront"]},"billing_date":{"type":"integer","title":"The billing_date schema","default":0,"examples":[0]},"version":{"type":"string","title":"Version","description":"Hash of the version of this subscription. Useful for comparing changes occurred","default":"","examples":["4759e32b938b86c20682f9e245fd885d"]}}}}}}},"tags":["Subscriptions"],"operationId":"api.v2.oneview.create.subscription.id"},"delete":{"description":"Delete your site subscriptions. This will mark the subscription as expired","summary":"Delete a subscription","deprecated":true,"security":[{"client_credentials":["write"]},{"user_permissions":["sites.manage"]}],"status":{"outage":["auth","ov"]},"parameters":[{"name":"id","required":true,"in":"path","description":"Valid OneView site ID (Ex. \"30616562663436302D643733312D346238622D623338332D613031343538363566383333\")","schema":{"type":"string","pattern":"^[A-Fa-f0-9]+$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"Delete subscription response schema","description":"The expected response when deleting a subscription","examples":[{"id":"cc99c6bf-1610-43c1-a793-f955c098449c","deleted":true}],"required":["id","deleted"],"properties":{"id":{"type":"string","title":"UUID of the customer","description":"The unique identifier of this customer.","default":"","examples":["cc99c6bf-1610-43c1-a793-f955c098449c"]},"deleted":{"type":"boolean","title":"Status","description":"Boolean indicating whether the subscription was deleted successfully or not.","default":"","examples":[true]}}}}}}},"tags":["Subscriptions"],"operationId":"api.v2.oneview.delete.subscription.id"},"get":{"description":"Get subscription data by site id.","summary":"Get subscription","deprecated":true,"security":[{"client_credentials":["read"]},{"user_permissions":["sites.view"]}],"status":{"outage":["auth","ov"]},"parameters":[{"name":"id","required":true,"in":"path","description":"Valid OneView site ID (Ex. \"30616562663436302D643733312D346238622D623338332D613031343538363566383333\")","schema":{"type":"string","pattern":"^[A-Fa-f0-9]+$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"Payload returned when getting a subscription","description":"get subscription response","examples":[{"catalog_name":"ThreatDown Incident Response","catalog_code":"BUS-CLOUD-IR-01","volume_purchased":1,"volume_used":0,"status":"active","term_type":"utility","term_ends_on":"2022-01-16","original_start_date":"2020-05-25T23:59:59.999+00:00","term_length":730,"reset_count":"0","billing_duration":"monthly","billing_date":0,"version":"4759e32b938b86c20682f9e245fd885d","timestamp":"2020-05-25T11:49:41.063"}],"required":["catalog_name","catalog_code","volume_purchased","volume_used","status","term_type","term_ends_on","original_start_date","term_length","reset_count"],"properties":{"catalog_name":{"type":"string","title":"Catalog name","description":"Friendly name indicating the purchased catalog","default":"","examples":["ThreatDown Incident Response"]},"catalog_code":{"type":"string","title":"Catalog code","description":"Product associated with this subscription. Some of the possible values: BUS-CLOUD-IR-01, BUS-CLOUD-EPR-01, BUS-CLOUD-IR-01, BUS-CLOUD-EPP-SER-01, BUS-CLOUD-EDR-SER-01"},"volume_purchased":{"type":"integer","title":"Number of seats purchased","description":"Amount of seats allocated for this subscription","default":0,"examples":[0]},"volume_used":{"type":"integer","title":"Seats used","description":"Amount of seats in use for this subscription","default":0,"examples":[0]},"status":{"type":"string","title":"Status","description":"Status of this subscription. 'active' when active.","default":"","examples":["active"]},"term_type":{"type":"string","title":"The term_type schema","description":"Type of term for this subscription.","default":"utility","emum":["utility","cloud_evaluation"],"examples":["string"]},"term_ends_on":{"type":"string","title":"End of term","description":"When the subscription expires. in format YYYY-mm-dd","default":"","examples":["2022-01-16"]},"original_start_date":{"type":"string","title":"Start of term","description":"A timestamp of creation date for this subscription.","default":"","examples":["2020-05-25T23:59:59.999+00:00"]},"term_length":{"type":"integer","title":"Duration","description":"Duration of subscription in days.","default":0,"examples":[730]},"reset_count":{"type":"string","title":"Reset count","description":"How many time the subscription was reset","default":"","examples":["0"]},"billing_duration":{"type":["string","null"],"title":"The billing_duration schema","description":"Recurrence of billing","examples":["monthly","annual","Usage","Upfront"]},"billing_date":{"type":"integer","title":"The billing_date schema","default":0,"examples":[0]},"version":{"type":"string","title":"Version","description":"Hash of the version of this subscription. Useful for comparing changes occurred","default":"","examples":["4759e32b938b86c20682f9e245fd885d"]}}}}}}},"tags":["Subscriptions"],"operationId":"api.v2.oneview.get.subscription.id"},"put":{"description":"Use this endpoint to upgrade/downgrade or change term types or seats","summary":"Update webhook subscription","deprecated":true,"security":[{"client_credentials":["write"]},{"user_permissions":["sites.manage"]}],"status":{"outage":["auth","ov"]},"parameters":[{"name":"id","required":true,"in":"path","description":"Valid OneView site ID (Ex. \"30616562663436302D643733312D346238622D623338332D613031343538363566383333\")","schema":{"type":"string","pattern":"^[A-Fa-f0-9]+$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"The root schema","description":"The root schema comprises the entire JSON document.","examples":[{"catalog_code":"BUS-CLOUD-EPP-01","volume_purchased":7,"term_length":365,"term_type":"utility"}],"required":["catalog_code","volume_purchased","term_length","term_type"],"additionalProperties":true,"properties":{"catalog_code":{"type":"string","title":"The catalog_code schema","description":"Product associated with this subscription","default":"","enum":["BUS-CLOUD-EPP-01","BUS-CLOUD-EPR-01","BUS-CLOUD-IR-01","BUS-CLOUD-EPP-SER-01","BUS-CLOUD-EDR-SER-01"],"examples":["BUS-CLOUD-EPR-01"]},"volume_purchased":{"type":"integer","title":"Number of seats purchased","description":"Amount of seats allocated for this subscription","default":0,"examples":[0]},"term_length":{"type":"integer","title":"Length of duration","description":"Length in days of the duration of the subscription","default":0,"examples":[0]},"term_type":{"type":"string","title":"The term_type schema","description":"Type of term for this subscription.","default":"utility","emum":["utility","cloud_evaluation"],"examples":["string"]},"billing_duration":{"type":["string","null"],"title":"The billing_duration schema","description":"Recurrence of billing","default":"monthly","enum":["monthly","annual"],"examples":["monthly"]},"billing_date":{"type":"integer","title":"The billing_date schema","default":0,"examples":[0]}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"Payload returned when getting a subscription","description":"get subscription response","examples":[{"catalog_name":"ThreatDown Incident Response","catalog_code":"BUS-CLOUD-IR-01","volume_purchased":1,"volume_used":0,"status":"active","term_type":"utility","term_ends_on":"2022-01-16","original_start_date":"2020-05-25T23:59:59.999+00:00","term_length":730,"reset_count":"0","billing_duration":"monthly","billing_date":0,"version":"4759e32b938b86c20682f9e245fd885d","timestamp":"2020-05-25T11:49:41.063"}],"required":["catalog_name","catalog_code","volume_purchased","volume_used","status","term_type","term_ends_on","original_start_date","term_length","reset_count"],"properties":{"catalog_name":{"type":"string","title":"Catalog name","description":"Friendly name indicating the purchased catalog","default":"","examples":["ThreatDown Incident Response"]},"catalog_code":{"type":"string","title":"Catalog code","description":"Product associated with this subscription. Some of the possible values: BUS-CLOUD-IR-01, BUS-CLOUD-EPR-01, BUS-CLOUD-IR-01, BUS-CLOUD-EPP-SER-01, BUS-CLOUD-EDR-SER-01"},"volume_purchased":{"type":"integer","title":"Number of seats purchased","description":"Amount of seats allocated for this subscription","default":0,"examples":[0]},"volume_used":{"type":"integer","title":"Seats used","description":"Amount of seats in use for this subscription","default":0,"examples":[0]},"status":{"type":"string","title":"Status","description":"Status of this subscription. 'active' when active.","default":"","examples":["active"]},"term_type":{"type":"string","title":"The term_type schema","description":"Type of term for this subscription.","default":"utility","emum":["utility","cloud_evaluation"],"examples":["string"]},"term_ends_on":{"type":"string","title":"End of term","description":"When the subscription expires. in format YYYY-mm-dd","default":"","examples":["2022-01-16"]},"original_start_date":{"type":"string","title":"Start of term","description":"A timestamp of creation date for this subscription.","default":"","examples":["2020-05-25T23:59:59.999+00:00"]},"term_length":{"type":"integer","title":"Duration","description":"Duration of subscription in days.","default":0,"examples":[730]},"reset_count":{"type":"string","title":"Reset count","description":"How many time the subscription was reset","default":"","examples":["0"]},"billing_duration":{"type":["string","null"],"title":"The billing_duration schema","description":"Recurrence of billing","examples":["monthly","annual","Usage","Upfront"]},"billing_date":{"type":"integer","title":"The billing_date schema","default":0,"examples":[0]},"version":{"type":"string","title":"Version","description":"Hash of the version of this subscription. Useful for comparing changes occurred","default":"","examples":["4759e32b938b86c20682f9e245fd885d"]}}}}}}},"tags":["Subscriptions"],"operationId":"api.v2.oneview.update.subscription.id"}},"/oneview/v1/sites/{id}/subscriptions/all":{"get":{"description":"Get all subscriptions data by site id.","summary":"Get all subscriptions","deprecated":true,"security":[{"client_credentials":["read"]},{"user_permissions":["sites.view"]}],"status":{"outage":["auth","ov"]},"parameters":[{"name":"id","required":true,"in":"path","description":"Valid OneView site ID (Ex. \"30616562663436302D643733312D346238622D623338332D613031343538363566383333\")","schema":{"type":"string","pattern":"^[A-Fa-f0-9]+$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"Payload returned when getting a subscription","description":"get subscription response","examples":[{"catalog_name":"ThreatDown Incident Response","catalog_code":"BUS-CLOUD-IR-01","volume_purchased":1,"volume_used":0,"status":"active","term_type":"utility","term_ends_on":"2022-01-16","original_start_date":"2020-05-25T23:59:59.999+00:00","term_length":730,"reset_count":"0","billing_duration":"monthly","billing_date":0,"version":"4759e32b938b86c20682f9e245fd885d","timestamp":"2020-05-25T11:49:41.063"}],"required":["entitlements","version"],"properties":{"version":{"type":["string","null"],"title":"Version","description":"Hash of the version of this subscription. Useful for comparing changes occurred","default":"","examples":["4759e32b938b86c20682f9e245fd885d"]},"entitlements":{"type":"array","title":"entitlements","description":"Hash of the version of this subscription. Useful for comparing changes occurred","items":{"type":"object","title":"entitlements","required":["catalog_name","catalog_code","volume_purchased","volume_used","status","term_type","term_ends_on","original_start_date","term_length","reset_count"],"description":"entitlement","properties":{"catalog_name":{"type":"string","title":"Catalog name","description":"Friendly name indicating the purchased catalog","default":"","examples":["ThreatDown Incident Response"]},"catalog_code":{"type":"string","title":"Catalog code","description":"Product associated with this subscription","examples":["BUS-CLOUD-IR-01"]},"volume_purchased":{"type":"integer","title":"Number of seats purchased","description":"Amount of seats allocated for this subscription","default":0,"examples":[0]},"volume_used":{"type":"integer","title":"Seats used","description":"Amount of seats in use for this subscription","default":0,"examples":[0]},"status":{"type":"string","title":"Status","description":"Status of this subscription. 'active' when active.","default":"","examples":["active"]},"term_type":{"type":"string","title":"The term_type schema","description":"Type of term for this subscription.","default":"utility","emum":["utility","cloud_evaluation"],"examples":["string"]},"term_ends_on":{"type":"string","title":"End of term","description":"When the subscription expires. in format YYYY-mm-dd","default":"","examples":["2022-01-16"]},"original_start_date":{"type":"string","title":"Start of term","description":"A timestamp of creation date for this subscription.","default":"","examples":["2020-05-25T23:59:59.999+00:00"]},"term_length":{"type":"integer","title":"Duration","description":"Duration of subscription in days.","default":0,"examples":[730]},"reset_count":{"type":"string","title":"Reset count","description":"How many time the subscription was reset","default":"","examples":["0"]},"billing_duration":{"type":["string","null"],"title":"The billing_duration schema","description":"Recurrence of billing","examples":["monthly","annual","Usage","Upfront"]},"billing_date":{"type":"integer","title":"The billing_date schema","default":0,"examples":[0]}}}}}}}}}},"tags":["Subscriptions"],"operationId":"api.v2.oneview.get.subscription.all"}},"/oneview/v1/subscriptions":{"get":{"description":"Get all entitlements","summary":"Get entitlements","deprecated":true,"security":[{"client_credentials":["read"]},{"user_permissions":["account.view"]}],"status":{"outage":["auth","ov"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"Master subscription response schema","description":"The expected response when getting a master subscription","examples":[{"entitlements":[{"catalog_name":"ThreatDown Endpoint Protection","catalog_code":"BUS-CLOUD-EPP-01","volume_purchased":1000,"volume_used":0,"status":"active","term_type":"utility","term_ends_on":"2022-01-16","original_start_date":"2019-01-17T23:59:59.999+00:00","term_length":365,"reset_count":"0","billing_duration":"Upfront","billing_date":0,"version":"32585d68c683ccb622bc25bec7661a76"}]}],"properties":{"entitlements":{"type":"array","items":{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"Payload returned when getting a subscription","description":"get subscription response","examples":[{"catalog_name":"ThreatDown Incident Response","catalog_code":"BUS-CLOUD-IR-01","volume_purchased":1,"volume_used":0,"status":"active","term_type":"utility","term_ends_on":"2022-01-16","original_start_date":"2020-05-25T23:59:59.999+00:00","term_length":730,"reset_count":"0","billing_duration":"monthly","billing_date":0,"version":"4759e32b938b86c20682f9e245fd885d","timestamp":"2020-05-25T11:49:41.063"}],"required":["catalog_name","catalog_code","volume_purchased","volume_used","status","term_type","term_ends_on","original_start_date","term_length","reset_count"],"properties":{"catalog_name":{"type":"string","title":"Catalog name","description":"Friendly name indicating the purchased catalog","default":"","examples":["ThreatDown Incident Response"]},"catalog_code":{"type":"string","title":"Catalog code","description":"Product associated with this subscription. Some of the possible values: BUS-CLOUD-IR-01, BUS-CLOUD-EPR-01, BUS-CLOUD-IR-01, BUS-CLOUD-EPP-SER-01, BUS-CLOUD-EDR-SER-01"},"volume_purchased":{"type":"integer","title":"Number of seats purchased","description":"Amount of seats allocated for this subscription","default":0,"examples":[0]},"volume_used":{"type":"integer","title":"Seats used","description":"Amount of seats in use for this subscription","default":0,"examples":[0]},"status":{"type":"string","title":"Status","description":"Status of this subscription. 'active' when active.","default":"","examples":["active"]},"term_type":{"type":"string","title":"The term_type schema","description":"Type of term for this subscription.","default":"utility","emum":["utility","cloud_evaluation"],"examples":["string"]},"term_ends_on":{"type":"string","title":"End of term","description":"When the subscription expires. in format YYYY-mm-dd","default":"","examples":["2022-01-16"]},"original_start_date":{"type":"string","title":"Start of term","description":"A timestamp of creation date for this subscription.","default":"","examples":["2020-05-25T23:59:59.999+00:00"]},"term_length":{"type":"integer","title":"Duration","description":"Duration of subscription in days.","default":0,"examples":[730]},"reset_count":{"type":"string","title":"Reset count","description":"How many time the subscription was reset","default":"","examples":["0"]},"billing_duration":{"type":["string","null"],"title":"The billing_duration schema","description":"Recurrence of billing","examples":["monthly","annual","Usage","Upfront"]},"billing_date":{"type":"integer","title":"The billing_date schema","default":0,"examples":[0]},"version":{"type":"string","title":"Version","description":"Hash of the version of this subscription. Useful for comparing changes occurred","default":"","examples":["4759e32b938b86c20682f9e245fd885d"]}}}}}}}}}},"tags":["Subscriptions"],"operationId":"api.v2.oneview.get.master.subscription.id"}},"/oneview/v1/subscriptions/quantity":{"get":{"description":"Get information about the usage of sites","summary":"Get usage","security":[{"client_credentials":["read"]},{"user_permissions":["account.view"]}],"status":{"outage":["auth","ov"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"Report about usage","description":"Report about the usage and the entitlements","default":{},"examples":[{"transaction_id":"001W000000tV1ngIAC","timestamp":"2020-09-23T10:03:03.036964Z","entitlements":[{"name":"Nebula EPP Combo","volume_used":47,"volume_allocated":938,"catalog_name":"ThreatDown Endpoint Protection","catalog_code":"BUS-CLOUD-EPP-01","code":"NEBULA-EP-COMBO","volume_available":62,"volume_purchased":1000},{"name":"Nebula EPR Combo","volume_used":44,"volume_allocated":50,"catalog_name":"ThreatDown Endpoint Detection and Response","catalog_code":"BUS-CLOUD-EPR-01","code":"NEBULA-EPR-COMBO","volume_available":950,"volume_purchased":1000},{"name":"Nebula IR Combo","volume_used":0,"volume_allocated":110,"catalog_name":"ThreatDown Incident Response","catalog_code":"BUS-CLOUD-IR-01","code":"NEBULA-IR-COMBO","volume_available":890,"volume_purchased":1000}],"seats_data":{"zero_seats_available":["65343561333061332D326463392D343037372D396463372D663734366634653938353438","34353439363334632D383465382D343961362D386562312D366437373134376336353538","35643962333232642D326663632D343938312D383137642D313138373562316661383537"],"zero_seats_used":["39353338653862372D303433322D346430302D393366652D356532396363383166363665"],"over_used":["39613062343139352D646532332D346563322D386133392D393261393033313634366636","38656266353363612D346439632D346462642D626234352D646431363032303439306362"]}}],"required":["transaction_id","timestamp","entitlements","seats_data"],"properties":{"timestamp":{"type":"string","title":"Timestamp","description":"Timestamp","examples":["2020-09-23T10:03:03.036964Z"]},"entitlements":{"type":"array","title":"Entitlements for this MSP account","description":"Entitlements and their info for this MSP account.","default":[],"examples":[[{"name":"Nebula EPP Combo","volume_used":47,"volume_allocated":938,"catalog_name":"ThreatDown Endpoint Protection","catalog_code":"BUS-CLOUD-EPP-01","code":"NEBULA-EP-COMBO","volume_available":62,"volume_purchased":1000},{"name":"Nebula EPR Combo","volume_used":44,"volume_allocated":50,"catalog_name":"ThreatDown Endpoint Detection and Response","catalog_code":"BUS-CLOUD-EPR-01","code":"NEBULA-EPR-COMBO","volume_available":950,"volume_purchased":1000}]],"items":{"type":"object","title":"Entitlement object","description":"Entitlement object","default":{},"examples":[{"name":"Nebula EPP Combo","volume_used":47,"volume_allocated":938,"catalog_name":"ThreatDown Endpoint Protection","catalog_code":"BUS-CLOUD-EPP-01","code":"NEBULA-EP-COMBO","volume_available":62,"volume_purchased":1000}],"required":["name","volume_used","volume_allocated","catalog_name","catalog_code","code","volume_available","volume_purchased"],"properties":{"name":{"type":"string","title":"Name of the Entitlement","description":"Name of the Entitlement.","default":"","examples":["Nebula EPP Combo"]},"volume_used":{"type":"integer","title":"The total volume used","description":"The total volume used.","default":0,"examples":[47]},"volume_allocated":{"type":"integer","title":"The total volume allocated","description":"The total volume allocated.","default":0,"examples":[938]},"catalog_name":{"type":"string","title":"The name from the catalog","description":"The name from the catalog.","default":"","examples":["ThreatDown Endpoint Protection"]},"catalog_code":{"type":"string","title":"Catalog code","description":"Catalog code.","default":"","examples":["BUS-CLOUD-EPP-01"]},"code":{"type":"string","title":"Code","description":"Code.","default":"","examples":["NEBULA-EP-COMBO"]},"volume_available":{"type":"integer","title":"Volume available","description":"Volume available.","default":0,"examples":[62]},"volume_purchased":{"type":"integer","title":"Volume purchased","description":"Volume purchased.","default":0,"examples":[1000]}}}},"seats_data":{"type":"object","title":"Informations about the seats","description":"Informations about the seats.","default":{},"examples":[{"zero_seats_available":["65343561333061332D326463392D343037372D396463372D663734366634653938353438","34353439363334632D383465382D343961362D386562312D366437373134376336353538"],"zero_seats_used":["39353338653862372D303433322D346430302D393366652D356532396363383166363665","61353333326538642D336236392D343461382D623234372D613130343564616165326336"],"over_used":["39613062343139352D646532332D346563322D386133392D393261393033313634366636","38656266353363612D346439632D346462642D626234352D646431363032303439306362"]}],"required":["zero_seats_available","zero_seats_used","over_used"],"properties":{"zero_seats_available":{"type":"array","title":"List of sites with zero seats available","description":"List of sites with zero seats available.","default":[],"examples":[["65343561333061332D326463392D343037372D396463372D663734366634653938353438","34353439363334632D383465382D343961362D386562312D366437373134376336353538"]],"items":{"type":"string","title":"UUID of site","description":"UUID of site.","default":"","examples":["65343561333061332D326463392D343037372D396463372D663734366634653938353438","34353439363334632D383465382D343961362D386562312D366437373134376336353538"]}},"zero_seats_used":{"type":"array","title":"List of sites with zero seats used","description":"List of sites with zero seats used.","default":[],"examples":[["39353338653862372D303433322D346430302D393366652D356532396363383166363665","61353333326538642D336236392D343461382D623234372D613130343564616165326336"]],"items":{"type":"string","title":"UUID of site","description":"UUID of site.","default":"","examples":["65343561333061332D326463392D343037372D396463372D663734366634653938353438","34353439363334632D383465382D343961362D386562312D366437373134376336353538"]}},"over_used":{"type":"array","title":"List of sites with overused license","description":"List of sites with overused license.","default":[],"examples":[["39613062343139352D646532332D346563322D386133392D393261393033313634366636","38656266353363612D346439632D346462642D626234352D646431363032303439306362"]],"items":{"type":"string","title":"UUID of site","description":"UUID of site.","default":"","examples":["65343561333061332D326463392D343037372D396463372D663734366634653938353438","34353439363334632D383465382D343961362D386562312D366437373134376336353538"]}}}}}}}}}},"tags":["Subscriptions"],"operationId":"api.v2.oneview.get.quantity"}},"/oneview/v1/subscriptions/report":{"get":{"description":"Get information about your customer subscriptions","summary":"Get report about your customer subscriptions","security":[{"client_credentials":["read"]},{"user_permissions":["account.view"]}],"status":{"outage":["auth","ov"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"Report about subscriptions","description":"The response of an utilization report.","examples":[{"expired_ids":["849337a3-962c-4187-8667-67f769378726","e50a63ab-43dc-4af6-b864-e480ca2c1628","a538e622-bd00-44a8-a67e-eecf1d13f5a2"],"expiring_in_thirty_days_ids":[],"expiring_in_sixty_days_ids":[],"expired_ids_trial":["7c899c14-8926-4427-8097-49c9c5981885"],"expiring_in_seven_days_ids_trial":["ac243c35-8724-4a78-948c-09baafa3fc32","57133924-28df-44e4-9bae-1715aff8517c"],"expiring_in_fifteen_days_ids_trial":["fb893812-d598-476e-870b-2f9f0bf43953","7da88fa7-2d97-49cd-ad49-a1e94cb940c5"],"timestamp":"2020-05-25T13:30:19.285"}],"required":["expired_ids","expiring_in_thirty_days_ids","expiring_in_sixty_days_ids","expired_ids_trial","expiring_in_seven_days_ids_trial","expiring_in_fifteen_days_ids_trial","timestamp"],"properties":{"expired_ids":{"type":"array","title":"Expired ids","description":"Customer whose subscription is expired","examples":[["849337a3-962c-4187-8667-67f769378726","e50a63ab-43dc-4af6-b864-e480ca2c1628"]],"items":{"type":"string"}},"expiring_in_thirty_days_ids":{"type":"array","title":"Expiration in thirty days","description":"Ids of customers whose subscription expired in 30 days","default":[],"examples":[[]],"items":{"type":"string"}},"expiring_in_sixty_days_ids":{"type":"array","title":"Expiration in sixty days","description":"Ids of customers whose subscription expired in 60 days","default":[],"examples":[[]],"items":{"type":"string"}},"expired_ids_trial":{"type":"array","title":"Expired trials","description":"Ids of customers whose trial expired","default":[],"examples":[["7c899c14-8926-4427-8097-49c9c5981885"]],"items":{"type":"string"}},"expiring_in_seven_days_ids_trial":{"type":"array","title":"Trial expring in seven days","description":"Ids of customers whose trial expires in 7 days","default":[],"examples":[["ac243c35-8724-4a78-948c-09baafa3fc32","57133924-28df-44e4-9bae-1715aff8517c"]],"items":{"type":"string"}},"expiring_in_fifteen_days_ids_trial":{"type":"array","title":"Trial expring in 15 days","description":"Ids of customers whose trial expires in 15 days","default":[],"examples":[["fb893812-d598-476e-870b-2f9f0bf43953","7da88fa7-2d97-49cd-ad49-a1e94cb940c5"]],"items":{"type":"string"}},"timestamp":{"type":"string","title":"The timestamp schema","default":"","examples":["2020-05-25T13:30:19.285"]}}}}}}},"tags":["Subscriptions"],"operationId":"api.v2.oneview.get.report.subscription.id"}},"/oneview/v1/accounts/{account_id}/webhooks/subscriptions":{"post":{"description":"Use this api endpoint to create a webhook subscription for a given account. This allows you to receive security events for the provided account.","summary":"Create webhook subscription","security":[{"client_credentials":["write"]},{"user_permissions":["notifications.createOwn"]}],"status":{"outage":["auth","webhooks_subscriptions"]},"parameters":[{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"The Webhooks Subscriptions Post Schema","required":["url","enabled","events"],"properties":{"url":{"type":"string","title":"The URL where you want to receive the webhook notification (Ex. \"https://example.com\")","pattern":"^https://.{4,}$","examples":["https://example.com"]},"description":{"type":"string","title":"Description for this subscription"},"enabled":{"type":"boolean","title":"Whether this subscription is enabled or not"},"events":{"type":"array","title":"The Events you want to subscribe to","minItems":1,"items":{"type":"string","title":"The Items Schema","enum":["all","detection","job_status_change","machine_events","threat_events","agent_events","quarantine_events","edr_events","syslog_events","exclusion_events","scheduled_events","policy_events","user_events","drive_events","cve_events","dns_events","license_events","appblock_events","endpoint_events"]}},"custom_headers":{"type":"array","title":"Custom headers you want to receive","items":{"type":"object","title":"The Items Schema","required":["key","value"],"properties":{"key":{"type":"string","title":"The key of the header","examples":["authorization"]},"value":{"type":"string","title":"The value of the header"}}}},"max_retries":{"type":"integer","title":"The max number of times the webhooks should retry upon failures","default":10,"exclusiveMinimum":0,"maximum":10},"secret_token":{"type":"string","title":"The signing key used to compute the HMAC of the payload"}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"The Webhooks Subscriptions Post Response Schema","required":["id","url","enabled","events"],"properties":{"id":{"type":"string","title":"The unique identifier for this subscription (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"url":{"type":"string","title":"The URL where you want to receive the webhook notification (Ex. \"https://example.com\")","pattern":"^https://.{4,}$","examples":["https://example.com"]},"description":{"type":"string","title":"The Description for this subscription"},"enabled":{"type":"boolean","title":"Whether this subscription is enabled or not"},"events":{"type":"array","title":"The Events you want to subscribe to","minItems":1,"items":{"type":"string","title":"Event","enum":["detection","job_status_change"]}},"custom_headers":{"type":"array","title":"Custom headers you want to receive","items":{"type":"object","title":"Items","required":["key","value"],"properties":{"key":{"type":"string","title":"The key of the header","examples":["authorization"]},"value":{"type":"string","title":"The value of the header"}}}},"max_retries":{"type":"integer","title":"The maximum number of times the webhooks should retry upon failures","default":10,"exclusiveMinimum":0,"maximum":10},"secret_token":{"type":"string","title":"The signing key used to compute the HMAC of the payload"},"client_id":{"type":"string","title":"client ID","examples":["mwb-cloud-d0ecec48fa24de7706f2a0be2e1b8cf6"]}}}}}}},"tags":["Webhooks"],"operationId":"api.v2.rmm.post.webhooks.subscriptions"},"get":{"description":"Retrieve all webhook subscriptions of your account or your managed accounts.","summary":"Get all webhook subscriptions","security":[{"client_credentials":["read"]},{"user_permissions":["notifications.viewOwn"]}],"status":{"outage":["auth","webhooks_subscriptions"]},"parameters":[{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}},{"name":"next_cursor","required":false,"in":"query","description":"The pagination cursor for next set of results. For further documentation, check Pagination section.","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Webhooks' subscriptions","required":["records","next_cursor"],"properties":{"records":{"type":"array","title":"Subscription records","items":{"type":"object","title":"List items","required":["id","url","enabled","events"],"properties":{"id":{"type":"string","title":"ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"url":{"type":"string","title":"Url (Ex. \"https://example.com\")","pattern":"^https://.{4,}$","examples":["https://example.com"]},"description":{"type":"string","title":"Description"},"enabled":{"type":"boolean","title":"Enabled"},"events":{"type":"array","title":"Events","items":{"type":"string","title":"Event Items"}},"custom_headers":{"type":"array","title":"Custom headers","items":{"type":"object","title":"Custom headers items","required":["key","value"],"properties":{"key":{"type":"string","title":"The header key","examples":["authorization"]},"value":{"type":"string","title":"The header value"}}}},"max_retries":{"type":"integer","title":"Maximum number of retries event payload is sent to webhook without receiving success response."},"secret_token":{"type":"string","title":"The signing key used to compute the HMAC of the payload"},"client_id":{"type":"string","title":"client ID","examples":["mwb-cloud-d0ecec48fa24de7706f2a0be2e1b8cf6"]}}}},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}}}}},"tags":["Webhooks"],"operationId":"api.v2.rmm.webhooks.subscriptions.get"}},"/oneview/v1/accounts/{account_id}/webhooks/subscriptions/{id}":{"delete":{"description":"Delete a webhook subscription if you want to stop receiving notifications. If you want to temporarily disable notifications, update the subscription by setting enable to false.","summary":"Delete webhook subscription","security":[{"client_credentials":["write"]},{"user_permissions":["notifications.deleteOwn"]}],"status":{"outage":["auth","webhooks_subscriptions"]},"parameters":[{"name":"id","required":true,"in":"path","description":"Valid UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"account_id","required":false,"in":"path","description":"Valid account UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"Successful response"}},"tags":["Webhooks"],"operationId":"api.v2.rmm.post.webhooks.subscriptions.delete"},"get":{"description":"Retrieve a subscription by its unique identifier.","summary":"Get webhook subscription","security":[{"client_credentials":["read"]},{"user_permissions":["notifications.viewOwn"]}],"status":{"outage":["auth","webhooks_subscriptions"]},"parameters":[{"name":"id","required":true,"in":"path","description":"Valid UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"account_id","required":false,"in":"path","description":"Valid account UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"The Webhooks Subscriptions Get Id Schema","required":["id","url","enabled","events"],"properties":{"id":{"type":"string","title":"ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"url":{"type":"string","title":"Url of the webhook (Ex. \"https://example.com\")","pattern":"^https://.{4,}$","examples":["https://example.com"]},"description":{"type":"string","title":"Description of the webhook"},"enabled":{"type":"boolean","title":"Webhook is enabled"},"events":{"type":"array","title":"List of events webhook starts to receive.","items":{"type":"string","title":"The Items Schema"}},"custom_headers":{"type":"array","title":"Custom headers","items":{"type":"object","title":"Custom headers items","required":["key","value"],"properties":{"key":{"type":"string","title":"The header key","examples":["authorization"]},"value":{"type":"string","title":"The header value"}}}},"max_retries":{"type":"integer","title":"Maximum number of retries event payload is sent to webhook without receiving success response.","default":10},"secret_token":{"type":"string","title":"The signing key used to compute the HMAC of the payload"},"client_id":{"type":"string","title":"client ID","examples":["mwb-cloud-d0ecec48fa24de7706f2a0be2e1b8cf6"]}}}}}}},"tags":["Webhooks"],"operationId":"api.v2.rmm.webhooks.subscriptions.get.id"},"put":{"description":"Update a subscription by its unique identifier.","summary":"Update a subscription","security":[{"client_credentials":["write"]},{"user_permissions":["notifications.editOwn"]}],"status":{"outage":["auth","webhooks_subscriptions"]},"parameters":[{"name":"id","required":true,"in":"path","description":"Valid UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"account_id","required":false,"in":"path","description":"Valid account UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Add webhook","required":["url","enabled","events"],"properties":{"url":{"type":"string","title":"Url of the webhook (Ex. \"https://example.com\")","pattern":"^https://.{4,}$","examples":["https://example.com"]},"description":{"type":"string","title":"Description of the webhook"},"enabled":{"type":"boolean","title":"Webhook is enabled"},"events":{"type":"array","title":"List of events webhook starts to receive.","items":{"type":"string","title":"List items","enum":["all","detection","job_status_change","machine_events","threat_events","agent_events","quarantine_events","edr_events","syslog_events","exclusion_events","scheduled_events","policy_events","user_events","drive_events","cve_events","dns_events","license_events","appblock_events","endpoint_events"]}},"custom_headers":{"type":"array","title":"Custom headers","items":{"type":"object","title":"Custom headers items","required":["key","value"],"properties":{"key":{"type":"string","title":"The header key","examples":["authorization"]},"value":{"type":"string","title":"The header value"}}}},"max_retries":{"type":"integer","title":"Maximum number of retries event payload is sent to webhook without receiving success response.","default":10},"secret_token":{"type":"string","title":"The signing key used to compute the HMAC of the payload"}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Update webhook","properties":{"id":{"type":"string","title":"ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"url":{"type":"string","title":"URL of the webhook (Ex. \"https://example.com\")","pattern":"^https://.{4,}$","examples":["https://example.com"]},"description":{"type":"string","title":"Description of the webhook"},"enabled":{"type":"boolean","title":"Webhook is enabled"},"events":{"type":"array","title":"List of events webhook starts to receive.","items":{"type":"string","title":"List items"}},"custom_headers":{"type":"array","title":"Custom headers","items":{"type":"object","title":"Custom headers items","required":["key","value"],"properties":{"key":{"type":"string","title":"The header key","examples":["authorization"]},"value":{"type":"string","title":"The header value"}}}},"max_retries":{"type":"integer","title":"Maximum number of retries event payload is sent to webhook without receiving success response.","default":10},"secret_token":{"type":"string","title":"The signing key used to compute the HMAC of the payload"},"client_id":{"type":"string","title":"client ID","examples":["mwb-cloud-d0ecec48fa24de7706f2a0be2e1b8cf6"]}}}}}}},"tags":["Webhooks"],"operationId":"api.v2.rmm.post.webhooks.subscriptions.update"}},"/oneview/v1/accounts/{account_id}/quarantine/export":{"post":{"description":"Export quarantined items data. You can export only per one account at a time. Specify your interested fields and the output format.\n\nSupported output formats: csv, xlsx, json.\n\n## Settings\n\n| Name | Description |\n|------|-------------|\n| download | If set to true, the server will set the `Content-Disposition` header using the `filename` and `format` |\n| select | Which fields to select, and which field name to map to. See request schema for allowed values |\n| type | Output encoding (for `csv` and `json` format) |\n| filename | Name of the file to be set in `Content-Disposition` header if `download` = true |\n\nCurrently the export API has a limit of 10000 items. Apply filters to narrow your search and get the desired results.\n\n## Examples\n\n### Download HTML file\n\nA request with this body sent by a browser will download a file called `nameofthefile.html`, displaying a table with columns: `Path`, `Name`, `Machine ID`, `Machine Name` for all quarantind items:\n\n```json\n\t{\n\t\t\"format\": \"html\",\n\t\t\"type\": \"string\",\n\t\t\"filename\": \"nameofthefile\",\n\t\t\"download\": true,\n\t\t\"select\": [{\n\t\t\t\"field\": \"path\",\n\t\t\t\"newField\": \"Path\"\n\t\t},{\n\t\t\t\"field\": \"threat_name\",\n\t\t\t\"newField\": \"Name\"\n\t\t}, {\n\t\t\t\"field\": \"machine_id\",\n\t\t\t\"newField\": \"Machine ID\"\n\t\t}, {\n\t\t\t\"field\": \"machine_name\",\n\t\t\t\"newField\": \"Machine Name\"\n\t\t}]\n\t}\n```\n","summary":"Export quarantine","security":[{"client_credentials":["read"]},{"user_permissions":["detections.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}},{"name":"next_cursor","required":false,"in":"query","description":"The pagination cursor for next set of results. For further documentation, check Pagination section.","schema":{"type":"string"}},{"name":"name","required":false,"in":"query","description":"Search with quarantine threat name.","schema":{"type":"string"}},{"name":"category","required":false,"in":"query","description":"Search with quarantine category.","schema":{"type":"string"}},{"name":"type","required":false,"in":"query","description":"Search with quarantine type","schema":{"type":"string"}},{"name":"since","required":false,"in":"query","description":"Timestamp to filter since quarantine scan times.","schema":{"type":"string"}},{"name":"until","required":false,"in":"query","description":"Timestamp to filter until quarantine scan times.","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Export request","required":["select","format"],"properties":{"groups":{"type":"array","items":{"type":"object","required":["account_ids"],"allOf":[{"type":"object","title":"Search quarantine","properties":{"fields":{"type":"array","title":"Specify which fields will be included in the response","items":{"enum":["trace_id","scan_id","machine_id","machine_name","group_id","group_name","policy_id","policy_name","account_id","account_name","parent_account_id","detection_id","correlation_hash","scanned_at","scanned_at_offset_seconds","reported_at","resource_created_at","resource_modified_at","threat_name","type","path","category","is_rtp_stream_event","updated_at","cleaned_at","parent_detection_id","rule_id","md5","sha256","online","auto_removal_at"],"type":"string"},"default":["trace_id","scan_id","machine_id","account_id"]},"sort_field":{"type":"string","title":"Sort field","enum":["scanned_at","auto_removal_at"],"default":"scanned_at"},"sort_order":{"type":"string","title":"Whether sorting should be ascending or descending","enum":["asc","desc"],"default":"desc"},"page_size":{"type":"number","title":"The page size","minimum":0,"maximum":2000},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]},"constraints":{"type":"array","title":"Quarantine constraints","items":{"title":"Quarantine Constraints","type":"object","oneOf":[{"title":"String (Equals, Not Equals) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"type":"string","title":"Quarantine UID String Fields","enum":["id","scan_id","machine_id","detection_id","parent_detection_id","account_id"]},{"title":"Quarantine Simple String Fields","type":"string","enum":["correlation_hash","threat_name","machine_name","path","md5","sha256","scanned_at_offset_seconds","trace_id","rule_id"]},{"type":"string","title":"Quarantine Enum String Fields","enum":["type","category"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["equals","not_equals"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}},"case_insensitive":{"type":"boolean","default":false}},"if":{"properties":{"field":{"type":"string","title":"Quarantine UID String Fields","enum":["id","scan_id","machine_id","detection_id","parent_detection_id","account_id"]}}},"then":{"properties":{"value":{"type":["string","array"],"format":"uuid","items":{"type":"string","format":"uuid"}}}}},{"title":"String (Contains, Not Contains) Constraints","required":["operator","value"],"properties":{"field":{"title":"Quarantine Simple String Fields","type":"string","enum":["correlation_hash","threat_name","machine_name","path","md5","sha256","scanned_at_offset_seconds","trace_id","rule_id"]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["contains","not_contains"]},"value":{"type":"string","title":"Value to search"},"case_insensitive":{"type":"boolean","default":false}}},{"title":"Boolean (Equals) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"type":"string","title":"Quarantine Boolean Fields","enum":["is_rtp_stream_event"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["equals"]},"value":{"title":"Value to search. Must be true or false","type":"boolean"}}},{"title":"Date (start, end) Constraints","properties":{"field":{"type":"string","title":"Quarantine Date Fields","enum":["scanned_at","reported_at","cleaned_at","updated_at","resource_created_at","resource_modified_at","auto_removal_at"]}},"oneOf":[{"minProperties":1,"title":"Specify Date Range","not":{"anyOf":[{"required":["operator"]},{"required":["value"]}]},"properties":{"start":{"type":"string","format":"date-time","title":"Start Date"},"end":{"type":"string","format":"date-time","title":"End Date"}}},{"title":"Specify Exact Date","not":{"anyOf":[{"required":["start"]},{"required":["end"]}]},"required":["operator","value"],"properties":{"operator":{"type":"string","enum":["equals"]},"value":{"type":["string","array"],"format":"date-time","title":"Value to search","items":{"format":"date-time"}}}}]}]}}}},{"type":"object","required":["account_ids"],"properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]}},"format":{"type":"string","title":"The output file","enum":["csv","xlsx","html","ods","txt","rtf","json"]},"download":{"type":"boolean","title":"Whether to instruct the client to download the response as a file. Only clients like browsers are supported"},"ids":{"type":"array","title":"IDs of quarantines to filter by (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","items":{"type":"string","title":"IDs of quarantine to filter by (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}},"type":{"type":"string","title":"The encoding of the output","enum":["string","base64","binary"],"default":"string"},"select":{"type":"array","title":"Which fields to select from the response","items":{"type":"object","title":"Field","properties":{"newField":{"type":"string","title":"the new value"},"field":{"type":"string","title":"The response field to map to a new value","enum":["id","type","scan_id","account_id","account_name","machine_id","machine_name","group_id","detection_id","scanned_at","scanned_at_local","reported_at","resource_created_at","resource_modified_at","threat_name","path","category","ip_address","url","port","md5","sha256","device.disk_model"]}}}}}}}}},"responses":{},"tags":["Quarantine"],"operationId":"api.rmm.export.quarantine-all"}},"/oneview/v1/accounts/{account_id}/quarantine":{"get":{"description":"Get all quarantined items scoped by account. Refer to the Jobs apis to restore and delete items from quarantine","summary":"Get all quarantine","security":[{"client_credentials":["read"]},{"user_permissions":["detections.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}},{"name":"next_cursor","required":false,"in":"query","description":"The pagination cursor for next set of results. For further documentation, check Pagination section.","schema":{"type":"string"}},{"name":"name","required":false,"in":"query","description":"Search with quarantine threat name.","schema":{"type":"string"}},{"name":"category","required":false,"in":"query","description":"Search with quarantine category.","schema":{"type":"string"}},{"name":"type","required":false,"in":"query","description":"Search with quarantine type","schema":{"type":"string"}},{"name":"since","required":false,"in":"query","description":"Timestamp to filter since quarantine scan times.","schema":{"type":"string"}},{"name":"until","required":false,"in":"query","description":"Timestamp to filter until quarantine scan times.","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"The get quearantines response","description":"Get quarantine for a given machine","examples":[{"quarantined_threats":[{"id":"957fc464-9ee1-473c-8f49-d89d2da1d5d8","scan_id":"00000000-0000-0000-0000-000000000000","machine_id":"0ac6eb75-3b3d-49ea-86ea-4349465d32bf","machine_name":"EndpointDetections","group_id":"999a0d78-a983-44fc-a302-995cdfb39da3","detection_id":"1491ac5b-60fc-439c-acd3-4e5e1881337f","scanned_at":"2020-05-20T13:21:21Z","scanned_at_local":"2020-05-20T13:21:21Z","reported_at":"2020-05-20T13:21:23.114719Z","threat_name":"ransomware.script","type":["file"],"stauts":"quarantined","path":"C:\\Deploy\\RealTime\\ransomware.exe","category":"arw","ip_address":"","url":"","port":""}],"total_count":1,"next_cursor":""}],"required":["quarantined_threats","total_count","next_cursor"],"properties":{"quarantined_threats":{"type":"array","title":"List of quearantine threats","description":"List of quarantined threats.","items":{"type":"object","title":"Get detection by id","additionalProperties":true,"required":["id","scan_id","machine_id","detection_id","scanned_at","scanned_at_local","reported_at","status","type","path","category"],"properties":{"id":{"type":"string","title":"The ID of the detection (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"scan_id":{"type":"string","title":"Scan ID this detection belongs to (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"machine_id":{"type":"string","title":"Endpoint ID this detection belongs to (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"machine_name":{"type":"string","title":"Machine name"},"group_id":{"type":"string","title":"Group ID the endpoint has (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"group_name":{"type":"string","title":"Group name the endpoint has"},"policy_id":{"type":"string","title":"The ID of the policy associated to the machine where this detection happened (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"policy_name":{"type":"string","title":"Policy name"},"detection_id":{"type":"string","title":"Detection id from endpoint"},"scanned_at":{"type":"string","title":"Scanned at time (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^\\d{4}-[0-1]\\d-[0-3]\\d[(t|T)\\s](?:[0-2]\\d:[0-5]\\d:[0-5]\\d|23:59:60)(?:\\.\\d+)?(?:(z|Z)|[+-]\\d{2}:\\d{2})$","examples":["2020-03-23T17:23:17.860482Z"]},"scanned_at_local":{"type":"string","title":"Scanned at local time (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^\\d{4}-[0-1]\\d-[0-3]\\d[(t|T)\\s](?:[0-2]\\d:[0-5]\\d:[0-5]\\d|23:59:60)(?:\\.\\d+)?(?:(z|Z)|[+-]\\d{2}:\\d{2})$","examples":["2020-03-23T17:23:17.860482Z"]},"reported_at":{"type":"string","title":"Detection reported at time (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^\\d{4}-[0-1]\\d-[0-3]\\d[(t|T)\\s](?:[0-2]\\d:[0-5]\\d:[0-5]\\d|23:59:60)(?:\\.\\d+)?(?:(z|Z)|[+-]\\d{2}:\\d{2})$","examples":["2020-03-23T17:23:17.860482Z"]},"resource_created_at":{"type":"string","title":"The creation timestamp of the original quarantined file","format":"date-time"},"resource_modified_at":{"type":"string","title":"The modification timestamp of the original quarantined file","format":"date-time"},"status":{"type":"string","title":"Status"},"action_taken":{"type":"string","title":"Action Taken","examples":["unknown","failed","noActionByUser","quarantined","replaced","deleteOnReboot","replaceOnReboot","blocked","whitelisted","unquarantined"]},"threat_name":{"type":"string","title":"Threat name"},"type":{"type":"array","title":"Type","items":{"type":"string","title":"Items"}},"path":{"type":"string","title":"Path"},"category":{"type":"string","title":"Category"},"ip_address":{"type":"string","title":"IP address"},"url":{"type":"string","title":"Url"},"port":{"type":"string","title":"Port"},"affected_application":{"type":"string","title":"Affected application"},"md5":{"type":"string","title":"Md5"},"process_name":{"type":"string","title":"Process name"},"auto_removal_at":{"type":["string","null"],"title":"Automatic removal timestamp","description":"When the quarantined item will be automatically removed.","format":"date-time","examples":["2020-03-23T17:23:17.860482Z"]}}}},"total_count":{"type":"integer","title":"Total count of items","description":"Total count of items","default":0,"examples":[1]},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}}}}},"tags":["Quarantine"],"operationId":"api.rmm.get.quarantine-all"}},"/oneview/v1/accounts/{account_id}/quarantine/search":{"post":{"description":"Search all quarantined items scoped by (parent) account. It's possible to add some constraints to filter the result","summary":"Search quarantine","security":[{"client_credentials":["read"]},{"user_permissions":["detections.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Search quarantine","allOf":[{"type":"object","title":"Search quarantine","properties":{"fields":{"type":"array","title":"Specify which fields will be included in the response","items":{"enum":["trace_id","scan_id","machine_id","machine_name","group_id","group_name","policy_id","policy_name","account_id","account_name","parent_account_id","detection_id","correlation_hash","scanned_at","scanned_at_offset_seconds","reported_at","resource_created_at","resource_modified_at","threat_name","type","path","category","is_rtp_stream_event","updated_at","cleaned_at","parent_detection_id","rule_id","md5","sha256","online","auto_removal_at"],"type":"string"},"default":["trace_id","scan_id","machine_id","account_id"]},"sort_field":{"type":"string","title":"Sort field","enum":["scanned_at","auto_removal_at"],"default":"scanned_at"},"sort_order":{"type":"string","title":"Whether sorting should be ascending or descending","enum":["asc","desc"],"default":"desc"},"page_size":{"type":"number","title":"The page size","minimum":0,"maximum":2000},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]},"constraints":{"type":"array","title":"Quarantine constraints","items":{"title":"Quarantine Constraints","type":"object","oneOf":[{"title":"String (Equals, Not Equals) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"type":"string","title":"Quarantine UID String Fields","enum":["id","scan_id","machine_id","detection_id","parent_detection_id","account_id"]},{"title":"Quarantine Simple String Fields","type":"string","enum":["correlation_hash","threat_name","machine_name","path","md5","sha256","scanned_at_offset_seconds","trace_id","rule_id"]},{"type":"string","title":"Quarantine Enum String Fields","enum":["type","category"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["equals","not_equals"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}},"case_insensitive":{"type":"boolean","default":false}},"if":{"properties":{"field":{"type":"string","title":"Quarantine UID String Fields","enum":["id","scan_id","machine_id","detection_id","parent_detection_id","account_id"]}}},"then":{"properties":{"value":{"type":["string","array"],"format":"uuid","items":{"type":"string","format":"uuid"}}}}},{"title":"String (Contains, Not Contains) Constraints","required":["operator","value"],"properties":{"field":{"title":"Quarantine Simple String Fields","type":"string","enum":["correlation_hash","threat_name","machine_name","path","md5","sha256","scanned_at_offset_seconds","trace_id","rule_id"]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["contains","not_contains"]},"value":{"type":"string","title":"Value to search"},"case_insensitive":{"type":"boolean","default":false}}},{"title":"Boolean (Equals) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"type":"string","title":"Quarantine Boolean Fields","enum":["is_rtp_stream_event"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["equals"]},"value":{"title":"Value to search. Must be true or false","type":"boolean"}}},{"title":"Date (start, end) Constraints","properties":{"field":{"type":"string","title":"Quarantine Date Fields","enum":["scanned_at","reported_at","cleaned_at","updated_at","resource_created_at","resource_modified_at","auto_removal_at"]}},"oneOf":[{"minProperties":1,"title":"Specify Date Range","not":{"anyOf":[{"required":["operator"]},{"required":["value"]}]},"properties":{"start":{"type":"string","format":"date-time","title":"Start Date"},"end":{"type":"string","format":"date-time","title":"End Date"}}},{"title":"Specify Exact Date","not":{"anyOf":[{"required":["start"]},{"required":["end"]}]},"required":["operator","value"],"properties":{"operator":{"type":"string","enum":["equals"]},"value":{"type":["string","array"],"format":"date-time","title":"Value to search","items":{"format":"date-time"}}}}]}]}}}},{"type":"object","properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"Search quearantines","description":"Search quarantines","examples":[{"quarantine":[{"id":"d284a484-0017-4962-bc79-e855a24a64f3","trace_id":"278b5a30-b7d4-4b85-8666-7b48fd430709_0c0cf8d6-22aa-11ea-a1b3-000c297231a7","scan_id":"278b5a30-b7d4-4b85-8666-7b48fd430709","machine_id":"dc41a3da-3f69-47ac-a931-5142973e9eae","machine_name":"Alex-Win81x86-QA","group_id":"9b40dd88-b1e6-4eb4-a009-5dc6f753ba95","group_name":"Alex_EPR","account_id":"550a20b8-6d36-4222-afbc-54d100f2e894","account_name":"Test-Account3","parent_account_id":"550a20b8-6d36-4222-afbc-54d100f2e894","detection_id":"0c0cf8d6-22aa-11ea-a1b3-000c297231a7","correlation_hash":"","scanned_at":"2019-12-19T21:52:41Z","scanned_at_offset_seconds":0,"reported_at":"2020-01-10T19:30:43.417539Z","cleaned_at":"2019-12-19T21:53:58Z","threat_name":"Trojan.MBAMTest","type":"WyJmaWxlIl0=","path":"C:\\Users\\osokolov\\Desktop\\Agent\\Sample Infections\\TEST-TROJAN.EXE","category":"Malware","is_rtp_stream_event":false,"updated_at":"2020-01-10T19:30:43.417854Z","policy_id":"dc1510a6-8d41-4216-93e9-0c57c57e03b4","policy_name":"alessio-tests","online":false}],"total_count":1,"next_cursor":""}],"required":["quarantine","total_count","next_cursor"],"properties":{"quarantine":{"type":"array","title":"List of quarantined threats","description":"List of quarantined threats.","items":{"type":"object","title":"Quarantine","required":["id"],"properties":{"id":{"type":"string","title":"ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"scan_id":{"type":"string","title":"Scan ID this detection belongs to (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"trace_id":{"type":"string","title":"Trace ID (Ex. \"1d15c701-0ed0-536c-baff-47472ddea30d_794597e5-2f43-4fd8-ab7a-c08219cdc06f\")","examples":["1d15c701-0ed0-536c-baff-47472ddea30d_794597e5-2f43-4fd8-ab7a-c08219cdc06f"]},"machine_id":{"type":"string","title":"Endpoint ID this detection belongs to (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"machine_name":{"type":"string","title":"Machine name"},"group_id":{"type":"string","title":"Group ID the endpoint has (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"group_name":{"type":"string","title":"Group name the endpoint has"},"policy_id":{"type":"string","title":"The ID of the policy associated to the machine where this detection happened (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"policy_name":{"type":"string","title":"Policy name"},"account_id":{"type":"string","title":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"account_name":{"type":"string","title":"Account name"},"parent_account_id":{"type":"string","title":"Parent Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"detection_id":{"type":"string","title":"Detection id from endpoint"},"correlation_hash":{"type":"string","title":"Correlation hash"},"scanned_at":{"type":"string","title":"Scanned at time (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^\\d{4}-[0-1]\\d-[0-3]\\d[(t|T)\\s](?:[0-2]\\d:[0-5]\\d:[0-5]\\d|23:59:60)(?:\\.\\d+)?(?:(z|Z)|[+-]\\d{2}:\\d{2})$","examples":["2020-03-23T17:23:17.860482Z"]},"scanned_at_offset_seconds":{"type":"integer","title":"Scanned at offset seconds"},"reported_at":{"type":"string","title":"Detection reported at time (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^\\d{4}-[0-1]\\d-[0-3]\\d[(t|T)\\s](?:[0-2]\\d:[0-5]\\d:[0-5]\\d|23:59:60)(?:\\.\\d+)?(?:(z|Z)|[+-]\\d{2}:\\d{2})$","examples":["2020-03-23T17:23:17.860482Z"]},"cleaned_at":{"type":"string","title":"Detection cleaned at time (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^\\d{4}-[0-1]\\d-[0-3]\\d[(t|T)\\s](?:[0-2]\\d:[0-5]\\d:[0-5]\\d|23:59:60)(?:\\.\\d+)?(?:(z|Z)|[+-]\\d{2}:\\d{2})$","examples":["2020-03-23T17:23:17.860482Z"]},"updated_at":{"type":"string","title":"Detection updated at time (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^\\d{4}-[0-1]\\d-[0-3]\\d[(t|T)\\s](?:[0-2]\\d:[0-5]\\d:[0-5]\\d|23:59:60)(?:\\.\\d+)?(?:(z|Z)|[+-]\\d{2}:\\d{2})$","examples":["2020-03-23T17:23:17.860482Z"]},"resource_created_at":{"type":"string","title":"The creation timestamp of the original quarantined file","format":"date-time"},"resource_modified_at":{"type":"string","title":"The modification timestamp of the original quarantined file","format":"date-time"},"auto_removal_at":{"type":"string","title":"Auto removal scheduled at time (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^\\d{4}-[0-1]\\d-[0-3]\\d[(t|T)\\s](?:[0-2]\\d:[0-5]\\d:[0-5]\\d|23:59:60)(?:\\.\\d+)?(?:(z|Z)|[+-]\\d{2}:\\d{2})$","examples":["2020-03-23T17:23:17.860482Z"]},"threat_name":{"type":"string","title":"Threat name"},"type":{"type":"array","title":"Type","items":{"type":"string","title":"Items"}},"path":{"type":"string","title":"Path"},"category":{"type":"string","title":"Category"},"md5":{"type":"string","title":"MD5"},"sha256":{"type":"string","title":"SHA256"},"is_rtp_stream_event":{"type":"boolean","title":"Is real-time-protection event"},"parent_detection_id":{"type":"string","title":"The ID of the parent detection. If there is no parent detection, it can be empty string or undefined","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"rule_id":{"type":"string","title":"The ID of the rule triggered","examples":["2403099913"]},"online":{"type":"boolean","title":"The online/offline status of the endpoint (when populated/selected)"}}}},"total_count":{"type":"integer","title":"Total count of items","description":"Total count of items","examples":[1]},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}}}}},"tags":["Quarantine"],"operationId":"api.rmm.post.quarantine-search"}},"/oneview/v1/accounts/{account_id}/flight-recorder/chart":{"post":{"description":"Search occurrence of suspicious activity. Wildcards are not supported.","summary":"Search occurrence of suspicious activity","security":[{"client_credentials":["read"]},{"user_permissions":["edr.view"]}],"status":{"outage":["auth","edr"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Flight Recorder chart request","required":["advanced_filters"],"oneOf":[{"required":["time_range"]},{"required":["time_window"]}],"properties":{"time_range":{"type":"string","title":"Time range","enum":["7d","3d","24h","12h","6h","3h","1h","30m"]},"time_window":{"type":"object","title":"Time window","properties":{"gte":{"type":"string","title":"Time window greater than or equal to date","format":"date-time"},"lte":{"type":"string","title":"Time window lower than or equal to date","format":"date-time"}}},"advanced_filters":{"type":"array","title":"Advanced flight recorder filters","items":{"items":{"type":"object","properties":{"or":{"type":"array","title":"Filter with or","items":{"type":"object","properties":{"eq":{"type":"array","title":"Equal operator","items":[{"type":"string","title":"Field name","enum":["command_line","contacted_domains","contacted_ips","hash.md5","hash.sha1","hash.sha256","hash.sha512","machine_id","pc_hostname","process_id","process_name","process_path","remote_port","user"]},{"type":"string","title":"Value to compare"}]},"neq":{"type":"array","title":"Not Equal operator","items":[{"type":"string","title":"Field name","enum":["command_line","contacted_domains","contacted_ips","hash.md5","hash.sha1","hash.sha256","hash.sha512","machine_id","pc_hostname","process_id","process_name","process_path","remote_port","user"]},{"type":"string","title":"Value to compare"}]},"contains":{"type":"array","title":"Contains operator","items":[{"type":"string","title":"Field name","enum":["command_line","contacted_domains","contacted_ips","hash.md5","hash.sha1","hash.sha256","hash.sha512","machine_id","pc_hostname","process_id","process_name","process_path","remote_port","user"]},{"type":"string","title":"Value to compare"}]},"not_contains":{"type":"array","title":"not_contains operator","items":[{"type":"string","title":"Field name","enum":["command_line","contacted_domains","contacted_ips","hash.md5","hash.sha1","hash.sha256","hash.sha512","machine_id","pc_hostname","process_id","process_name","process_path","remote_port","user"]},{"type":"string","title":"Value to compare"}]},"starts_with":{"type":"array","title":"starts_with operator","items":[{"type":"string","title":"Field name","enum":["command_line","contacted_domains","contacted_ips","hash.md5","hash.sha1","hash.sha256","hash.sha512","machine_id","pc_hostname","process_id","process_name","process_path","remote_port","user"]},{"type":"string","title":"Value to compare"}]},"ends_with":{"type":"array","title":"ends_with operator","items":[{"type":"string","title":"Field name","enum":["command_line","contacted_domains","contacted_ips","hash.md5","hash.sha1","hash.sha256","hash.sha512","machine_id","pc_hostname","process_id","process_name","process_path","remote_port","user"]},{"type":"string","title":"Value to compare"}]}}}},"and":{"type":"array","title":"Filter with and","items":{"type":"object","properties":{"eq":{"type":"array","title":"Equal operator","items":[{"type":"string","title":"Field name","enum":["command_line","contacted_domains","contacted_ips","hash.md5","hash.sha1","hash.sha256","hash.sha512","machine_id","pc_hostname","process_id","process_name","process_path","remote_port","user"]},{"type":"string","title":"Value to compare"}]},"neq":{"type":"array","title":"Not Equal operator","items":[{"type":"string","title":"Field name","enum":["command_line","contacted_domains","contacted_ips","hash.md5","hash.sha1","hash.sha256","hash.sha512","machine_id","pc_hostname","process_id","process_name","process_path","remote_port","user"]},{"type":"string","title":"Value to compare"}]},"contains":{"type":"array","title":"Contains operator","items":[{"type":"string","title":"Field name","enum":["command_line","contacted_domains","contacted_ips","hash.md5","hash.sha1","hash.sha256","hash.sha512","machine_id","pc_hostname","process_id","process_name","process_path","remote_port","user"]},{"type":"string","title":"Value to compare"}]},"not_contains":{"type":"array","title":"not_contains operator","items":[{"type":"string","title":"Field name","enum":["command_line","contacted_domains","contacted_ips","hash.md5","hash.sha1","hash.sha256","hash.sha512","machine_id","pc_hostname","process_id","process_name","process_path","remote_port","user"]},{"type":"string","title":"Value to compare"}]},"starts_with":{"type":"array","title":"starts_with operator","items":[{"type":"string","title":"Field name","enum":["command_line","contacted_domains","contacted_ips","hash.md5","hash.sha1","hash.sha256","hash.sha512","machine_id","pc_hostname","process_id","process_name","process_path","remote_port","user"]},{"type":"string","title":"Value to compare"}]},"ends_with":{"type":"array","title":"ends_with operator","items":[{"type":"string","title":"Field name","enum":["command_line","contacted_domains","contacted_ips","hash.md5","hash.sha1","hash.sha256","hash.sha512","pc_hostname","process_id","process_name","process_path","remote_port","user"]},{"type":"string","title":"Value to compare"}]}}}}}}}}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"array","title":"Flight Recorder chart result","items":{"type":"object","title":"Collection items","properties":{"date":{"type":"string","title":"Date","examples":["2020-06-01T07:00:00.000Z"]},"bucket":{"type":"integer","title":"Bucket"},"process":{"type":"integer","title":"Process"},"filesystem":{"type":"integer","title":"Filesystem"},"script_activity":{"type":"integer","title":"script_activity"},"network":{"type":"integer","title":"Network"},"registry":{"type":"integer","title":"Registry"},"system_event":{"type":"integer","title":"System event"},"other":{"type":"integer","title":"Other"}}}}}}}},"tags":["Flight-recorder"],"operationId":"api.rmm.post.flightrecorder.chart"}},"/oneview/v1/accounts/{account_id}/flight-recorder/endpoints":{"post":{"description":"Search flight recorder for endpoints that had processes with the selected parameters.","summary":"Search flight recorder by process parameters","security":[{"client_credentials":["read"]},{"user_permissions":["edr.view"]}],"status":{"outage":["auth","edr"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Flight Recorder endpoints request","oneOf":[{"required":["time_range"]},{"required":["time_window"]}],"properties":{"advanced_filters":{"type":"array","title":"Advanced flight recorder filters. REQUIRED field","items":{"items":{"type":"object","properties":{"or":{"type":"array","title":"Filter with or","items":{"type":"object","properties":{"eq":{"type":"array","title":"Equal operator","items":[{"type":"string","title":"Field name","enum":["command_line","contacted_domains","contacted_ips","hash.md5","hash.sha1","hash.sha256","hash.sha512","machine_id","pc_hostname","process_id","process_name","process_path","remote_port","user"]},{"type":"string","title":"Value to compare"}]},"neq":{"type":"array","title":"Not Equal operator","items":[{"type":"string","title":"Field name","enum":["command_line","contacted_domains","contacted_ips","hash.md5","hash.sha1","hash.sha256","hash.sha512","machine_id","pc_hostname","process_id","process_name","process_path","remote_port","user"]},{"type":"string","title":"Value to compare"}]},"contains":{"type":"array","title":"Contains operator","items":[{"type":"string","title":"Field name","enum":["command_line","contacted_domains","contacted_ips","hash.md5","hash.sha1","hash.sha256","hash.sha512","machine_id","pc_hostname","process_id","process_name","process_path","remote_port","user"]},{"type":"string","title":"Value to compare"}]},"not_contains":{"type":"array","title":"not_contains operator","items":[{"type":"string","title":"Field name","enum":["command_line","contacted_domains","contacted_ips","hash.md5","hash.sha1","hash.sha256","hash.sha512","machine_id","pc_hostname","process_id","process_name","process_path","remote_port","user"]},{"type":"string","title":"Value to compare"}]},"starts_with":{"type":"array","title":"starts_with operator","items":[{"type":"string","title":"Field name","enum":["command_line","contacted_domains","contacted_ips","hash.md5","hash.sha1","hash.sha256","hash.sha512","machine_id","pc_hostname","process_id","process_name","process_path","remote_port","user"]},{"type":"string","title":"Value to compare"}]},"ends_with":{"type":"array","title":"ends_with operator","items":[{"type":"string","title":"Field name","enum":["command_line","contacted_domains","contacted_ips","hash.md5","hash.sha1","hash.sha256","hash.sha512","machine_id","pc_hostname","process_id","process_name","process_path","remote_port","user"]},{"type":"string","title":"Value to compare"}]}}}},"and":{"type":"array","title":"Filter with and","items":{"type":"object","properties":{"eq":{"type":"array","title":"Equal operator","items":[{"type":"string","title":"Field name","enum":["command_line","contacted_domains","contacted_ips","hash.md5","hash.sha1","hash.sha256","hash.sha512","machine_id","pc_hostname","process_id","process_name","process_path","remote_port","user"]},{"type":"string","title":"Value to compare"}]},"neq":{"type":"array","title":"Not Equal operator","items":[{"type":"string","title":"Field name","enum":["command_line","contacted_domains","contacted_ips","hash.md5","hash.sha1","hash.sha256","hash.sha512","machine_id","pc_hostname","process_id","process_name","process_path","remote_port","user"]},{"type":"string","title":"Value to compare"}]},"contains":{"type":"array","title":"Contains operator","items":[{"type":"string","title":"Field name","enum":["command_line","contacted_domains","contacted_ips","hash.md5","hash.sha1","hash.sha256","hash.sha512","machine_id","pc_hostname","process_id","process_name","process_path","remote_port","user"]},{"type":"string","title":"Value to compare"}]},"not_contains":{"type":"array","title":"not_contains operator","items":[{"type":"string","title":"Field name","enum":["command_line","contacted_domains","contacted_ips","hash.md5","hash.sha1","hash.sha256","hash.sha512","machine_id","pc_hostname","process_id","process_name","process_path","remote_port","user"]},{"type":"string","title":"Value to compare"}]},"starts_with":{"type":"array","title":"starts_with operator","items":[{"type":"string","title":"Field name","enum":["command_line","contacted_domains","contacted_ips","hash.md5","hash.sha1","hash.sha256","hash.sha512","machine_id","pc_hostname","process_id","process_name","process_path","remote_port","user"]},{"type":"string","title":"Value to compare"}]},"ends_with":{"type":"array","title":"ends_with operator","items":[{"type":"string","title":"Field name","enum":["command_line","contacted_domains","contacted_ips","hash.md5","hash.sha1","hash.sha256","hash.sha512","pc_hostname","process_id","process_name","process_path","remote_port","user"]},{"type":"string","title":"Value to compare"}]}}}}}}}},"time_range":{"type":"string","title":"Time range","enum":["7d","3d","24h","12h","6h","3h","1h","30m"]},"time_window":{"type":"object","title":"Time window","properties":{"gte":{"type":"string","title":"Time window greater than or equal to date","format":"date-time"},"lte":{"type":"string","title":"Time window lower than or equal to date","format":"date-time"}}}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Flight Recorder endpoints result","properties":{"results":{"type":"array","title":"Results","items":{"type":"object","title":"Result items","properties":{"event_categories":{"type":"object","title":"Event categories","properties":{"process":{"type":"integer","title":"Process"},"registry":{"type":"integer","title":"Registry"},"network":{"type":"integer","title":"Network"},"filesystem":{"type":"integer","title":"Filesystem"}}},"first_timestamp":{"type":"string","title":"Seen earliest","examples":["2020-06-01T09:52:10.579Z"]},"last_timestamp":{"type":"string","title":"Seen latest","examples":["2020-06-01T09:52:10.579Z"]},"pc_hostname":{"type":"string","title":"Hostname of PC"},"machine_id":{"type":"string","title":"Endpoint ID","examples":["aff7bb09-4515-4043-a40c-16f2f5a7b9b4"]},"os_type":{"type":"string","title":"OS type","examples":["Windows"]}}}},"total":{"type":"integer","title":"Total"}}}}}}},"tags":["Flight-recorder"],"operationId":"api.rmm.post.flightrecorder.endpoints"}},"/oneview/v1/accounts/{account_id}/flight-recorder/processes":{"post":{"description":"Retrieve a list of processes matching the search input for the specified endpoint.","summary":"Search a list of processes","security":[{"client_credentials":["read"]},{"user_permissions":["edr.view"]}],"status":{"outage":["auth","edr"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Flight Recorder processes request","oneOf":[{"required":["time_range"]},{"required":["time_window"]}],"properties":{"advanced_filters":{"type":"array","title":"Advanced flight recorder filters","items":{"items":{"type":"object","properties":{"or":{"type":"array","title":"Filter with or","items":{"type":"object","properties":{"eq":{"type":"array","title":"Equal operator","items":[{"type":"string","title":"Field name","enum":["command_line","contacted_domains","contacted_ips","hash.md5","hash.sha1","hash.sha256","hash.sha512","machine_id","pc_hostname","process_id","process_name","process_path","remote_port","user"]},{"type":"string","title":"Value to compare"}]},"neq":{"type":"array","title":"Not Equal operator","items":[{"type":"string","title":"Field name","enum":["command_line","contacted_domains","contacted_ips","hash.md5","hash.sha1","hash.sha256","hash.sha512","machine_id","pc_hostname","process_id","process_name","process_path","remote_port","user"]},{"type":"string","title":"Value to compare"}]},"contains":{"type":"array","title":"Contains operator","items":[{"type":"string","title":"Field name","enum":["command_line","contacted_domains","contacted_ips","hash.md5","hash.sha1","hash.sha256","hash.sha512","machine_id","pc_hostname","process_id","process_name","process_path","remote_port","user"]},{"type":"string","title":"Value to compare"}]},"not_contains":{"type":"array","title":"not_contains operator","items":[{"type":"string","title":"Field name","enum":["command_line","contacted_domains","contacted_ips","hash.md5","hash.sha1","hash.sha256","hash.sha512","machine_id","pc_hostname","process_id","process_name","process_path","remote_port","user"]},{"type":"string","title":"Value to compare"}]},"starts_with":{"type":"array","title":"starts_with operator","items":[{"type":"string","title":"Field name","enum":["command_line","contacted_domains","contacted_ips","hash.md5","hash.sha1","hash.sha256","hash.sha512","machine_id","pc_hostname","process_id","process_name","process_path","remote_port","user"]},{"type":"string","title":"Value to compare"}]},"ends_with":{"type":"array","title":"ends_with operator","items":[{"type":"string","title":"Field name","enum":["command_line","contacted_domains","contacted_ips","hash.md5","hash.sha1","hash.sha256","hash.sha512","machine_id","pc_hostname","process_id","process_name","process_path","remote_port","user"]},{"type":"string","title":"Value to compare"}]}}}},"and":{"type":"array","title":"Filter with and","items":{"type":"object","properties":{"eq":{"type":"array","title":"Equal operator","items":[{"type":"string","title":"Field name","enum":["command_line","contacted_domains","contacted_ips","hash.md5","hash.sha1","hash.sha256","hash.sha512","machine_id","pc_hostname","process_id","process_name","process_path","remote_port","user"]},{"type":"string","title":"Value to compare"}]},"neq":{"type":"array","title":"Not Equal operator","items":[{"type":"string","title":"Field name","enum":["command_line","contacted_domains","contacted_ips","hash.md5","hash.sha1","hash.sha256","hash.sha512","machine_id","pc_hostname","process_id","process_name","process_path","remote_port","user"]},{"type":"string","title":"Value to compare"}]},"contains":{"type":"array","title":"Contains operator","items":[{"type":"string","title":"Field name","enum":["command_line","contacted_domains","contacted_ips","hash.md5","hash.sha1","hash.sha256","hash.sha512","machine_id","pc_hostname","process_id","process_name","process_path","remote_port","user"]},{"type":"string","title":"Value to compare"}]},"not_contains":{"type":"array","title":"not_contains operator","items":[{"type":"string","title":"Field name","enum":["command_line","contacted_domains","contacted_ips","hash.md5","hash.sha1","hash.sha256","hash.sha512","machine_id","pc_hostname","process_id","process_name","process_path","remote_port","user"]},{"type":"string","title":"Value to compare"}]},"starts_with":{"type":"array","title":"starts_with operator","items":[{"type":"string","title":"Field name","enum":["command_line","contacted_domains","contacted_ips","hash.md5","hash.sha1","hash.sha256","hash.sha512","machine_id","pc_hostname","process_id","process_name","process_path","remote_port","user"]},{"type":"string","title":"Value to compare"}]},"ends_with":{"type":"array","title":"ends_with operator","items":[{"type":"string","title":"Field name","enum":["command_line","contacted_domains","contacted_ips","hash.md5","hash.sha1","hash.sha256","hash.sha512","pc_hostname","process_id","process_name","process_path","remote_port","user"]},{"type":"string","title":"Value to compare"}]}}}}}}}},"time_range":{"type":"string","title":"Time range","enum":["7d","3d","24h","12h","6h","3h","1h","30m"]},"time_window":{"type":"object","title":"Time window","properties":{"gte":{"type":"string","title":"Time window greater than or equal to date","format":"date-time"},"lte":{"type":"string","title":"Time window lower than or equal to date","format":"date-time"}}},"event_category":{"type":"string","enum":["process","filesystem","registry","network","script activity","system event"],"title":"Event's type category filter. Can be one of process, filesystem, registry, network"},"first_activity_gte":{"type":"string","title":"Filter by first activity gte"},"first_activity_lte":{"type":"string","title":"Filter by first activity lte"},"last_activity_gte":{"type":"string","title":"Filter by last activity gte"},"last_activity_lte":{"type":"string","title":"Filter by last activity lte"},"machine_id":{"type":"string","title":"Filter by machine id"},"md5":{"type":"string","title":"Filter by md5"},"os_type":{"type":"string","title":"Filter by machine id"},"pc_hostname":{"type":"string","title":"Filter by os type"},"pid":{"type":"string","title":"Filter by pid"},"pid_version":{"type":"string","title":"Filter by pid version"},"process_name":{"type":"string","title":"Filter by process name"},"process_path":{"type":"string","title":"Filter by process path"},"sha1":{"type":"string","title":"Filter by sha1"},"sha256":{"type":"string","title":"Filter by sha256"},"sha512":{"type":"string","title":"Filter by sha512"},"user":{"type":"string","title":"Filter by user"},"sort":{"type":"object","title":"Choose sort field and type","anyOf":[{"properties":{"first_seen":{"type":"string","enum":["desc","asc"]}}},{"properties":{"last_seen":{"type":"string","enum":["desc","asc"]}}},{"properties":{"os_type":{"type":"string","enum":["desc","asc"]}}},{"properties":{"pc_hostname":{"type":"string","enum":["desc","asc"]}}},{"properties":{"process_path":{"type":"string","enum":["desc","asc"]}}},{"properties":{"user":{"type":"string","enum":["desc","asc"]}}}]}},"page":{"type":"integer","minimum":1,"title":"Page number"},"page_size":{"type":"integer","minimum":1,"maximum":2000,"title":"Page size"}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Flight Recorder processes result","properties":{"results":{"type":"array","title":"Results","items":{"type":"object","title":"Result items","properties":{"event_categories":{"type":"object","title":"Event categories","properties":{"network":{"type":"integer","title":"Network"},"process":{"type":"integer","title":"Process"},"registry":{"type":"integer","title":"Registry"},"script_activity":{"type":"integer","title":"Script Activity"},"system_event":{"type":"integer","title":"System Event"},"other":{"type":"integer","title":"Other"}}},"first_activity":{"type":"string","title":"Seen earliest","examples":["2020-06-01T09:52:10.579Z"]},"last_activity":{"type":"string","title":"Seen latest","examples":["2020-06-01T09:52:10.579Z"]},"machine_id":{"type":"string","title":"Machine Id"},"pid":{"type":"string","title":"Process Id"},"pid_version":{"type":"string","title":"Process Id version"},"process_path":{"type":"string","title":"Process path"},"md5":{"type":"string","title":"md5"},"sha1":{"type":"string","title":"sha1"},"sha256":{"type":["string","null"],"title":"sha256"},"sha512":{"type":"string","title":"sha512"},"user":{"type":"string","title":"user"}}}},"total":{"type":"integer","title":"Total"}}}}}}},"tags":["Flight-recorder"],"operationId":"api.rmm.post.flightrecorder.processes"}},"/oneview/v1/accounts/{account_id}/flight-recorder/recap":{"post":{"description":"Search suspicious activity. Wildcards are not supported.","summary":"Search suspicious activity","security":[{"client_credentials":["read"]},{"user_permissions":["edr.view"]}],"status":{"outage":["auth","edr"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Flight Recorder recap request","required":["input_value"],"oneOf":[{"required":["time_range"]},{"required":["time_window"]}],"properties":{"input_value":{"type":"string","title":"Input value"},"advanced_filters":{"type":"array","title":"Advanced flight recorder filters. REQUIRED field","items":{"items":{"type":"object","properties":{"or":{"type":"array","title":"Filter with or","items":{"type":"object","properties":{"eq":{"type":"array","title":"Equal operator","items":[{"type":"string","title":"Field name","enum":["command_line","contacted_domains","contacted_ips","hash.md5","hash.sha1","hash.sha256","hash.sha512","machine_id","pc_hostname","process_id","process_name","process_path","remote_port","user"]},{"type":"string","title":"Value to compare"}]},"neq":{"type":"array","title":"Not Equal operator","items":[{"type":"string","title":"Field name","enum":["command_line","contacted_domains","contacted_ips","hash.md5","hash.sha1","hash.sha256","hash.sha512","machine_id","pc_hostname","process_id","process_name","process_path","remote_port","user"]},{"type":"string","title":"Value to compare"}]},"contains":{"type":"array","title":"Contains operator","items":[{"type":"string","title":"Field name","enum":["command_line","contacted_domains","contacted_ips","hash.md5","hash.sha1","hash.sha256","hash.sha512","machine_id","pc_hostname","process_id","process_name","process_path","remote_port","user"]},{"type":"string","title":"Value to compare"}]},"not_contains":{"type":"array","title":"not_contains operator","items":[{"type":"string","title":"Field name","enum":["command_line","contacted_domains","contacted_ips","hash.md5","hash.sha1","hash.sha256","hash.sha512","machine_id","pc_hostname","process_id","process_name","process_path","remote_port","user"]},{"type":"string","title":"Value to compare"}]},"starts_with":{"type":"array","title":"starts_with operator","items":[{"type":"string","title":"Field name","enum":["command_line","contacted_domains","contacted_ips","hash.md5","hash.sha1","hash.sha256","hash.sha512","machine_id","pc_hostname","process_id","process_name","process_path","remote_port","user"]},{"type":"string","title":"Value to compare"}]},"ends_with":{"type":"array","title":"ends_with operator","items":[{"type":"string","title":"Field name","enum":["command_line","contacted_domains","contacted_ips","hash.md5","hash.sha1","hash.sha256","hash.sha512","machine_id","pc_hostname","process_id","process_name","process_path","remote_port","user"]},{"type":"string","title":"Value to compare"}]}}}},"and":{"type":"array","title":"Filter with and","items":{"type":"object","properties":{"eq":{"type":"array","title":"Equal operator","items":[{"type":"string","title":"Field name","enum":["command_line","contacted_domains","contacted_ips","hash.md5","hash.sha1","hash.sha256","hash.sha512","machine_id","pc_hostname","process_id","process_name","process_path","remote_port","user"]},{"type":"string","title":"Value to compare"}]},"neq":{"type":"array","title":"Not Equal operator","items":[{"type":"string","title":"Field name","enum":["command_line","contacted_domains","contacted_ips","hash.md5","hash.sha1","hash.sha256","hash.sha512","machine_id","pc_hostname","process_id","process_name","process_path","remote_port","user"]},{"type":"string","title":"Value to compare"}]},"contains":{"type":"array","title":"Contains operator","items":[{"type":"string","title":"Field name","enum":["command_line","contacted_domains","contacted_ips","hash.md5","hash.sha1","hash.sha256","hash.sha512","machine_id","pc_hostname","process_id","process_name","process_path","remote_port","user"]},{"type":"string","title":"Value to compare"}]},"not_contains":{"type":"array","title":"not_contains operator","items":[{"type":"string","title":"Field name","enum":["command_line","contacted_domains","contacted_ips","hash.md5","hash.sha1","hash.sha256","hash.sha512","machine_id","pc_hostname","process_id","process_name","process_path","remote_port","user"]},{"type":"string","title":"Value to compare"}]},"starts_with":{"type":"array","title":"starts_with operator","items":[{"type":"string","title":"Field name","enum":["command_line","contacted_domains","contacted_ips","hash.md5","hash.sha1","hash.sha256","hash.sha512","machine_id","pc_hostname","process_id","process_name","process_path","remote_port","user"]},{"type":"string","title":"Value to compare"}]},"ends_with":{"type":"array","title":"ends_with operator","items":[{"type":"string","title":"Field name","enum":["command_line","contacted_domains","contacted_ips","hash.md5","hash.sha1","hash.sha256","hash.sha512","pc_hostname","process_id","process_name","process_path","remote_port","user"]},{"type":"string","title":"Value to compare"}]}}}}}}}},"time_range":{"type":"string","title":"Time range","enum":["7d","3d","24h","12h","6h","3h","1h","30m"]},"time_window":{"type":"object","title":"Time window","properties":{"gte":{"type":"string","title":"Time window greater than or equal to date","format":"date-time"},"lte":{"type":"string","title":"Time window lower than or equal to date","format":"date-time"}}}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Flight Recorder recap result","properties":{"endpoints":{"type":"integer","title":"The endpoints schema"},"last_seen":{"type":"object","title":"Seen latest","properties":{"timestamp":{"type":"string","title":"Timestamp","examples":["2020-06-01T09:52:10.579Z"]},"machine_id":{"type":"string","title":"Endpoint ID","examples":["aff7bb09-4515-4043-a40c-16f2f5a7b9b4"]},"pc_hostname":{"type":"string","title":"Hostname of PC"}}},"first_seen":{"type":"object","title":"Seen earliest","properties":{"timestamp":{"type":"string","title":"Timestamp","examples":["2020-06-01T09:52:10.579Z"]},"machine_id":{"type":"string","title":"Machine ID","examples":["aff7bb09-4515-4043-a40c-16f2f5a7b9b4"]},"pc_hostname":{"type":"string","title":"Hostname of PC"}}}}}}}}},"tags":["Flight-recorder"],"operationId":"api.rmm.post.flightrecorder.recap"}},"/oneview/v1/accounts/{account_id}/flight-recorder/search":{"post":{"description":"Search the flight recorder with advanced queries.","summary":"Search the flight recorder with advanced queries","security":[{"client_credentials":["read"]},{"user_permissions":["edr.view"]}],"status":{"outage":["auth","edr"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Flight Recorder search request","required":["advanced_filters"],"examples":[{"time_range":"7d","advanced_filters":[{"or":[{"and":[{"eq":["process_name","explorer.exe"]},{"eq":["pc_hostname","Bob-Pc"]}]},{"and":[{"eq":["pc_hostname","Alice-PC"]},{"eq":["process_name","explorer.exe"]}]}]}]}],"oneOf":[{"required":["time_range"]},{"required":["time_window"]}],"properties":{"time_range":{"type":"string","title":"Time range","enum":["7d","3d","24h","12h","6h","3h","1h","30m"]},"time_window":{"type":"object","title":"Time window","properties":{"gte":{"type":"string","title":"Time window greater than or equal to date","format":"date-time"},"lte":{"type":"string","title":"Time window lower than or equal to date","format":"date-time"}}},"pc_hostname":{"type":"string","title":"Hostname filter"},"event_category":{"type":"string","title":"Event category filter","enum":["network","filesystem","proccess","registry","script activity"]},"advanced_filters":{"type":"array","title":"Advanced flight recorder filters","items":{"items":{"type":"object","properties":{"or":{"type":"array","title":"Filter with or","items":{"type":"object","properties":{"eq":{"type":"array","title":"Equal operator","items":[{"type":"string","title":"Field name","enum":["command_line","contacted_domains","contacted_ips","hash.md5","hash.sha1","hash.sha256","hash.sha512","machine_id","pc_hostname","process_id","process_name","process_path","remote_port","user"]},{"type":"string","title":"Value to compare"}]},"neq":{"type":"array","title":"Not Equal operator","items":[{"type":"string","title":"Field name","enum":["command_line","contacted_domains","contacted_ips","hash.md5","hash.sha1","hash.sha256","hash.sha512","machine_id","pc_hostname","process_id","process_name","process_path","remote_port","user"]},{"type":"string","title":"Value to compare"}]},"contains":{"type":"array","title":"Contains operator","items":[{"type":"string","title":"Field name","enum":["command_line","contacted_domains","contacted_ips","hash.md5","hash.sha1","hash.sha256","hash.sha512","machine_id","pc_hostname","process_id","process_name","process_path","remote_port","user"]},{"type":"string","title":"Value to compare"}]},"not_contains":{"type":"array","title":"not_contains operator","items":[{"type":"string","title":"Field name","enum":["command_line","contacted_domains","contacted_ips","hash.md5","hash.sha1","hash.sha256","hash.sha512","machine_id","pc_hostname","process_id","process_name","process_path","remote_port","user"]},{"type":"string","title":"Value to compare"}]},"starts_with":{"type":"array","title":"starts_with operator","items":[{"type":"string","title":"Field name","enum":["command_line","contacted_domains","contacted_ips","hash.md5","hash.sha1","hash.sha256","hash.sha512","machine_id","pc_hostname","process_id","process_name","process_path","remote_port","user"]},{"type":"string","title":"Value to compare"}]},"ends_with":{"type":"array","title":"ends_with operator","items":[{"type":"string","title":"Field name","enum":["command_line","contacted_domains","contacted_ips","hash.md5","hash.sha1","hash.sha256","hash.sha512","machine_id","pc_hostname","process_id","process_name","process_path","remote_port","user"]},{"type":"string","title":"Value to compare"}]}}}},"and":{"type":"array","title":"Filter with and","items":{"type":"object","properties":{"eq":{"type":"array","title":"Equal operator","items":[{"type":"string","title":"Field name","enum":["command_line","contacted_domains","contacted_ips","hash.md5","hash.sha1","hash.sha256","hash.sha512","machine_id","pc_hostname","process_id","process_name","process_path","remote_port","user"]},{"type":"string","title":"Value to compare"}]},"neq":{"type":"array","title":"Not Equal operator","items":[{"type":"string","title":"Field name","enum":["command_line","contacted_domains","contacted_ips","hash.md5","hash.sha1","hash.sha256","hash.sha512","machine_id","pc_hostname","process_id","process_name","process_path","remote_port","user"]},{"type":"string","title":"Value to compare"}]},"contains":{"type":"array","title":"Contains operator","items":[{"type":"string","title":"Field name","enum":["command_line","contacted_domains","contacted_ips","hash.md5","hash.sha1","hash.sha256","hash.sha512","machine_id","pc_hostname","process_id","process_name","process_path","remote_port","user"]},{"type":"string","title":"Value to compare"}]},"not_contains":{"type":"array","title":"not_contains operator","items":[{"type":"string","title":"Field name","enum":["command_line","contacted_domains","contacted_ips","hash.md5","hash.sha1","hash.sha256","hash.sha512","machine_id","pc_hostname","process_id","process_name","process_path","remote_port","user"]},{"type":"string","title":"Value to compare"}]},"starts_with":{"type":"array","title":"starts_with operator","items":[{"type":"string","title":"Field name","enum":["command_line","contacted_domains","contacted_ips","hash.md5","hash.sha1","hash.sha256","hash.sha512","machine_id","pc_hostname","process_id","process_name","process_path","remote_port","user"]},{"type":"string","title":"Value to compare"}]},"ends_with":{"type":"array","title":"ends_with operator","items":[{"type":"string","title":"Field name","enum":["command_line","contacted_domains","contacted_ips","hash.md5","hash.sha1","hash.sha256","hash.sha512","pc_hostname","process_id","process_name","process_path","remote_port","user"]},{"type":"string","title":"Value to compare"}]}}}}}}}}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Flight Recorder processes result","properties":{"results":{"type":"array","title":"Results","items":{"type":"object","title":"Result items","properties":{"event_categories":{"type":"object","title":"Event categories","properties":{"network":{"type":"integer","title":"Network"},"process":{"type":"integer","title":"Process"},"registry":{"type":"integer","title":"Registry"},"script_activity":{"type":"integer","title":"Script Activity"},"system_event":{"type":"integer","title":"System Event"},"other":{"type":"integer","title":"Other"}}},"first_activity":{"type":"string","title":"Seen earliest","examples":["2020-06-01T09:52:10.579Z"]},"last_activity":{"type":"string","title":"Seen latest","examples":["2020-06-01T09:52:10.579Z"]},"machine_id":{"type":"string","title":"Machine Id"},"pid":{"type":"string","title":"Process Id"},"pid_version":{"type":"string","title":"Process Id version"},"process_path":{"type":"string","title":"Process path"},"md5":{"type":"string","title":"md5"},"sha1":{"type":"string","title":"sha1"},"sha256":{"type":["string","null"],"title":"sha256"},"sha512":{"type":"string","title":"sha512"},"user":{"type":"string","title":"user"}}}},"total":{"type":"integer","title":"Total"}}}}}}},"tags":["Flight-recorder"],"operationId":"api.rmm.post.flightrecorder.search"}},"/oneview/v1/accounts/{account_id}/flight-recorder/process_graph":{"post":{"description":"Search the process graph.","summary":"Search the process graph","security":[{"client_credentials":["read"]},{"user_permissions":["edr.view"]}],"status":{"outage":["auth","edr"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Flight Recorder process_graph request","required":["pid","path","machine_id"],"properties":{"time_range":{"type":"string","title":"Time range","enum":["7d","3d","24h","12h","6h","3h","1h","30m"],"default":"7d"},"time_window":{"type":"object","title":"Time window","properties":{"gte":{"type":"string","title":"Time window greater than or equal to date"},"lte":{"type":"string","title":"Time window lower than or equal to date"}}},"account_id":{"type":"string","title":"Account Id"},"machine_id":{"type":"string","title":"Machine id"},"pid":{"type":"string","title":"Process Id"},"path":{"type":"string","title":"Process path"},"pid_version":{"type":"string","title":"Process Id version filter","default":0},"os_type":{"type":"string","title":"Os Type filter","default":"Windows"}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Flight Recorder process_graph result","properties":{"id":{"type":"string","title":"Id"},"name":{"type":"string","title":"Name"},"node_type":{"type":"string","title":"Node type"},"children":{"type":"array","title":"The Children nodes","items":{"type":"object","title":"The Children node, recursive structure","properties":{"id":{"type":"string","title":"id"},"name":{"type":"string","title":"Name"},"edge_info":{"type":"object","description":"Edge Info","properties":{"command_line":{"type":"string","title":"Command line"},"timestamp":{"type":"string","format":"date-time","title":"Timestamp"},"relation":{"type":"string","title":"Relation"}}},"node_type":{"type":"string","title":"Node type"},"node_info":{"type":"object","title":"Node info","properties":{"activities":{"type":"array","title":"Activities"},"process_id":{"type":"string","title":"Process Id"},"dropped":{"type":"boolean","title":"Dropped"},"process_path":{"type":"string","title":"Process Path"},"main_node":{"type":"boolean","title":"Main Node"}}}}}},"node_info":{"type":"object","title":"Node metadata","additionalProperties":true},"edge_info":{"type":"object","title":"Edge node info","additionalProperties":true}}}}}}},"tags":["Flight-recorder"],"operationId":"api.rmm.post.flightrecorder.process_graph"}},"/oneview/v1/accounts/{account_id}/flight-recorder/raw_events":{"post":{"description":"Retrieve a list of raw events matching the given filters for the specified endpoint.","summary":"Search a list of raw events","security":[{"client_credentials":["read"]},{"user_permissions":["edr.view"]}],"status":{"outage":["auth","edr"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Flight Recorder raw_events request","required":["machine_id","pid","pid_version","path","event_type","first_activity","last_activity"],"properties":{"machine_id":{"type":"string","title":"Machine id"},"pid":{"type":"string","title":"Process Id filter"},"pid_version":{"type":"string","title":"Process Id version filter"},"path":{"type":"string","title":"Process Path"},"event_type":{"type":"string","enum":["ANTIMALWARE_SCAN","FILE_DELETE","FILE_READ","FILE_RENAME","FILE_SET_INFORMATION","FILE_WRITE","NET_CONNECT_INBOUND","NET_CONNECT_INBOUND_PRIVATE","NET_CONNECT_OUTBOUND","NET_CONNECT_OUTBOUND_PRIVATE","REG_QUERY_VALUE","REG_SET_VALUE","SYSTEM_CALL","SYSTEM_EVENT","WIN_LOG"],"title":"Raw event's type filter"},"first_activity":{"type":"string","title":"Initial date","format":"date-time"},"last_activity":{"type":"string","title":"Last date","format":"date-time"},"page":{"type":"integer","minimum":1,"title":"Page number"},"page_size":{"type":"integer","minimum":1,"title":"Page size"}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Flight Recorder raw_events result","properties":{"results":{"type":"array","title":"Results","items":{"type":"object","properties":{"account_id":{"type":"string","title":"Account Id"},"amsi_data":{"type":"string","title":"Amsi data"},"amsi_data_type":{"type":"string","title":"Amsi data type"},"command_line":{"type":"string","title":"Command line"},"create_options":{"type":"string","title":"Create Options"},"etw_data":{"type":"string","title":"Etw data"},"event_category":{"type":"string","title":"Event Category"},"event_type":{"type":"string","title":"Event type"},"evt_log_data":{"type":"string","title":"Event log data"},"hostname":{"type":"string","title":"Hostname"},"machine_id":{"type":"string","title":"Machine id"},"ipv4_local_ip":{"type":"string","title":"IPv4 local IP"},"ipv4_remote_country_code":{"type":"string","title":"IPv4 remote country code"},"ipv4_remote_ip":{"type":"string","title":"IPv4 remote IP"},"ipv6_local_ip":{"type":"string","title":"IPv6 local IP"},"ipv6_remote_country_code":{"type":"string","title":"IPv6 remote country code"},"ipv6_remote_ip":{"type":"string","title":"IPv6 remote IP"},"local_port":{"type":"string","title":"Local port"},"new_name":{"type":"string","title":"New name"},"new_path":{"type":"string","title":"New path"},"new_process_id":{"type":"string","title":"New process id"},"object_name":{"type":"string","title":"Object name"},"object_path":{"type":"string","title":"Object path"},"process_name":{"type":"string","title":"Process name"},"protocol":{"type":"string","title":"Protocol"},"registry_data":{"type":"string","title":"Registry data"},"registry_data_type":{"type":"string","title":"Registry data type"},"registry_key":{"type":"string","title":"Registry key"},"registry_value":{"type":"string","title":"Registry value"},"remote_port":{"type":"string","title":"Remote port"},"sha256":{"type":"string","title":"SHA256"},"stream_id":{"type":"string","title":"Stream id"},"winlog_event_id":{"type":"string","title":"Winlog event id"},"timestamp":{"type":"string","title":"Timestamp"}}}},"total":{"type":"integer","title":"Total"}}}}}}},"tags":["Flight-recorder"],"operationId":"api.rmm.post.flightrecorder.raw_events"}},"/oneview/v1/accounts/{account_id}/sa":{"get":{"description":"Fetch suspicious activity records of the account.","summary":"Suspicious activity of the account","security":[{"client_credentials":["read"]},{"user_permissions":["edr.view"]}],"status":{"outage":["auth","edr"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}},{"name":"sort_field","required":false,"in":"query","description":"Sort field","schema":{"type":"string","enum":["timestamp","level","pc_hostname"]}},{"name":"sort_direction","required":false,"in":"query","description":"Sort direction","schema":{"type":"string","enum":["asc","desc"]}},{"name":"next_cursor","required":false,"in":"query","description":"The pagination cursor for next set of results. For further documentation, check Pagination section.","schema":{"type":"string"}},{"name":"since","required":false,"in":"query","description":"Since (Ex. \"2020-03-23T17:23:17.860482Z\")","schema":{"type":"string","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$"}},{"name":"before","required":false,"in":"query","description":"Before (Ex. \"2020-03-23T17:23:17.860482Z\")","schema":{"type":"string","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$"}},{"name":"group_ids","required":false,"in":"query","description":"Group ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":["string","array"],"pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"per_page","required":false,"in":"query","description":"Page size","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Suspicious activity response","required":["sa","total_count"],"properties":{"sa":{"type":"array","title":"Suspicious activity","items":{"type":"object","title":"Suspicious activity items","additionalProperties":true,"properties":{"detection_id_list":{"type":"array","title":"List of detections IDs","items":{"type":"number"}},"status":{"type":"string","title":"Status"},"timestamp":{"type":"string","title":"Timestamp"},"path":{"type":"string","title":"Path"},"pc_hostname":{"type":"string","title":"Hostname of PC"},"machine_id":{"type":"string","title":"placeholder"},"account_id":{"type":"string","title":"Account ID"},"closed":{"type":"integer","title":"Closed"},"level":{"type":"integer","title":"Level"},"detected_by_count":{"type":"integer","title":"Count"}}}},"total_count":{"type":"integer","title":"Total count"},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}}}}},"tags":["Suspicious Activity"],"operationId":"api.rmm.get.suspiciousactivity"}},"/oneview/v1/accounts/{account_id}/sa/{id}/process_graph":{"get":{"description":"Fetch process graph of suspicious activity.","summary":"Suspicious activity process graph","security":[{"client_credentials":["read"]},{"user_permissions":["edr.view"]}],"status":{"outage":["auth","edr"]},"parameters":[{"name":"account_id","required":true,"in":"path","description":"Valid Account UUID","schema":{"type":"string"}},{"name":"id","required":true,"in":"path","description":"ID of suspicious activity","schema":{"type":"string"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Process graph of suspicious activity","additionalProperties":true,"properties":{"data":{"type":"object","title":"Data","additionalProperties":true,"properties":{"node_type":{"type":"string","title":"Node type"},"children":{"type":"array","title":"Children of this node","default":[],"additionalItems":true,"items":{"type":"object","title":"Items of childres","additionalProperties":true,"properties":{"id":{"type":"string","title":"ID"},"name":{"type":"string","title":"Name","examples":["EXPLORER.EXE"]},"node_type":{"type":"string","title":"Node type","examples":["Process"]},"children":{"type":"array","title":"Children of this node. Follows the same structure as current node.","additionalItems":true,"items":{"type":"object","title":"Children items","additionalProperties":true}},"node_info":{"type":"object","title":"Node info","additionalProperties":true,"properties":{"activities":{"type":"array","title":"Activities","default":[],"items":{"type":"object","title":"Activities items","additionalProperties":true},"additionalItems":true},"process_id":{"type":"integer","title":"Process id - PID","examples":[5696]},"dropped":{"type":"boolean","title":"Dropped"},"process_path":{"type":"string","title":"Process path","examples":["C:\\WINDOWS\\EXPLORER.EXE"]}}}}}},"name":{"type":"string","title":"Name","examples":["START"]},"id":{"type":"string","title":"ID","examples":["-"]}}}}}}}}},"tags":["Suspicious Activity"],"operationId":"api.rmm.get.suspiciousactivity.process_graph"}},"/oneview/v1/accounts/{account_id}/sa/close":{"post":{"description":"Placeholder. Please extend this","summary":"Placeholder. Please extend this","deprecated":false,"security":[{"client_credentials":["read"]},{"user_permissions":["edr.manage"]}],"status":{"outage":["auth","edr"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Payload to open/close a suspicious activity","properties":{"account_id":{"type":"string","title":"Account ID of the Site on which execute command (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"detection_id_list":{"type":"array","title":"Array of integers indicating the detections on which execute remediation","items":{"type":"integer"}},"machine_id":{"type":"string","title":"ID of the machine on which execute command (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"user_email":{"type":"string","title":"Email of user executing command"},"user_id":{"type":"string","title":"ID of user executing command"},"username":{"type":"string","title":"Email of who's executing command"}},"required":["account_id","detection_id_list","machine_id","user_email","user_id","username"]}}}},"responses":{"200":{"description":"Successful response"}},"tags":["Suspicious Activity"],"operationId":"api.rmm.post.sa.close"}},"/oneview/v1/accounts/{account_id}/sa/details":{"post":{"description":"Fetch details of suspicious activity.","summary":"Suspicious activity details","security":[{"client_credentials":["read"]},{"user_permissions":["edr.view"]}],"status":{"outage":["auth","edr"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}},{"name":"next_cursor","required":false,"in":"query","description":"The pagination cursor for next set of results. For further documentation, check Pagination section.","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Suspicious activity request payload","required":["detection_id_list","endpoint"],"properties":{"detection_id_list":{"type":"array","title":"List of Suspicious Activity IDs","items":{"type":"integer","title":"Suspicious Activity IDs","examples":[274304,7874825]}},"endpoint":{"type":"string","title":"UUID of the endpoint","examples":["3fdbe4c1-8a80-4a57-8369-9ec4399fbf0b"]}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Details of suspicious activities","additionalProperties":true,"properties":{"data":{"type":"object","title":"The Details Schema","additionalProperties":true,"properties":{"resolved":{"type":["null","string","number"],"title":"The Resolved Schema"},"pc_hostname":{"type":"string","title":"Hostname of PC"},"status":{"type":"string","title":"Status"},"tot":{"type":"integer","title":"Count of suspicious activities"},"list":{"type":"array","title":"List of suspicious activities","additionalItems":true,"items":{"type":"object","title":"List items","additionalProperties":true,"properties":{"status":{"type":"string","title":"Status","examples":["detected"]},"timestamp":{"type":"string","title":"Timestamp"},"path":{"type":"string","title":"Path","examples":["C:\\WINDOWS\\SYSTEM32\\CMD.EXE"]},"detection_id":{"type":"integer","title":"Id of the suspicious activity"},"details":{"type":"array","title":"Collection of details about suspicious activity","additionalItems":true,"items":{"type":"object","title":"Detail items","additionalProperties":true,"properties":{"timestamp":{"type":"string","title":"Timestamp","examples":["2020-03-25 14:56:12"]},"path":{"type":"string","title":"Path","examples":["C:\\WINDOWS\\SYSTEM32\\WINDOWSPOWERSHELL\\V1.0\\POWERSHELL.EXE"]},"detected_by":{"type":"array","title":"Detected by collection","additionalItems":true,"items":{"type":"object","title":"Detected by items","additionalProperties":true,"properties":{"description":{"type":"string","title":"Description","examples":["A suspicious script has been executed by Powershell"]},"verbose":{"type":"string","title":"Verbose Description","examples":["A suspicious script has been executed by Powershell"]},"tag":{"type":"string","title":"Tag","examples":["powershell scripting activity"]},"content":{"type":"array","title":"The Content Schema","default":[],"examples":[[{"launched_proc":"POWERSHELL.EXE","hash":{"Sha256":"908b64b1971a979c7e3e8ce4621945cba84854cb98d76367b791a6e22b5f6d53","Sha1":"36c5d12033b2eaf251bae61c00690ffb17fddc87","Md5":"cda48fc75952ad12d99e526d0b6bf70a","Sha512":"31946a5c80088646fe951081e88a7478b804da874236a44e845842404c9770450c9b1ac3bb1af2b00b0102fe4983b5728fe4df8c40d28f9bef16230a28ae5df0"},"command_line":"\"C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -ExecutionPolicy Bypass -windowstyle hidden -File \"C:\\Program Files\\EAWindowsTool\\EAWindowsTool.ps1 "}]],"additionalItems":true,"items":{"type":"object","title":"The Items Schema","additionalProperties":true,"properties":{"command_line":{"type":"string","title":"Command line","examples":["\"C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -ExecutionPolicy Bypass -windowstyle hidden -File \"C:\\Program Files\\EAWindowsTool\\EAWindowsTool.ps1 "]},"hash":{"type":"object","title":"Hashes","additionalProperties":true,"properties":{"Md5":{"type":"string","title":"Md5"},"Sha1":{"type":"string","title":"Sha1","examples":["36c5d12033b2eaf251bae61c00690ffb17fddc87"]},"Sha256":{"type":"string","title":"Sha256","examples":["908b64b1971a979c7e3e8ce4621945cba84854cb98d76367b791a6e22b5f6d53"]},"Sha512":{"type":"string","title":"Sha512","examples":["31946a5c80088646fe951081e88a7478b804da874236a44e845842404c9770450c9b1ac3bb1af2b00b0102fe4983b5728fe4df8c40d28f9bef16230a28ae5df0"]}}},"launched_proc":{"type":"string","title":"Launched process","examples":["POWERSHELL.EXE"]}}}},"level":{"type":"integer","title":"Level"}}}},"pid":{"type":"integer","title":"Process ID"}}}},"pid":{"type":"integer","title":"Process ID"}}}}}},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}}}}},"tags":["Suspicious Activity"],"operationId":"api.rmm.get.suspiciousactivity.details"}},"/oneview/v1/accounts/{account_id}/sa/open":{"post":{"description":"Placeholder. Please extend this","summary":"Placeholder. Please extend this","deprecated":false,"security":[{"client_credentials":["read"]},{"user_permissions":["edr.manage"]}],"status":{"outage":["auth","edr"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Payload to open/close a suspicious activity","properties":{"account_id":{"type":"string","title":"Account ID of the Site on which execute command (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"detection_id_list":{"type":"array","title":"Array of integers indicating the detections on which execute remediation","items":{"type":"integer"}},"machine_id":{"type":"string","title":"ID of the machine on which execute command (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"user_email":{"type":"string","title":"Email of user executing command"},"user_id":{"type":"string","title":"ID of user executing command"},"username":{"type":"string","title":"Email of who's executing command"}},"required":["account_id","detection_id_list","machine_id","user_email","user_id","username"]}}}},"responses":{"200":{"description":"Successful response"}},"tags":["Suspicious Activity"],"operationId":"api.rmm.post.sa.open"}},"/oneview/v1/accounts/{account_id}/sa/remediate":{"post":{"description":"Placeholder. Please extend this","summary":"Placeholder. Please extend this","deprecated":false,"security":[{"client_credentials":["read"]},{"user_permissions":["edr.manage"]}],"status":{"outage":["auth","edr"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Remediate suspicious activity on endpoint","properties":{"correlation_id":{"type":"string","title":"ID of the correlation for task creation (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"detection_id_list":{"type":"array","title":"Array of integers indicating the detections on which execute remediation","items":{"type":"integer"}},"machine_id":{"type":"string","title":"ID of the machine on which execute command (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}},"required":["correlation_id","detection_id_list","machine_id"]}}}},"responses":{"201":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"The eagle remediate schema","properties":{"job_id":{"type":["string","null"],"title":"ID of the remediation job (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"correlation_id":{"type":"string","title":"Correlation ID of the job (Parent job ID). Could be used to find related child jobs.","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}}}},"tags":["Suspicious Activity"],"operationId":"api.rmm.post.sa.remediate"}},"/oneview/v1/notifications/subscriptions/change-owner":{"put":{"description":"Change notification owner.","summary":"Change notification owner","security":[{"client_credentials":["write"]},{"user_permissions":["notifications.editOthers"]}],"status":{"outage":["auth","webhooks_subscriptions"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"change notification owner request","allOf":[{"type":"object","title":"change notification owner request","required":["subscriptions","owner"],"properties":{"subscriptions":{"type":"array","minLength":1,"items":{"type":"string","title":"notification ID","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},"owner":{"title":"the new owner of the subscription","type":"string"}}},{"required":["parent_account_id"],"properties":{"parent_account_id":{"title":"the subscriptions' account_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}}]}}}},"responses":{"202":{"description":"response schema","content":{"application/json":{}}}},"tags":["Notifications"],"operationId":"api.v2.rmm.change-owner.notification"}},"/oneview/v1/notifications/subscriptions":{"post":{"description":"Create notification subscription.","summary":"Create notification","security":[{"client_credentials":["write"]},{"user_permissions":["notifications.createOwn"]}],"status":{"outage":["auth","webhooks_subscriptions"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"The Schema For Notifications Creation","properties":{"parent_account_id":{"type":"string","title":"Nebula Parent Account id (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\").","description":"If this is specified, all the events from the child account_ids will be included. In that case, account_ids is not required","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}},"anyOf":[{"required":["account_ids"]},{"required":["parent_account_id"]}],"allOf":[{"type":"object","title":"The Schema For Notifications Creation","anyOf":[{"allOf":[{"type":"object","title":"The create notification Body","required":["name","category","delivery"],"properties":{"name":{"title":"Notification name. Must be unique","type":"string"},"description":{"title":"Notification description","type":"string","default":""},"category":{"title":"The category of the events to be notified","type":"string"},"delivery":{},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object"},"aggregation":{"title":"Aggregate multiple events in a single notifications","type":"object","properties":{"interval":{"title":"Interval in seconds for aggregating events in a single notification. It must be defined to apply aggregation","type":"integer","minimum":10,"maximum":86400}}},"enabled":{"title":"enable/disable notification","type":"boolean","default":true},"owner":{"title":"the identifier of the owner of the subscription. Not available for read-only users","type":"string"}},"anyOf":[{"title":"Detections","properties":{"category":{"enum":["threat_detections"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Detections output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","os_release_name","os_platform","os_type","os_version","category","type","path","status","scanned_at","reported_at","resource_created_at","resource_modified_at","threat_name","affected_application","process_name","machine_id","machine_name","machine_ip","group_id","group_name","policy_id","policy_name","nics","md5","sha256","engine_version","last_user","active_directory_ou","id"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Detections output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","os_release_name","os_platform","os_type","os_version","category","type","path","status","scanned_at","reported_at","resource_created_at","resource_modified_at","threat_name","affected_application","process_name","machine_id","machine_name","machine_ip","group_id","group_name","policy_id","policy_name","nics","md5","sha256","engine_version","last_user","active_directory_ou","id"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","affected_application","category","group_id","group_name","machine_id","machine_ip","machine_name","os_platform","os_release_name","path","policy_id","policy_name","process_name","status","threat_name","type"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"category\". 1: \"MALWARE\",\"PUP\",\"PUM\",\"AE\",\"ARW\",\"MWAC\",\"RID\",\"VULNERABLE_DRIVER\"","items":[{"const":"category"}],"additionalItems":{"title":"Filter events by detection category","type":"string","enum":["MALWARE","PUP","PUM","AE","ARW","MWAC","RID","VULNERABLE_DRIVER"]}},{"title":"0: \"action\". 1: \"blocked\", \"deleted\", \"deletedAutoPrune\", \"found\", \"quarantined\", \"restored\"","items":[{"const":"action"}],"additionalItems":{"title":"Filter events by action","type":"string","enum":["blocked","deleted","deletedAutoPrune","found","quarantined","restored"]}},{"title":"0: \"threat_name\". 1: string","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux), \"4\"(Android), \"3\"(IOS), \"3\"(ChromeOS)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3,4,5,6]}},{"title":"0: \"rtp\". 1: true, false","items":[{"const":"rtp"},{"title":"Filter events by real time protection"}],"additionalItems":false,"if":{"items":[{"const":"rtp"}]},"then":{"items":[{"const":"rtp"},{"type":"boolean"}]}},{"title":"0: \"type\". 1: \"application\", \"exploit\", \"extension\", \"file\", \"folder\", \"InboundConnection\", \"module\", \"OutboundConnection\", \"process\", \"reg_key\", \"reg_value\"","items":[{"const":"type"}],"additionalItems":{"title":"Filter events by type","type":"string","enum":["application","exploit","extension","file","folder","InboundConnection","module","OutboundConnection","process","reg_key","reg_value"]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"threat_name\". 1: string","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","anyOf":[{"title":"0: \"threat_name\". 1: string","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_contains":{"type":"array","anyOf":[{"title":"0: \"threat_name\". 1: string","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"begins_with":{"title":"0: \"threat_name\". 1: string","type":"array","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Suspicious activity","properties":{"category":{"enum":["threat_suspicious_activity"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Suspicious activity","type":"array","minItems":1,"items":{"type":"string","enum":["severity","account_id","account_name","os_release_name","os_platform","type","path","status","scanned_at","reported_at","threat_name","machine_id","machine_name","machine_ip","group_id","group_name","policy_id","policy_name","nics","last_user","first_activity","last_activity","isolation_type","id"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Suspicious activity","type":"array","minItems":1,"items":{"type":"string","enum":["severity","account_id","account_name","os_release_name","os_platform","type","path","status","scanned_at","reported_at","threat_name","machine_id","machine_name","machine_ip","group_id","group_name","policy_id","policy_name","nics","last_user","first_activity","last_activity","isolation_type","id"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","group_id","group_name","machine_id","machine_ip","machine_name","os_platform","os_release_name","path","policy_id","policy_name","severity","status","threat_name"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"level\". 1: \"low\", \"medium\", \"high\", \"critical\"","items":[{"const":"level"}],"additionalItems":{"title":"Filter events by severity level","type":"string","enum":["low","medium","high","critical"]}},{"title":"0: \"threat_name\". 1: string","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux), \"4\"(Android), \"3\"(IOS), \"3\"(ChromeOS)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3,4,5,6]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"threat_name\". 1: string","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"contains":{"title":"0: \"threat_name\". 1: string","type":"array","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},"not_contains":{"title":"0: \"threat_name\". 1: string","type":"array","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},"begins_with":{"title":"0: \"threat_name\". 1: string","type":"array","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},"exists":{"type":"string","anyOf":[{"title":"Filter events by isolation_type exists","const":"isolation_type"}]},"not_exists":{"anyOf":[{"title":"Filter events by isolation_type not exists","const":"isolation_type"}]},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"User added","properties":{"category":{"enum":["user_added"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"User added","type":"array","minItems":1,"items":{"type":"string","enum":["ip_address","invited_by","role","email","full_group_access","timestamp","account_id"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"User added","type":"array","minItems":1,"items":{"type":"string","enum":["ip_address","invited_by","role","email","full_group_access","timestamp","account_id"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","invited_by","ip_address","role"]}}}}}},{"title":"User deleted","properties":{"category":{"enum":["user_deleted"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"User deleted output fields","type":"array","minItems":1,"items":{"type":"string","enum":["ip_address","timestamp","account_id","deleted_by","email"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"User deleted output fields","type":"array","minItems":1,"items":{"type":"string","enum":["ip_address","timestamp","account_id","deleted_by","email"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","ip_address","deleted_by"]}}}}}},{"title":"User verified","properties":{"category":{"enum":["user_verified"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"User verified","type":"array","minItems":1,"items":{"type":"string","enum":["email","timestamp","account_id"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"User verified","type":"array","minItems":1,"items":{"type":"string","enum":["email","timestamp","account_id"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name"]}}}}}},{"title":"Endpoint registered","properties":{"category":{"enum":["endpoint_registered"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Endpoint registered output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","created_at"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Endpoint registered output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","created_at"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Endpoint deleted","properties":{"category":{"enum":["endpoint_unregistered"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Endpoint deleted output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","timestamp","timeout"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Endpoint deleted output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","timestamp","timeout"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"timeout\". 1: true, false","items":[{"const":"timeout"},{"title":"Filter events by timeout (true if the machine was deleted because marked_for_deletion and never connected again until a timeout)"}],"additionalItems":false,"if":{"items":[{"const":"timeout"}]},"then":{"items":[{"const":"timeout"},{"type":"boolean"}]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Command update","properties":{"category":{"enum":["endpoint_command_update"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Command update output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","command","status","created_at","updated_at","expires_at","machine_id","machine_name","group_id","active_directory_ou"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Command update output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","command","status","created_at","updated_at","expires_at","machine_id","machine_name","group_id","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","command","status","machine_id","machine_name"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"status\". 1: \"CREATED\",\"SENT\",\"RECEIVED\",\"STARTED\",\"TIMED_OUT\",\"COMPLETED\",\"EXPIRED\",\"FAILED\",\"CANCELLED\"","items":[{"const":"status"}],"additionalItems":{"title":"Filter the type of the machine_events to be notified","type":"string","enum":["CREATED","SENT","RECEIVED","STARTED","TIMED_OUT","COMPLETED","EXPIRED","FAILED","CANCELLED"]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Quarantine","properties":{"category":{"enum":["quarantine"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Quarantine output fields","type":"array","minItems":1,"items":{"type":"string","enum":["path","machine_name","created_at","status"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Quarantine output fields","type":"array","minItems":1,"items":{"type":"string","enum":["path","machine_name","created_at","status"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","status"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","title":"0: \"quarantine_action\". 1: \"QUARANTINE_DELETED\",\"QUARANTINE_RESTORED\"","items":[{"const":"quarantine_action"}],"additionalItems":{"title":"Filter the type of the quarantine_events to be notified","type":"string","enum":["QUARANTINE_DELETED","QUARANTINE_RESTORED"]}},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Threat scan","properties":{"category":{"enum":["threat_scan"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Threat scan output_fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","scan_date","scan_id","machine_id","machine_name","group_id","group_name","policy_id","policy_name","ip_address","detections","active_directory_ou"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Threat scan output_fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","scan_date","scan_id","machine_id","machine_name","group_id","group_name","policy_id","policy_name","ip_address","detections","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","ip_address","policy_id","policy_name"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"action\". 1: \"THREAT_CLEANED\",\"THREAT_FOUND\"","items":[{"const":"action"}],"additionalItems":{"title":"Filter events by threat activity action","type":"string","enum":["THREAT_CLEANED","THREAT_FOUND"]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Device control","properties":{"category":{"enum":["device_control"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Device control output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version","path","date","action","device_name","manufacturer","volume_serial","serial_number","physical_disk_name","disk_interface","file_system","volume_name","volume_device_path","last_user","active_directory_ou"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Device control output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version","path","date","action","device_name","manufacturer","volume_serial","serial_number","physical_disk_name","disk_interface","file_system","volume_name","volume_device_path","last_user","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","group_id","group_name","machine_id","machine_name","os_platform","os_release_name","policy_id","policy_name"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"action\". 1: \"blocked\", \"read-only\"","items":[{"const":"action"}],"additionalItems":{"title":"Filter events by action","type":"string","enum":["blocked","read-only"]}},{"title":"0: \"device_name\". 1: string","items":[{"const":"device_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"manufacturer\". 1: string","items":[{"const":"manufacturer"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"device_name\". 1: string","items":[{"const":"device_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"manufacturer\". 1: string","items":[{"const":"manufacturer"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","anyOf":[{"title":"0: \"device_name\". 1: string","items":[{"const":"device_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"manufacturer\". 1: string","items":[{"const":"manufacturer"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_contains":{"type":"array","anyOf":[{"title":"0: \"device_name\". 1: string","items":[{"const":"device_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"manufacturer\". 1: string","items":[{"const":"manufacturer"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Site end date","properties":{"category":{"enum":["license_expiring"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Site end date output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status","licensed_seats","used_seats","license_key","catalog_code","combo_product","licensed_product","license_expires_at","days_left"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Site end date output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status","licensed_seats","used_seats","license_key","catalog_code","combo_product","licensed_product","license_expires_at","days_left"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"days_left\". 1: 0,1,3,5,7,14,30","items":[{"const":"days_left"}],"additionalItems":{"title":"Filter events by days left before the license expiration","type":"number","enum":[0,1,3,5,7,14,30]}},{"title":"0: \"license_term_type\". 1: \"cloud_evaluation\",\"evaluation\",\"freemium\",\"nfr\",\"site_license\",\"subscription\",\"utility\"","items":[{"const":"license_term_type"}],"additionalItems":{"title":"Filter events by license term type","type":"string","enum":["cloud_evaluation","evaluation","freemium","nfr","site_license","subscription","utility"]}}]},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Site over deployed","properties":{"category":{"enum":["license_over_deployment"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Site over deployed output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status","licensed_seats","used_seats","license_key","catalog_code","combo_product"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Site over deployed output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status","licensed_seats","used_seats","license_key","catalog_code","combo_product"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"license_term_type\". 1: \"cloud_evaluation\",\"evaluation\",\"freemium\",\"nfr\",\"site_license\",\"subscription\",\"utility\"","items":[{"const":"license_term_type"}],"additionalItems":{"title":"Filter events by license term type","type":"string","enum":["cloud_evaluation","evaluation","freemium","nfr","site_license","subscription","utility"]}}]},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Vulnerability status","properties":{"category":{"enum":["cve_found"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Vulnerability status output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","product","vendor","installed_version","machine_id","machine_name","group_id","group_name","policy_id","policy_name","cve_id","severity","created_at","os_platform","os_release_name","os_version","cisa_exploitable","known_ransomware_campaign_use","description","published_at","severity_score","active_directory_ou"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Vulnerability status output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","product","vendor","installed_version","machine_id","machine_name","group_id","group_name","policy_id","policy_name","cve_id","severity","created_at","os_platform","os_release_name","os_version","cisa_exploitable","known_ransomware_campaign_use","description","published_at","severity_score","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","cve_id","product","os_platform"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"severity\". 1: \"unknown\",\"low\",\"medium\",\"high\",\"critical\"","items":[{"const":"severity"}],"additionalItems":{"title":"Filter events by severity","type":"string","enum":["unknown","low","medium","high","critical"]}},{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"cisa_exploitable\". 1: true, false","items":[{"const":"cisa_exploitable"},{"title":"Filter events by CISA exploitable"}],"additionalItems":false,"if":{"items":[{"const":"cisa_exploitable"}]},"then":{"items":[{"const":"cisa_exploitable"},{"type":"boolean"}]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","anyOf":[{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_contains":{"type":"array","anyOf":[{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","anyOf":[{"title":"Filter events by available patch exists","const":"available_patch"}]},"not_exists":{"type":"string","anyOf":[{"title":"Filter events by available patch not exists","const":"available_patch"}]},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"CVE Ignored","properties":{"category":{"enum":["cve_ignored"]},"delivery":{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}},"output_fields":{"title":"CVE Ignored output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","cve_id","ignored_reason","display_product","ignored_at","ignored_until","ignored_by","ignored_by_name"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","cve_id"]}}}}}},{"title":"Patch applied","properties":{"category":{"enum":["patch_applied"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Patch applied output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","title","description","product","vendor","severity","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_version","reboot_required","preview_patch","date","status","category","active_directory_ou"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Patch applied output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","title","description","product","vendor","severity","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_version","reboot_required","preview_patch","date","status","category","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","os_platform"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"status\". 1: \"COMPLETED\",\"FAILED\",\"REBOOT_REQUIRED\"","items":[{"const":"status"}],"additionalItems":{"title":"Filter events by status","type":"string","enum":["COMPLETED","FAILED","REBOOT_REQUIRED"]}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"preview_patch\". 1: true, false","items":[{"const":"preview_patch"},{"title":"Filter events by preview_patch"}],"additionalItems":false,"if":{"items":[{"const":"preview_patch"}]},"then":{"items":[{"const":"preview_patch"},{"type":"boolean"}]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Software update applied","properties":{"category":{"enum":["software_update"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Software update applied output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","product","vendor","current_version","new_version","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_version","date","status","signature_id","active_directory_ou"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Software update applied output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","product","vendor","current_version","new_version","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_version","date","status","signature_id","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","os_platform"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"status\". 1: \"COMPLETED\",\"FAILED\"","items":[{"const":"status"}],"additionalItems":{"title":"Filter events by status","type":"string","enum":["COMPLETED","FAILED"]}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Patch or software update available","properties":{"category":{"enum":["patch_available"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Patch or software update available","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","title","description","product","vendor","severity","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_version","reboot_required","preview_patch","date","category","patch_id","kb_id","released_at","size","active_directory_ou"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Patch or software update available","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","title","description","product","vendor","severity","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_version","reboot_required","preview_patch","date","category","patch_id","kb_id","released_at","size","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","os_platform"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"severity\". 1: \"unknown\",\"moderate\",\"low\",\"important\",\"critical\"","items":[{"const":"severity"}],"additionalItems":{"title":"Filter events by severity","type":"string","enum":["unknown","moderate","low","important","critical"]}},{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"reboot_required\". 1: true, false","items":[{"const":"reboot_required"},{"title":"Filter events by reboot_required"}],"additionalItems":false,"if":{"items":[{"const":"reboot_required"}]},"then":{"items":[{"const":"reboot_required"},{"type":"boolean"}]}},{"title":"0: \"preview_patch\". 1: true, false","items":[{"const":"preview_patch"},{"title":"Filter events by preview_patch"}],"additionalItems":false,"if":{"items":[{"const":"preview_patch"}]},"then":{"items":[{"const":"preview_patch"},{"type":"boolean"}]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","anyOf":[{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_contains":{"type":"array","anyOf":[{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"begins_with":{"type":"array","anyOf":[{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}}]},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"CSS detection","properties":{"category":{"enum":["css_detection"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"CSS detection output fields","minItems":1,"type":"array","items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name","file_name","css_threat_name","action_taken","file_location","file_owner","timestamp"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"CSS detection output fields","minItems":1,"type":"array","items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name","file_name","css_threat_name","action_taken","file_location","file_owner","timestamp"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","action_taken","cloud_provider","scan_configuration_name"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"action_taken\". 1: \"Found\", \"Quarantined\"","items":[{"const":"action_taken"}],"additionalItems":{"title":"Filter events by action taken","type":"string","enum":["Found","Quarantined"]}},{"title":"0: \"cloud_provider\". 1: \"BOX\", \"ONEDRIVE\", \"GOOGLEDRIVE\"","items":[{"const":"cloud_provider"}],"additionalItems":{"title":"Filter events by cloud provider","type":"string","enum":["BOX","ONEDRIVE","GOOGLEDRIVE"]}},{"title":"0: \"scan_configuration_name\". 1: string","items":[{"const":"scan_configuration_name"}],"additionalItems":{"title":"Filter events by scan configuration name","type":"string"}}]},"not_eq":{"type":"array","title":"0: \"scan_configuration_name\". 1: string","items":[{"const":"scan_configuration_name"}],"additionalItems":{"title":"Filter events by scan_configuration_name","type":"string"}},"contains":{"title":"0: \"scan_configuration_name\". 1: string","type":"array","items":[{"const":"scan_configuration_name"}],"additionalItems":{"title":"Filter events by scan_configuration_name","type":"string"}},"not_contains":{"title":"0: \"scan_configuration_name\". 1: string","type":"array","items":[{"const":"scan_configuration_name"}],"additionalItems":{"title":"Filter events by scan_configuration_name","type":"string"}},"begins_with":{"title":"0: \"scan_configuration_name\". 1: string","type":"array","items":[{"const":"scan_configuration_name"}],"additionalItems":{"title":"Filter events by scan_configuration_name","type":"string"}},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"CSS capacity approached","properties":{"category":{"enum":["css_capacity_approached"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"CSS capacity approached output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name","timestamp"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"CSS capacity approached output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name","timestamp"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name"]}}}}}},{"title":"CSS capacity reached","properties":{"category":{"enum":["css_capacity_reached"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"CSS capacity reached output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name","timestamp"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"CSS capacity reached output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name","timestamp"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name"]}}}}}},{"title":"CSS capacity exceeded","properties":{"category":{"enum":["css_capacity_exceeded"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"CSS capacity exceeded output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name","timestamp"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"CSS capacity exceeded output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name","timestamp"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name"]}}}}}},{"title":"DNS blocked","properties":{"category":{"enum":["dns_blocked"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"DNS blocked output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","timestamp","group_id","group_name","policy_id","policy_name","colo_id","device_id","user_id","dst_ip","src_ip","email","location","policy","rule_name","action","protocol","query_name","query_name_reversed","resolver_decision","query_category_ids","query_size","query_type","src_port","dst_port","os_platform","os_release_name","os_type","os_version","os_architecture"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"DNS blocked output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","timestamp","group_id","group_name","policy_id","policy_name","colo_id","device_id","user_id","dst_ip","src_ip","email","location","policy","rule_name","action","protocol","query_name","query_name_reversed","resolver_decision","query_category_ids","query_size","query_type","src_port","dst_port","os_platform","os_release_name","os_type","os_version","os_architecture"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"policy_id\". 1: string","items":[{"const":"policy_id"}],"additionalItems":{"title":"Filter events by policy_id","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"policy_id\". 1: string","items":[{"const":"policy_id"}],"additionalItems":{"title":"Filter events by policy_id","type":"string"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Case management","properties":{"category":{"enum":["siemplify_case"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Case management output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","case_id","case_name","case_status","case_created_at","priority","action_required","event","endpoints","detections"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Case management output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","case_id","case_name","case_status","case_created_at","priority","action_required","event","endpoints","detections"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","case_id"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"event\". 1: \"case_created\",\"case_updated\",\"case_closed\"","items":[{"const":"event"}],"additionalItems":{"title":"Filter events by status","type":"string","enum":["case_created","case_updated","case_closed"]}},{"title":"0: \"priority\". 1: \"Critical\", \"High\", \"Medium\", \"Low\"","items":[{"const":"priority"}],"additionalItems":{"title":"Filter events by status","type":"string","enum":["Critical","High","Medium","Low"]}},{"title":"0: \"action_required\". 1: true, false","items":[{"const":"action_required"},{"title":"Filter events by CISA exploitable"}],"additionalItems":false,"if":{"items":[{"const":"action_required"}]},"then":{"items":[{"const":"action_required"},{"type":"boolean"}]}}]},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Application block","properties":{"category":{"enum":["app_block"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Application block output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","app_block_rules","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version","scanned_at","file_path","last_user","active_directory_ou"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Application block output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","app_block_rules","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version","scanned_at","file_path","last_user","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"policy_id\". 1: string","items":[{"const":"policy_id"}],"additionalItems":{"title":"Filter events by policy_id","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"policy_id\". 1: string","items":[{"const":"policy_id"}],"additionalItems":{"title":"Filter events by policy_id","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","additionalItems":false},"lte":{"type":"array","const":""},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Entitlement changed","properties":{"category":{"enum":["license_entitlement_changed"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Entitlement changed output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status","licensed_seats","used_seats","license_key","catalog_code","combo_product","licensed_product","license_expires_at","license_key_status","auto_renew","status"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Entitlement changed output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status","licensed_seats","used_seats","license_key","catalog_code","combo_product","licensed_product","license_expires_at","license_key_status","auto_renew","status"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"status\". 1: \"added\",\"updated\",\"removed\"","items":[{"const":"status"}],"additionalItems":{"title":"Filter events by status","type":"string","enum":["added","updated","removed"]}},{"title":"0: \"license_term_type\". 1: \"cloud_evaluation\",\"evaluation\",\"freemium\",\"nfr\",\"site_license\",\"subscription\",\"utility\"","items":[{"const":"license_term_type"}],"additionalItems":{"title":"Filter events by license term type","type":"string","enum":["cloud_evaluation","evaluation","freemium","nfr","site_license","subscription","utility"]}}]},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Entitlement usage changed","properties":{"category":{"enum":["license_entitlement_usage_changed"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Entitlement usage changed output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status","licensed_seats","used_seats","license_key","catalog_code","combo_product","licensed_product","license_expires_at","license_key_status","auto_renew"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Entitlement usage changed output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status","licensed_seats","used_seats","license_key","catalog_code","combo_product","licensed_product","license_expires_at","license_key_status","auto_renew"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","title":"0: \"license_term_type\". 1: \"cloud_evaluation\",\"evaluation\",\"freemium\",\"nfr\",\"site_license\",\"subscription\",\"utility\"","items":[{"const":"license_term_type"}],"additionalItems":{"title":"Filter events by license term type","type":"string","enum":["cloud_evaluation","evaluation","freemium","nfr","site_license","subscription","utility"]}},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Endpoint status changed","properties":{"category":{"enum":["endpoint_status_changed"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Endpoint status changed","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","status_change","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version","codes"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Endpoint status changed","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","status_change","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version","codes"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","status_change","machine_id","machine_name"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"status_change\". 1: \"ENDPOINT_REBOOT_REQUIRED\",\"ENDPOINT_REBOOT_REQUIRED_CLEARED\",\"ENDPOINT_INFECTED\",\"ENDPOINT_REMEDIATED\",\"ENDPOINT_ISOLATED\",\"ENDPOINT_UNISOLATED\",\"ENDPOINT_SUSPICIOUS_ACTIVITY_FOUND\",\"ENDPOINT_SUSPICIOUS_ACTIVITY_CLEARED\",\"AGENT_ALERTS_CHANGED\"","items":[{"const":"status_change"}],"additionalItems":{"title":"Filter the type of status_change to be notified","type":"string","enum":["ENDPOINT_REBOOT_REQUIRED","ENDPOINT_REBOOT_REQUIRED_CLEARED","ENDPOINT_INFECTED","ENDPOINT_REMEDIATED","ENDPOINT_ISOLATED","ENDPOINT_UNISOLATED","ENDPOINT_SUSPICIOUS_ACTIVITY_FOUND","ENDPOINT_SUSPICIOUS_ACTIVITY_CLEARED","AGENT_ALERTS_CHANGED"]}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Inactive endpoint","properties":{"category":{"enum":["inactive_endpoint"]},"delivery":{"properties":{"output_fields":{"title":"Information to include in the JSON body. If omitted, include all","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version","last_seen_at"]}}}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"os_type\". 1: \"1\"(Workstation), \"2\"(Server), \"3\"(Mobile)","items":[{"const":"os_type"}],"additionalItems":{"title":"Filter events by OS type","type":"number","enum":[1,2,3]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"policy_id\". 1: string","items":[{"const":"policy_id"}],"additionalItems":{"title":"Filter events by policy_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"contains":{"type":"array","anyOf":[{"title":"0: \"policy_name\". 1: string","items":[{"const":"policy_name"}],"additionalItems":{"title":"Filter events by policy_name","type":"string"}},{"title":"0: \"group_name\". 1: string","items":[{"const":"group_name"}],"additionalItems":{"title":"Filter events by group_name","type":"string"}}]},"not_contains":{"type":"array","anyOf":[{"title":"0: \"policy_name\". 1: string","items":[{"const":"policy_name"}],"additionalItems":{"title":"Filter events by policy_name","type":"string"}},{"title":"0: \"group_name\". 1: string","items":[{"const":"group_name"}],"additionalItems":{"title":"Filter events by group_name","type":"string"}}]},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","anyOf":[{"title":"0: \"last_seen_at\"","items":[{"const":"last_seen_at"}],"additionalItems":{"title":"Filter inactive machines by less than equals days since last active","type":"number","minimum":1}}]},"gte":{"type":"array","anyOf":[{"title":"0: \"last_seen_at\"","items":[{"const":"last_seen_at"}],"additionalItems":{"title":"Filter inactive machines by less than equals days since last active","type":"number","minimum":1}}]}}}}}}}}}}},{"title":"Firewall activity","properties":{"category":{"enum":["firewall_activity"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Firewall activity output fields","type":"array","minItems":1,"items":{"type":"string","enum":["start_time","end_time","rule_id","rule_name","ruleset_id","ruleset_name","direction","action","protocol","location","program","service","hits","account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Firewall activity output fields","type":"array","minItems":1,"items":{"type":"string","enum":["start_time","end_time","rule_id","rule_name","ruleset_id","ruleset_name","direction","action","protocol","location","program","service","hits","account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"action\". 1: \"ALLOW\", \"BLOCK\"","items":[{"const":"action"}],"additionalItems":{"title":"Filter events by action","type":"string","enum":["ALLOW","BLOCK"]}},{"title":"0: \"direction\". 1: \"Inbound\", \"Outbound\"","items":[{"const":"direction"}],"additionalItems":{"title":"Filter events by direction","type":"string","enum":["Inbound","Outbound"]}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"policy_id\". 1: string","items":[{"const":"policy_id"}],"additionalItems":{"title":"Filter events by policy_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"policy_id\". 1: string","items":[{"const":"policy_id"}],"additionalItems":{"title":"Filter events by policy_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Endpoint isolation","properties":{"category":{"enum":["endpoint_isolation"]},"delivery":{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}},"output_fields":{"title":"Endpoint isolation output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","status","created_at","updated_at","expires_at","machine_id","machine_name","os_release_name","os_platform","os_type","os_version","rule_id","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","status","machine_id","machine_name"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"status\". 1: \"COMPLETED\",\"EXPIRED\",\"FAILED\",\"CANCELLED\"","items":[{"const":"status"}],"additionalItems":{"title":"Filter the type of the status update to be notified","type":"string","enum":["COMPLETED","EXPIRED","FAILED","CANCELLED"]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","anyOf":[{"title":"Filter events by rule_ud exists. If it exists, it indicates that it's an auto-isolation job","const":"rule_id"}]},"not_exists":{"type":"string","anyOf":[{"title":"Filter events by rule_ud exists. If it exists, it indicates that it's an auto-isolation job","const":"rule_id"}]},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Record (notification/report) audit","properties":{"category":{"enum":["record_audit"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Record audit output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","record_type","record_name","record_action","timestamp","user_email","owner"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Record audit output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","record_type","record_name","record_action","timestamp","user_email","owner"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","additionalItems":false},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","anyOf":[{"title":"0: \"record_action\". 1: \"REPORT\", \"NOTIFICATION\", \"UPDATED\", \"DELETED\"","items":[{"const":"record_action"}],"additionalItems":{"title":"Filter events by record action","type":"string","enum":["REPORT","NOTIFICATION","UPDATED","DELETED"]}}]},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"MXDR integration communication inactive","properties":{"category":{"enum":["mxdr_integration_inactive"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"mxdr_integration_inactive output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","source","last_log_seen","inactive_hours"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"mxdr_integration_inactive output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","source","last_log_seen","inactive_hours"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"source\". 1: \"okta\", \"entra\", \"msgraphapi\", \"meraki\", \"watchguard\", \"fortinet\"","items":[{"const":"source"}],"additionalItems":{"title":"Filter events by source","type":"string","enum":["okta","entra","msgraphapi","meraki","watchguard","fortinet"]}},{"title":"0: \"inactive_hours\". 1: 1, 24","items":[{"const":"inactive_hours"}],"additionalItems":{"title":"Filter events by inactive_hours","type":"number","enum":[1,24]}}]},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Audit log activity","properties":{"category":{"enum":["audit_log_activity"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Audit log activity output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","user_id","user_name","action","patch_titles","application_names","expires_at","reason","ignore_rule_name","application_version","ignore_rule_applies_to"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Audit log activity output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","user_id","user_name","action","patch_titles","application_names","expires_at","reason","ignore_rule_name","application_version","ignore_rule_applies_to"]}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"resource_type\". 1: \"ignore_rule\"","items":[{"const":"resource_type"}],"additionalItems":{"title":"Filter events by resource type","type":"string","enum":["ignore_rule"]}},{"title":"0: \"action\". 1: \"create\", \"update\"","items":[{"const":"action"}],"additionalItems":{"title":"Filter events by action","type":"string","enum":["create","update"]}}]}}}}}}}}}}},{"title":"XDR alert","properties":{"category":{"enum":["xdr_alert"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"xdr_alert output fields","type":"array","minItems":1,"items":{"type":"string","enum":["source","severity","account_id","account_name","created_at","category","alert_id","rule_name","attack_category","attack_detection_type","identity_primary_identifier","identity_group_name"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"xdr_alert output fields","type":"array","minItems":1,"items":{"type":"string","enum":["source","severity","account_id","account_name","created_at","category","alert_id","rule_name","attack_category","attack_detection_type","identity_primary_identifier","identity_group_name"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","source"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"source\". 1: \"okta\", \"entra\", \"edr\"","items":[{"const":"source"}],"additionalItems":{"title":"Filter events by source","type":"string","enum":["okta","entra","edr"]}},{"title":"0: \"severity\". 1: \"information\", \"low\", \"medium\", \"high\", \"critical\"","items":[{"const":"severity"}],"additionalItems":{"title":"Filter events by severity","type":"string","enum":["information","low","medium","high","critical"]}},{"title":"0: \"attack_category\". 1: string","items":[{"const":"attack_category"}],"additionalItems":{"title":"Filter events by attack_category","type":"string"}},{"title":"0: \"identity_primary_identifier\". 1: string","items":[{"const":"identity_primary_identifier"}],"additionalItems":{"title":"Filter events by identity_primary_identifier","type":"string"}},{"title":"0: \"identity_group_name\". 1: string","items":[{"const":"identity_group_name"}],"additionalItems":{"title":"Filter events by identity_group_name","type":"string"}}]},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","anyOf":[{"title":"0: \"attack_category\". 1: string","items":[{"const":"attack_category"}],"additionalItems":{"title":"Filter events by attack_category","type":"string"}},{"title":"0: \"identity_primary_identifier\". 1: string","items":[{"const":"identity_primary_identifier"}],"additionalItems":{"title":"Filter events by identity_primary_identifier","type":"string"}},{"title":"0: \"identity_group_name\". 1: string","items":[{"const":"identity_group_name"}],"additionalItems":{"title":"Filter events by identity_group_name","type":"string"}}]},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Drive encryption","properties":{"category":{"enum":["drive_encryption"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Drive encryption output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","action","machine_name","policy_name","encryption_method","drive_label","timestamp"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Drive encryption output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","action","machine_name","policy_name","encryption_method","drive_label","timestamp"]}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"action\". 1: \"MACHINE_DRIVE_ENCRYPTION_ENCRYPTION_FAILED\", \"MACHINE_DRIVE_ENCRYPTION_SUSPENDED\", or \"MACHINE_DRIVE_ENCRYPTION_RECOVERY_DETECTED\"","items":[{"const":"action"}],"additionalItems":{"title":"Filter events by action type","type":"string","enum":["MACHINE_DRIVE_ENCRYPTION_ENCRYPTION_FAILED","MACHINE_DRIVE_ENCRYPTION_SUSPENDED","MACHINE_DRIVE_ENCRYPTION_RECOVERY_DETECTED"]}}]}}}}}}}}}}}],"if":{"properties":{"category":{"enum":["user_added","user_deleted","user_verified","license_over_deployment","css_capacity_approached","css_capacity_reached","css_capacity_exceeded"]}}},"then":{"properties":{"conditions":{"additionalProperties":false}}}},{"type":"object","properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]},{"allOf":[{"required":["name","category","delivery"],"properties":{"name":{"title":"Notification name. Must be unique","type":"string"},"description":{"title":"Notification description","type":"string","default":""},"category":{"title":"The category of the events to be notified","type":"string"},"delivery":{},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object"},"aggregation":{"title":"Aggregate multiple events in a single notifications","type":"object","properties":{"interval":{"title":"Interval in seconds for aggregating events in a single notification. It must be defined to apply aggregation","type":"integer","minimum":10,"maximum":86400}}},"enabled":{"title":"enable/disable notification","type":"boolean","default":true},"owner":{"title":"the identifier of the owner of the subscription","type":"string"}}},{"anyOf":[{"title":"OneView user added","properties":{"category":{"enum":["oneview_user_added"]},"delivery":{"anyOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"OneView user added output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","user_id","user_name","user_email","user_role","ip_address","timestamp","sites","invited_by_email"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["invited_by_email"]}}}}}},{"title":"OneView user verified","properties":{"category":{"enum":["oneview_user_verified"]},"delivery":{"anyOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"OneView user verified output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","user_id","user_name","user_email","ip_address","timestamp"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"Not available for this category","maxItems":0}}}}},{"title":"OneView user deleted","properties":{"category":{"enum":["oneview_user_deleted"]},"delivery":{"anyOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"OneView user deleted output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","user_id","user_name","user_email","user_role","ip_address","timestamp","sites","deleted_by_email"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["deleted_by_email"]}}}}}},{"title":"OneView sites assigned","allOf":[{"properties":{"category":{"enum":["oneview_sites_assigned"]},"delivery":{"anyOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"OneView sites assigned output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","user_id","user_name","user_email","user_role","ip_address","timestamp","sites","assigned_by_email","added_sites","removed_sites"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["assigned_by_email","user_email"]}}}}}},{"type":"object","properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]},{"title":"OneView trial to paid status","allOf":[{"properties":{"category":{"enum":["oneview_trial_to_paid_status"]},"delivery":{"anyOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"OneView trial to paid status output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","timestamp","max_protection","device_type","conversion_status","sites"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["device_type","conversion_status","max_protection"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"nebula_account_id\". 1: string","items":[{"const":"nebula_account_id"}],"additionalItems":{"title":"Filter events by nebula_account_id","type":"string"}},{"title":"0: \"conversion_status\". 1: \"FAILED\", \"SUCCESS\"","items":[{"const":"conversion_status"}],"additionalItems":{"title":"Filter events by conversion status","type":"string","enum":["FAILED","SUCCESS"]}}]},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""}}}}}}}}}}},{"type":"object","properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]},{"title":"OneView site end date approaching","properties":{"category":{"enum":["oneview_site_end_date_approaching"]},"delivery":{"anyOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"OneView site end date approachnig output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","timestamp","sites","days_left","site_end_date"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","maxItems":0}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"days_left\". 1: 0,1,7,14,30","items":[{"const":"days_left"}],"additionalItems":{"title":"Filter events by days left before the license expiration","type":"number","enum":[0,1,7,14,30]}}]},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""}}}}}}}}}}}]},{"if":{"properties":{"category":{"enum":["oneview_user_added","oneview_user_deleted","oneview_user_verified","oneview_sites_assigned"]}}},"then":{"properties":{"conditions":{"additionalProperties":false}}}}]}]}],"if":{"properties":{"category":{"enum":["oneview_user_added","oneview_user_verified","oneview_user_deleted","oneview_sites_assigned","oneview_trial_to_paid_status","oneview_site_end_date_approaching"]}}},"then":{"required":["parent_account_id"]}}}}},"responses":{"202":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"RMM notification response","allOf":[{"type":"object","title":"The Schema For Notifications Creation","anyOf":[{"allOf":[{"type":"object","title":"The create notification Body","required":["name","category","delivery"],"properties":{"name":{"title":"Notification name. Must be unique","type":"string"},"description":{"title":"Notification description","type":"string","default":""},"category":{"title":"The category of the events to be notified","type":"string"},"delivery":{},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object"},"aggregation":{"title":"Aggregate multiple events in a single notifications","type":"object","properties":{"interval":{"title":"Interval in seconds for aggregating events in a single notification. It must be defined to apply aggregation","type":"integer","minimum":10,"maximum":86400}}},"enabled":{"title":"enable/disable notification","type":"boolean","default":true},"owner":{"title":"the identifier of the owner of the subscription. Not available for read-only users","type":"string"}},"anyOf":[{"title":"Detections","properties":{"category":{"enum":["threat_detections"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Detections output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","os_release_name","os_platform","os_type","os_version","category","type","path","status","scanned_at","reported_at","resource_created_at","resource_modified_at","threat_name","affected_application","process_name","machine_id","machine_name","machine_ip","group_id","group_name","policy_id","policy_name","nics","md5","sha256","engine_version","last_user","active_directory_ou","id"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Detections output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","os_release_name","os_platform","os_type","os_version","category","type","path","status","scanned_at","reported_at","resource_created_at","resource_modified_at","threat_name","affected_application","process_name","machine_id","machine_name","machine_ip","group_id","group_name","policy_id","policy_name","nics","md5","sha256","engine_version","last_user","active_directory_ou","id"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","affected_application","category","group_id","group_name","machine_id","machine_ip","machine_name","os_platform","os_release_name","path","policy_id","policy_name","process_name","status","threat_name","type"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"category\". 1: \"MALWARE\",\"PUP\",\"PUM\",\"AE\",\"ARW\",\"MWAC\",\"RID\",\"VULNERABLE_DRIVER\"","items":[{"const":"category"}],"additionalItems":{"title":"Filter events by detection category","type":"string","enum":["MALWARE","PUP","PUM","AE","ARW","MWAC","RID","VULNERABLE_DRIVER"]}},{"title":"0: \"action\". 1: \"blocked\", \"deleted\", \"deletedAutoPrune\", \"found\", \"quarantined\", \"restored\"","items":[{"const":"action"}],"additionalItems":{"title":"Filter events by action","type":"string","enum":["blocked","deleted","deletedAutoPrune","found","quarantined","restored"]}},{"title":"0: \"threat_name\". 1: string","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux), \"4\"(Android), \"3\"(IOS), \"3\"(ChromeOS)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3,4,5,6]}},{"title":"0: \"rtp\". 1: true, false","items":[{"const":"rtp"},{"title":"Filter events by real time protection"}],"additionalItems":false,"if":{"items":[{"const":"rtp"}]},"then":{"items":[{"const":"rtp"},{"type":"boolean"}]}},{"title":"0: \"type\". 1: \"application\", \"exploit\", \"extension\", \"file\", \"folder\", \"InboundConnection\", \"module\", \"OutboundConnection\", \"process\", \"reg_key\", \"reg_value\"","items":[{"const":"type"}],"additionalItems":{"title":"Filter events by type","type":"string","enum":["application","exploit","extension","file","folder","InboundConnection","module","OutboundConnection","process","reg_key","reg_value"]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"threat_name\". 1: string","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","anyOf":[{"title":"0: \"threat_name\". 1: string","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_contains":{"type":"array","anyOf":[{"title":"0: \"threat_name\". 1: string","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"begins_with":{"title":"0: \"threat_name\". 1: string","type":"array","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Suspicious activity","properties":{"category":{"enum":["threat_suspicious_activity"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Suspicious activity","type":"array","minItems":1,"items":{"type":"string","enum":["severity","account_id","account_name","os_release_name","os_platform","type","path","status","scanned_at","reported_at","threat_name","machine_id","machine_name","machine_ip","group_id","group_name","policy_id","policy_name","nics","last_user","first_activity","last_activity","isolation_type","id"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Suspicious activity","type":"array","minItems":1,"items":{"type":"string","enum":["severity","account_id","account_name","os_release_name","os_platform","type","path","status","scanned_at","reported_at","threat_name","machine_id","machine_name","machine_ip","group_id","group_name","policy_id","policy_name","nics","last_user","first_activity","last_activity","isolation_type","id"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","group_id","group_name","machine_id","machine_ip","machine_name","os_platform","os_release_name","path","policy_id","policy_name","severity","status","threat_name"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"level\". 1: \"low\", \"medium\", \"high\", \"critical\"","items":[{"const":"level"}],"additionalItems":{"title":"Filter events by severity level","type":"string","enum":["low","medium","high","critical"]}},{"title":"0: \"threat_name\". 1: string","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux), \"4\"(Android), \"3\"(IOS), \"3\"(ChromeOS)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3,4,5,6]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"threat_name\". 1: string","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"contains":{"title":"0: \"threat_name\". 1: string","type":"array","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},"not_contains":{"title":"0: \"threat_name\". 1: string","type":"array","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},"begins_with":{"title":"0: \"threat_name\". 1: string","type":"array","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},"exists":{"type":"string","anyOf":[{"title":"Filter events by isolation_type exists","const":"isolation_type"}]},"not_exists":{"anyOf":[{"title":"Filter events by isolation_type not exists","const":"isolation_type"}]},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"User added","properties":{"category":{"enum":["user_added"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"User added","type":"array","minItems":1,"items":{"type":"string","enum":["ip_address","invited_by","role","email","full_group_access","timestamp","account_id"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"User added","type":"array","minItems":1,"items":{"type":"string","enum":["ip_address","invited_by","role","email","full_group_access","timestamp","account_id"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","invited_by","ip_address","role"]}}}}}},{"title":"User deleted","properties":{"category":{"enum":["user_deleted"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"User deleted output fields","type":"array","minItems":1,"items":{"type":"string","enum":["ip_address","timestamp","account_id","deleted_by","email"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"User deleted output fields","type":"array","minItems":1,"items":{"type":"string","enum":["ip_address","timestamp","account_id","deleted_by","email"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","ip_address","deleted_by"]}}}}}},{"title":"User verified","properties":{"category":{"enum":["user_verified"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"User verified","type":"array","minItems":1,"items":{"type":"string","enum":["email","timestamp","account_id"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"User verified","type":"array","minItems":1,"items":{"type":"string","enum":["email","timestamp","account_id"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name"]}}}}}},{"title":"Endpoint registered","properties":{"category":{"enum":["endpoint_registered"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Endpoint registered output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","created_at"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Endpoint registered output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","created_at"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Endpoint deleted","properties":{"category":{"enum":["endpoint_unregistered"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Endpoint deleted output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","timestamp","timeout"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Endpoint deleted output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","timestamp","timeout"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"timeout\". 1: true, false","items":[{"const":"timeout"},{"title":"Filter events by timeout (true if the machine was deleted because marked_for_deletion and never connected again until a timeout)"}],"additionalItems":false,"if":{"items":[{"const":"timeout"}]},"then":{"items":[{"const":"timeout"},{"type":"boolean"}]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Command update","properties":{"category":{"enum":["endpoint_command_update"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Command update output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","command","status","created_at","updated_at","expires_at","machine_id","machine_name","group_id","active_directory_ou"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Command update output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","command","status","created_at","updated_at","expires_at","machine_id","machine_name","group_id","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","command","status","machine_id","machine_name"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"status\". 1: \"CREATED\",\"SENT\",\"RECEIVED\",\"STARTED\",\"TIMED_OUT\",\"COMPLETED\",\"EXPIRED\",\"FAILED\",\"CANCELLED\"","items":[{"const":"status"}],"additionalItems":{"title":"Filter the type of the machine_events to be notified","type":"string","enum":["CREATED","SENT","RECEIVED","STARTED","TIMED_OUT","COMPLETED","EXPIRED","FAILED","CANCELLED"]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Quarantine","properties":{"category":{"enum":["quarantine"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Quarantine output fields","type":"array","minItems":1,"items":{"type":"string","enum":["path","machine_name","created_at","status"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Quarantine output fields","type":"array","minItems":1,"items":{"type":"string","enum":["path","machine_name","created_at","status"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","status"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","title":"0: \"quarantine_action\". 1: \"QUARANTINE_DELETED\",\"QUARANTINE_RESTORED\"","items":[{"const":"quarantine_action"}],"additionalItems":{"title":"Filter the type of the quarantine_events to be notified","type":"string","enum":["QUARANTINE_DELETED","QUARANTINE_RESTORED"]}},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Threat scan","properties":{"category":{"enum":["threat_scan"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Threat scan output_fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","scan_date","scan_id","machine_id","machine_name","group_id","group_name","policy_id","policy_name","ip_address","detections","active_directory_ou"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Threat scan output_fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","scan_date","scan_id","machine_id","machine_name","group_id","group_name","policy_id","policy_name","ip_address","detections","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","ip_address","policy_id","policy_name"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"action\". 1: \"THREAT_CLEANED\",\"THREAT_FOUND\"","items":[{"const":"action"}],"additionalItems":{"title":"Filter events by threat activity action","type":"string","enum":["THREAT_CLEANED","THREAT_FOUND"]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Device control","properties":{"category":{"enum":["device_control"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Device control output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version","path","date","action","device_name","manufacturer","volume_serial","serial_number","physical_disk_name","disk_interface","file_system","volume_name","volume_device_path","last_user","active_directory_ou"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Device control output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version","path","date","action","device_name","manufacturer","volume_serial","serial_number","physical_disk_name","disk_interface","file_system","volume_name","volume_device_path","last_user","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","group_id","group_name","machine_id","machine_name","os_platform","os_release_name","policy_id","policy_name"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"action\". 1: \"blocked\", \"read-only\"","items":[{"const":"action"}],"additionalItems":{"title":"Filter events by action","type":"string","enum":["blocked","read-only"]}},{"title":"0: \"device_name\". 1: string","items":[{"const":"device_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"manufacturer\". 1: string","items":[{"const":"manufacturer"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"device_name\". 1: string","items":[{"const":"device_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"manufacturer\". 1: string","items":[{"const":"manufacturer"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","anyOf":[{"title":"0: \"device_name\". 1: string","items":[{"const":"device_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"manufacturer\". 1: string","items":[{"const":"manufacturer"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_contains":{"type":"array","anyOf":[{"title":"0: \"device_name\". 1: string","items":[{"const":"device_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"manufacturer\". 1: string","items":[{"const":"manufacturer"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Site end date","properties":{"category":{"enum":["license_expiring"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Site end date output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status","licensed_seats","used_seats","license_key","catalog_code","combo_product","licensed_product","license_expires_at","days_left"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Site end date output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status","licensed_seats","used_seats","license_key","catalog_code","combo_product","licensed_product","license_expires_at","days_left"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"days_left\". 1: 0,1,3,5,7,14,30","items":[{"const":"days_left"}],"additionalItems":{"title":"Filter events by days left before the license expiration","type":"number","enum":[0,1,3,5,7,14,30]}},{"title":"0: \"license_term_type\". 1: \"cloud_evaluation\",\"evaluation\",\"freemium\",\"nfr\",\"site_license\",\"subscription\",\"utility\"","items":[{"const":"license_term_type"}],"additionalItems":{"title":"Filter events by license term type","type":"string","enum":["cloud_evaluation","evaluation","freemium","nfr","site_license","subscription","utility"]}}]},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Site over deployed","properties":{"category":{"enum":["license_over_deployment"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Site over deployed output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status","licensed_seats","used_seats","license_key","catalog_code","combo_product"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Site over deployed output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status","licensed_seats","used_seats","license_key","catalog_code","combo_product"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"license_term_type\". 1: \"cloud_evaluation\",\"evaluation\",\"freemium\",\"nfr\",\"site_license\",\"subscription\",\"utility\"","items":[{"const":"license_term_type"}],"additionalItems":{"title":"Filter events by license term type","type":"string","enum":["cloud_evaluation","evaluation","freemium","nfr","site_license","subscription","utility"]}}]},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Vulnerability status","properties":{"category":{"enum":["cve_found"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Vulnerability status output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","product","vendor","installed_version","machine_id","machine_name","group_id","group_name","policy_id","policy_name","cve_id","severity","created_at","os_platform","os_release_name","os_version","cisa_exploitable","known_ransomware_campaign_use","description","published_at","severity_score","active_directory_ou"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Vulnerability status output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","product","vendor","installed_version","machine_id","machine_name","group_id","group_name","policy_id","policy_name","cve_id","severity","created_at","os_platform","os_release_name","os_version","cisa_exploitable","known_ransomware_campaign_use","description","published_at","severity_score","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","cve_id","product","os_platform"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"severity\". 1: \"unknown\",\"low\",\"medium\",\"high\",\"critical\"","items":[{"const":"severity"}],"additionalItems":{"title":"Filter events by severity","type":"string","enum":["unknown","low","medium","high","critical"]}},{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"cisa_exploitable\". 1: true, false","items":[{"const":"cisa_exploitable"},{"title":"Filter events by CISA exploitable"}],"additionalItems":false,"if":{"items":[{"const":"cisa_exploitable"}]},"then":{"items":[{"const":"cisa_exploitable"},{"type":"boolean"}]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","anyOf":[{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_contains":{"type":"array","anyOf":[{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","anyOf":[{"title":"Filter events by available patch exists","const":"available_patch"}]},"not_exists":{"type":"string","anyOf":[{"title":"Filter events by available patch not exists","const":"available_patch"}]},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"CVE Ignored","properties":{"category":{"enum":["cve_ignored"]},"delivery":{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}},"output_fields":{"title":"CVE Ignored output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","cve_id","ignored_reason","display_product","ignored_at","ignored_until","ignored_by","ignored_by_name"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","cve_id"]}}}}}},{"title":"Patch applied","properties":{"category":{"enum":["patch_applied"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Patch applied output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","title","description","product","vendor","severity","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_version","reboot_required","preview_patch","date","status","category","active_directory_ou"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Patch applied output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","title","description","product","vendor","severity","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_version","reboot_required","preview_patch","date","status","category","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","os_platform"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"status\". 1: \"COMPLETED\",\"FAILED\",\"REBOOT_REQUIRED\"","items":[{"const":"status"}],"additionalItems":{"title":"Filter events by status","type":"string","enum":["COMPLETED","FAILED","REBOOT_REQUIRED"]}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"preview_patch\". 1: true, false","items":[{"const":"preview_patch"},{"title":"Filter events by preview_patch"}],"additionalItems":false,"if":{"items":[{"const":"preview_patch"}]},"then":{"items":[{"const":"preview_patch"},{"type":"boolean"}]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Software update applied","properties":{"category":{"enum":["software_update"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Software update applied output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","product","vendor","current_version","new_version","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_version","date","status","signature_id","active_directory_ou"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Software update applied output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","product","vendor","current_version","new_version","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_version","date","status","signature_id","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","os_platform"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"status\". 1: \"COMPLETED\",\"FAILED\"","items":[{"const":"status"}],"additionalItems":{"title":"Filter events by status","type":"string","enum":["COMPLETED","FAILED"]}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Patch or software update available","properties":{"category":{"enum":["patch_available"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Patch or software update available","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","title","description","product","vendor","severity","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_version","reboot_required","preview_patch","date","category","patch_id","kb_id","released_at","size","active_directory_ou"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Patch or software update available","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","title","description","product","vendor","severity","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_version","reboot_required","preview_patch","date","category","patch_id","kb_id","released_at","size","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","os_platform"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"severity\". 1: \"unknown\",\"moderate\",\"low\",\"important\",\"critical\"","items":[{"const":"severity"}],"additionalItems":{"title":"Filter events by severity","type":"string","enum":["unknown","moderate","low","important","critical"]}},{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"reboot_required\". 1: true, false","items":[{"const":"reboot_required"},{"title":"Filter events by reboot_required"}],"additionalItems":false,"if":{"items":[{"const":"reboot_required"}]},"then":{"items":[{"const":"reboot_required"},{"type":"boolean"}]}},{"title":"0: \"preview_patch\". 1: true, false","items":[{"const":"preview_patch"},{"title":"Filter events by preview_patch"}],"additionalItems":false,"if":{"items":[{"const":"preview_patch"}]},"then":{"items":[{"const":"preview_patch"},{"type":"boolean"}]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","anyOf":[{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_contains":{"type":"array","anyOf":[{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"begins_with":{"type":"array","anyOf":[{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}}]},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"CSS detection","properties":{"category":{"enum":["css_detection"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"CSS detection output fields","minItems":1,"type":"array","items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name","file_name","css_threat_name","action_taken","file_location","file_owner","timestamp"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"CSS detection output fields","minItems":1,"type":"array","items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name","file_name","css_threat_name","action_taken","file_location","file_owner","timestamp"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","action_taken","cloud_provider","scan_configuration_name"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"action_taken\". 1: \"Found\", \"Quarantined\"","items":[{"const":"action_taken"}],"additionalItems":{"title":"Filter events by action taken","type":"string","enum":["Found","Quarantined"]}},{"title":"0: \"cloud_provider\". 1: \"BOX\", \"ONEDRIVE\", \"GOOGLEDRIVE\"","items":[{"const":"cloud_provider"}],"additionalItems":{"title":"Filter events by cloud provider","type":"string","enum":["BOX","ONEDRIVE","GOOGLEDRIVE"]}},{"title":"0: \"scan_configuration_name\". 1: string","items":[{"const":"scan_configuration_name"}],"additionalItems":{"title":"Filter events by scan configuration name","type":"string"}}]},"not_eq":{"type":"array","title":"0: \"scan_configuration_name\". 1: string","items":[{"const":"scan_configuration_name"}],"additionalItems":{"title":"Filter events by scan_configuration_name","type":"string"}},"contains":{"title":"0: \"scan_configuration_name\". 1: string","type":"array","items":[{"const":"scan_configuration_name"}],"additionalItems":{"title":"Filter events by scan_configuration_name","type":"string"}},"not_contains":{"title":"0: \"scan_configuration_name\". 1: string","type":"array","items":[{"const":"scan_configuration_name"}],"additionalItems":{"title":"Filter events by scan_configuration_name","type":"string"}},"begins_with":{"title":"0: \"scan_configuration_name\". 1: string","type":"array","items":[{"const":"scan_configuration_name"}],"additionalItems":{"title":"Filter events by scan_configuration_name","type":"string"}},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"CSS capacity approached","properties":{"category":{"enum":["css_capacity_approached"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"CSS capacity approached output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name","timestamp"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"CSS capacity approached output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name","timestamp"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name"]}}}}}},{"title":"CSS capacity reached","properties":{"category":{"enum":["css_capacity_reached"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"CSS capacity reached output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name","timestamp"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"CSS capacity reached output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name","timestamp"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name"]}}}}}},{"title":"CSS capacity exceeded","properties":{"category":{"enum":["css_capacity_exceeded"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"CSS capacity exceeded output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name","timestamp"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"CSS capacity exceeded output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name","timestamp"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name"]}}}}}},{"title":"DNS blocked","properties":{"category":{"enum":["dns_blocked"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"DNS blocked output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","timestamp","group_id","group_name","policy_id","policy_name","colo_id","device_id","user_id","dst_ip","src_ip","email","location","policy","rule_name","action","protocol","query_name","query_name_reversed","resolver_decision","query_category_ids","query_size","query_type","src_port","dst_port","os_platform","os_release_name","os_type","os_version","os_architecture"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"DNS blocked output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","timestamp","group_id","group_name","policy_id","policy_name","colo_id","device_id","user_id","dst_ip","src_ip","email","location","policy","rule_name","action","protocol","query_name","query_name_reversed","resolver_decision","query_category_ids","query_size","query_type","src_port","dst_port","os_platform","os_release_name","os_type","os_version","os_architecture"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"policy_id\". 1: string","items":[{"const":"policy_id"}],"additionalItems":{"title":"Filter events by policy_id","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"policy_id\". 1: string","items":[{"const":"policy_id"}],"additionalItems":{"title":"Filter events by policy_id","type":"string"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Case management","properties":{"category":{"enum":["siemplify_case"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Case management output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","case_id","case_name","case_status","case_created_at","priority","action_required","event","endpoints","detections"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Case management output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","case_id","case_name","case_status","case_created_at","priority","action_required","event","endpoints","detections"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","case_id"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"event\". 1: \"case_created\",\"case_updated\",\"case_closed\"","items":[{"const":"event"}],"additionalItems":{"title":"Filter events by status","type":"string","enum":["case_created","case_updated","case_closed"]}},{"title":"0: \"priority\". 1: \"Critical\", \"High\", \"Medium\", \"Low\"","items":[{"const":"priority"}],"additionalItems":{"title":"Filter events by status","type":"string","enum":["Critical","High","Medium","Low"]}},{"title":"0: \"action_required\". 1: true, false","items":[{"const":"action_required"},{"title":"Filter events by CISA exploitable"}],"additionalItems":false,"if":{"items":[{"const":"action_required"}]},"then":{"items":[{"const":"action_required"},{"type":"boolean"}]}}]},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Application block","properties":{"category":{"enum":["app_block"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Application block output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","app_block_rules","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version","scanned_at","file_path","last_user","active_directory_ou"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Application block output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","app_block_rules","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version","scanned_at","file_path","last_user","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"policy_id\". 1: string","items":[{"const":"policy_id"}],"additionalItems":{"title":"Filter events by policy_id","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"policy_id\". 1: string","items":[{"const":"policy_id"}],"additionalItems":{"title":"Filter events by policy_id","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","additionalItems":false},"lte":{"type":"array","const":""},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Entitlement changed","properties":{"category":{"enum":["license_entitlement_changed"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Entitlement changed output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status","licensed_seats","used_seats","license_key","catalog_code","combo_product","licensed_product","license_expires_at","license_key_status","auto_renew","status"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Entitlement changed output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status","licensed_seats","used_seats","license_key","catalog_code","combo_product","licensed_product","license_expires_at","license_key_status","auto_renew","status"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"status\". 1: \"added\",\"updated\",\"removed\"","items":[{"const":"status"}],"additionalItems":{"title":"Filter events by status","type":"string","enum":["added","updated","removed"]}},{"title":"0: \"license_term_type\". 1: \"cloud_evaluation\",\"evaluation\",\"freemium\",\"nfr\",\"site_license\",\"subscription\",\"utility\"","items":[{"const":"license_term_type"}],"additionalItems":{"title":"Filter events by license term type","type":"string","enum":["cloud_evaluation","evaluation","freemium","nfr","site_license","subscription","utility"]}}]},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Entitlement usage changed","properties":{"category":{"enum":["license_entitlement_usage_changed"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Entitlement usage changed output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status","licensed_seats","used_seats","license_key","catalog_code","combo_product","licensed_product","license_expires_at","license_key_status","auto_renew"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Entitlement usage changed output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status","licensed_seats","used_seats","license_key","catalog_code","combo_product","licensed_product","license_expires_at","license_key_status","auto_renew"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","title":"0: \"license_term_type\". 1: \"cloud_evaluation\",\"evaluation\",\"freemium\",\"nfr\",\"site_license\",\"subscription\",\"utility\"","items":[{"const":"license_term_type"}],"additionalItems":{"title":"Filter events by license term type","type":"string","enum":["cloud_evaluation","evaluation","freemium","nfr","site_license","subscription","utility"]}},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Endpoint status changed","properties":{"category":{"enum":["endpoint_status_changed"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Endpoint status changed","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","status_change","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version","codes"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Endpoint status changed","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","status_change","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version","codes"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","status_change","machine_id","machine_name"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"status_change\". 1: \"ENDPOINT_REBOOT_REQUIRED\",\"ENDPOINT_REBOOT_REQUIRED_CLEARED\",\"ENDPOINT_INFECTED\",\"ENDPOINT_REMEDIATED\",\"ENDPOINT_ISOLATED\",\"ENDPOINT_UNISOLATED\",\"ENDPOINT_SUSPICIOUS_ACTIVITY_FOUND\",\"ENDPOINT_SUSPICIOUS_ACTIVITY_CLEARED\",\"AGENT_ALERTS_CHANGED\"","items":[{"const":"status_change"}],"additionalItems":{"title":"Filter the type of status_change to be notified","type":"string","enum":["ENDPOINT_REBOOT_REQUIRED","ENDPOINT_REBOOT_REQUIRED_CLEARED","ENDPOINT_INFECTED","ENDPOINT_REMEDIATED","ENDPOINT_ISOLATED","ENDPOINT_UNISOLATED","ENDPOINT_SUSPICIOUS_ACTIVITY_FOUND","ENDPOINT_SUSPICIOUS_ACTIVITY_CLEARED","AGENT_ALERTS_CHANGED"]}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Inactive endpoint","properties":{"category":{"enum":["inactive_endpoint"]},"delivery":{"properties":{"output_fields":{"title":"Information to include in the JSON body. If omitted, include all","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version","last_seen_at"]}}}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"os_type\". 1: \"1\"(Workstation), \"2\"(Server), \"3\"(Mobile)","items":[{"const":"os_type"}],"additionalItems":{"title":"Filter events by OS type","type":"number","enum":[1,2,3]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"policy_id\". 1: string","items":[{"const":"policy_id"}],"additionalItems":{"title":"Filter events by policy_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"contains":{"type":"array","anyOf":[{"title":"0: \"policy_name\". 1: string","items":[{"const":"policy_name"}],"additionalItems":{"title":"Filter events by policy_name","type":"string"}},{"title":"0: \"group_name\". 1: string","items":[{"const":"group_name"}],"additionalItems":{"title":"Filter events by group_name","type":"string"}}]},"not_contains":{"type":"array","anyOf":[{"title":"0: \"policy_name\". 1: string","items":[{"const":"policy_name"}],"additionalItems":{"title":"Filter events by policy_name","type":"string"}},{"title":"0: \"group_name\". 1: string","items":[{"const":"group_name"}],"additionalItems":{"title":"Filter events by group_name","type":"string"}}]},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","anyOf":[{"title":"0: \"last_seen_at\"","items":[{"const":"last_seen_at"}],"additionalItems":{"title":"Filter inactive machines by less than equals days since last active","type":"number","minimum":1}}]},"gte":{"type":"array","anyOf":[{"title":"0: \"last_seen_at\"","items":[{"const":"last_seen_at"}],"additionalItems":{"title":"Filter inactive machines by less than equals days since last active","type":"number","minimum":1}}]}}}}}}}}}}},{"title":"Firewall activity","properties":{"category":{"enum":["firewall_activity"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Firewall activity output fields","type":"array","minItems":1,"items":{"type":"string","enum":["start_time","end_time","rule_id","rule_name","ruleset_id","ruleset_name","direction","action","protocol","location","program","service","hits","account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Firewall activity output fields","type":"array","minItems":1,"items":{"type":"string","enum":["start_time","end_time","rule_id","rule_name","ruleset_id","ruleset_name","direction","action","protocol","location","program","service","hits","account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"action\". 1: \"ALLOW\", \"BLOCK\"","items":[{"const":"action"}],"additionalItems":{"title":"Filter events by action","type":"string","enum":["ALLOW","BLOCK"]}},{"title":"0: \"direction\". 1: \"Inbound\", \"Outbound\"","items":[{"const":"direction"}],"additionalItems":{"title":"Filter events by direction","type":"string","enum":["Inbound","Outbound"]}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"policy_id\". 1: string","items":[{"const":"policy_id"}],"additionalItems":{"title":"Filter events by policy_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"policy_id\". 1: string","items":[{"const":"policy_id"}],"additionalItems":{"title":"Filter events by policy_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Endpoint isolation","properties":{"category":{"enum":["endpoint_isolation"]},"delivery":{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}},"output_fields":{"title":"Endpoint isolation output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","status","created_at","updated_at","expires_at","machine_id","machine_name","os_release_name","os_platform","os_type","os_version","rule_id","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","status","machine_id","machine_name"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"status\". 1: \"COMPLETED\",\"EXPIRED\",\"FAILED\",\"CANCELLED\"","items":[{"const":"status"}],"additionalItems":{"title":"Filter the type of the status update to be notified","type":"string","enum":["COMPLETED","EXPIRED","FAILED","CANCELLED"]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","anyOf":[{"title":"Filter events by rule_ud exists. If it exists, it indicates that it's an auto-isolation job","const":"rule_id"}]},"not_exists":{"type":"string","anyOf":[{"title":"Filter events by rule_ud exists. If it exists, it indicates that it's an auto-isolation job","const":"rule_id"}]},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Record (notification/report) audit","properties":{"category":{"enum":["record_audit"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Record audit output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","record_type","record_name","record_action","timestamp","user_email","owner"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Record audit output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","record_type","record_name","record_action","timestamp","user_email","owner"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","additionalItems":false},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","anyOf":[{"title":"0: \"record_action\". 1: \"REPORT\", \"NOTIFICATION\", \"UPDATED\", \"DELETED\"","items":[{"const":"record_action"}],"additionalItems":{"title":"Filter events by record action","type":"string","enum":["REPORT","NOTIFICATION","UPDATED","DELETED"]}}]},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"MXDR integration communication inactive","properties":{"category":{"enum":["mxdr_integration_inactive"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"mxdr_integration_inactive output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","source","last_log_seen","inactive_hours"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"mxdr_integration_inactive output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","source","last_log_seen","inactive_hours"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"source\". 1: \"okta\", \"entra\", \"msgraphapi\", \"meraki\", \"watchguard\", \"fortinet\"","items":[{"const":"source"}],"additionalItems":{"title":"Filter events by source","type":"string","enum":["okta","entra","msgraphapi","meraki","watchguard","fortinet"]}},{"title":"0: \"inactive_hours\". 1: 1, 24","items":[{"const":"inactive_hours"}],"additionalItems":{"title":"Filter events by inactive_hours","type":"number","enum":[1,24]}}]},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Audit log activity","properties":{"category":{"enum":["audit_log_activity"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Audit log activity output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","user_id","user_name","action","patch_titles","application_names","expires_at","reason","ignore_rule_name","application_version","ignore_rule_applies_to"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Audit log activity output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","user_id","user_name","action","patch_titles","application_names","expires_at","reason","ignore_rule_name","application_version","ignore_rule_applies_to"]}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"resource_type\". 1: \"ignore_rule\"","items":[{"const":"resource_type"}],"additionalItems":{"title":"Filter events by resource type","type":"string","enum":["ignore_rule"]}},{"title":"0: \"action\". 1: \"create\", \"update\"","items":[{"const":"action"}],"additionalItems":{"title":"Filter events by action","type":"string","enum":["create","update"]}}]}}}}}}}}}}},{"title":"XDR alert","properties":{"category":{"enum":["xdr_alert"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"xdr_alert output fields","type":"array","minItems":1,"items":{"type":"string","enum":["source","severity","account_id","account_name","created_at","category","alert_id","rule_name","attack_category","attack_detection_type","identity_primary_identifier","identity_group_name"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"xdr_alert output fields","type":"array","minItems":1,"items":{"type":"string","enum":["source","severity","account_id","account_name","created_at","category","alert_id","rule_name","attack_category","attack_detection_type","identity_primary_identifier","identity_group_name"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","source"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"source\". 1: \"okta\", \"entra\", \"edr\"","items":[{"const":"source"}],"additionalItems":{"title":"Filter events by source","type":"string","enum":["okta","entra","edr"]}},{"title":"0: \"severity\". 1: \"information\", \"low\", \"medium\", \"high\", \"critical\"","items":[{"const":"severity"}],"additionalItems":{"title":"Filter events by severity","type":"string","enum":["information","low","medium","high","critical"]}},{"title":"0: \"attack_category\". 1: string","items":[{"const":"attack_category"}],"additionalItems":{"title":"Filter events by attack_category","type":"string"}},{"title":"0: \"identity_primary_identifier\". 1: string","items":[{"const":"identity_primary_identifier"}],"additionalItems":{"title":"Filter events by identity_primary_identifier","type":"string"}},{"title":"0: \"identity_group_name\". 1: string","items":[{"const":"identity_group_name"}],"additionalItems":{"title":"Filter events by identity_group_name","type":"string"}}]},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","anyOf":[{"title":"0: \"attack_category\". 1: string","items":[{"const":"attack_category"}],"additionalItems":{"title":"Filter events by attack_category","type":"string"}},{"title":"0: \"identity_primary_identifier\". 1: string","items":[{"const":"identity_primary_identifier"}],"additionalItems":{"title":"Filter events by identity_primary_identifier","type":"string"}},{"title":"0: \"identity_group_name\". 1: string","items":[{"const":"identity_group_name"}],"additionalItems":{"title":"Filter events by identity_group_name","type":"string"}}]},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Drive encryption","properties":{"category":{"enum":["drive_encryption"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Drive encryption output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","action","machine_name","policy_name","encryption_method","drive_label","timestamp"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Drive encryption output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","action","machine_name","policy_name","encryption_method","drive_label","timestamp"]}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"action\". 1: \"MACHINE_DRIVE_ENCRYPTION_ENCRYPTION_FAILED\", \"MACHINE_DRIVE_ENCRYPTION_SUSPENDED\", or \"MACHINE_DRIVE_ENCRYPTION_RECOVERY_DETECTED\"","items":[{"const":"action"}],"additionalItems":{"title":"Filter events by action type","type":"string","enum":["MACHINE_DRIVE_ENCRYPTION_ENCRYPTION_FAILED","MACHINE_DRIVE_ENCRYPTION_SUSPENDED","MACHINE_DRIVE_ENCRYPTION_RECOVERY_DETECTED"]}}]}}}}}}}}}}}],"if":{"properties":{"category":{"enum":["user_added","user_deleted","user_verified","license_over_deployment","css_capacity_approached","css_capacity_reached","css_capacity_exceeded"]}}},"then":{"properties":{"conditions":{"additionalProperties":false}}}},{"type":"object","properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]},{"allOf":[{"required":["name","category","delivery"],"properties":{"name":{"title":"Notification name. Must be unique","type":"string"},"description":{"title":"Notification description","type":"string","default":""},"category":{"title":"The category of the events to be notified","type":"string"},"delivery":{},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object"},"aggregation":{"title":"Aggregate multiple events in a single notifications","type":"object","properties":{"interval":{"title":"Interval in seconds for aggregating events in a single notification. It must be defined to apply aggregation","type":"integer","minimum":10,"maximum":86400}}},"enabled":{"title":"enable/disable notification","type":"boolean","default":true},"owner":{"title":"the identifier of the owner of the subscription","type":"string"}}},{"anyOf":[{"title":"OneView user added","properties":{"category":{"enum":["oneview_user_added"]},"delivery":{"anyOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"OneView user added output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","user_id","user_name","user_email","user_role","ip_address","timestamp","sites","invited_by_email"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["invited_by_email"]}}}}}},{"title":"OneView user verified","properties":{"category":{"enum":["oneview_user_verified"]},"delivery":{"anyOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"OneView user verified output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","user_id","user_name","user_email","ip_address","timestamp"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"Not available for this category","maxItems":0}}}}},{"title":"OneView user deleted","properties":{"category":{"enum":["oneview_user_deleted"]},"delivery":{"anyOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"OneView user deleted output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","user_id","user_name","user_email","user_role","ip_address","timestamp","sites","deleted_by_email"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["deleted_by_email"]}}}}}},{"title":"OneView sites assigned","allOf":[{"properties":{"category":{"enum":["oneview_sites_assigned"]},"delivery":{"anyOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"OneView sites assigned output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","user_id","user_name","user_email","user_role","ip_address","timestamp","sites","assigned_by_email","added_sites","removed_sites"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["assigned_by_email","user_email"]}}}}}},{"type":"object","properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]},{"title":"OneView trial to paid status","allOf":[{"properties":{"category":{"enum":["oneview_trial_to_paid_status"]},"delivery":{"anyOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"OneView trial to paid status output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","timestamp","max_protection","device_type","conversion_status","sites"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["device_type","conversion_status","max_protection"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"nebula_account_id\". 1: string","items":[{"const":"nebula_account_id"}],"additionalItems":{"title":"Filter events by nebula_account_id","type":"string"}},{"title":"0: \"conversion_status\". 1: \"FAILED\", \"SUCCESS\"","items":[{"const":"conversion_status"}],"additionalItems":{"title":"Filter events by conversion status","type":"string","enum":["FAILED","SUCCESS"]}}]},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""}}}}}}}}}}},{"type":"object","properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]},{"title":"OneView site end date approaching","properties":{"category":{"enum":["oneview_site_end_date_approaching"]},"delivery":{"anyOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"OneView site end date approachnig output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","timestamp","sites","days_left","site_end_date"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","maxItems":0}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"days_left\". 1: 0,1,7,14,30","items":[{"const":"days_left"}],"additionalItems":{"title":"Filter events by days left before the license expiration","type":"number","enum":[0,1,7,14,30]}}]},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""}}}}}}}}}}}]},{"if":{"properties":{"category":{"enum":["oneview_user_added","oneview_user_deleted","oneview_user_verified","oneview_sites_assigned"]}}},"then":{"properties":{"conditions":{"additionalProperties":false}}}}]}]},{"required":["id"],"properties":{"id":{"title":"Notification Id","type":"string"},"owner":{"title":"Notification owner","type":"string"},"account_id":{"title":"Account Id of the owner of the notification","type":"string"},"created_at":{"title":"Created at timestamp","format":"date-time"},"updated_at":{"title":"Updated at timestamp","format":"date-time"},"created_by":{"title":"Created by","type":"string"},"updated_by":{"title":"Created by","type":"string"}}}]}}}}},"tags":["Notifications"],"operationId":"api.v2.rmm.post.notification"},"get":{"description":"Get all notification subscriptions.","summary":"Get all notifications","security":[{"client_credentials":["read"]},{"user_permissions":["notifications.viewOwn"]}],"status":{"outage":["auth","webhooks_subscriptions"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}},{"name":"page_size","required":false,"in":"query","description":"The page_size Schema","schema":{"type":"string","pattern":"^(?:[1-9][0-9]{0,2}|1[0-9]{3}|2000)$"}},{"name":"next_cursor","required":false,"in":"query","description":"The pagination cursor for next set of results. For further documentation, check Pagination section.","schema":{"type":"string"}},{"name":"only_current_owner","required":false,"in":"query","description":"if true, only the notifications subscriptions owned by the requester will be returned","schema":{"type":"boolean"}},{"name":"parent_account_id","required":false,"in":"query","description":"the subscriptions' account_id. This is required to access notifications subscriptions for a different owner, but in the same account (requires super admin permission).","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"The get all notification Body","required":["records","next_cursor"],"properties":{"records":{"type":"array","items":{"type":"object","title":"RMM notification response","allOf":[{"type":"object","title":"The Schema For Notifications Creation","anyOf":[{"allOf":[{"type":"object","title":"The create notification Body","required":["name","category","delivery"],"properties":{"name":{"title":"Notification name. Must be unique","type":"string"},"description":{"title":"Notification description","type":"string","default":""},"category":{"title":"The category of the events to be notified","type":"string"},"delivery":{},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object"},"aggregation":{"title":"Aggregate multiple events in a single notifications","type":"object","properties":{"interval":{"title":"Interval in seconds for aggregating events in a single notification. It must be defined to apply aggregation","type":"integer","minimum":10,"maximum":86400}}},"enabled":{"title":"enable/disable notification","type":"boolean","default":true},"owner":{"title":"the identifier of the owner of the subscription. Not available for read-only users","type":"string"}},"anyOf":[{"title":"Detections","properties":{"category":{"enum":["threat_detections"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Detections output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","os_release_name","os_platform","os_type","os_version","category","type","path","status","scanned_at","reported_at","resource_created_at","resource_modified_at","threat_name","affected_application","process_name","machine_id","machine_name","machine_ip","group_id","group_name","policy_id","policy_name","nics","md5","sha256","engine_version","last_user","active_directory_ou","id"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Detections output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","os_release_name","os_platform","os_type","os_version","category","type","path","status","scanned_at","reported_at","resource_created_at","resource_modified_at","threat_name","affected_application","process_name","machine_id","machine_name","machine_ip","group_id","group_name","policy_id","policy_name","nics","md5","sha256","engine_version","last_user","active_directory_ou","id"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","affected_application","category","group_id","group_name","machine_id","machine_ip","machine_name","os_platform","os_release_name","path","policy_id","policy_name","process_name","status","threat_name","type"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"category\". 1: \"MALWARE\",\"PUP\",\"PUM\",\"AE\",\"ARW\",\"MWAC\",\"RID\",\"VULNERABLE_DRIVER\"","items":[{"const":"category"}],"additionalItems":{"title":"Filter events by detection category","type":"string","enum":["MALWARE","PUP","PUM","AE","ARW","MWAC","RID","VULNERABLE_DRIVER"]}},{"title":"0: \"action\". 1: \"blocked\", \"deleted\", \"deletedAutoPrune\", \"found\", \"quarantined\", \"restored\"","items":[{"const":"action"}],"additionalItems":{"title":"Filter events by action","type":"string","enum":["blocked","deleted","deletedAutoPrune","found","quarantined","restored"]}},{"title":"0: \"threat_name\". 1: string","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux), \"4\"(Android), \"3\"(IOS), \"3\"(ChromeOS)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3,4,5,6]}},{"title":"0: \"rtp\". 1: true, false","items":[{"const":"rtp"},{"title":"Filter events by real time protection"}],"additionalItems":false,"if":{"items":[{"const":"rtp"}]},"then":{"items":[{"const":"rtp"},{"type":"boolean"}]}},{"title":"0: \"type\". 1: \"application\", \"exploit\", \"extension\", \"file\", \"folder\", \"InboundConnection\", \"module\", \"OutboundConnection\", \"process\", \"reg_key\", \"reg_value\"","items":[{"const":"type"}],"additionalItems":{"title":"Filter events by type","type":"string","enum":["application","exploit","extension","file","folder","InboundConnection","module","OutboundConnection","process","reg_key","reg_value"]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"threat_name\". 1: string","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","anyOf":[{"title":"0: \"threat_name\". 1: string","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_contains":{"type":"array","anyOf":[{"title":"0: \"threat_name\". 1: string","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"begins_with":{"title":"0: \"threat_name\". 1: string","type":"array","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Suspicious activity","properties":{"category":{"enum":["threat_suspicious_activity"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Suspicious activity","type":"array","minItems":1,"items":{"type":"string","enum":["severity","account_id","account_name","os_release_name","os_platform","type","path","status","scanned_at","reported_at","threat_name","machine_id","machine_name","machine_ip","group_id","group_name","policy_id","policy_name","nics","last_user","first_activity","last_activity","isolation_type","id"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Suspicious activity","type":"array","minItems":1,"items":{"type":"string","enum":["severity","account_id","account_name","os_release_name","os_platform","type","path","status","scanned_at","reported_at","threat_name","machine_id","machine_name","machine_ip","group_id","group_name","policy_id","policy_name","nics","last_user","first_activity","last_activity","isolation_type","id"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","group_id","group_name","machine_id","machine_ip","machine_name","os_platform","os_release_name","path","policy_id","policy_name","severity","status","threat_name"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"level\". 1: \"low\", \"medium\", \"high\", \"critical\"","items":[{"const":"level"}],"additionalItems":{"title":"Filter events by severity level","type":"string","enum":["low","medium","high","critical"]}},{"title":"0: \"threat_name\". 1: string","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux), \"4\"(Android), \"3\"(IOS), \"3\"(ChromeOS)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3,4,5,6]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"threat_name\". 1: string","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"contains":{"title":"0: \"threat_name\". 1: string","type":"array","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},"not_contains":{"title":"0: \"threat_name\". 1: string","type":"array","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},"begins_with":{"title":"0: \"threat_name\". 1: string","type":"array","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},"exists":{"type":"string","anyOf":[{"title":"Filter events by isolation_type exists","const":"isolation_type"}]},"not_exists":{"anyOf":[{"title":"Filter events by isolation_type not exists","const":"isolation_type"}]},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"User added","properties":{"category":{"enum":["user_added"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"User added","type":"array","minItems":1,"items":{"type":"string","enum":["ip_address","invited_by","role","email","full_group_access","timestamp","account_id"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"User added","type":"array","minItems":1,"items":{"type":"string","enum":["ip_address","invited_by","role","email","full_group_access","timestamp","account_id"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","invited_by","ip_address","role"]}}}}}},{"title":"User deleted","properties":{"category":{"enum":["user_deleted"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"User deleted output fields","type":"array","minItems":1,"items":{"type":"string","enum":["ip_address","timestamp","account_id","deleted_by","email"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"User deleted output fields","type":"array","minItems":1,"items":{"type":"string","enum":["ip_address","timestamp","account_id","deleted_by","email"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","ip_address","deleted_by"]}}}}}},{"title":"User verified","properties":{"category":{"enum":["user_verified"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"User verified","type":"array","minItems":1,"items":{"type":"string","enum":["email","timestamp","account_id"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"User verified","type":"array","minItems":1,"items":{"type":"string","enum":["email","timestamp","account_id"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name"]}}}}}},{"title":"Endpoint registered","properties":{"category":{"enum":["endpoint_registered"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Endpoint registered output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","created_at"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Endpoint registered output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","created_at"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Endpoint deleted","properties":{"category":{"enum":["endpoint_unregistered"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Endpoint deleted output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","timestamp","timeout"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Endpoint deleted output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","timestamp","timeout"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"timeout\". 1: true, false","items":[{"const":"timeout"},{"title":"Filter events by timeout (true if the machine was deleted because marked_for_deletion and never connected again until a timeout)"}],"additionalItems":false,"if":{"items":[{"const":"timeout"}]},"then":{"items":[{"const":"timeout"},{"type":"boolean"}]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Command update","properties":{"category":{"enum":["endpoint_command_update"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Command update output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","command","status","created_at","updated_at","expires_at","machine_id","machine_name","group_id","active_directory_ou"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Command update output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","command","status","created_at","updated_at","expires_at","machine_id","machine_name","group_id","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","command","status","machine_id","machine_name"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"status\". 1: \"CREATED\",\"SENT\",\"RECEIVED\",\"STARTED\",\"TIMED_OUT\",\"COMPLETED\",\"EXPIRED\",\"FAILED\",\"CANCELLED\"","items":[{"const":"status"}],"additionalItems":{"title":"Filter the type of the machine_events to be notified","type":"string","enum":["CREATED","SENT","RECEIVED","STARTED","TIMED_OUT","COMPLETED","EXPIRED","FAILED","CANCELLED"]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Quarantine","properties":{"category":{"enum":["quarantine"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Quarantine output fields","type":"array","minItems":1,"items":{"type":"string","enum":["path","machine_name","created_at","status"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Quarantine output fields","type":"array","minItems":1,"items":{"type":"string","enum":["path","machine_name","created_at","status"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","status"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","title":"0: \"quarantine_action\". 1: \"QUARANTINE_DELETED\",\"QUARANTINE_RESTORED\"","items":[{"const":"quarantine_action"}],"additionalItems":{"title":"Filter the type of the quarantine_events to be notified","type":"string","enum":["QUARANTINE_DELETED","QUARANTINE_RESTORED"]}},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Threat scan","properties":{"category":{"enum":["threat_scan"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Threat scan output_fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","scan_date","scan_id","machine_id","machine_name","group_id","group_name","policy_id","policy_name","ip_address","detections","active_directory_ou"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Threat scan output_fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","scan_date","scan_id","machine_id","machine_name","group_id","group_name","policy_id","policy_name","ip_address","detections","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","ip_address","policy_id","policy_name"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"action\". 1: \"THREAT_CLEANED\",\"THREAT_FOUND\"","items":[{"const":"action"}],"additionalItems":{"title":"Filter events by threat activity action","type":"string","enum":["THREAT_CLEANED","THREAT_FOUND"]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Device control","properties":{"category":{"enum":["device_control"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Device control output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version","path","date","action","device_name","manufacturer","volume_serial","serial_number","physical_disk_name","disk_interface","file_system","volume_name","volume_device_path","last_user","active_directory_ou"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Device control output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version","path","date","action","device_name","manufacturer","volume_serial","serial_number","physical_disk_name","disk_interface","file_system","volume_name","volume_device_path","last_user","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","group_id","group_name","machine_id","machine_name","os_platform","os_release_name","policy_id","policy_name"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"action\". 1: \"blocked\", \"read-only\"","items":[{"const":"action"}],"additionalItems":{"title":"Filter events by action","type":"string","enum":["blocked","read-only"]}},{"title":"0: \"device_name\". 1: string","items":[{"const":"device_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"manufacturer\". 1: string","items":[{"const":"manufacturer"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"device_name\". 1: string","items":[{"const":"device_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"manufacturer\". 1: string","items":[{"const":"manufacturer"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","anyOf":[{"title":"0: \"device_name\". 1: string","items":[{"const":"device_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"manufacturer\". 1: string","items":[{"const":"manufacturer"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_contains":{"type":"array","anyOf":[{"title":"0: \"device_name\". 1: string","items":[{"const":"device_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"manufacturer\". 1: string","items":[{"const":"manufacturer"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Site end date","properties":{"category":{"enum":["license_expiring"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Site end date output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status","licensed_seats","used_seats","license_key","catalog_code","combo_product","licensed_product","license_expires_at","days_left"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Site end date output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status","licensed_seats","used_seats","license_key","catalog_code","combo_product","licensed_product","license_expires_at","days_left"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"days_left\". 1: 0,1,3,5,7,14,30","items":[{"const":"days_left"}],"additionalItems":{"title":"Filter events by days left before the license expiration","type":"number","enum":[0,1,3,5,7,14,30]}},{"title":"0: \"license_term_type\". 1: \"cloud_evaluation\",\"evaluation\",\"freemium\",\"nfr\",\"site_license\",\"subscription\",\"utility\"","items":[{"const":"license_term_type"}],"additionalItems":{"title":"Filter events by license term type","type":"string","enum":["cloud_evaluation","evaluation","freemium","nfr","site_license","subscription","utility"]}}]},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Site over deployed","properties":{"category":{"enum":["license_over_deployment"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Site over deployed output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status","licensed_seats","used_seats","license_key","catalog_code","combo_product"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Site over deployed output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status","licensed_seats","used_seats","license_key","catalog_code","combo_product"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"license_term_type\". 1: \"cloud_evaluation\",\"evaluation\",\"freemium\",\"nfr\",\"site_license\",\"subscription\",\"utility\"","items":[{"const":"license_term_type"}],"additionalItems":{"title":"Filter events by license term type","type":"string","enum":["cloud_evaluation","evaluation","freemium","nfr","site_license","subscription","utility"]}}]},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Vulnerability status","properties":{"category":{"enum":["cve_found"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Vulnerability status output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","product","vendor","installed_version","machine_id","machine_name","group_id","group_name","policy_id","policy_name","cve_id","severity","created_at","os_platform","os_release_name","os_version","cisa_exploitable","known_ransomware_campaign_use","description","published_at","severity_score","active_directory_ou"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Vulnerability status output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","product","vendor","installed_version","machine_id","machine_name","group_id","group_name","policy_id","policy_name","cve_id","severity","created_at","os_platform","os_release_name","os_version","cisa_exploitable","known_ransomware_campaign_use","description","published_at","severity_score","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","cve_id","product","os_platform"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"severity\". 1: \"unknown\",\"low\",\"medium\",\"high\",\"critical\"","items":[{"const":"severity"}],"additionalItems":{"title":"Filter events by severity","type":"string","enum":["unknown","low","medium","high","critical"]}},{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"cisa_exploitable\". 1: true, false","items":[{"const":"cisa_exploitable"},{"title":"Filter events by CISA exploitable"}],"additionalItems":false,"if":{"items":[{"const":"cisa_exploitable"}]},"then":{"items":[{"const":"cisa_exploitable"},{"type":"boolean"}]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","anyOf":[{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_contains":{"type":"array","anyOf":[{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","anyOf":[{"title":"Filter events by available patch exists","const":"available_patch"}]},"not_exists":{"type":"string","anyOf":[{"title":"Filter events by available patch not exists","const":"available_patch"}]},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"CVE Ignored","properties":{"category":{"enum":["cve_ignored"]},"delivery":{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}},"output_fields":{"title":"CVE Ignored output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","cve_id","ignored_reason","display_product","ignored_at","ignored_until","ignored_by","ignored_by_name"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","cve_id"]}}}}}},{"title":"Patch applied","properties":{"category":{"enum":["patch_applied"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Patch applied output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","title","description","product","vendor","severity","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_version","reboot_required","preview_patch","date","status","category","active_directory_ou"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Patch applied output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","title","description","product","vendor","severity","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_version","reboot_required","preview_patch","date","status","category","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","os_platform"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"status\". 1: \"COMPLETED\",\"FAILED\",\"REBOOT_REQUIRED\"","items":[{"const":"status"}],"additionalItems":{"title":"Filter events by status","type":"string","enum":["COMPLETED","FAILED","REBOOT_REQUIRED"]}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"preview_patch\". 1: true, false","items":[{"const":"preview_patch"},{"title":"Filter events by preview_patch"}],"additionalItems":false,"if":{"items":[{"const":"preview_patch"}]},"then":{"items":[{"const":"preview_patch"},{"type":"boolean"}]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Software update applied","properties":{"category":{"enum":["software_update"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Software update applied output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","product","vendor","current_version","new_version","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_version","date","status","signature_id","active_directory_ou"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Software update applied output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","product","vendor","current_version","new_version","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_version","date","status","signature_id","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","os_platform"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"status\". 1: \"COMPLETED\",\"FAILED\"","items":[{"const":"status"}],"additionalItems":{"title":"Filter events by status","type":"string","enum":["COMPLETED","FAILED"]}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Patch or software update available","properties":{"category":{"enum":["patch_available"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Patch or software update available","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","title","description","product","vendor","severity","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_version","reboot_required","preview_patch","date","category","patch_id","kb_id","released_at","size","active_directory_ou"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Patch or software update available","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","title","description","product","vendor","severity","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_version","reboot_required","preview_patch","date","category","patch_id","kb_id","released_at","size","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","os_platform"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"severity\". 1: \"unknown\",\"moderate\",\"low\",\"important\",\"critical\"","items":[{"const":"severity"}],"additionalItems":{"title":"Filter events by severity","type":"string","enum":["unknown","moderate","low","important","critical"]}},{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"reboot_required\". 1: true, false","items":[{"const":"reboot_required"},{"title":"Filter events by reboot_required"}],"additionalItems":false,"if":{"items":[{"const":"reboot_required"}]},"then":{"items":[{"const":"reboot_required"},{"type":"boolean"}]}},{"title":"0: \"preview_patch\". 1: true, false","items":[{"const":"preview_patch"},{"title":"Filter events by preview_patch"}],"additionalItems":false,"if":{"items":[{"const":"preview_patch"}]},"then":{"items":[{"const":"preview_patch"},{"type":"boolean"}]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","anyOf":[{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_contains":{"type":"array","anyOf":[{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"begins_with":{"type":"array","anyOf":[{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}}]},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"CSS detection","properties":{"category":{"enum":["css_detection"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"CSS detection output fields","minItems":1,"type":"array","items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name","file_name","css_threat_name","action_taken","file_location","file_owner","timestamp"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"CSS detection output fields","minItems":1,"type":"array","items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name","file_name","css_threat_name","action_taken","file_location","file_owner","timestamp"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","action_taken","cloud_provider","scan_configuration_name"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"action_taken\". 1: \"Found\", \"Quarantined\"","items":[{"const":"action_taken"}],"additionalItems":{"title":"Filter events by action taken","type":"string","enum":["Found","Quarantined"]}},{"title":"0: \"cloud_provider\". 1: \"BOX\", \"ONEDRIVE\", \"GOOGLEDRIVE\"","items":[{"const":"cloud_provider"}],"additionalItems":{"title":"Filter events by cloud provider","type":"string","enum":["BOX","ONEDRIVE","GOOGLEDRIVE"]}},{"title":"0: \"scan_configuration_name\". 1: string","items":[{"const":"scan_configuration_name"}],"additionalItems":{"title":"Filter events by scan configuration name","type":"string"}}]},"not_eq":{"type":"array","title":"0: \"scan_configuration_name\". 1: string","items":[{"const":"scan_configuration_name"}],"additionalItems":{"title":"Filter events by scan_configuration_name","type":"string"}},"contains":{"title":"0: \"scan_configuration_name\". 1: string","type":"array","items":[{"const":"scan_configuration_name"}],"additionalItems":{"title":"Filter events by scan_configuration_name","type":"string"}},"not_contains":{"title":"0: \"scan_configuration_name\". 1: string","type":"array","items":[{"const":"scan_configuration_name"}],"additionalItems":{"title":"Filter events by scan_configuration_name","type":"string"}},"begins_with":{"title":"0: \"scan_configuration_name\". 1: string","type":"array","items":[{"const":"scan_configuration_name"}],"additionalItems":{"title":"Filter events by scan_configuration_name","type":"string"}},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"CSS capacity approached","properties":{"category":{"enum":["css_capacity_approached"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"CSS capacity approached output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name","timestamp"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"CSS capacity approached output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name","timestamp"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name"]}}}}}},{"title":"CSS capacity reached","properties":{"category":{"enum":["css_capacity_reached"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"CSS capacity reached output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name","timestamp"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"CSS capacity reached output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name","timestamp"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name"]}}}}}},{"title":"CSS capacity exceeded","properties":{"category":{"enum":["css_capacity_exceeded"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"CSS capacity exceeded output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name","timestamp"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"CSS capacity exceeded output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name","timestamp"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name"]}}}}}},{"title":"DNS blocked","properties":{"category":{"enum":["dns_blocked"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"DNS blocked output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","timestamp","group_id","group_name","policy_id","policy_name","colo_id","device_id","user_id","dst_ip","src_ip","email","location","policy","rule_name","action","protocol","query_name","query_name_reversed","resolver_decision","query_category_ids","query_size","query_type","src_port","dst_port","os_platform","os_release_name","os_type","os_version","os_architecture"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"DNS blocked output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","timestamp","group_id","group_name","policy_id","policy_name","colo_id","device_id","user_id","dst_ip","src_ip","email","location","policy","rule_name","action","protocol","query_name","query_name_reversed","resolver_decision","query_category_ids","query_size","query_type","src_port","dst_port","os_platform","os_release_name","os_type","os_version","os_architecture"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"policy_id\". 1: string","items":[{"const":"policy_id"}],"additionalItems":{"title":"Filter events by policy_id","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"policy_id\". 1: string","items":[{"const":"policy_id"}],"additionalItems":{"title":"Filter events by policy_id","type":"string"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Case management","properties":{"category":{"enum":["siemplify_case"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Case management output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","case_id","case_name","case_status","case_created_at","priority","action_required","event","endpoints","detections"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Case management output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","case_id","case_name","case_status","case_created_at","priority","action_required","event","endpoints","detections"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","case_id"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"event\". 1: \"case_created\",\"case_updated\",\"case_closed\"","items":[{"const":"event"}],"additionalItems":{"title":"Filter events by status","type":"string","enum":["case_created","case_updated","case_closed"]}},{"title":"0: \"priority\". 1: \"Critical\", \"High\", \"Medium\", \"Low\"","items":[{"const":"priority"}],"additionalItems":{"title":"Filter events by status","type":"string","enum":["Critical","High","Medium","Low"]}},{"title":"0: \"action_required\". 1: true, false","items":[{"const":"action_required"},{"title":"Filter events by CISA exploitable"}],"additionalItems":false,"if":{"items":[{"const":"action_required"}]},"then":{"items":[{"const":"action_required"},{"type":"boolean"}]}}]},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Application block","properties":{"category":{"enum":["app_block"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Application block output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","app_block_rules","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version","scanned_at","file_path","last_user","active_directory_ou"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Application block output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","app_block_rules","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version","scanned_at","file_path","last_user","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"policy_id\". 1: string","items":[{"const":"policy_id"}],"additionalItems":{"title":"Filter events by policy_id","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"policy_id\". 1: string","items":[{"const":"policy_id"}],"additionalItems":{"title":"Filter events by policy_id","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","additionalItems":false},"lte":{"type":"array","const":""},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Entitlement changed","properties":{"category":{"enum":["license_entitlement_changed"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Entitlement changed output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status","licensed_seats","used_seats","license_key","catalog_code","combo_product","licensed_product","license_expires_at","license_key_status","auto_renew","status"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Entitlement changed output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status","licensed_seats","used_seats","license_key","catalog_code","combo_product","licensed_product","license_expires_at","license_key_status","auto_renew","status"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"status\". 1: \"added\",\"updated\",\"removed\"","items":[{"const":"status"}],"additionalItems":{"title":"Filter events by status","type":"string","enum":["added","updated","removed"]}},{"title":"0: \"license_term_type\". 1: \"cloud_evaluation\",\"evaluation\",\"freemium\",\"nfr\",\"site_license\",\"subscription\",\"utility\"","items":[{"const":"license_term_type"}],"additionalItems":{"title":"Filter events by license term type","type":"string","enum":["cloud_evaluation","evaluation","freemium","nfr","site_license","subscription","utility"]}}]},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Entitlement usage changed","properties":{"category":{"enum":["license_entitlement_usage_changed"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Entitlement usage changed output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status","licensed_seats","used_seats","license_key","catalog_code","combo_product","licensed_product","license_expires_at","license_key_status","auto_renew"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Entitlement usage changed output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status","licensed_seats","used_seats","license_key","catalog_code","combo_product","licensed_product","license_expires_at","license_key_status","auto_renew"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","title":"0: \"license_term_type\". 1: \"cloud_evaluation\",\"evaluation\",\"freemium\",\"nfr\",\"site_license\",\"subscription\",\"utility\"","items":[{"const":"license_term_type"}],"additionalItems":{"title":"Filter events by license term type","type":"string","enum":["cloud_evaluation","evaluation","freemium","nfr","site_license","subscription","utility"]}},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Endpoint status changed","properties":{"category":{"enum":["endpoint_status_changed"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Endpoint status changed","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","status_change","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version","codes"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Endpoint status changed","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","status_change","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version","codes"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","status_change","machine_id","machine_name"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"status_change\". 1: \"ENDPOINT_REBOOT_REQUIRED\",\"ENDPOINT_REBOOT_REQUIRED_CLEARED\",\"ENDPOINT_INFECTED\",\"ENDPOINT_REMEDIATED\",\"ENDPOINT_ISOLATED\",\"ENDPOINT_UNISOLATED\",\"ENDPOINT_SUSPICIOUS_ACTIVITY_FOUND\",\"ENDPOINT_SUSPICIOUS_ACTIVITY_CLEARED\",\"AGENT_ALERTS_CHANGED\"","items":[{"const":"status_change"}],"additionalItems":{"title":"Filter the type of status_change to be notified","type":"string","enum":["ENDPOINT_REBOOT_REQUIRED","ENDPOINT_REBOOT_REQUIRED_CLEARED","ENDPOINT_INFECTED","ENDPOINT_REMEDIATED","ENDPOINT_ISOLATED","ENDPOINT_UNISOLATED","ENDPOINT_SUSPICIOUS_ACTIVITY_FOUND","ENDPOINT_SUSPICIOUS_ACTIVITY_CLEARED","AGENT_ALERTS_CHANGED"]}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Inactive endpoint","properties":{"category":{"enum":["inactive_endpoint"]},"delivery":{"properties":{"output_fields":{"title":"Information to include in the JSON body. If omitted, include all","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version","last_seen_at"]}}}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"os_type\". 1: \"1\"(Workstation), \"2\"(Server), \"3\"(Mobile)","items":[{"const":"os_type"}],"additionalItems":{"title":"Filter events by OS type","type":"number","enum":[1,2,3]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"policy_id\". 1: string","items":[{"const":"policy_id"}],"additionalItems":{"title":"Filter events by policy_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"contains":{"type":"array","anyOf":[{"title":"0: \"policy_name\". 1: string","items":[{"const":"policy_name"}],"additionalItems":{"title":"Filter events by policy_name","type":"string"}},{"title":"0: \"group_name\". 1: string","items":[{"const":"group_name"}],"additionalItems":{"title":"Filter events by group_name","type":"string"}}]},"not_contains":{"type":"array","anyOf":[{"title":"0: \"policy_name\". 1: string","items":[{"const":"policy_name"}],"additionalItems":{"title":"Filter events by policy_name","type":"string"}},{"title":"0: \"group_name\". 1: string","items":[{"const":"group_name"}],"additionalItems":{"title":"Filter events by group_name","type":"string"}}]},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","anyOf":[{"title":"0: \"last_seen_at\"","items":[{"const":"last_seen_at"}],"additionalItems":{"title":"Filter inactive machines by less than equals days since last active","type":"number","minimum":1}}]},"gte":{"type":"array","anyOf":[{"title":"0: \"last_seen_at\"","items":[{"const":"last_seen_at"}],"additionalItems":{"title":"Filter inactive machines by less than equals days since last active","type":"number","minimum":1}}]}}}}}}}}}}},{"title":"Firewall activity","properties":{"category":{"enum":["firewall_activity"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Firewall activity output fields","type":"array","minItems":1,"items":{"type":"string","enum":["start_time","end_time","rule_id","rule_name","ruleset_id","ruleset_name","direction","action","protocol","location","program","service","hits","account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Firewall activity output fields","type":"array","minItems":1,"items":{"type":"string","enum":["start_time","end_time","rule_id","rule_name","ruleset_id","ruleset_name","direction","action","protocol","location","program","service","hits","account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"action\". 1: \"ALLOW\", \"BLOCK\"","items":[{"const":"action"}],"additionalItems":{"title":"Filter events by action","type":"string","enum":["ALLOW","BLOCK"]}},{"title":"0: \"direction\". 1: \"Inbound\", \"Outbound\"","items":[{"const":"direction"}],"additionalItems":{"title":"Filter events by direction","type":"string","enum":["Inbound","Outbound"]}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"policy_id\". 1: string","items":[{"const":"policy_id"}],"additionalItems":{"title":"Filter events by policy_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"policy_id\". 1: string","items":[{"const":"policy_id"}],"additionalItems":{"title":"Filter events by policy_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Endpoint isolation","properties":{"category":{"enum":["endpoint_isolation"]},"delivery":{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}},"output_fields":{"title":"Endpoint isolation output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","status","created_at","updated_at","expires_at","machine_id","machine_name","os_release_name","os_platform","os_type","os_version","rule_id","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","status","machine_id","machine_name"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"status\". 1: \"COMPLETED\",\"EXPIRED\",\"FAILED\",\"CANCELLED\"","items":[{"const":"status"}],"additionalItems":{"title":"Filter the type of the status update to be notified","type":"string","enum":["COMPLETED","EXPIRED","FAILED","CANCELLED"]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","anyOf":[{"title":"Filter events by rule_ud exists. If it exists, it indicates that it's an auto-isolation job","const":"rule_id"}]},"not_exists":{"type":"string","anyOf":[{"title":"Filter events by rule_ud exists. If it exists, it indicates that it's an auto-isolation job","const":"rule_id"}]},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Record (notification/report) audit","properties":{"category":{"enum":["record_audit"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Record audit output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","record_type","record_name","record_action","timestamp","user_email","owner"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Record audit output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","record_type","record_name","record_action","timestamp","user_email","owner"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","additionalItems":false},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","anyOf":[{"title":"0: \"record_action\". 1: \"REPORT\", \"NOTIFICATION\", \"UPDATED\", \"DELETED\"","items":[{"const":"record_action"}],"additionalItems":{"title":"Filter events by record action","type":"string","enum":["REPORT","NOTIFICATION","UPDATED","DELETED"]}}]},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"MXDR integration communication inactive","properties":{"category":{"enum":["mxdr_integration_inactive"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"mxdr_integration_inactive output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","source","last_log_seen","inactive_hours"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"mxdr_integration_inactive output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","source","last_log_seen","inactive_hours"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"source\". 1: \"okta\", \"entra\", \"msgraphapi\", \"meraki\", \"watchguard\", \"fortinet\"","items":[{"const":"source"}],"additionalItems":{"title":"Filter events by source","type":"string","enum":["okta","entra","msgraphapi","meraki","watchguard","fortinet"]}},{"title":"0: \"inactive_hours\". 1: 1, 24","items":[{"const":"inactive_hours"}],"additionalItems":{"title":"Filter events by inactive_hours","type":"number","enum":[1,24]}}]},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Audit log activity","properties":{"category":{"enum":["audit_log_activity"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Audit log activity output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","user_id","user_name","action","patch_titles","application_names","expires_at","reason","ignore_rule_name","application_version","ignore_rule_applies_to"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Audit log activity output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","user_id","user_name","action","patch_titles","application_names","expires_at","reason","ignore_rule_name","application_version","ignore_rule_applies_to"]}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"resource_type\". 1: \"ignore_rule\"","items":[{"const":"resource_type"}],"additionalItems":{"title":"Filter events by resource type","type":"string","enum":["ignore_rule"]}},{"title":"0: \"action\". 1: \"create\", \"update\"","items":[{"const":"action"}],"additionalItems":{"title":"Filter events by action","type":"string","enum":["create","update"]}}]}}}}}}}}}}},{"title":"XDR alert","properties":{"category":{"enum":["xdr_alert"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"xdr_alert output fields","type":"array","minItems":1,"items":{"type":"string","enum":["source","severity","account_id","account_name","created_at","category","alert_id","rule_name","attack_category","attack_detection_type","identity_primary_identifier","identity_group_name"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"xdr_alert output fields","type":"array","minItems":1,"items":{"type":"string","enum":["source","severity","account_id","account_name","created_at","category","alert_id","rule_name","attack_category","attack_detection_type","identity_primary_identifier","identity_group_name"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","source"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"source\". 1: \"okta\", \"entra\", \"edr\"","items":[{"const":"source"}],"additionalItems":{"title":"Filter events by source","type":"string","enum":["okta","entra","edr"]}},{"title":"0: \"severity\". 1: \"information\", \"low\", \"medium\", \"high\", \"critical\"","items":[{"const":"severity"}],"additionalItems":{"title":"Filter events by severity","type":"string","enum":["information","low","medium","high","critical"]}},{"title":"0: \"attack_category\". 1: string","items":[{"const":"attack_category"}],"additionalItems":{"title":"Filter events by attack_category","type":"string"}},{"title":"0: \"identity_primary_identifier\". 1: string","items":[{"const":"identity_primary_identifier"}],"additionalItems":{"title":"Filter events by identity_primary_identifier","type":"string"}},{"title":"0: \"identity_group_name\". 1: string","items":[{"const":"identity_group_name"}],"additionalItems":{"title":"Filter events by identity_group_name","type":"string"}}]},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","anyOf":[{"title":"0: \"attack_category\". 1: string","items":[{"const":"attack_category"}],"additionalItems":{"title":"Filter events by attack_category","type":"string"}},{"title":"0: \"identity_primary_identifier\". 1: string","items":[{"const":"identity_primary_identifier"}],"additionalItems":{"title":"Filter events by identity_primary_identifier","type":"string"}},{"title":"0: \"identity_group_name\". 1: string","items":[{"const":"identity_group_name"}],"additionalItems":{"title":"Filter events by identity_group_name","type":"string"}}]},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Drive encryption","properties":{"category":{"enum":["drive_encryption"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Drive encryption output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","action","machine_name","policy_name","encryption_method","drive_label","timestamp"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Drive encryption output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","action","machine_name","policy_name","encryption_method","drive_label","timestamp"]}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"action\". 1: \"MACHINE_DRIVE_ENCRYPTION_ENCRYPTION_FAILED\", \"MACHINE_DRIVE_ENCRYPTION_SUSPENDED\", or \"MACHINE_DRIVE_ENCRYPTION_RECOVERY_DETECTED\"","items":[{"const":"action"}],"additionalItems":{"title":"Filter events by action type","type":"string","enum":["MACHINE_DRIVE_ENCRYPTION_ENCRYPTION_FAILED","MACHINE_DRIVE_ENCRYPTION_SUSPENDED","MACHINE_DRIVE_ENCRYPTION_RECOVERY_DETECTED"]}}]}}}}}}}}}}}],"if":{"properties":{"category":{"enum":["user_added","user_deleted","user_verified","license_over_deployment","css_capacity_approached","css_capacity_reached","css_capacity_exceeded"]}}},"then":{"properties":{"conditions":{"additionalProperties":false}}}},{"type":"object","properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]},{"allOf":[{"required":["name","category","delivery"],"properties":{"name":{"title":"Notification name. Must be unique","type":"string"},"description":{"title":"Notification description","type":"string","default":""},"category":{"title":"The category of the events to be notified","type":"string"},"delivery":{},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object"},"aggregation":{"title":"Aggregate multiple events in a single notifications","type":"object","properties":{"interval":{"title":"Interval in seconds for aggregating events in a single notification. It must be defined to apply aggregation","type":"integer","minimum":10,"maximum":86400}}},"enabled":{"title":"enable/disable notification","type":"boolean","default":true},"owner":{"title":"the identifier of the owner of the subscription","type":"string"}}},{"anyOf":[{"title":"OneView user added","properties":{"category":{"enum":["oneview_user_added"]},"delivery":{"anyOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"OneView user added output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","user_id","user_name","user_email","user_role","ip_address","timestamp","sites","invited_by_email"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["invited_by_email"]}}}}}},{"title":"OneView user verified","properties":{"category":{"enum":["oneview_user_verified"]},"delivery":{"anyOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"OneView user verified output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","user_id","user_name","user_email","ip_address","timestamp"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"Not available for this category","maxItems":0}}}}},{"title":"OneView user deleted","properties":{"category":{"enum":["oneview_user_deleted"]},"delivery":{"anyOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"OneView user deleted output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","user_id","user_name","user_email","user_role","ip_address","timestamp","sites","deleted_by_email"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["deleted_by_email"]}}}}}},{"title":"OneView sites assigned","allOf":[{"properties":{"category":{"enum":["oneview_sites_assigned"]},"delivery":{"anyOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"OneView sites assigned output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","user_id","user_name","user_email","user_role","ip_address","timestamp","sites","assigned_by_email","added_sites","removed_sites"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["assigned_by_email","user_email"]}}}}}},{"type":"object","properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]},{"title":"OneView trial to paid status","allOf":[{"properties":{"category":{"enum":["oneview_trial_to_paid_status"]},"delivery":{"anyOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"OneView trial to paid status output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","timestamp","max_protection","device_type","conversion_status","sites"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["device_type","conversion_status","max_protection"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"nebula_account_id\". 1: string","items":[{"const":"nebula_account_id"}],"additionalItems":{"title":"Filter events by nebula_account_id","type":"string"}},{"title":"0: \"conversion_status\". 1: \"FAILED\", \"SUCCESS\"","items":[{"const":"conversion_status"}],"additionalItems":{"title":"Filter events by conversion status","type":"string","enum":["FAILED","SUCCESS"]}}]},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""}}}}}}}}}}},{"type":"object","properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]},{"title":"OneView site end date approaching","properties":{"category":{"enum":["oneview_site_end_date_approaching"]},"delivery":{"anyOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"OneView site end date approachnig output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","timestamp","sites","days_left","site_end_date"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","maxItems":0}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"days_left\". 1: 0,1,7,14,30","items":[{"const":"days_left"}],"additionalItems":{"title":"Filter events by days left before the license expiration","type":"number","enum":[0,1,7,14,30]}}]},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""}}}}}}}}}}}]},{"if":{"properties":{"category":{"enum":["oneview_user_added","oneview_user_deleted","oneview_user_verified","oneview_sites_assigned"]}}},"then":{"properties":{"conditions":{"additionalProperties":false}}}}]}]},{"required":["id"],"properties":{"id":{"title":"Notification Id","type":"string"},"owner":{"title":"Notification owner","type":"string"},"account_id":{"title":"Account Id of the owner of the notification","type":"string"},"created_at":{"title":"Created at timestamp","format":"date-time"},"updated_at":{"title":"Updated at timestamp","format":"date-time"},"created_by":{"title":"Created by","type":"string"},"updated_by":{"title":"Created by","type":"string"}}}]}},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}}}}},"tags":["Notifications"],"operationId":"api.v2.rmm.get-all.notification"}},"/oneview/v1/notifications/subscriptions/{id}":{"delete":{"description":"Delete notification by subscription id.","summary":"Delete notification","security":[{"client_credentials":["write"]},{"user_permissions":["notifications.deleteOwn"]}],"status":{"outage":["auth","webhooks_subscriptions"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}},{"name":"parent_account_id","required":false,"in":"query","description":"the subscriptions' account_id. This is required to access notifications subscriptions for a different owner, but in the same account (requires super admin permission).","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}],"responses":{"200":{"description":"Successful response"}},"tags":["Notifications"],"operationId":"api.v2.rmm.delete.notification"},"get":{"description":"Get notification by subscription id.","summary":"Get notification","security":[{"client_credentials":["read"]},{"user_permissions":["notifications.viewOwn"]}],"status":{"outage":["auth","webhooks_subscriptions"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}},{"name":"parent_account_id","required":false,"in":"query","description":"the subscriptions' account_id. This is required to access notifications subscriptions for a different owner, but in the same account (requires super admin permission).","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"RMM notification response","allOf":[{"type":"object","title":"The Schema For Notifications Creation","anyOf":[{"allOf":[{"type":"object","title":"The create notification Body","required":["name","category","delivery"],"properties":{"name":{"title":"Notification name. Must be unique","type":"string"},"description":{"title":"Notification description","type":"string","default":""},"category":{"title":"The category of the events to be notified","type":"string"},"delivery":{},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object"},"aggregation":{"title":"Aggregate multiple events in a single notifications","type":"object","properties":{"interval":{"title":"Interval in seconds for aggregating events in a single notification. It must be defined to apply aggregation","type":"integer","minimum":10,"maximum":86400}}},"enabled":{"title":"enable/disable notification","type":"boolean","default":true},"owner":{"title":"the identifier of the owner of the subscription. Not available for read-only users","type":"string"}},"anyOf":[{"title":"Detections","properties":{"category":{"enum":["threat_detections"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Detections output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","os_release_name","os_platform","os_type","os_version","category","type","path","status","scanned_at","reported_at","resource_created_at","resource_modified_at","threat_name","affected_application","process_name","machine_id","machine_name","machine_ip","group_id","group_name","policy_id","policy_name","nics","md5","sha256","engine_version","last_user","active_directory_ou","id"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Detections output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","os_release_name","os_platform","os_type","os_version","category","type","path","status","scanned_at","reported_at","resource_created_at","resource_modified_at","threat_name","affected_application","process_name","machine_id","machine_name","machine_ip","group_id","group_name","policy_id","policy_name","nics","md5","sha256","engine_version","last_user","active_directory_ou","id"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","affected_application","category","group_id","group_name","machine_id","machine_ip","machine_name","os_platform","os_release_name","path","policy_id","policy_name","process_name","status","threat_name","type"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"category\". 1: \"MALWARE\",\"PUP\",\"PUM\",\"AE\",\"ARW\",\"MWAC\",\"RID\",\"VULNERABLE_DRIVER\"","items":[{"const":"category"}],"additionalItems":{"title":"Filter events by detection category","type":"string","enum":["MALWARE","PUP","PUM","AE","ARW","MWAC","RID","VULNERABLE_DRIVER"]}},{"title":"0: \"action\". 1: \"blocked\", \"deleted\", \"deletedAutoPrune\", \"found\", \"quarantined\", \"restored\"","items":[{"const":"action"}],"additionalItems":{"title":"Filter events by action","type":"string","enum":["blocked","deleted","deletedAutoPrune","found","quarantined","restored"]}},{"title":"0: \"threat_name\". 1: string","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux), \"4\"(Android), \"3\"(IOS), \"3\"(ChromeOS)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3,4,5,6]}},{"title":"0: \"rtp\". 1: true, false","items":[{"const":"rtp"},{"title":"Filter events by real time protection"}],"additionalItems":false,"if":{"items":[{"const":"rtp"}]},"then":{"items":[{"const":"rtp"},{"type":"boolean"}]}},{"title":"0: \"type\". 1: \"application\", \"exploit\", \"extension\", \"file\", \"folder\", \"InboundConnection\", \"module\", \"OutboundConnection\", \"process\", \"reg_key\", \"reg_value\"","items":[{"const":"type"}],"additionalItems":{"title":"Filter events by type","type":"string","enum":["application","exploit","extension","file","folder","InboundConnection","module","OutboundConnection","process","reg_key","reg_value"]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"threat_name\". 1: string","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","anyOf":[{"title":"0: \"threat_name\". 1: string","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_contains":{"type":"array","anyOf":[{"title":"0: \"threat_name\". 1: string","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"begins_with":{"title":"0: \"threat_name\". 1: string","type":"array","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Suspicious activity","properties":{"category":{"enum":["threat_suspicious_activity"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Suspicious activity","type":"array","minItems":1,"items":{"type":"string","enum":["severity","account_id","account_name","os_release_name","os_platform","type","path","status","scanned_at","reported_at","threat_name","machine_id","machine_name","machine_ip","group_id","group_name","policy_id","policy_name","nics","last_user","first_activity","last_activity","isolation_type","id"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Suspicious activity","type":"array","minItems":1,"items":{"type":"string","enum":["severity","account_id","account_name","os_release_name","os_platform","type","path","status","scanned_at","reported_at","threat_name","machine_id","machine_name","machine_ip","group_id","group_name","policy_id","policy_name","nics","last_user","first_activity","last_activity","isolation_type","id"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","group_id","group_name","machine_id","machine_ip","machine_name","os_platform","os_release_name","path","policy_id","policy_name","severity","status","threat_name"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"level\". 1: \"low\", \"medium\", \"high\", \"critical\"","items":[{"const":"level"}],"additionalItems":{"title":"Filter events by severity level","type":"string","enum":["low","medium","high","critical"]}},{"title":"0: \"threat_name\". 1: string","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux), \"4\"(Android), \"3\"(IOS), \"3\"(ChromeOS)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3,4,5,6]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"threat_name\". 1: string","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"contains":{"title":"0: \"threat_name\". 1: string","type":"array","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},"not_contains":{"title":"0: \"threat_name\". 1: string","type":"array","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},"begins_with":{"title":"0: \"threat_name\". 1: string","type":"array","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},"exists":{"type":"string","anyOf":[{"title":"Filter events by isolation_type exists","const":"isolation_type"}]},"not_exists":{"anyOf":[{"title":"Filter events by isolation_type not exists","const":"isolation_type"}]},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"User added","properties":{"category":{"enum":["user_added"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"User added","type":"array","minItems":1,"items":{"type":"string","enum":["ip_address","invited_by","role","email","full_group_access","timestamp","account_id"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"User added","type":"array","minItems":1,"items":{"type":"string","enum":["ip_address","invited_by","role","email","full_group_access","timestamp","account_id"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","invited_by","ip_address","role"]}}}}}},{"title":"User deleted","properties":{"category":{"enum":["user_deleted"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"User deleted output fields","type":"array","minItems":1,"items":{"type":"string","enum":["ip_address","timestamp","account_id","deleted_by","email"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"User deleted output fields","type":"array","minItems":1,"items":{"type":"string","enum":["ip_address","timestamp","account_id","deleted_by","email"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","ip_address","deleted_by"]}}}}}},{"title":"User verified","properties":{"category":{"enum":["user_verified"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"User verified","type":"array","minItems":1,"items":{"type":"string","enum":["email","timestamp","account_id"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"User verified","type":"array","minItems":1,"items":{"type":"string","enum":["email","timestamp","account_id"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name"]}}}}}},{"title":"Endpoint registered","properties":{"category":{"enum":["endpoint_registered"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Endpoint registered output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","created_at"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Endpoint registered output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","created_at"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Endpoint deleted","properties":{"category":{"enum":["endpoint_unregistered"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Endpoint deleted output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","timestamp","timeout"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Endpoint deleted output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","timestamp","timeout"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"timeout\". 1: true, false","items":[{"const":"timeout"},{"title":"Filter events by timeout (true if the machine was deleted because marked_for_deletion and never connected again until a timeout)"}],"additionalItems":false,"if":{"items":[{"const":"timeout"}]},"then":{"items":[{"const":"timeout"},{"type":"boolean"}]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Command update","properties":{"category":{"enum":["endpoint_command_update"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Command update output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","command","status","created_at","updated_at","expires_at","machine_id","machine_name","group_id","active_directory_ou"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Command update output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","command","status","created_at","updated_at","expires_at","machine_id","machine_name","group_id","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","command","status","machine_id","machine_name"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"status\". 1: \"CREATED\",\"SENT\",\"RECEIVED\",\"STARTED\",\"TIMED_OUT\",\"COMPLETED\",\"EXPIRED\",\"FAILED\",\"CANCELLED\"","items":[{"const":"status"}],"additionalItems":{"title":"Filter the type of the machine_events to be notified","type":"string","enum":["CREATED","SENT","RECEIVED","STARTED","TIMED_OUT","COMPLETED","EXPIRED","FAILED","CANCELLED"]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Quarantine","properties":{"category":{"enum":["quarantine"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Quarantine output fields","type":"array","minItems":1,"items":{"type":"string","enum":["path","machine_name","created_at","status"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Quarantine output fields","type":"array","minItems":1,"items":{"type":"string","enum":["path","machine_name","created_at","status"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","status"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","title":"0: \"quarantine_action\". 1: \"QUARANTINE_DELETED\",\"QUARANTINE_RESTORED\"","items":[{"const":"quarantine_action"}],"additionalItems":{"title":"Filter the type of the quarantine_events to be notified","type":"string","enum":["QUARANTINE_DELETED","QUARANTINE_RESTORED"]}},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Threat scan","properties":{"category":{"enum":["threat_scan"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Threat scan output_fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","scan_date","scan_id","machine_id","machine_name","group_id","group_name","policy_id","policy_name","ip_address","detections","active_directory_ou"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Threat scan output_fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","scan_date","scan_id","machine_id","machine_name","group_id","group_name","policy_id","policy_name","ip_address","detections","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","ip_address","policy_id","policy_name"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"action\". 1: \"THREAT_CLEANED\",\"THREAT_FOUND\"","items":[{"const":"action"}],"additionalItems":{"title":"Filter events by threat activity action","type":"string","enum":["THREAT_CLEANED","THREAT_FOUND"]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Device control","properties":{"category":{"enum":["device_control"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Device control output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version","path","date","action","device_name","manufacturer","volume_serial","serial_number","physical_disk_name","disk_interface","file_system","volume_name","volume_device_path","last_user","active_directory_ou"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Device control output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version","path","date","action","device_name","manufacturer","volume_serial","serial_number","physical_disk_name","disk_interface","file_system","volume_name","volume_device_path","last_user","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","group_id","group_name","machine_id","machine_name","os_platform","os_release_name","policy_id","policy_name"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"action\". 1: \"blocked\", \"read-only\"","items":[{"const":"action"}],"additionalItems":{"title":"Filter events by action","type":"string","enum":["blocked","read-only"]}},{"title":"0: \"device_name\". 1: string","items":[{"const":"device_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"manufacturer\". 1: string","items":[{"const":"manufacturer"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"device_name\". 1: string","items":[{"const":"device_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"manufacturer\". 1: string","items":[{"const":"manufacturer"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","anyOf":[{"title":"0: \"device_name\". 1: string","items":[{"const":"device_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"manufacturer\". 1: string","items":[{"const":"manufacturer"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_contains":{"type":"array","anyOf":[{"title":"0: \"device_name\". 1: string","items":[{"const":"device_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"manufacturer\". 1: string","items":[{"const":"manufacturer"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Site end date","properties":{"category":{"enum":["license_expiring"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Site end date output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status","licensed_seats","used_seats","license_key","catalog_code","combo_product","licensed_product","license_expires_at","days_left"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Site end date output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status","licensed_seats","used_seats","license_key","catalog_code","combo_product","licensed_product","license_expires_at","days_left"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"days_left\". 1: 0,1,3,5,7,14,30","items":[{"const":"days_left"}],"additionalItems":{"title":"Filter events by days left before the license expiration","type":"number","enum":[0,1,3,5,7,14,30]}},{"title":"0: \"license_term_type\". 1: \"cloud_evaluation\",\"evaluation\",\"freemium\",\"nfr\",\"site_license\",\"subscription\",\"utility\"","items":[{"const":"license_term_type"}],"additionalItems":{"title":"Filter events by license term type","type":"string","enum":["cloud_evaluation","evaluation","freemium","nfr","site_license","subscription","utility"]}}]},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Site over deployed","properties":{"category":{"enum":["license_over_deployment"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Site over deployed output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status","licensed_seats","used_seats","license_key","catalog_code","combo_product"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Site over deployed output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status","licensed_seats","used_seats","license_key","catalog_code","combo_product"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"license_term_type\". 1: \"cloud_evaluation\",\"evaluation\",\"freemium\",\"nfr\",\"site_license\",\"subscription\",\"utility\"","items":[{"const":"license_term_type"}],"additionalItems":{"title":"Filter events by license term type","type":"string","enum":["cloud_evaluation","evaluation","freemium","nfr","site_license","subscription","utility"]}}]},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Vulnerability status","properties":{"category":{"enum":["cve_found"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Vulnerability status output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","product","vendor","installed_version","machine_id","machine_name","group_id","group_name","policy_id","policy_name","cve_id","severity","created_at","os_platform","os_release_name","os_version","cisa_exploitable","known_ransomware_campaign_use","description","published_at","severity_score","active_directory_ou"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Vulnerability status output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","product","vendor","installed_version","machine_id","machine_name","group_id","group_name","policy_id","policy_name","cve_id","severity","created_at","os_platform","os_release_name","os_version","cisa_exploitable","known_ransomware_campaign_use","description","published_at","severity_score","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","cve_id","product","os_platform"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"severity\". 1: \"unknown\",\"low\",\"medium\",\"high\",\"critical\"","items":[{"const":"severity"}],"additionalItems":{"title":"Filter events by severity","type":"string","enum":["unknown","low","medium","high","critical"]}},{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"cisa_exploitable\". 1: true, false","items":[{"const":"cisa_exploitable"},{"title":"Filter events by CISA exploitable"}],"additionalItems":false,"if":{"items":[{"const":"cisa_exploitable"}]},"then":{"items":[{"const":"cisa_exploitable"},{"type":"boolean"}]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","anyOf":[{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_contains":{"type":"array","anyOf":[{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","anyOf":[{"title":"Filter events by available patch exists","const":"available_patch"}]},"not_exists":{"type":"string","anyOf":[{"title":"Filter events by available patch not exists","const":"available_patch"}]},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"CVE Ignored","properties":{"category":{"enum":["cve_ignored"]},"delivery":{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}},"output_fields":{"title":"CVE Ignored output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","cve_id","ignored_reason","display_product","ignored_at","ignored_until","ignored_by","ignored_by_name"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","cve_id"]}}}}}},{"title":"Patch applied","properties":{"category":{"enum":["patch_applied"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Patch applied output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","title","description","product","vendor","severity","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_version","reboot_required","preview_patch","date","status","category","active_directory_ou"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Patch applied output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","title","description","product","vendor","severity","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_version","reboot_required","preview_patch","date","status","category","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","os_platform"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"status\". 1: \"COMPLETED\",\"FAILED\",\"REBOOT_REQUIRED\"","items":[{"const":"status"}],"additionalItems":{"title":"Filter events by status","type":"string","enum":["COMPLETED","FAILED","REBOOT_REQUIRED"]}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"preview_patch\". 1: true, false","items":[{"const":"preview_patch"},{"title":"Filter events by preview_patch"}],"additionalItems":false,"if":{"items":[{"const":"preview_patch"}]},"then":{"items":[{"const":"preview_patch"},{"type":"boolean"}]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Software update applied","properties":{"category":{"enum":["software_update"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Software update applied output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","product","vendor","current_version","new_version","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_version","date","status","signature_id","active_directory_ou"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Software update applied output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","product","vendor","current_version","new_version","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_version","date","status","signature_id","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","os_platform"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"status\". 1: \"COMPLETED\",\"FAILED\"","items":[{"const":"status"}],"additionalItems":{"title":"Filter events by status","type":"string","enum":["COMPLETED","FAILED"]}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Patch or software update available","properties":{"category":{"enum":["patch_available"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Patch or software update available","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","title","description","product","vendor","severity","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_version","reboot_required","preview_patch","date","category","patch_id","kb_id","released_at","size","active_directory_ou"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Patch or software update available","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","title","description","product","vendor","severity","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_version","reboot_required","preview_patch","date","category","patch_id","kb_id","released_at","size","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","os_platform"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"severity\". 1: \"unknown\",\"moderate\",\"low\",\"important\",\"critical\"","items":[{"const":"severity"}],"additionalItems":{"title":"Filter events by severity","type":"string","enum":["unknown","moderate","low","important","critical"]}},{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"reboot_required\". 1: true, false","items":[{"const":"reboot_required"},{"title":"Filter events by reboot_required"}],"additionalItems":false,"if":{"items":[{"const":"reboot_required"}]},"then":{"items":[{"const":"reboot_required"},{"type":"boolean"}]}},{"title":"0: \"preview_patch\". 1: true, false","items":[{"const":"preview_patch"},{"title":"Filter events by preview_patch"}],"additionalItems":false,"if":{"items":[{"const":"preview_patch"}]},"then":{"items":[{"const":"preview_patch"},{"type":"boolean"}]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","anyOf":[{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_contains":{"type":"array","anyOf":[{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"begins_with":{"type":"array","anyOf":[{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}}]},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"CSS detection","properties":{"category":{"enum":["css_detection"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"CSS detection output fields","minItems":1,"type":"array","items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name","file_name","css_threat_name","action_taken","file_location","file_owner","timestamp"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"CSS detection output fields","minItems":1,"type":"array","items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name","file_name","css_threat_name","action_taken","file_location","file_owner","timestamp"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","action_taken","cloud_provider","scan_configuration_name"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"action_taken\". 1: \"Found\", \"Quarantined\"","items":[{"const":"action_taken"}],"additionalItems":{"title":"Filter events by action taken","type":"string","enum":["Found","Quarantined"]}},{"title":"0: \"cloud_provider\". 1: \"BOX\", \"ONEDRIVE\", \"GOOGLEDRIVE\"","items":[{"const":"cloud_provider"}],"additionalItems":{"title":"Filter events by cloud provider","type":"string","enum":["BOX","ONEDRIVE","GOOGLEDRIVE"]}},{"title":"0: \"scan_configuration_name\". 1: string","items":[{"const":"scan_configuration_name"}],"additionalItems":{"title":"Filter events by scan configuration name","type":"string"}}]},"not_eq":{"type":"array","title":"0: \"scan_configuration_name\". 1: string","items":[{"const":"scan_configuration_name"}],"additionalItems":{"title":"Filter events by scan_configuration_name","type":"string"}},"contains":{"title":"0: \"scan_configuration_name\". 1: string","type":"array","items":[{"const":"scan_configuration_name"}],"additionalItems":{"title":"Filter events by scan_configuration_name","type":"string"}},"not_contains":{"title":"0: \"scan_configuration_name\". 1: string","type":"array","items":[{"const":"scan_configuration_name"}],"additionalItems":{"title":"Filter events by scan_configuration_name","type":"string"}},"begins_with":{"title":"0: \"scan_configuration_name\". 1: string","type":"array","items":[{"const":"scan_configuration_name"}],"additionalItems":{"title":"Filter events by scan_configuration_name","type":"string"}},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"CSS capacity approached","properties":{"category":{"enum":["css_capacity_approached"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"CSS capacity approached output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name","timestamp"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"CSS capacity approached output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name","timestamp"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name"]}}}}}},{"title":"CSS capacity reached","properties":{"category":{"enum":["css_capacity_reached"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"CSS capacity reached output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name","timestamp"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"CSS capacity reached output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name","timestamp"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name"]}}}}}},{"title":"CSS capacity exceeded","properties":{"category":{"enum":["css_capacity_exceeded"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"CSS capacity exceeded output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name","timestamp"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"CSS capacity exceeded output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name","timestamp"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name"]}}}}}},{"title":"DNS blocked","properties":{"category":{"enum":["dns_blocked"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"DNS blocked output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","timestamp","group_id","group_name","policy_id","policy_name","colo_id","device_id","user_id","dst_ip","src_ip","email","location","policy","rule_name","action","protocol","query_name","query_name_reversed","resolver_decision","query_category_ids","query_size","query_type","src_port","dst_port","os_platform","os_release_name","os_type","os_version","os_architecture"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"DNS blocked output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","timestamp","group_id","group_name","policy_id","policy_name","colo_id","device_id","user_id","dst_ip","src_ip","email","location","policy","rule_name","action","protocol","query_name","query_name_reversed","resolver_decision","query_category_ids","query_size","query_type","src_port","dst_port","os_platform","os_release_name","os_type","os_version","os_architecture"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"policy_id\". 1: string","items":[{"const":"policy_id"}],"additionalItems":{"title":"Filter events by policy_id","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"policy_id\". 1: string","items":[{"const":"policy_id"}],"additionalItems":{"title":"Filter events by policy_id","type":"string"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Case management","properties":{"category":{"enum":["siemplify_case"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Case management output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","case_id","case_name","case_status","case_created_at","priority","action_required","event","endpoints","detections"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Case management output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","case_id","case_name","case_status","case_created_at","priority","action_required","event","endpoints","detections"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","case_id"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"event\". 1: \"case_created\",\"case_updated\",\"case_closed\"","items":[{"const":"event"}],"additionalItems":{"title":"Filter events by status","type":"string","enum":["case_created","case_updated","case_closed"]}},{"title":"0: \"priority\". 1: \"Critical\", \"High\", \"Medium\", \"Low\"","items":[{"const":"priority"}],"additionalItems":{"title":"Filter events by status","type":"string","enum":["Critical","High","Medium","Low"]}},{"title":"0: \"action_required\". 1: true, false","items":[{"const":"action_required"},{"title":"Filter events by CISA exploitable"}],"additionalItems":false,"if":{"items":[{"const":"action_required"}]},"then":{"items":[{"const":"action_required"},{"type":"boolean"}]}}]},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Application block","properties":{"category":{"enum":["app_block"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Application block output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","app_block_rules","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version","scanned_at","file_path","last_user","active_directory_ou"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Application block output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","app_block_rules","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version","scanned_at","file_path","last_user","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"policy_id\". 1: string","items":[{"const":"policy_id"}],"additionalItems":{"title":"Filter events by policy_id","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"policy_id\". 1: string","items":[{"const":"policy_id"}],"additionalItems":{"title":"Filter events by policy_id","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","additionalItems":false},"lte":{"type":"array","const":""},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Entitlement changed","properties":{"category":{"enum":["license_entitlement_changed"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Entitlement changed output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status","licensed_seats","used_seats","license_key","catalog_code","combo_product","licensed_product","license_expires_at","license_key_status","auto_renew","status"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Entitlement changed output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status","licensed_seats","used_seats","license_key","catalog_code","combo_product","licensed_product","license_expires_at","license_key_status","auto_renew","status"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"status\". 1: \"added\",\"updated\",\"removed\"","items":[{"const":"status"}],"additionalItems":{"title":"Filter events by status","type":"string","enum":["added","updated","removed"]}},{"title":"0: \"license_term_type\". 1: \"cloud_evaluation\",\"evaluation\",\"freemium\",\"nfr\",\"site_license\",\"subscription\",\"utility\"","items":[{"const":"license_term_type"}],"additionalItems":{"title":"Filter events by license term type","type":"string","enum":["cloud_evaluation","evaluation","freemium","nfr","site_license","subscription","utility"]}}]},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Entitlement usage changed","properties":{"category":{"enum":["license_entitlement_usage_changed"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Entitlement usage changed output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status","licensed_seats","used_seats","license_key","catalog_code","combo_product","licensed_product","license_expires_at","license_key_status","auto_renew"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Entitlement usage changed output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status","licensed_seats","used_seats","license_key","catalog_code","combo_product","licensed_product","license_expires_at","license_key_status","auto_renew"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","title":"0: \"license_term_type\". 1: \"cloud_evaluation\",\"evaluation\",\"freemium\",\"nfr\",\"site_license\",\"subscription\",\"utility\"","items":[{"const":"license_term_type"}],"additionalItems":{"title":"Filter events by license term type","type":"string","enum":["cloud_evaluation","evaluation","freemium","nfr","site_license","subscription","utility"]}},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Endpoint status changed","properties":{"category":{"enum":["endpoint_status_changed"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Endpoint status changed","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","status_change","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version","codes"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Endpoint status changed","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","status_change","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version","codes"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","status_change","machine_id","machine_name"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"status_change\". 1: \"ENDPOINT_REBOOT_REQUIRED\",\"ENDPOINT_REBOOT_REQUIRED_CLEARED\",\"ENDPOINT_INFECTED\",\"ENDPOINT_REMEDIATED\",\"ENDPOINT_ISOLATED\",\"ENDPOINT_UNISOLATED\",\"ENDPOINT_SUSPICIOUS_ACTIVITY_FOUND\",\"ENDPOINT_SUSPICIOUS_ACTIVITY_CLEARED\",\"AGENT_ALERTS_CHANGED\"","items":[{"const":"status_change"}],"additionalItems":{"title":"Filter the type of status_change to be notified","type":"string","enum":["ENDPOINT_REBOOT_REQUIRED","ENDPOINT_REBOOT_REQUIRED_CLEARED","ENDPOINT_INFECTED","ENDPOINT_REMEDIATED","ENDPOINT_ISOLATED","ENDPOINT_UNISOLATED","ENDPOINT_SUSPICIOUS_ACTIVITY_FOUND","ENDPOINT_SUSPICIOUS_ACTIVITY_CLEARED","AGENT_ALERTS_CHANGED"]}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Inactive endpoint","properties":{"category":{"enum":["inactive_endpoint"]},"delivery":{"properties":{"output_fields":{"title":"Information to include in the JSON body. If omitted, include all","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version","last_seen_at"]}}}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"os_type\". 1: \"1\"(Workstation), \"2\"(Server), \"3\"(Mobile)","items":[{"const":"os_type"}],"additionalItems":{"title":"Filter events by OS type","type":"number","enum":[1,2,3]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"policy_id\". 1: string","items":[{"const":"policy_id"}],"additionalItems":{"title":"Filter events by policy_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"contains":{"type":"array","anyOf":[{"title":"0: \"policy_name\". 1: string","items":[{"const":"policy_name"}],"additionalItems":{"title":"Filter events by policy_name","type":"string"}},{"title":"0: \"group_name\". 1: string","items":[{"const":"group_name"}],"additionalItems":{"title":"Filter events by group_name","type":"string"}}]},"not_contains":{"type":"array","anyOf":[{"title":"0: \"policy_name\". 1: string","items":[{"const":"policy_name"}],"additionalItems":{"title":"Filter events by policy_name","type":"string"}},{"title":"0: \"group_name\". 1: string","items":[{"const":"group_name"}],"additionalItems":{"title":"Filter events by group_name","type":"string"}}]},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","anyOf":[{"title":"0: \"last_seen_at\"","items":[{"const":"last_seen_at"}],"additionalItems":{"title":"Filter inactive machines by less than equals days since last active","type":"number","minimum":1}}]},"gte":{"type":"array","anyOf":[{"title":"0: \"last_seen_at\"","items":[{"const":"last_seen_at"}],"additionalItems":{"title":"Filter inactive machines by less than equals days since last active","type":"number","minimum":1}}]}}}}}}}}}}},{"title":"Firewall activity","properties":{"category":{"enum":["firewall_activity"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Firewall activity output fields","type":"array","minItems":1,"items":{"type":"string","enum":["start_time","end_time","rule_id","rule_name","ruleset_id","ruleset_name","direction","action","protocol","location","program","service","hits","account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Firewall activity output fields","type":"array","minItems":1,"items":{"type":"string","enum":["start_time","end_time","rule_id","rule_name","ruleset_id","ruleset_name","direction","action","protocol","location","program","service","hits","account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"action\". 1: \"ALLOW\", \"BLOCK\"","items":[{"const":"action"}],"additionalItems":{"title":"Filter events by action","type":"string","enum":["ALLOW","BLOCK"]}},{"title":"0: \"direction\". 1: \"Inbound\", \"Outbound\"","items":[{"const":"direction"}],"additionalItems":{"title":"Filter events by direction","type":"string","enum":["Inbound","Outbound"]}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"policy_id\". 1: string","items":[{"const":"policy_id"}],"additionalItems":{"title":"Filter events by policy_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"policy_id\". 1: string","items":[{"const":"policy_id"}],"additionalItems":{"title":"Filter events by policy_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Endpoint isolation","properties":{"category":{"enum":["endpoint_isolation"]},"delivery":{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}},"output_fields":{"title":"Endpoint isolation output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","status","created_at","updated_at","expires_at","machine_id","machine_name","os_release_name","os_platform","os_type","os_version","rule_id","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","status","machine_id","machine_name"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"status\". 1: \"COMPLETED\",\"EXPIRED\",\"FAILED\",\"CANCELLED\"","items":[{"const":"status"}],"additionalItems":{"title":"Filter the type of the status update to be notified","type":"string","enum":["COMPLETED","EXPIRED","FAILED","CANCELLED"]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","anyOf":[{"title":"Filter events by rule_ud exists. If it exists, it indicates that it's an auto-isolation job","const":"rule_id"}]},"not_exists":{"type":"string","anyOf":[{"title":"Filter events by rule_ud exists. If it exists, it indicates that it's an auto-isolation job","const":"rule_id"}]},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Record (notification/report) audit","properties":{"category":{"enum":["record_audit"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Record audit output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","record_type","record_name","record_action","timestamp","user_email","owner"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Record audit output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","record_type","record_name","record_action","timestamp","user_email","owner"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","additionalItems":false},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","anyOf":[{"title":"0: \"record_action\". 1: \"REPORT\", \"NOTIFICATION\", \"UPDATED\", \"DELETED\"","items":[{"const":"record_action"}],"additionalItems":{"title":"Filter events by record action","type":"string","enum":["REPORT","NOTIFICATION","UPDATED","DELETED"]}}]},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"MXDR integration communication inactive","properties":{"category":{"enum":["mxdr_integration_inactive"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"mxdr_integration_inactive output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","source","last_log_seen","inactive_hours"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"mxdr_integration_inactive output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","source","last_log_seen","inactive_hours"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"source\". 1: \"okta\", \"entra\", \"msgraphapi\", \"meraki\", \"watchguard\", \"fortinet\"","items":[{"const":"source"}],"additionalItems":{"title":"Filter events by source","type":"string","enum":["okta","entra","msgraphapi","meraki","watchguard","fortinet"]}},{"title":"0: \"inactive_hours\". 1: 1, 24","items":[{"const":"inactive_hours"}],"additionalItems":{"title":"Filter events by inactive_hours","type":"number","enum":[1,24]}}]},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Audit log activity","properties":{"category":{"enum":["audit_log_activity"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Audit log activity output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","user_id","user_name","action","patch_titles","application_names","expires_at","reason","ignore_rule_name","application_version","ignore_rule_applies_to"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Audit log activity output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","user_id","user_name","action","patch_titles","application_names","expires_at","reason","ignore_rule_name","application_version","ignore_rule_applies_to"]}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"resource_type\". 1: \"ignore_rule\"","items":[{"const":"resource_type"}],"additionalItems":{"title":"Filter events by resource type","type":"string","enum":["ignore_rule"]}},{"title":"0: \"action\". 1: \"create\", \"update\"","items":[{"const":"action"}],"additionalItems":{"title":"Filter events by action","type":"string","enum":["create","update"]}}]}}}}}}}}}}},{"title":"XDR alert","properties":{"category":{"enum":["xdr_alert"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"xdr_alert output fields","type":"array","minItems":1,"items":{"type":"string","enum":["source","severity","account_id","account_name","created_at","category","alert_id","rule_name","attack_category","attack_detection_type","identity_primary_identifier","identity_group_name"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"xdr_alert output fields","type":"array","minItems":1,"items":{"type":"string","enum":["source","severity","account_id","account_name","created_at","category","alert_id","rule_name","attack_category","attack_detection_type","identity_primary_identifier","identity_group_name"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","source"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"source\". 1: \"okta\", \"entra\", \"edr\"","items":[{"const":"source"}],"additionalItems":{"title":"Filter events by source","type":"string","enum":["okta","entra","edr"]}},{"title":"0: \"severity\". 1: \"information\", \"low\", \"medium\", \"high\", \"critical\"","items":[{"const":"severity"}],"additionalItems":{"title":"Filter events by severity","type":"string","enum":["information","low","medium","high","critical"]}},{"title":"0: \"attack_category\". 1: string","items":[{"const":"attack_category"}],"additionalItems":{"title":"Filter events by attack_category","type":"string"}},{"title":"0: \"identity_primary_identifier\". 1: string","items":[{"const":"identity_primary_identifier"}],"additionalItems":{"title":"Filter events by identity_primary_identifier","type":"string"}},{"title":"0: \"identity_group_name\". 1: string","items":[{"const":"identity_group_name"}],"additionalItems":{"title":"Filter events by identity_group_name","type":"string"}}]},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","anyOf":[{"title":"0: \"attack_category\". 1: string","items":[{"const":"attack_category"}],"additionalItems":{"title":"Filter events by attack_category","type":"string"}},{"title":"0: \"identity_primary_identifier\". 1: string","items":[{"const":"identity_primary_identifier"}],"additionalItems":{"title":"Filter events by identity_primary_identifier","type":"string"}},{"title":"0: \"identity_group_name\". 1: string","items":[{"const":"identity_group_name"}],"additionalItems":{"title":"Filter events by identity_group_name","type":"string"}}]},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Drive encryption","properties":{"category":{"enum":["drive_encryption"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Drive encryption output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","action","machine_name","policy_name","encryption_method","drive_label","timestamp"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Drive encryption output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","action","machine_name","policy_name","encryption_method","drive_label","timestamp"]}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"action\". 1: \"MACHINE_DRIVE_ENCRYPTION_ENCRYPTION_FAILED\", \"MACHINE_DRIVE_ENCRYPTION_SUSPENDED\", or \"MACHINE_DRIVE_ENCRYPTION_RECOVERY_DETECTED\"","items":[{"const":"action"}],"additionalItems":{"title":"Filter events by action type","type":"string","enum":["MACHINE_DRIVE_ENCRYPTION_ENCRYPTION_FAILED","MACHINE_DRIVE_ENCRYPTION_SUSPENDED","MACHINE_DRIVE_ENCRYPTION_RECOVERY_DETECTED"]}}]}}}}}}}}}}}],"if":{"properties":{"category":{"enum":["user_added","user_deleted","user_verified","license_over_deployment","css_capacity_approached","css_capacity_reached","css_capacity_exceeded"]}}},"then":{"properties":{"conditions":{"additionalProperties":false}}}},{"type":"object","properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]},{"allOf":[{"required":["name","category","delivery"],"properties":{"name":{"title":"Notification name. Must be unique","type":"string"},"description":{"title":"Notification description","type":"string","default":""},"category":{"title":"The category of the events to be notified","type":"string"},"delivery":{},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object"},"aggregation":{"title":"Aggregate multiple events in a single notifications","type":"object","properties":{"interval":{"title":"Interval in seconds for aggregating events in a single notification. It must be defined to apply aggregation","type":"integer","minimum":10,"maximum":86400}}},"enabled":{"title":"enable/disable notification","type":"boolean","default":true},"owner":{"title":"the identifier of the owner of the subscription","type":"string"}}},{"anyOf":[{"title":"OneView user added","properties":{"category":{"enum":["oneview_user_added"]},"delivery":{"anyOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"OneView user added output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","user_id","user_name","user_email","user_role","ip_address","timestamp","sites","invited_by_email"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["invited_by_email"]}}}}}},{"title":"OneView user verified","properties":{"category":{"enum":["oneview_user_verified"]},"delivery":{"anyOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"OneView user verified output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","user_id","user_name","user_email","ip_address","timestamp"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"Not available for this category","maxItems":0}}}}},{"title":"OneView user deleted","properties":{"category":{"enum":["oneview_user_deleted"]},"delivery":{"anyOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"OneView user deleted output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","user_id","user_name","user_email","user_role","ip_address","timestamp","sites","deleted_by_email"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["deleted_by_email"]}}}}}},{"title":"OneView sites assigned","allOf":[{"properties":{"category":{"enum":["oneview_sites_assigned"]},"delivery":{"anyOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"OneView sites assigned output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","user_id","user_name","user_email","user_role","ip_address","timestamp","sites","assigned_by_email","added_sites","removed_sites"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["assigned_by_email","user_email"]}}}}}},{"type":"object","properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]},{"title":"OneView trial to paid status","allOf":[{"properties":{"category":{"enum":["oneview_trial_to_paid_status"]},"delivery":{"anyOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"OneView trial to paid status output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","timestamp","max_protection","device_type","conversion_status","sites"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["device_type","conversion_status","max_protection"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"nebula_account_id\". 1: string","items":[{"const":"nebula_account_id"}],"additionalItems":{"title":"Filter events by nebula_account_id","type":"string"}},{"title":"0: \"conversion_status\". 1: \"FAILED\", \"SUCCESS\"","items":[{"const":"conversion_status"}],"additionalItems":{"title":"Filter events by conversion status","type":"string","enum":["FAILED","SUCCESS"]}}]},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""}}}}}}}}}}},{"type":"object","properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]},{"title":"OneView site end date approaching","properties":{"category":{"enum":["oneview_site_end_date_approaching"]},"delivery":{"anyOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"OneView site end date approachnig output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","timestamp","sites","days_left","site_end_date"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","maxItems":0}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"days_left\". 1: 0,1,7,14,30","items":[{"const":"days_left"}],"additionalItems":{"title":"Filter events by days left before the license expiration","type":"number","enum":[0,1,7,14,30]}}]},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""}}}}}}}}}}}]},{"if":{"properties":{"category":{"enum":["oneview_user_added","oneview_user_deleted","oneview_user_verified","oneview_sites_assigned"]}}},"then":{"properties":{"conditions":{"additionalProperties":false}}}}]}]},{"required":["id"],"properties":{"id":{"title":"Notification Id","type":"string"},"owner":{"title":"Notification owner","type":"string"},"account_id":{"title":"Account Id of the owner of the notification","type":"string"},"created_at":{"title":"Created at timestamp","format":"date-time"},"updated_at":{"title":"Updated at timestamp","format":"date-time"},"created_by":{"title":"Created by","type":"string"},"updated_by":{"title":"Created by","type":"string"}}}]}}}}},"tags":["Notifications"],"operationId":"api.v2.rmm.get.notification"},"put":{"description":"Update notification subscription.","summary":"Update notification","security":[{"client_credentials":["write"]},{"user_permissions":["notifications.editOwn"]}],"status":{"outage":["auth","webhooks_subscriptions"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"The Schema For Notifications Creation","properties":{"parent_account_id":{"type":"string","title":"Nebula Parent Account id (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\").","description":"If this is specified, all the events from the child account_ids will be included. In that case, account_ids is not required","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}},"anyOf":[{"required":["account_ids"]},{"required":["parent_account_id"]}],"allOf":[{"type":"object","title":"The Schema For Notifications Creation","anyOf":[{"allOf":[{"type":"object","title":"The create notification Body","required":["name","category","delivery"],"properties":{"name":{"title":"Notification name. Must be unique","type":"string"},"description":{"title":"Notification description","type":"string","default":""},"category":{"title":"The category of the events to be notified","type":"string"},"delivery":{},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object"},"aggregation":{"title":"Aggregate multiple events in a single notifications","type":"object","properties":{"interval":{"title":"Interval in seconds for aggregating events in a single notification. It must be defined to apply aggregation","type":"integer","minimum":10,"maximum":86400}}},"enabled":{"title":"enable/disable notification","type":"boolean","default":true},"owner":{"title":"the identifier of the owner of the subscription. Not available for read-only users","type":"string"}},"anyOf":[{"title":"Detections","properties":{"category":{"enum":["threat_detections"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Detections output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","os_release_name","os_platform","os_type","os_version","category","type","path","status","scanned_at","reported_at","resource_created_at","resource_modified_at","threat_name","affected_application","process_name","machine_id","machine_name","machine_ip","group_id","group_name","policy_id","policy_name","nics","md5","sha256","engine_version","last_user","active_directory_ou","id"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Detections output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","os_release_name","os_platform","os_type","os_version","category","type","path","status","scanned_at","reported_at","resource_created_at","resource_modified_at","threat_name","affected_application","process_name","machine_id","machine_name","machine_ip","group_id","group_name","policy_id","policy_name","nics","md5","sha256","engine_version","last_user","active_directory_ou","id"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","affected_application","category","group_id","group_name","machine_id","machine_ip","machine_name","os_platform","os_release_name","path","policy_id","policy_name","process_name","status","threat_name","type"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"category\". 1: \"MALWARE\",\"PUP\",\"PUM\",\"AE\",\"ARW\",\"MWAC\",\"RID\",\"VULNERABLE_DRIVER\"","items":[{"const":"category"}],"additionalItems":{"title":"Filter events by detection category","type":"string","enum":["MALWARE","PUP","PUM","AE","ARW","MWAC","RID","VULNERABLE_DRIVER"]}},{"title":"0: \"action\". 1: \"blocked\", \"deleted\", \"deletedAutoPrune\", \"found\", \"quarantined\", \"restored\"","items":[{"const":"action"}],"additionalItems":{"title":"Filter events by action","type":"string","enum":["blocked","deleted","deletedAutoPrune","found","quarantined","restored"]}},{"title":"0: \"threat_name\". 1: string","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux), \"4\"(Android), \"3\"(IOS), \"3\"(ChromeOS)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3,4,5,6]}},{"title":"0: \"rtp\". 1: true, false","items":[{"const":"rtp"},{"title":"Filter events by real time protection"}],"additionalItems":false,"if":{"items":[{"const":"rtp"}]},"then":{"items":[{"const":"rtp"},{"type":"boolean"}]}},{"title":"0: \"type\". 1: \"application\", \"exploit\", \"extension\", \"file\", \"folder\", \"InboundConnection\", \"module\", \"OutboundConnection\", \"process\", \"reg_key\", \"reg_value\"","items":[{"const":"type"}],"additionalItems":{"title":"Filter events by type","type":"string","enum":["application","exploit","extension","file","folder","InboundConnection","module","OutboundConnection","process","reg_key","reg_value"]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"threat_name\". 1: string","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","anyOf":[{"title":"0: \"threat_name\". 1: string","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_contains":{"type":"array","anyOf":[{"title":"0: \"threat_name\". 1: string","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"begins_with":{"title":"0: \"threat_name\". 1: string","type":"array","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Suspicious activity","properties":{"category":{"enum":["threat_suspicious_activity"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Suspicious activity","type":"array","minItems":1,"items":{"type":"string","enum":["severity","account_id","account_name","os_release_name","os_platform","type","path","status","scanned_at","reported_at","threat_name","machine_id","machine_name","machine_ip","group_id","group_name","policy_id","policy_name","nics","last_user","first_activity","last_activity","isolation_type","id"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Suspicious activity","type":"array","minItems":1,"items":{"type":"string","enum":["severity","account_id","account_name","os_release_name","os_platform","type","path","status","scanned_at","reported_at","threat_name","machine_id","machine_name","machine_ip","group_id","group_name","policy_id","policy_name","nics","last_user","first_activity","last_activity","isolation_type","id"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","group_id","group_name","machine_id","machine_ip","machine_name","os_platform","os_release_name","path","policy_id","policy_name","severity","status","threat_name"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"level\". 1: \"low\", \"medium\", \"high\", \"critical\"","items":[{"const":"level"}],"additionalItems":{"title":"Filter events by severity level","type":"string","enum":["low","medium","high","critical"]}},{"title":"0: \"threat_name\". 1: string","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux), \"4\"(Android), \"3\"(IOS), \"3\"(ChromeOS)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3,4,5,6]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"threat_name\". 1: string","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"contains":{"title":"0: \"threat_name\". 1: string","type":"array","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},"not_contains":{"title":"0: \"threat_name\". 1: string","type":"array","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},"begins_with":{"title":"0: \"threat_name\". 1: string","type":"array","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},"exists":{"type":"string","anyOf":[{"title":"Filter events by isolation_type exists","const":"isolation_type"}]},"not_exists":{"anyOf":[{"title":"Filter events by isolation_type not exists","const":"isolation_type"}]},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"User added","properties":{"category":{"enum":["user_added"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"User added","type":"array","minItems":1,"items":{"type":"string","enum":["ip_address","invited_by","role","email","full_group_access","timestamp","account_id"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"User added","type":"array","minItems":1,"items":{"type":"string","enum":["ip_address","invited_by","role","email","full_group_access","timestamp","account_id"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","invited_by","ip_address","role"]}}}}}},{"title":"User deleted","properties":{"category":{"enum":["user_deleted"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"User deleted output fields","type":"array","minItems":1,"items":{"type":"string","enum":["ip_address","timestamp","account_id","deleted_by","email"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"User deleted output fields","type":"array","minItems":1,"items":{"type":"string","enum":["ip_address","timestamp","account_id","deleted_by","email"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","ip_address","deleted_by"]}}}}}},{"title":"User verified","properties":{"category":{"enum":["user_verified"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"User verified","type":"array","minItems":1,"items":{"type":"string","enum":["email","timestamp","account_id"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"User verified","type":"array","minItems":1,"items":{"type":"string","enum":["email","timestamp","account_id"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name"]}}}}}},{"title":"Endpoint registered","properties":{"category":{"enum":["endpoint_registered"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Endpoint registered output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","created_at"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Endpoint registered output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","created_at"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Endpoint deleted","properties":{"category":{"enum":["endpoint_unregistered"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Endpoint deleted output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","timestamp","timeout"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Endpoint deleted output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","timestamp","timeout"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"timeout\". 1: true, false","items":[{"const":"timeout"},{"title":"Filter events by timeout (true if the machine was deleted because marked_for_deletion and never connected again until a timeout)"}],"additionalItems":false,"if":{"items":[{"const":"timeout"}]},"then":{"items":[{"const":"timeout"},{"type":"boolean"}]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Command update","properties":{"category":{"enum":["endpoint_command_update"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Command update output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","command","status","created_at","updated_at","expires_at","machine_id","machine_name","group_id","active_directory_ou"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Command update output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","command","status","created_at","updated_at","expires_at","machine_id","machine_name","group_id","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","command","status","machine_id","machine_name"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"status\". 1: \"CREATED\",\"SENT\",\"RECEIVED\",\"STARTED\",\"TIMED_OUT\",\"COMPLETED\",\"EXPIRED\",\"FAILED\",\"CANCELLED\"","items":[{"const":"status"}],"additionalItems":{"title":"Filter the type of the machine_events to be notified","type":"string","enum":["CREATED","SENT","RECEIVED","STARTED","TIMED_OUT","COMPLETED","EXPIRED","FAILED","CANCELLED"]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Quarantine","properties":{"category":{"enum":["quarantine"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Quarantine output fields","type":"array","minItems":1,"items":{"type":"string","enum":["path","machine_name","created_at","status"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Quarantine output fields","type":"array","minItems":1,"items":{"type":"string","enum":["path","machine_name","created_at","status"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","status"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","title":"0: \"quarantine_action\". 1: \"QUARANTINE_DELETED\",\"QUARANTINE_RESTORED\"","items":[{"const":"quarantine_action"}],"additionalItems":{"title":"Filter the type of the quarantine_events to be notified","type":"string","enum":["QUARANTINE_DELETED","QUARANTINE_RESTORED"]}},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Threat scan","properties":{"category":{"enum":["threat_scan"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Threat scan output_fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","scan_date","scan_id","machine_id","machine_name","group_id","group_name","policy_id","policy_name","ip_address","detections","active_directory_ou"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Threat scan output_fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","scan_date","scan_id","machine_id","machine_name","group_id","group_name","policy_id","policy_name","ip_address","detections","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","ip_address","policy_id","policy_name"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"action\". 1: \"THREAT_CLEANED\",\"THREAT_FOUND\"","items":[{"const":"action"}],"additionalItems":{"title":"Filter events by threat activity action","type":"string","enum":["THREAT_CLEANED","THREAT_FOUND"]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Device control","properties":{"category":{"enum":["device_control"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Device control output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version","path","date","action","device_name","manufacturer","volume_serial","serial_number","physical_disk_name","disk_interface","file_system","volume_name","volume_device_path","last_user","active_directory_ou"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Device control output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version","path","date","action","device_name","manufacturer","volume_serial","serial_number","physical_disk_name","disk_interface","file_system","volume_name","volume_device_path","last_user","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","group_id","group_name","machine_id","machine_name","os_platform","os_release_name","policy_id","policy_name"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"action\". 1: \"blocked\", \"read-only\"","items":[{"const":"action"}],"additionalItems":{"title":"Filter events by action","type":"string","enum":["blocked","read-only"]}},{"title":"0: \"device_name\". 1: string","items":[{"const":"device_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"manufacturer\". 1: string","items":[{"const":"manufacturer"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"device_name\". 1: string","items":[{"const":"device_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"manufacturer\". 1: string","items":[{"const":"manufacturer"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","anyOf":[{"title":"0: \"device_name\". 1: string","items":[{"const":"device_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"manufacturer\". 1: string","items":[{"const":"manufacturer"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_contains":{"type":"array","anyOf":[{"title":"0: \"device_name\". 1: string","items":[{"const":"device_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"manufacturer\". 1: string","items":[{"const":"manufacturer"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Site end date","properties":{"category":{"enum":["license_expiring"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Site end date output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status","licensed_seats","used_seats","license_key","catalog_code","combo_product","licensed_product","license_expires_at","days_left"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Site end date output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status","licensed_seats","used_seats","license_key","catalog_code","combo_product","licensed_product","license_expires_at","days_left"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"days_left\". 1: 0,1,3,5,7,14,30","items":[{"const":"days_left"}],"additionalItems":{"title":"Filter events by days left before the license expiration","type":"number","enum":[0,1,3,5,7,14,30]}},{"title":"0: \"license_term_type\". 1: \"cloud_evaluation\",\"evaluation\",\"freemium\",\"nfr\",\"site_license\",\"subscription\",\"utility\"","items":[{"const":"license_term_type"}],"additionalItems":{"title":"Filter events by license term type","type":"string","enum":["cloud_evaluation","evaluation","freemium","nfr","site_license","subscription","utility"]}}]},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Site over deployed","properties":{"category":{"enum":["license_over_deployment"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Site over deployed output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status","licensed_seats","used_seats","license_key","catalog_code","combo_product"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Site over deployed output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status","licensed_seats","used_seats","license_key","catalog_code","combo_product"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"license_term_type\". 1: \"cloud_evaluation\",\"evaluation\",\"freemium\",\"nfr\",\"site_license\",\"subscription\",\"utility\"","items":[{"const":"license_term_type"}],"additionalItems":{"title":"Filter events by license term type","type":"string","enum":["cloud_evaluation","evaluation","freemium","nfr","site_license","subscription","utility"]}}]},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Vulnerability status","properties":{"category":{"enum":["cve_found"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Vulnerability status output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","product","vendor","installed_version","machine_id","machine_name","group_id","group_name","policy_id","policy_name","cve_id","severity","created_at","os_platform","os_release_name","os_version","cisa_exploitable","known_ransomware_campaign_use","description","published_at","severity_score","active_directory_ou"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Vulnerability status output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","product","vendor","installed_version","machine_id","machine_name","group_id","group_name","policy_id","policy_name","cve_id","severity","created_at","os_platform","os_release_name","os_version","cisa_exploitable","known_ransomware_campaign_use","description","published_at","severity_score","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","cve_id","product","os_platform"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"severity\". 1: \"unknown\",\"low\",\"medium\",\"high\",\"critical\"","items":[{"const":"severity"}],"additionalItems":{"title":"Filter events by severity","type":"string","enum":["unknown","low","medium","high","critical"]}},{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"cisa_exploitable\". 1: true, false","items":[{"const":"cisa_exploitable"},{"title":"Filter events by CISA exploitable"}],"additionalItems":false,"if":{"items":[{"const":"cisa_exploitable"}]},"then":{"items":[{"const":"cisa_exploitable"},{"type":"boolean"}]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","anyOf":[{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_contains":{"type":"array","anyOf":[{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","anyOf":[{"title":"Filter events by available patch exists","const":"available_patch"}]},"not_exists":{"type":"string","anyOf":[{"title":"Filter events by available patch not exists","const":"available_patch"}]},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"CVE Ignored","properties":{"category":{"enum":["cve_ignored"]},"delivery":{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}},"output_fields":{"title":"CVE Ignored output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","cve_id","ignored_reason","display_product","ignored_at","ignored_until","ignored_by","ignored_by_name"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","cve_id"]}}}}}},{"title":"Patch applied","properties":{"category":{"enum":["patch_applied"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Patch applied output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","title","description","product","vendor","severity","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_version","reboot_required","preview_patch","date","status","category","active_directory_ou"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Patch applied output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","title","description","product","vendor","severity","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_version","reboot_required","preview_patch","date","status","category","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","os_platform"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"status\". 1: \"COMPLETED\",\"FAILED\",\"REBOOT_REQUIRED\"","items":[{"const":"status"}],"additionalItems":{"title":"Filter events by status","type":"string","enum":["COMPLETED","FAILED","REBOOT_REQUIRED"]}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"preview_patch\". 1: true, false","items":[{"const":"preview_patch"},{"title":"Filter events by preview_patch"}],"additionalItems":false,"if":{"items":[{"const":"preview_patch"}]},"then":{"items":[{"const":"preview_patch"},{"type":"boolean"}]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Software update applied","properties":{"category":{"enum":["software_update"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Software update applied output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","product","vendor","current_version","new_version","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_version","date","status","signature_id","active_directory_ou"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Software update applied output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","product","vendor","current_version","new_version","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_version","date","status","signature_id","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","os_platform"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"status\". 1: \"COMPLETED\",\"FAILED\"","items":[{"const":"status"}],"additionalItems":{"title":"Filter events by status","type":"string","enum":["COMPLETED","FAILED"]}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Patch or software update available","properties":{"category":{"enum":["patch_available"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Patch or software update available","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","title","description","product","vendor","severity","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_version","reboot_required","preview_patch","date","category","patch_id","kb_id","released_at","size","active_directory_ou"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Patch or software update available","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","title","description","product","vendor","severity","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_version","reboot_required","preview_patch","date","category","patch_id","kb_id","released_at","size","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","os_platform"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"severity\". 1: \"unknown\",\"moderate\",\"low\",\"important\",\"critical\"","items":[{"const":"severity"}],"additionalItems":{"title":"Filter events by severity","type":"string","enum":["unknown","moderate","low","important","critical"]}},{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"reboot_required\". 1: true, false","items":[{"const":"reboot_required"},{"title":"Filter events by reboot_required"}],"additionalItems":false,"if":{"items":[{"const":"reboot_required"}]},"then":{"items":[{"const":"reboot_required"},{"type":"boolean"}]}},{"title":"0: \"preview_patch\". 1: true, false","items":[{"const":"preview_patch"},{"title":"Filter events by preview_patch"}],"additionalItems":false,"if":{"items":[{"const":"preview_patch"}]},"then":{"items":[{"const":"preview_patch"},{"type":"boolean"}]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","anyOf":[{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_contains":{"type":"array","anyOf":[{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"begins_with":{"type":"array","anyOf":[{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}}]},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"CSS detection","properties":{"category":{"enum":["css_detection"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"CSS detection output fields","minItems":1,"type":"array","items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name","file_name","css_threat_name","action_taken","file_location","file_owner","timestamp"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"CSS detection output fields","minItems":1,"type":"array","items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name","file_name","css_threat_name","action_taken","file_location","file_owner","timestamp"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","action_taken","cloud_provider","scan_configuration_name"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"action_taken\". 1: \"Found\", \"Quarantined\"","items":[{"const":"action_taken"}],"additionalItems":{"title":"Filter events by action taken","type":"string","enum":["Found","Quarantined"]}},{"title":"0: \"cloud_provider\". 1: \"BOX\", \"ONEDRIVE\", \"GOOGLEDRIVE\"","items":[{"const":"cloud_provider"}],"additionalItems":{"title":"Filter events by cloud provider","type":"string","enum":["BOX","ONEDRIVE","GOOGLEDRIVE"]}},{"title":"0: \"scan_configuration_name\". 1: string","items":[{"const":"scan_configuration_name"}],"additionalItems":{"title":"Filter events by scan configuration name","type":"string"}}]},"not_eq":{"type":"array","title":"0: \"scan_configuration_name\". 1: string","items":[{"const":"scan_configuration_name"}],"additionalItems":{"title":"Filter events by scan_configuration_name","type":"string"}},"contains":{"title":"0: \"scan_configuration_name\". 1: string","type":"array","items":[{"const":"scan_configuration_name"}],"additionalItems":{"title":"Filter events by scan_configuration_name","type":"string"}},"not_contains":{"title":"0: \"scan_configuration_name\". 1: string","type":"array","items":[{"const":"scan_configuration_name"}],"additionalItems":{"title":"Filter events by scan_configuration_name","type":"string"}},"begins_with":{"title":"0: \"scan_configuration_name\". 1: string","type":"array","items":[{"const":"scan_configuration_name"}],"additionalItems":{"title":"Filter events by scan_configuration_name","type":"string"}},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"CSS capacity approached","properties":{"category":{"enum":["css_capacity_approached"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"CSS capacity approached output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name","timestamp"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"CSS capacity approached output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name","timestamp"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name"]}}}}}},{"title":"CSS capacity reached","properties":{"category":{"enum":["css_capacity_reached"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"CSS capacity reached output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name","timestamp"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"CSS capacity reached output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name","timestamp"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name"]}}}}}},{"title":"CSS capacity exceeded","properties":{"category":{"enum":["css_capacity_exceeded"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"CSS capacity exceeded output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name","timestamp"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"CSS capacity exceeded output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name","timestamp"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name"]}}}}}},{"title":"DNS blocked","properties":{"category":{"enum":["dns_blocked"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"DNS blocked output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","timestamp","group_id","group_name","policy_id","policy_name","colo_id","device_id","user_id","dst_ip","src_ip","email","location","policy","rule_name","action","protocol","query_name","query_name_reversed","resolver_decision","query_category_ids","query_size","query_type","src_port","dst_port","os_platform","os_release_name","os_type","os_version","os_architecture"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"DNS blocked output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","timestamp","group_id","group_name","policy_id","policy_name","colo_id","device_id","user_id","dst_ip","src_ip","email","location","policy","rule_name","action","protocol","query_name","query_name_reversed","resolver_decision","query_category_ids","query_size","query_type","src_port","dst_port","os_platform","os_release_name","os_type","os_version","os_architecture"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"policy_id\". 1: string","items":[{"const":"policy_id"}],"additionalItems":{"title":"Filter events by policy_id","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"policy_id\". 1: string","items":[{"const":"policy_id"}],"additionalItems":{"title":"Filter events by policy_id","type":"string"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Case management","properties":{"category":{"enum":["siemplify_case"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Case management output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","case_id","case_name","case_status","case_created_at","priority","action_required","event","endpoints","detections"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Case management output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","case_id","case_name","case_status","case_created_at","priority","action_required","event","endpoints","detections"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","case_id"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"event\". 1: \"case_created\",\"case_updated\",\"case_closed\"","items":[{"const":"event"}],"additionalItems":{"title":"Filter events by status","type":"string","enum":["case_created","case_updated","case_closed"]}},{"title":"0: \"priority\". 1: \"Critical\", \"High\", \"Medium\", \"Low\"","items":[{"const":"priority"}],"additionalItems":{"title":"Filter events by status","type":"string","enum":["Critical","High","Medium","Low"]}},{"title":"0: \"action_required\". 1: true, false","items":[{"const":"action_required"},{"title":"Filter events by CISA exploitable"}],"additionalItems":false,"if":{"items":[{"const":"action_required"}]},"then":{"items":[{"const":"action_required"},{"type":"boolean"}]}}]},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Application block","properties":{"category":{"enum":["app_block"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Application block output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","app_block_rules","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version","scanned_at","file_path","last_user","active_directory_ou"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Application block output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","app_block_rules","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version","scanned_at","file_path","last_user","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"policy_id\". 1: string","items":[{"const":"policy_id"}],"additionalItems":{"title":"Filter events by policy_id","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"policy_id\". 1: string","items":[{"const":"policy_id"}],"additionalItems":{"title":"Filter events by policy_id","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","additionalItems":false},"lte":{"type":"array","const":""},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Entitlement changed","properties":{"category":{"enum":["license_entitlement_changed"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Entitlement changed output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status","licensed_seats","used_seats","license_key","catalog_code","combo_product","licensed_product","license_expires_at","license_key_status","auto_renew","status"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Entitlement changed output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status","licensed_seats","used_seats","license_key","catalog_code","combo_product","licensed_product","license_expires_at","license_key_status","auto_renew","status"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"status\". 1: \"added\",\"updated\",\"removed\"","items":[{"const":"status"}],"additionalItems":{"title":"Filter events by status","type":"string","enum":["added","updated","removed"]}},{"title":"0: \"license_term_type\". 1: \"cloud_evaluation\",\"evaluation\",\"freemium\",\"nfr\",\"site_license\",\"subscription\",\"utility\"","items":[{"const":"license_term_type"}],"additionalItems":{"title":"Filter events by license term type","type":"string","enum":["cloud_evaluation","evaluation","freemium","nfr","site_license","subscription","utility"]}}]},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Entitlement usage changed","properties":{"category":{"enum":["license_entitlement_usage_changed"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Entitlement usage changed output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status","licensed_seats","used_seats","license_key","catalog_code","combo_product","licensed_product","license_expires_at","license_key_status","auto_renew"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Entitlement usage changed output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status","licensed_seats","used_seats","license_key","catalog_code","combo_product","licensed_product","license_expires_at","license_key_status","auto_renew"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","title":"0: \"license_term_type\". 1: \"cloud_evaluation\",\"evaluation\",\"freemium\",\"nfr\",\"site_license\",\"subscription\",\"utility\"","items":[{"const":"license_term_type"}],"additionalItems":{"title":"Filter events by license term type","type":"string","enum":["cloud_evaluation","evaluation","freemium","nfr","site_license","subscription","utility"]}},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Endpoint status changed","properties":{"category":{"enum":["endpoint_status_changed"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Endpoint status changed","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","status_change","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version","codes"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Endpoint status changed","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","status_change","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version","codes"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","status_change","machine_id","machine_name"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"status_change\". 1: \"ENDPOINT_REBOOT_REQUIRED\",\"ENDPOINT_REBOOT_REQUIRED_CLEARED\",\"ENDPOINT_INFECTED\",\"ENDPOINT_REMEDIATED\",\"ENDPOINT_ISOLATED\",\"ENDPOINT_UNISOLATED\",\"ENDPOINT_SUSPICIOUS_ACTIVITY_FOUND\",\"ENDPOINT_SUSPICIOUS_ACTIVITY_CLEARED\",\"AGENT_ALERTS_CHANGED\"","items":[{"const":"status_change"}],"additionalItems":{"title":"Filter the type of status_change to be notified","type":"string","enum":["ENDPOINT_REBOOT_REQUIRED","ENDPOINT_REBOOT_REQUIRED_CLEARED","ENDPOINT_INFECTED","ENDPOINT_REMEDIATED","ENDPOINT_ISOLATED","ENDPOINT_UNISOLATED","ENDPOINT_SUSPICIOUS_ACTIVITY_FOUND","ENDPOINT_SUSPICIOUS_ACTIVITY_CLEARED","AGENT_ALERTS_CHANGED"]}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Inactive endpoint","properties":{"category":{"enum":["inactive_endpoint"]},"delivery":{"properties":{"output_fields":{"title":"Information to include in the JSON body. If omitted, include all","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version","last_seen_at"]}}}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"os_type\". 1: \"1\"(Workstation), \"2\"(Server), \"3\"(Mobile)","items":[{"const":"os_type"}],"additionalItems":{"title":"Filter events by OS type","type":"number","enum":[1,2,3]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"policy_id\". 1: string","items":[{"const":"policy_id"}],"additionalItems":{"title":"Filter events by policy_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"contains":{"type":"array","anyOf":[{"title":"0: \"policy_name\". 1: string","items":[{"const":"policy_name"}],"additionalItems":{"title":"Filter events by policy_name","type":"string"}},{"title":"0: \"group_name\". 1: string","items":[{"const":"group_name"}],"additionalItems":{"title":"Filter events by group_name","type":"string"}}]},"not_contains":{"type":"array","anyOf":[{"title":"0: \"policy_name\". 1: string","items":[{"const":"policy_name"}],"additionalItems":{"title":"Filter events by policy_name","type":"string"}},{"title":"0: \"group_name\". 1: string","items":[{"const":"group_name"}],"additionalItems":{"title":"Filter events by group_name","type":"string"}}]},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","anyOf":[{"title":"0: \"last_seen_at\"","items":[{"const":"last_seen_at"}],"additionalItems":{"title":"Filter inactive machines by less than equals days since last active","type":"number","minimum":1}}]},"gte":{"type":"array","anyOf":[{"title":"0: \"last_seen_at\"","items":[{"const":"last_seen_at"}],"additionalItems":{"title":"Filter inactive machines by less than equals days since last active","type":"number","minimum":1}}]}}}}}}}}}}},{"title":"Firewall activity","properties":{"category":{"enum":["firewall_activity"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Firewall activity output fields","type":"array","minItems":1,"items":{"type":"string","enum":["start_time","end_time","rule_id","rule_name","ruleset_id","ruleset_name","direction","action","protocol","location","program","service","hits","account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Firewall activity output fields","type":"array","minItems":1,"items":{"type":"string","enum":["start_time","end_time","rule_id","rule_name","ruleset_id","ruleset_name","direction","action","protocol","location","program","service","hits","account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"action\". 1: \"ALLOW\", \"BLOCK\"","items":[{"const":"action"}],"additionalItems":{"title":"Filter events by action","type":"string","enum":["ALLOW","BLOCK"]}},{"title":"0: \"direction\". 1: \"Inbound\", \"Outbound\"","items":[{"const":"direction"}],"additionalItems":{"title":"Filter events by direction","type":"string","enum":["Inbound","Outbound"]}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"policy_id\". 1: string","items":[{"const":"policy_id"}],"additionalItems":{"title":"Filter events by policy_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"policy_id\". 1: string","items":[{"const":"policy_id"}],"additionalItems":{"title":"Filter events by policy_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Endpoint isolation","properties":{"category":{"enum":["endpoint_isolation"]},"delivery":{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}},"output_fields":{"title":"Endpoint isolation output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","status","created_at","updated_at","expires_at","machine_id","machine_name","os_release_name","os_platform","os_type","os_version","rule_id","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","status","machine_id","machine_name"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"status\". 1: \"COMPLETED\",\"EXPIRED\",\"FAILED\",\"CANCELLED\"","items":[{"const":"status"}],"additionalItems":{"title":"Filter the type of the status update to be notified","type":"string","enum":["COMPLETED","EXPIRED","FAILED","CANCELLED"]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","anyOf":[{"title":"Filter events by rule_ud exists. If it exists, it indicates that it's an auto-isolation job","const":"rule_id"}]},"not_exists":{"type":"string","anyOf":[{"title":"Filter events by rule_ud exists. If it exists, it indicates that it's an auto-isolation job","const":"rule_id"}]},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Record (notification/report) audit","properties":{"category":{"enum":["record_audit"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Record audit output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","record_type","record_name","record_action","timestamp","user_email","owner"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Record audit output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","record_type","record_name","record_action","timestamp","user_email","owner"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","additionalItems":false},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","anyOf":[{"title":"0: \"record_action\". 1: \"REPORT\", \"NOTIFICATION\", \"UPDATED\", \"DELETED\"","items":[{"const":"record_action"}],"additionalItems":{"title":"Filter events by record action","type":"string","enum":["REPORT","NOTIFICATION","UPDATED","DELETED"]}}]},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"MXDR integration communication inactive","properties":{"category":{"enum":["mxdr_integration_inactive"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"mxdr_integration_inactive output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","source","last_log_seen","inactive_hours"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"mxdr_integration_inactive output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","source","last_log_seen","inactive_hours"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"source\". 1: \"okta\", \"entra\", \"msgraphapi\", \"meraki\", \"watchguard\", \"fortinet\"","items":[{"const":"source"}],"additionalItems":{"title":"Filter events by source","type":"string","enum":["okta","entra","msgraphapi","meraki","watchguard","fortinet"]}},{"title":"0: \"inactive_hours\". 1: 1, 24","items":[{"const":"inactive_hours"}],"additionalItems":{"title":"Filter events by inactive_hours","type":"number","enum":[1,24]}}]},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Audit log activity","properties":{"category":{"enum":["audit_log_activity"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Audit log activity output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","user_id","user_name","action","patch_titles","application_names","expires_at","reason","ignore_rule_name","application_version","ignore_rule_applies_to"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Audit log activity output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","user_id","user_name","action","patch_titles","application_names","expires_at","reason","ignore_rule_name","application_version","ignore_rule_applies_to"]}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"resource_type\". 1: \"ignore_rule\"","items":[{"const":"resource_type"}],"additionalItems":{"title":"Filter events by resource type","type":"string","enum":["ignore_rule"]}},{"title":"0: \"action\". 1: \"create\", \"update\"","items":[{"const":"action"}],"additionalItems":{"title":"Filter events by action","type":"string","enum":["create","update"]}}]}}}}}}}}}}},{"title":"XDR alert","properties":{"category":{"enum":["xdr_alert"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"xdr_alert output fields","type":"array","minItems":1,"items":{"type":"string","enum":["source","severity","account_id","account_name","created_at","category","alert_id","rule_name","attack_category","attack_detection_type","identity_primary_identifier","identity_group_name"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"xdr_alert output fields","type":"array","minItems":1,"items":{"type":"string","enum":["source","severity","account_id","account_name","created_at","category","alert_id","rule_name","attack_category","attack_detection_type","identity_primary_identifier","identity_group_name"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","source"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"source\". 1: \"okta\", \"entra\", \"edr\"","items":[{"const":"source"}],"additionalItems":{"title":"Filter events by source","type":"string","enum":["okta","entra","edr"]}},{"title":"0: \"severity\". 1: \"information\", \"low\", \"medium\", \"high\", \"critical\"","items":[{"const":"severity"}],"additionalItems":{"title":"Filter events by severity","type":"string","enum":["information","low","medium","high","critical"]}},{"title":"0: \"attack_category\". 1: string","items":[{"const":"attack_category"}],"additionalItems":{"title":"Filter events by attack_category","type":"string"}},{"title":"0: \"identity_primary_identifier\". 1: string","items":[{"const":"identity_primary_identifier"}],"additionalItems":{"title":"Filter events by identity_primary_identifier","type":"string"}},{"title":"0: \"identity_group_name\". 1: string","items":[{"const":"identity_group_name"}],"additionalItems":{"title":"Filter events by identity_group_name","type":"string"}}]},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","anyOf":[{"title":"0: \"attack_category\". 1: string","items":[{"const":"attack_category"}],"additionalItems":{"title":"Filter events by attack_category","type":"string"}},{"title":"0: \"identity_primary_identifier\". 1: string","items":[{"const":"identity_primary_identifier"}],"additionalItems":{"title":"Filter events by identity_primary_identifier","type":"string"}},{"title":"0: \"identity_group_name\". 1: string","items":[{"const":"identity_group_name"}],"additionalItems":{"title":"Filter events by identity_group_name","type":"string"}}]},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Drive encryption","properties":{"category":{"enum":["drive_encryption"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Drive encryption output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","action","machine_name","policy_name","encryption_method","drive_label","timestamp"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Drive encryption output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","action","machine_name","policy_name","encryption_method","drive_label","timestamp"]}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"action\". 1: \"MACHINE_DRIVE_ENCRYPTION_ENCRYPTION_FAILED\", \"MACHINE_DRIVE_ENCRYPTION_SUSPENDED\", or \"MACHINE_DRIVE_ENCRYPTION_RECOVERY_DETECTED\"","items":[{"const":"action"}],"additionalItems":{"title":"Filter events by action type","type":"string","enum":["MACHINE_DRIVE_ENCRYPTION_ENCRYPTION_FAILED","MACHINE_DRIVE_ENCRYPTION_SUSPENDED","MACHINE_DRIVE_ENCRYPTION_RECOVERY_DETECTED"]}}]}}}}}}}}}}}],"if":{"properties":{"category":{"enum":["user_added","user_deleted","user_verified","license_over_deployment","css_capacity_approached","css_capacity_reached","css_capacity_exceeded"]}}},"then":{"properties":{"conditions":{"additionalProperties":false}}}},{"type":"object","properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]},{"allOf":[{"required":["name","category","delivery"],"properties":{"name":{"title":"Notification name. Must be unique","type":"string"},"description":{"title":"Notification description","type":"string","default":""},"category":{"title":"The category of the events to be notified","type":"string"},"delivery":{},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object"},"aggregation":{"title":"Aggregate multiple events in a single notifications","type":"object","properties":{"interval":{"title":"Interval in seconds for aggregating events in a single notification. It must be defined to apply aggregation","type":"integer","minimum":10,"maximum":86400}}},"enabled":{"title":"enable/disable notification","type":"boolean","default":true},"owner":{"title":"the identifier of the owner of the subscription","type":"string"}}},{"anyOf":[{"title":"OneView user added","properties":{"category":{"enum":["oneview_user_added"]},"delivery":{"anyOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"OneView user added output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","user_id","user_name","user_email","user_role","ip_address","timestamp","sites","invited_by_email"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["invited_by_email"]}}}}}},{"title":"OneView user verified","properties":{"category":{"enum":["oneview_user_verified"]},"delivery":{"anyOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"OneView user verified output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","user_id","user_name","user_email","ip_address","timestamp"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"Not available for this category","maxItems":0}}}}},{"title":"OneView user deleted","properties":{"category":{"enum":["oneview_user_deleted"]},"delivery":{"anyOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"OneView user deleted output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","user_id","user_name","user_email","user_role","ip_address","timestamp","sites","deleted_by_email"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["deleted_by_email"]}}}}}},{"title":"OneView sites assigned","allOf":[{"properties":{"category":{"enum":["oneview_sites_assigned"]},"delivery":{"anyOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"OneView sites assigned output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","user_id","user_name","user_email","user_role","ip_address","timestamp","sites","assigned_by_email","added_sites","removed_sites"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["assigned_by_email","user_email"]}}}}}},{"type":"object","properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]},{"title":"OneView trial to paid status","allOf":[{"properties":{"category":{"enum":["oneview_trial_to_paid_status"]},"delivery":{"anyOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"OneView trial to paid status output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","timestamp","max_protection","device_type","conversion_status","sites"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["device_type","conversion_status","max_protection"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"nebula_account_id\". 1: string","items":[{"const":"nebula_account_id"}],"additionalItems":{"title":"Filter events by nebula_account_id","type":"string"}},{"title":"0: \"conversion_status\". 1: \"FAILED\", \"SUCCESS\"","items":[{"const":"conversion_status"}],"additionalItems":{"title":"Filter events by conversion status","type":"string","enum":["FAILED","SUCCESS"]}}]},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""}}}}}}}}}}},{"type":"object","properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]},{"title":"OneView site end date approaching","properties":{"category":{"enum":["oneview_site_end_date_approaching"]},"delivery":{"anyOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"OneView site end date approachnig output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","timestamp","sites","days_left","site_end_date"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","maxItems":0}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"days_left\". 1: 0,1,7,14,30","items":[{"const":"days_left"}],"additionalItems":{"title":"Filter events by days left before the license expiration","type":"number","enum":[0,1,7,14,30]}}]},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""}}}}}}}}}}}]},{"if":{"properties":{"category":{"enum":["oneview_user_added","oneview_user_deleted","oneview_user_verified","oneview_sites_assigned"]}}},"then":{"properties":{"conditions":{"additionalProperties":false}}}}]}]}],"if":{"properties":{"category":{"enum":["oneview_user_added","oneview_user_verified","oneview_user_deleted","oneview_sites_assigned","oneview_trial_to_paid_status","oneview_site_end_date_approaching"]}}},"then":{"required":["parent_account_id"]}}}}},"responses":{"202":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"RMM notification response","allOf":[{"type":"object","title":"The Schema For Notifications Creation","anyOf":[{"allOf":[{"type":"object","title":"The create notification Body","required":["name","category","delivery"],"properties":{"name":{"title":"Notification name. Must be unique","type":"string"},"description":{"title":"Notification description","type":"string","default":""},"category":{"title":"The category of the events to be notified","type":"string"},"delivery":{},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object"},"aggregation":{"title":"Aggregate multiple events in a single notifications","type":"object","properties":{"interval":{"title":"Interval in seconds for aggregating events in a single notification. It must be defined to apply aggregation","type":"integer","minimum":10,"maximum":86400}}},"enabled":{"title":"enable/disable notification","type":"boolean","default":true},"owner":{"title":"the identifier of the owner of the subscription. Not available for read-only users","type":"string"}},"anyOf":[{"title":"Detections","properties":{"category":{"enum":["threat_detections"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Detections output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","os_release_name","os_platform","os_type","os_version","category","type","path","status","scanned_at","reported_at","resource_created_at","resource_modified_at","threat_name","affected_application","process_name","machine_id","machine_name","machine_ip","group_id","group_name","policy_id","policy_name","nics","md5","sha256","engine_version","last_user","active_directory_ou","id"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Detections output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","os_release_name","os_platform","os_type","os_version","category","type","path","status","scanned_at","reported_at","resource_created_at","resource_modified_at","threat_name","affected_application","process_name","machine_id","machine_name","machine_ip","group_id","group_name","policy_id","policy_name","nics","md5","sha256","engine_version","last_user","active_directory_ou","id"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","affected_application","category","group_id","group_name","machine_id","machine_ip","machine_name","os_platform","os_release_name","path","policy_id","policy_name","process_name","status","threat_name","type"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"category\". 1: \"MALWARE\",\"PUP\",\"PUM\",\"AE\",\"ARW\",\"MWAC\",\"RID\",\"VULNERABLE_DRIVER\"","items":[{"const":"category"}],"additionalItems":{"title":"Filter events by detection category","type":"string","enum":["MALWARE","PUP","PUM","AE","ARW","MWAC","RID","VULNERABLE_DRIVER"]}},{"title":"0: \"action\". 1: \"blocked\", \"deleted\", \"deletedAutoPrune\", \"found\", \"quarantined\", \"restored\"","items":[{"const":"action"}],"additionalItems":{"title":"Filter events by action","type":"string","enum":["blocked","deleted","deletedAutoPrune","found","quarantined","restored"]}},{"title":"0: \"threat_name\". 1: string","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux), \"4\"(Android), \"3\"(IOS), \"3\"(ChromeOS)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3,4,5,6]}},{"title":"0: \"rtp\". 1: true, false","items":[{"const":"rtp"},{"title":"Filter events by real time protection"}],"additionalItems":false,"if":{"items":[{"const":"rtp"}]},"then":{"items":[{"const":"rtp"},{"type":"boolean"}]}},{"title":"0: \"type\". 1: \"application\", \"exploit\", \"extension\", \"file\", \"folder\", \"InboundConnection\", \"module\", \"OutboundConnection\", \"process\", \"reg_key\", \"reg_value\"","items":[{"const":"type"}],"additionalItems":{"title":"Filter events by type","type":"string","enum":["application","exploit","extension","file","folder","InboundConnection","module","OutboundConnection","process","reg_key","reg_value"]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"threat_name\". 1: string","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","anyOf":[{"title":"0: \"threat_name\". 1: string","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_contains":{"type":"array","anyOf":[{"title":"0: \"threat_name\". 1: string","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"begins_with":{"title":"0: \"threat_name\". 1: string","type":"array","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Suspicious activity","properties":{"category":{"enum":["threat_suspicious_activity"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Suspicious activity","type":"array","minItems":1,"items":{"type":"string","enum":["severity","account_id","account_name","os_release_name","os_platform","type","path","status","scanned_at","reported_at","threat_name","machine_id","machine_name","machine_ip","group_id","group_name","policy_id","policy_name","nics","last_user","first_activity","last_activity","isolation_type","id"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Suspicious activity","type":"array","minItems":1,"items":{"type":"string","enum":["severity","account_id","account_name","os_release_name","os_platform","type","path","status","scanned_at","reported_at","threat_name","machine_id","machine_name","machine_ip","group_id","group_name","policy_id","policy_name","nics","last_user","first_activity","last_activity","isolation_type","id"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","group_id","group_name","machine_id","machine_ip","machine_name","os_platform","os_release_name","path","policy_id","policy_name","severity","status","threat_name"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"level\". 1: \"low\", \"medium\", \"high\", \"critical\"","items":[{"const":"level"}],"additionalItems":{"title":"Filter events by severity level","type":"string","enum":["low","medium","high","critical"]}},{"title":"0: \"threat_name\". 1: string","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux), \"4\"(Android), \"3\"(IOS), \"3\"(ChromeOS)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3,4,5,6]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"threat_name\". 1: string","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"contains":{"title":"0: \"threat_name\". 1: string","type":"array","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},"not_contains":{"title":"0: \"threat_name\". 1: string","type":"array","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},"begins_with":{"title":"0: \"threat_name\". 1: string","type":"array","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},"exists":{"type":"string","anyOf":[{"title":"Filter events by isolation_type exists","const":"isolation_type"}]},"not_exists":{"anyOf":[{"title":"Filter events by isolation_type not exists","const":"isolation_type"}]},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"User added","properties":{"category":{"enum":["user_added"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"User added","type":"array","minItems":1,"items":{"type":"string","enum":["ip_address","invited_by","role","email","full_group_access","timestamp","account_id"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"User added","type":"array","minItems":1,"items":{"type":"string","enum":["ip_address","invited_by","role","email","full_group_access","timestamp","account_id"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","invited_by","ip_address","role"]}}}}}},{"title":"User deleted","properties":{"category":{"enum":["user_deleted"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"User deleted output fields","type":"array","minItems":1,"items":{"type":"string","enum":["ip_address","timestamp","account_id","deleted_by","email"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"User deleted output fields","type":"array","minItems":1,"items":{"type":"string","enum":["ip_address","timestamp","account_id","deleted_by","email"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","ip_address","deleted_by"]}}}}}},{"title":"User verified","properties":{"category":{"enum":["user_verified"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"User verified","type":"array","minItems":1,"items":{"type":"string","enum":["email","timestamp","account_id"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"User verified","type":"array","minItems":1,"items":{"type":"string","enum":["email","timestamp","account_id"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name"]}}}}}},{"title":"Endpoint registered","properties":{"category":{"enum":["endpoint_registered"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Endpoint registered output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","created_at"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Endpoint registered output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","created_at"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Endpoint deleted","properties":{"category":{"enum":["endpoint_unregistered"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Endpoint deleted output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","timestamp","timeout"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Endpoint deleted output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","timestamp","timeout"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"timeout\". 1: true, false","items":[{"const":"timeout"},{"title":"Filter events by timeout (true if the machine was deleted because marked_for_deletion and never connected again until a timeout)"}],"additionalItems":false,"if":{"items":[{"const":"timeout"}]},"then":{"items":[{"const":"timeout"},{"type":"boolean"}]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Command update","properties":{"category":{"enum":["endpoint_command_update"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Command update output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","command","status","created_at","updated_at","expires_at","machine_id","machine_name","group_id","active_directory_ou"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Command update output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","command","status","created_at","updated_at","expires_at","machine_id","machine_name","group_id","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","command","status","machine_id","machine_name"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"status\". 1: \"CREATED\",\"SENT\",\"RECEIVED\",\"STARTED\",\"TIMED_OUT\",\"COMPLETED\",\"EXPIRED\",\"FAILED\",\"CANCELLED\"","items":[{"const":"status"}],"additionalItems":{"title":"Filter the type of the machine_events to be notified","type":"string","enum":["CREATED","SENT","RECEIVED","STARTED","TIMED_OUT","COMPLETED","EXPIRED","FAILED","CANCELLED"]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Quarantine","properties":{"category":{"enum":["quarantine"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Quarantine output fields","type":"array","minItems":1,"items":{"type":"string","enum":["path","machine_name","created_at","status"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Quarantine output fields","type":"array","minItems":1,"items":{"type":"string","enum":["path","machine_name","created_at","status"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","status"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","title":"0: \"quarantine_action\". 1: \"QUARANTINE_DELETED\",\"QUARANTINE_RESTORED\"","items":[{"const":"quarantine_action"}],"additionalItems":{"title":"Filter the type of the quarantine_events to be notified","type":"string","enum":["QUARANTINE_DELETED","QUARANTINE_RESTORED"]}},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Threat scan","properties":{"category":{"enum":["threat_scan"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Threat scan output_fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","scan_date","scan_id","machine_id","machine_name","group_id","group_name","policy_id","policy_name","ip_address","detections","active_directory_ou"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Threat scan output_fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","scan_date","scan_id","machine_id","machine_name","group_id","group_name","policy_id","policy_name","ip_address","detections","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","ip_address","policy_id","policy_name"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"action\". 1: \"THREAT_CLEANED\",\"THREAT_FOUND\"","items":[{"const":"action"}],"additionalItems":{"title":"Filter events by threat activity action","type":"string","enum":["THREAT_CLEANED","THREAT_FOUND"]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Device control","properties":{"category":{"enum":["device_control"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Device control output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version","path","date","action","device_name","manufacturer","volume_serial","serial_number","physical_disk_name","disk_interface","file_system","volume_name","volume_device_path","last_user","active_directory_ou"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Device control output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version","path","date","action","device_name","manufacturer","volume_serial","serial_number","physical_disk_name","disk_interface","file_system","volume_name","volume_device_path","last_user","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","group_id","group_name","machine_id","machine_name","os_platform","os_release_name","policy_id","policy_name"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"action\". 1: \"blocked\", \"read-only\"","items":[{"const":"action"}],"additionalItems":{"title":"Filter events by action","type":"string","enum":["blocked","read-only"]}},{"title":"0: \"device_name\". 1: string","items":[{"const":"device_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"manufacturer\". 1: string","items":[{"const":"manufacturer"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"device_name\". 1: string","items":[{"const":"device_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"manufacturer\". 1: string","items":[{"const":"manufacturer"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","anyOf":[{"title":"0: \"device_name\". 1: string","items":[{"const":"device_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"manufacturer\". 1: string","items":[{"const":"manufacturer"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_contains":{"type":"array","anyOf":[{"title":"0: \"device_name\". 1: string","items":[{"const":"device_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"manufacturer\". 1: string","items":[{"const":"manufacturer"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Site end date","properties":{"category":{"enum":["license_expiring"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Site end date output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status","licensed_seats","used_seats","license_key","catalog_code","combo_product","licensed_product","license_expires_at","days_left"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Site end date output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status","licensed_seats","used_seats","license_key","catalog_code","combo_product","licensed_product","license_expires_at","days_left"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"days_left\". 1: 0,1,3,5,7,14,30","items":[{"const":"days_left"}],"additionalItems":{"title":"Filter events by days left before the license expiration","type":"number","enum":[0,1,3,5,7,14,30]}},{"title":"0: \"license_term_type\". 1: \"cloud_evaluation\",\"evaluation\",\"freemium\",\"nfr\",\"site_license\",\"subscription\",\"utility\"","items":[{"const":"license_term_type"}],"additionalItems":{"title":"Filter events by license term type","type":"string","enum":["cloud_evaluation","evaluation","freemium","nfr","site_license","subscription","utility"]}}]},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Site over deployed","properties":{"category":{"enum":["license_over_deployment"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Site over deployed output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status","licensed_seats","used_seats","license_key","catalog_code","combo_product"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Site over deployed output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status","licensed_seats","used_seats","license_key","catalog_code","combo_product"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"license_term_type\". 1: \"cloud_evaluation\",\"evaluation\",\"freemium\",\"nfr\",\"site_license\",\"subscription\",\"utility\"","items":[{"const":"license_term_type"}],"additionalItems":{"title":"Filter events by license term type","type":"string","enum":["cloud_evaluation","evaluation","freemium","nfr","site_license","subscription","utility"]}}]},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Vulnerability status","properties":{"category":{"enum":["cve_found"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Vulnerability status output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","product","vendor","installed_version","machine_id","machine_name","group_id","group_name","policy_id","policy_name","cve_id","severity","created_at","os_platform","os_release_name","os_version","cisa_exploitable","known_ransomware_campaign_use","description","published_at","severity_score","active_directory_ou"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Vulnerability status output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","product","vendor","installed_version","machine_id","machine_name","group_id","group_name","policy_id","policy_name","cve_id","severity","created_at","os_platform","os_release_name","os_version","cisa_exploitable","known_ransomware_campaign_use","description","published_at","severity_score","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","cve_id","product","os_platform"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"severity\". 1: \"unknown\",\"low\",\"medium\",\"high\",\"critical\"","items":[{"const":"severity"}],"additionalItems":{"title":"Filter events by severity","type":"string","enum":["unknown","low","medium","high","critical"]}},{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"cisa_exploitable\". 1: true, false","items":[{"const":"cisa_exploitable"},{"title":"Filter events by CISA exploitable"}],"additionalItems":false,"if":{"items":[{"const":"cisa_exploitable"}]},"then":{"items":[{"const":"cisa_exploitable"},{"type":"boolean"}]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","anyOf":[{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_contains":{"type":"array","anyOf":[{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","anyOf":[{"title":"Filter events by available patch exists","const":"available_patch"}]},"not_exists":{"type":"string","anyOf":[{"title":"Filter events by available patch not exists","const":"available_patch"}]},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"CVE Ignored","properties":{"category":{"enum":["cve_ignored"]},"delivery":{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}},"output_fields":{"title":"CVE Ignored output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","cve_id","ignored_reason","display_product","ignored_at","ignored_until","ignored_by","ignored_by_name"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","cve_id"]}}}}}},{"title":"Patch applied","properties":{"category":{"enum":["patch_applied"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Patch applied output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","title","description","product","vendor","severity","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_version","reboot_required","preview_patch","date","status","category","active_directory_ou"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Patch applied output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","title","description","product","vendor","severity","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_version","reboot_required","preview_patch","date","status","category","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","os_platform"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"status\". 1: \"COMPLETED\",\"FAILED\",\"REBOOT_REQUIRED\"","items":[{"const":"status"}],"additionalItems":{"title":"Filter events by status","type":"string","enum":["COMPLETED","FAILED","REBOOT_REQUIRED"]}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"preview_patch\". 1: true, false","items":[{"const":"preview_patch"},{"title":"Filter events by preview_patch"}],"additionalItems":false,"if":{"items":[{"const":"preview_patch"}]},"then":{"items":[{"const":"preview_patch"},{"type":"boolean"}]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Software update applied","properties":{"category":{"enum":["software_update"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Software update applied output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","product","vendor","current_version","new_version","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_version","date","status","signature_id","active_directory_ou"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Software update applied output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","product","vendor","current_version","new_version","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_version","date","status","signature_id","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","os_platform"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"status\". 1: \"COMPLETED\",\"FAILED\"","items":[{"const":"status"}],"additionalItems":{"title":"Filter events by status","type":"string","enum":["COMPLETED","FAILED"]}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Patch or software update available","properties":{"category":{"enum":["patch_available"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Patch or software update available","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","title","description","product","vendor","severity","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_version","reboot_required","preview_patch","date","category","patch_id","kb_id","released_at","size","active_directory_ou"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Patch or software update available","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","title","description","product","vendor","severity","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_version","reboot_required","preview_patch","date","category","patch_id","kb_id","released_at","size","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","os_platform"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"severity\". 1: \"unknown\",\"moderate\",\"low\",\"important\",\"critical\"","items":[{"const":"severity"}],"additionalItems":{"title":"Filter events by severity","type":"string","enum":["unknown","moderate","low","important","critical"]}},{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"reboot_required\". 1: true, false","items":[{"const":"reboot_required"},{"title":"Filter events by reboot_required"}],"additionalItems":false,"if":{"items":[{"const":"reboot_required"}]},"then":{"items":[{"const":"reboot_required"},{"type":"boolean"}]}},{"title":"0: \"preview_patch\". 1: true, false","items":[{"const":"preview_patch"},{"title":"Filter events by preview_patch"}],"additionalItems":false,"if":{"items":[{"const":"preview_patch"}]},"then":{"items":[{"const":"preview_patch"},{"type":"boolean"}]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","anyOf":[{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_contains":{"type":"array","anyOf":[{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"begins_with":{"type":"array","anyOf":[{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}}]},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"CSS detection","properties":{"category":{"enum":["css_detection"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"CSS detection output fields","minItems":1,"type":"array","items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name","file_name","css_threat_name","action_taken","file_location","file_owner","timestamp"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"CSS detection output fields","minItems":1,"type":"array","items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name","file_name","css_threat_name","action_taken","file_location","file_owner","timestamp"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","action_taken","cloud_provider","scan_configuration_name"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"action_taken\". 1: \"Found\", \"Quarantined\"","items":[{"const":"action_taken"}],"additionalItems":{"title":"Filter events by action taken","type":"string","enum":["Found","Quarantined"]}},{"title":"0: \"cloud_provider\". 1: \"BOX\", \"ONEDRIVE\", \"GOOGLEDRIVE\"","items":[{"const":"cloud_provider"}],"additionalItems":{"title":"Filter events by cloud provider","type":"string","enum":["BOX","ONEDRIVE","GOOGLEDRIVE"]}},{"title":"0: \"scan_configuration_name\". 1: string","items":[{"const":"scan_configuration_name"}],"additionalItems":{"title":"Filter events by scan configuration name","type":"string"}}]},"not_eq":{"type":"array","title":"0: \"scan_configuration_name\". 1: string","items":[{"const":"scan_configuration_name"}],"additionalItems":{"title":"Filter events by scan_configuration_name","type":"string"}},"contains":{"title":"0: \"scan_configuration_name\". 1: string","type":"array","items":[{"const":"scan_configuration_name"}],"additionalItems":{"title":"Filter events by scan_configuration_name","type":"string"}},"not_contains":{"title":"0: \"scan_configuration_name\". 1: string","type":"array","items":[{"const":"scan_configuration_name"}],"additionalItems":{"title":"Filter events by scan_configuration_name","type":"string"}},"begins_with":{"title":"0: \"scan_configuration_name\". 1: string","type":"array","items":[{"const":"scan_configuration_name"}],"additionalItems":{"title":"Filter events by scan_configuration_name","type":"string"}},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"CSS capacity approached","properties":{"category":{"enum":["css_capacity_approached"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"CSS capacity approached output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name","timestamp"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"CSS capacity approached output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name","timestamp"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name"]}}}}}},{"title":"CSS capacity reached","properties":{"category":{"enum":["css_capacity_reached"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"CSS capacity reached output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name","timestamp"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"CSS capacity reached output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name","timestamp"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name"]}}}}}},{"title":"CSS capacity exceeded","properties":{"category":{"enum":["css_capacity_exceeded"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"CSS capacity exceeded output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name","timestamp"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"CSS capacity exceeded output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name","timestamp"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name"]}}}}}},{"title":"DNS blocked","properties":{"category":{"enum":["dns_blocked"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"DNS blocked output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","timestamp","group_id","group_name","policy_id","policy_name","colo_id","device_id","user_id","dst_ip","src_ip","email","location","policy","rule_name","action","protocol","query_name","query_name_reversed","resolver_decision","query_category_ids","query_size","query_type","src_port","dst_port","os_platform","os_release_name","os_type","os_version","os_architecture"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"DNS blocked output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","timestamp","group_id","group_name","policy_id","policy_name","colo_id","device_id","user_id","dst_ip","src_ip","email","location","policy","rule_name","action","protocol","query_name","query_name_reversed","resolver_decision","query_category_ids","query_size","query_type","src_port","dst_port","os_platform","os_release_name","os_type","os_version","os_architecture"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"policy_id\". 1: string","items":[{"const":"policy_id"}],"additionalItems":{"title":"Filter events by policy_id","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"policy_id\". 1: string","items":[{"const":"policy_id"}],"additionalItems":{"title":"Filter events by policy_id","type":"string"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Case management","properties":{"category":{"enum":["siemplify_case"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Case management output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","case_id","case_name","case_status","case_created_at","priority","action_required","event","endpoints","detections"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Case management output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","case_id","case_name","case_status","case_created_at","priority","action_required","event","endpoints","detections"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","case_id"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"event\". 1: \"case_created\",\"case_updated\",\"case_closed\"","items":[{"const":"event"}],"additionalItems":{"title":"Filter events by status","type":"string","enum":["case_created","case_updated","case_closed"]}},{"title":"0: \"priority\". 1: \"Critical\", \"High\", \"Medium\", \"Low\"","items":[{"const":"priority"}],"additionalItems":{"title":"Filter events by status","type":"string","enum":["Critical","High","Medium","Low"]}},{"title":"0: \"action_required\". 1: true, false","items":[{"const":"action_required"},{"title":"Filter events by CISA exploitable"}],"additionalItems":false,"if":{"items":[{"const":"action_required"}]},"then":{"items":[{"const":"action_required"},{"type":"boolean"}]}}]},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Application block","properties":{"category":{"enum":["app_block"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Application block output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","app_block_rules","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version","scanned_at","file_path","last_user","active_directory_ou"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Application block output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","app_block_rules","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version","scanned_at","file_path","last_user","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"policy_id\". 1: string","items":[{"const":"policy_id"}],"additionalItems":{"title":"Filter events by policy_id","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"policy_id\". 1: string","items":[{"const":"policy_id"}],"additionalItems":{"title":"Filter events by policy_id","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","additionalItems":false},"lte":{"type":"array","const":""},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Entitlement changed","properties":{"category":{"enum":["license_entitlement_changed"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Entitlement changed output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status","licensed_seats","used_seats","license_key","catalog_code","combo_product","licensed_product","license_expires_at","license_key_status","auto_renew","status"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Entitlement changed output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status","licensed_seats","used_seats","license_key","catalog_code","combo_product","licensed_product","license_expires_at","license_key_status","auto_renew","status"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"status\". 1: \"added\",\"updated\",\"removed\"","items":[{"const":"status"}],"additionalItems":{"title":"Filter events by status","type":"string","enum":["added","updated","removed"]}},{"title":"0: \"license_term_type\". 1: \"cloud_evaluation\",\"evaluation\",\"freemium\",\"nfr\",\"site_license\",\"subscription\",\"utility\"","items":[{"const":"license_term_type"}],"additionalItems":{"title":"Filter events by license term type","type":"string","enum":["cloud_evaluation","evaluation","freemium","nfr","site_license","subscription","utility"]}}]},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Entitlement usage changed","properties":{"category":{"enum":["license_entitlement_usage_changed"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Entitlement usage changed output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status","licensed_seats","used_seats","license_key","catalog_code","combo_product","licensed_product","license_expires_at","license_key_status","auto_renew"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Entitlement usage changed output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status","licensed_seats","used_seats","license_key","catalog_code","combo_product","licensed_product","license_expires_at","license_key_status","auto_renew"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","title":"0: \"license_term_type\". 1: \"cloud_evaluation\",\"evaluation\",\"freemium\",\"nfr\",\"site_license\",\"subscription\",\"utility\"","items":[{"const":"license_term_type"}],"additionalItems":{"title":"Filter events by license term type","type":"string","enum":["cloud_evaluation","evaluation","freemium","nfr","site_license","subscription","utility"]}},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Endpoint status changed","properties":{"category":{"enum":["endpoint_status_changed"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Endpoint status changed","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","status_change","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version","codes"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Endpoint status changed","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","status_change","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version","codes"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","status_change","machine_id","machine_name"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"status_change\". 1: \"ENDPOINT_REBOOT_REQUIRED\",\"ENDPOINT_REBOOT_REQUIRED_CLEARED\",\"ENDPOINT_INFECTED\",\"ENDPOINT_REMEDIATED\",\"ENDPOINT_ISOLATED\",\"ENDPOINT_UNISOLATED\",\"ENDPOINT_SUSPICIOUS_ACTIVITY_FOUND\",\"ENDPOINT_SUSPICIOUS_ACTIVITY_CLEARED\",\"AGENT_ALERTS_CHANGED\"","items":[{"const":"status_change"}],"additionalItems":{"title":"Filter the type of status_change to be notified","type":"string","enum":["ENDPOINT_REBOOT_REQUIRED","ENDPOINT_REBOOT_REQUIRED_CLEARED","ENDPOINT_INFECTED","ENDPOINT_REMEDIATED","ENDPOINT_ISOLATED","ENDPOINT_UNISOLATED","ENDPOINT_SUSPICIOUS_ACTIVITY_FOUND","ENDPOINT_SUSPICIOUS_ACTIVITY_CLEARED","AGENT_ALERTS_CHANGED"]}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Inactive endpoint","properties":{"category":{"enum":["inactive_endpoint"]},"delivery":{"properties":{"output_fields":{"title":"Information to include in the JSON body. If omitted, include all","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version","last_seen_at"]}}}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"os_type\". 1: \"1\"(Workstation), \"2\"(Server), \"3\"(Mobile)","items":[{"const":"os_type"}],"additionalItems":{"title":"Filter events by OS type","type":"number","enum":[1,2,3]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"policy_id\". 1: string","items":[{"const":"policy_id"}],"additionalItems":{"title":"Filter events by policy_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"contains":{"type":"array","anyOf":[{"title":"0: \"policy_name\". 1: string","items":[{"const":"policy_name"}],"additionalItems":{"title":"Filter events by policy_name","type":"string"}},{"title":"0: \"group_name\". 1: string","items":[{"const":"group_name"}],"additionalItems":{"title":"Filter events by group_name","type":"string"}}]},"not_contains":{"type":"array","anyOf":[{"title":"0: \"policy_name\". 1: string","items":[{"const":"policy_name"}],"additionalItems":{"title":"Filter events by policy_name","type":"string"}},{"title":"0: \"group_name\". 1: string","items":[{"const":"group_name"}],"additionalItems":{"title":"Filter events by group_name","type":"string"}}]},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","anyOf":[{"title":"0: \"last_seen_at\"","items":[{"const":"last_seen_at"}],"additionalItems":{"title":"Filter inactive machines by less than equals days since last active","type":"number","minimum":1}}]},"gte":{"type":"array","anyOf":[{"title":"0: \"last_seen_at\"","items":[{"const":"last_seen_at"}],"additionalItems":{"title":"Filter inactive machines by less than equals days since last active","type":"number","minimum":1}}]}}}}}}}}}}},{"title":"Firewall activity","properties":{"category":{"enum":["firewall_activity"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Firewall activity output fields","type":"array","minItems":1,"items":{"type":"string","enum":["start_time","end_time","rule_id","rule_name","ruleset_id","ruleset_name","direction","action","protocol","location","program","service","hits","account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Firewall activity output fields","type":"array","minItems":1,"items":{"type":"string","enum":["start_time","end_time","rule_id","rule_name","ruleset_id","ruleset_name","direction","action","protocol","location","program","service","hits","account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"action\". 1: \"ALLOW\", \"BLOCK\"","items":[{"const":"action"}],"additionalItems":{"title":"Filter events by action","type":"string","enum":["ALLOW","BLOCK"]}},{"title":"0: \"direction\". 1: \"Inbound\", \"Outbound\"","items":[{"const":"direction"}],"additionalItems":{"title":"Filter events by direction","type":"string","enum":["Inbound","Outbound"]}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"policy_id\". 1: string","items":[{"const":"policy_id"}],"additionalItems":{"title":"Filter events by policy_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"policy_id\". 1: string","items":[{"const":"policy_id"}],"additionalItems":{"title":"Filter events by policy_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Endpoint isolation","properties":{"category":{"enum":["endpoint_isolation"]},"delivery":{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}},"output_fields":{"title":"Endpoint isolation output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","status","created_at","updated_at","expires_at","machine_id","machine_name","os_release_name","os_platform","os_type","os_version","rule_id","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","status","machine_id","machine_name"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"status\". 1: \"COMPLETED\",\"EXPIRED\",\"FAILED\",\"CANCELLED\"","items":[{"const":"status"}],"additionalItems":{"title":"Filter the type of the status update to be notified","type":"string","enum":["COMPLETED","EXPIRED","FAILED","CANCELLED"]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","anyOf":[{"title":"Filter events by rule_ud exists. If it exists, it indicates that it's an auto-isolation job","const":"rule_id"}]},"not_exists":{"type":"string","anyOf":[{"title":"Filter events by rule_ud exists. If it exists, it indicates that it's an auto-isolation job","const":"rule_id"}]},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Record (notification/report) audit","properties":{"category":{"enum":["record_audit"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Record audit output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","record_type","record_name","record_action","timestamp","user_email","owner"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Record audit output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","record_type","record_name","record_action","timestamp","user_email","owner"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","additionalItems":false},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","anyOf":[{"title":"0: \"record_action\". 1: \"REPORT\", \"NOTIFICATION\", \"UPDATED\", \"DELETED\"","items":[{"const":"record_action"}],"additionalItems":{"title":"Filter events by record action","type":"string","enum":["REPORT","NOTIFICATION","UPDATED","DELETED"]}}]},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"MXDR integration communication inactive","properties":{"category":{"enum":["mxdr_integration_inactive"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"mxdr_integration_inactive output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","source","last_log_seen","inactive_hours"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"mxdr_integration_inactive output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","source","last_log_seen","inactive_hours"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"source\". 1: \"okta\", \"entra\", \"msgraphapi\", \"meraki\", \"watchguard\", \"fortinet\"","items":[{"const":"source"}],"additionalItems":{"title":"Filter events by source","type":"string","enum":["okta","entra","msgraphapi","meraki","watchguard","fortinet"]}},{"title":"0: \"inactive_hours\". 1: 1, 24","items":[{"const":"inactive_hours"}],"additionalItems":{"title":"Filter events by inactive_hours","type":"number","enum":[1,24]}}]},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Audit log activity","properties":{"category":{"enum":["audit_log_activity"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Audit log activity output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","user_id","user_name","action","patch_titles","application_names","expires_at","reason","ignore_rule_name","application_version","ignore_rule_applies_to"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Audit log activity output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","user_id","user_name","action","patch_titles","application_names","expires_at","reason","ignore_rule_name","application_version","ignore_rule_applies_to"]}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"resource_type\". 1: \"ignore_rule\"","items":[{"const":"resource_type"}],"additionalItems":{"title":"Filter events by resource type","type":"string","enum":["ignore_rule"]}},{"title":"0: \"action\". 1: \"create\", \"update\"","items":[{"const":"action"}],"additionalItems":{"title":"Filter events by action","type":"string","enum":["create","update"]}}]}}}}}}}}}}},{"title":"XDR alert","properties":{"category":{"enum":["xdr_alert"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"xdr_alert output fields","type":"array","minItems":1,"items":{"type":"string","enum":["source","severity","account_id","account_name","created_at","category","alert_id","rule_name","attack_category","attack_detection_type","identity_primary_identifier","identity_group_name"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"xdr_alert output fields","type":"array","minItems":1,"items":{"type":"string","enum":["source","severity","account_id","account_name","created_at","category","alert_id","rule_name","attack_category","attack_detection_type","identity_primary_identifier","identity_group_name"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","source"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"source\". 1: \"okta\", \"entra\", \"edr\"","items":[{"const":"source"}],"additionalItems":{"title":"Filter events by source","type":"string","enum":["okta","entra","edr"]}},{"title":"0: \"severity\". 1: \"information\", \"low\", \"medium\", \"high\", \"critical\"","items":[{"const":"severity"}],"additionalItems":{"title":"Filter events by severity","type":"string","enum":["information","low","medium","high","critical"]}},{"title":"0: \"attack_category\". 1: string","items":[{"const":"attack_category"}],"additionalItems":{"title":"Filter events by attack_category","type":"string"}},{"title":"0: \"identity_primary_identifier\". 1: string","items":[{"const":"identity_primary_identifier"}],"additionalItems":{"title":"Filter events by identity_primary_identifier","type":"string"}},{"title":"0: \"identity_group_name\". 1: string","items":[{"const":"identity_group_name"}],"additionalItems":{"title":"Filter events by identity_group_name","type":"string"}}]},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","anyOf":[{"title":"0: \"attack_category\". 1: string","items":[{"const":"attack_category"}],"additionalItems":{"title":"Filter events by attack_category","type":"string"}},{"title":"0: \"identity_primary_identifier\". 1: string","items":[{"const":"identity_primary_identifier"}],"additionalItems":{"title":"Filter events by identity_primary_identifier","type":"string"}},{"title":"0: \"identity_group_name\". 1: string","items":[{"const":"identity_group_name"}],"additionalItems":{"title":"Filter events by identity_group_name","type":"string"}}]},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Drive encryption","properties":{"category":{"enum":["drive_encryption"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Drive encryption output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","action","machine_name","policy_name","encryption_method","drive_label","timestamp"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Drive encryption output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","action","machine_name","policy_name","encryption_method","drive_label","timestamp"]}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"action\". 1: \"MACHINE_DRIVE_ENCRYPTION_ENCRYPTION_FAILED\", \"MACHINE_DRIVE_ENCRYPTION_SUSPENDED\", or \"MACHINE_DRIVE_ENCRYPTION_RECOVERY_DETECTED\"","items":[{"const":"action"}],"additionalItems":{"title":"Filter events by action type","type":"string","enum":["MACHINE_DRIVE_ENCRYPTION_ENCRYPTION_FAILED","MACHINE_DRIVE_ENCRYPTION_SUSPENDED","MACHINE_DRIVE_ENCRYPTION_RECOVERY_DETECTED"]}}]}}}}}}}}}}}],"if":{"properties":{"category":{"enum":["user_added","user_deleted","user_verified","license_over_deployment","css_capacity_approached","css_capacity_reached","css_capacity_exceeded"]}}},"then":{"properties":{"conditions":{"additionalProperties":false}}}},{"type":"object","properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]},{"allOf":[{"required":["name","category","delivery"],"properties":{"name":{"title":"Notification name. Must be unique","type":"string"},"description":{"title":"Notification description","type":"string","default":""},"category":{"title":"The category of the events to be notified","type":"string"},"delivery":{},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object"},"aggregation":{"title":"Aggregate multiple events in a single notifications","type":"object","properties":{"interval":{"title":"Interval in seconds for aggregating events in a single notification. It must be defined to apply aggregation","type":"integer","minimum":10,"maximum":86400}}},"enabled":{"title":"enable/disable notification","type":"boolean","default":true},"owner":{"title":"the identifier of the owner of the subscription","type":"string"}}},{"anyOf":[{"title":"OneView user added","properties":{"category":{"enum":["oneview_user_added"]},"delivery":{"anyOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"OneView user added output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","user_id","user_name","user_email","user_role","ip_address","timestamp","sites","invited_by_email"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["invited_by_email"]}}}}}},{"title":"OneView user verified","properties":{"category":{"enum":["oneview_user_verified"]},"delivery":{"anyOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"OneView user verified output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","user_id","user_name","user_email","ip_address","timestamp"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"Not available for this category","maxItems":0}}}}},{"title":"OneView user deleted","properties":{"category":{"enum":["oneview_user_deleted"]},"delivery":{"anyOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"OneView user deleted output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","user_id","user_name","user_email","user_role","ip_address","timestamp","sites","deleted_by_email"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["deleted_by_email"]}}}}}},{"title":"OneView sites assigned","allOf":[{"properties":{"category":{"enum":["oneview_sites_assigned"]},"delivery":{"anyOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"OneView sites assigned output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","user_id","user_name","user_email","user_role","ip_address","timestamp","sites","assigned_by_email","added_sites","removed_sites"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["assigned_by_email","user_email"]}}}}}},{"type":"object","properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]},{"title":"OneView trial to paid status","allOf":[{"properties":{"category":{"enum":["oneview_trial_to_paid_status"]},"delivery":{"anyOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"OneView trial to paid status output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","timestamp","max_protection","device_type","conversion_status","sites"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["device_type","conversion_status","max_protection"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"nebula_account_id\". 1: string","items":[{"const":"nebula_account_id"}],"additionalItems":{"title":"Filter events by nebula_account_id","type":"string"}},{"title":"0: \"conversion_status\". 1: \"FAILED\", \"SUCCESS\"","items":[{"const":"conversion_status"}],"additionalItems":{"title":"Filter events by conversion status","type":"string","enum":["FAILED","SUCCESS"]}}]},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""}}}}}}}}}}},{"type":"object","properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]},{"title":"OneView site end date approaching","properties":{"category":{"enum":["oneview_site_end_date_approaching"]},"delivery":{"anyOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"OneView site end date approachnig output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","timestamp","sites","days_left","site_end_date"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","maxItems":0}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"days_left\". 1: 0,1,7,14,30","items":[{"const":"days_left"}],"additionalItems":{"title":"Filter events by days left before the license expiration","type":"number","enum":[0,1,7,14,30]}}]},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""}}}}}}}}}}}]},{"if":{"properties":{"category":{"enum":["oneview_user_added","oneview_user_deleted","oneview_user_verified","oneview_sites_assigned"]}}},"then":{"properties":{"conditions":{"additionalProperties":false}}}}]}]},{"required":["id"],"properties":{"id":{"title":"Notification Id","type":"string"},"owner":{"title":"Notification owner","type":"string"},"account_id":{"title":"Account Id of the owner of the notification","type":"string"},"created_at":{"title":"Created at timestamp","format":"date-time"},"updated_at":{"title":"Updated at timestamp","format":"date-time"},"created_by":{"title":"Created by","type":"string"},"updated_by":{"title":"Created by","type":"string"}}}]}}}}},"tags":["Notifications"],"operationId":"api.v2.rmm.put.notification"}},"/oneview/v1/notifications/subscriptions/bulk":{"delete":{"description":"Delete multiple notification subscriptions in bulk.","summary":"Delete notification bulk","security":[{"client_credentials":["write"]},{"user_permissions":["notifications.deleteOwn"]}],"status":{"outage":["auth","webhooks_subscriptions"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}},{"name":"parent_account_id","required":false,"in":"query","description":"the subscriptions' account_id. This is required to access notifications subscriptions for a different owner, but in the same account (requires super admin permission).","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"The delete bulk notification Body","required":["subscriptions"],"properties":{"subscriptions":{"type":"array","title":"The subscriptions to delete","minItems":1,"items":{"title":"Subscription to delete","type":"object","required":["id"],"properties":{"id":{"type":"string","title":"Subscription id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}}}}}},"responses":{"200":{"description":"Successful response"}},"tags":["Notifications"],"operationId":"api.v2.rmm.delete-bulk.notification"},"put":{"description":"Update multiple notification subscriptions in bulk.","summary":"Update notification bulk","security":[{"client_credentials":["write"]},{"user_permissions":["notifications.editOwn"]}],"status":{"outage":["auth","webhooks_subscriptions"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"The update bulk notification Body","required":["records"],"properties":{"records":{"type":"array","title":"The subscriptions to update","minItems":1,"items":{"allOf":[{"type":"object","title":"The Schema For Notifications Creation","properties":{"parent_account_id":{"type":"string","title":"Nebula Parent Account id (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\").","description":"If this is specified, all the events from the child account_ids will be included. In that case, account_ids is not required","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}},"anyOf":[{"required":["account_ids"]},{"required":["parent_account_id"]}],"allOf":[{"type":"object","title":"The Schema For Notifications Creation","anyOf":[{"allOf":[{"type":"object","title":"The create notification Body","required":["name","category","delivery"],"properties":{"name":{"title":"Notification name. Must be unique","type":"string"},"description":{"title":"Notification description","type":"string","default":""},"category":{"title":"The category of the events to be notified","type":"string"},"delivery":{},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object"},"aggregation":{"title":"Aggregate multiple events in a single notifications","type":"object","properties":{"interval":{"title":"Interval in seconds for aggregating events in a single notification. It must be defined to apply aggregation","type":"integer","minimum":10,"maximum":86400}}},"enabled":{"title":"enable/disable notification","type":"boolean","default":true},"owner":{"title":"the identifier of the owner of the subscription. Not available for read-only users","type":"string"}},"anyOf":[{"title":"Detections","properties":{"category":{"enum":["threat_detections"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Detections output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","os_release_name","os_platform","os_type","os_version","category","type","path","status","scanned_at","reported_at","resource_created_at","resource_modified_at","threat_name","affected_application","process_name","machine_id","machine_name","machine_ip","group_id","group_name","policy_id","policy_name","nics","md5","sha256","engine_version","last_user","active_directory_ou","id"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Detections output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","os_release_name","os_platform","os_type","os_version","category","type","path","status","scanned_at","reported_at","resource_created_at","resource_modified_at","threat_name","affected_application","process_name","machine_id","machine_name","machine_ip","group_id","group_name","policy_id","policy_name","nics","md5","sha256","engine_version","last_user","active_directory_ou","id"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","affected_application","category","group_id","group_name","machine_id","machine_ip","machine_name","os_platform","os_release_name","path","policy_id","policy_name","process_name","status","threat_name","type"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"category\". 1: \"MALWARE\",\"PUP\",\"PUM\",\"AE\",\"ARW\",\"MWAC\",\"RID\",\"VULNERABLE_DRIVER\"","items":[{"const":"category"}],"additionalItems":{"title":"Filter events by detection category","type":"string","enum":["MALWARE","PUP","PUM","AE","ARW","MWAC","RID","VULNERABLE_DRIVER"]}},{"title":"0: \"action\". 1: \"blocked\", \"deleted\", \"deletedAutoPrune\", \"found\", \"quarantined\", \"restored\"","items":[{"const":"action"}],"additionalItems":{"title":"Filter events by action","type":"string","enum":["blocked","deleted","deletedAutoPrune","found","quarantined","restored"]}},{"title":"0: \"threat_name\". 1: string","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux), \"4\"(Android), \"3\"(IOS), \"3\"(ChromeOS)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3,4,5,6]}},{"title":"0: \"rtp\". 1: true, false","items":[{"const":"rtp"},{"title":"Filter events by real time protection"}],"additionalItems":false,"if":{"items":[{"const":"rtp"}]},"then":{"items":[{"const":"rtp"},{"type":"boolean"}]}},{"title":"0: \"type\". 1: \"application\", \"exploit\", \"extension\", \"file\", \"folder\", \"InboundConnection\", \"module\", \"OutboundConnection\", \"process\", \"reg_key\", \"reg_value\"","items":[{"const":"type"}],"additionalItems":{"title":"Filter events by type","type":"string","enum":["application","exploit","extension","file","folder","InboundConnection","module","OutboundConnection","process","reg_key","reg_value"]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"threat_name\". 1: string","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","anyOf":[{"title":"0: \"threat_name\". 1: string","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_contains":{"type":"array","anyOf":[{"title":"0: \"threat_name\". 1: string","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"begins_with":{"title":"0: \"threat_name\". 1: string","type":"array","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Suspicious activity","properties":{"category":{"enum":["threat_suspicious_activity"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Suspicious activity","type":"array","minItems":1,"items":{"type":"string","enum":["severity","account_id","account_name","os_release_name","os_platform","type","path","status","scanned_at","reported_at","threat_name","machine_id","machine_name","machine_ip","group_id","group_name","policy_id","policy_name","nics","last_user","first_activity","last_activity","isolation_type","id"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Suspicious activity","type":"array","minItems":1,"items":{"type":"string","enum":["severity","account_id","account_name","os_release_name","os_platform","type","path","status","scanned_at","reported_at","threat_name","machine_id","machine_name","machine_ip","group_id","group_name","policy_id","policy_name","nics","last_user","first_activity","last_activity","isolation_type","id"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","group_id","group_name","machine_id","machine_ip","machine_name","os_platform","os_release_name","path","policy_id","policy_name","severity","status","threat_name"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"level\". 1: \"low\", \"medium\", \"high\", \"critical\"","items":[{"const":"level"}],"additionalItems":{"title":"Filter events by severity level","type":"string","enum":["low","medium","high","critical"]}},{"title":"0: \"threat_name\". 1: string","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux), \"4\"(Android), \"3\"(IOS), \"3\"(ChromeOS)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3,4,5,6]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"threat_name\". 1: string","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"contains":{"title":"0: \"threat_name\". 1: string","type":"array","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},"not_contains":{"title":"0: \"threat_name\". 1: string","type":"array","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},"begins_with":{"title":"0: \"threat_name\". 1: string","type":"array","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},"exists":{"type":"string","anyOf":[{"title":"Filter events by isolation_type exists","const":"isolation_type"}]},"not_exists":{"anyOf":[{"title":"Filter events by isolation_type not exists","const":"isolation_type"}]},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"User added","properties":{"category":{"enum":["user_added"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"User added","type":"array","minItems":1,"items":{"type":"string","enum":["ip_address","invited_by","role","email","full_group_access","timestamp","account_id"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"User added","type":"array","minItems":1,"items":{"type":"string","enum":["ip_address","invited_by","role","email","full_group_access","timestamp","account_id"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","invited_by","ip_address","role"]}}}}}},{"title":"User deleted","properties":{"category":{"enum":["user_deleted"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"User deleted output fields","type":"array","minItems":1,"items":{"type":"string","enum":["ip_address","timestamp","account_id","deleted_by","email"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"User deleted output fields","type":"array","minItems":1,"items":{"type":"string","enum":["ip_address","timestamp","account_id","deleted_by","email"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","ip_address","deleted_by"]}}}}}},{"title":"User verified","properties":{"category":{"enum":["user_verified"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"User verified","type":"array","minItems":1,"items":{"type":"string","enum":["email","timestamp","account_id"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"User verified","type":"array","minItems":1,"items":{"type":"string","enum":["email","timestamp","account_id"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name"]}}}}}},{"title":"Endpoint registered","properties":{"category":{"enum":["endpoint_registered"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Endpoint registered output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","created_at"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Endpoint registered output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","created_at"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Endpoint deleted","properties":{"category":{"enum":["endpoint_unregistered"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Endpoint deleted output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","timestamp","timeout"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Endpoint deleted output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","timestamp","timeout"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"timeout\". 1: true, false","items":[{"const":"timeout"},{"title":"Filter events by timeout (true if the machine was deleted because marked_for_deletion and never connected again until a timeout)"}],"additionalItems":false,"if":{"items":[{"const":"timeout"}]},"then":{"items":[{"const":"timeout"},{"type":"boolean"}]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Command update","properties":{"category":{"enum":["endpoint_command_update"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Command update output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","command","status","created_at","updated_at","expires_at","machine_id","machine_name","group_id","active_directory_ou"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Command update output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","command","status","created_at","updated_at","expires_at","machine_id","machine_name","group_id","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","command","status","machine_id","machine_name"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"status\". 1: \"CREATED\",\"SENT\",\"RECEIVED\",\"STARTED\",\"TIMED_OUT\",\"COMPLETED\",\"EXPIRED\",\"FAILED\",\"CANCELLED\"","items":[{"const":"status"}],"additionalItems":{"title":"Filter the type of the machine_events to be notified","type":"string","enum":["CREATED","SENT","RECEIVED","STARTED","TIMED_OUT","COMPLETED","EXPIRED","FAILED","CANCELLED"]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Quarantine","properties":{"category":{"enum":["quarantine"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Quarantine output fields","type":"array","minItems":1,"items":{"type":"string","enum":["path","machine_name","created_at","status"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Quarantine output fields","type":"array","minItems":1,"items":{"type":"string","enum":["path","machine_name","created_at","status"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","status"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","title":"0: \"quarantine_action\". 1: \"QUARANTINE_DELETED\",\"QUARANTINE_RESTORED\"","items":[{"const":"quarantine_action"}],"additionalItems":{"title":"Filter the type of the quarantine_events to be notified","type":"string","enum":["QUARANTINE_DELETED","QUARANTINE_RESTORED"]}},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Threat scan","properties":{"category":{"enum":["threat_scan"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Threat scan output_fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","scan_date","scan_id","machine_id","machine_name","group_id","group_name","policy_id","policy_name","ip_address","detections","active_directory_ou"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Threat scan output_fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","scan_date","scan_id","machine_id","machine_name","group_id","group_name","policy_id","policy_name","ip_address","detections","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","ip_address","policy_id","policy_name"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"action\". 1: \"THREAT_CLEANED\",\"THREAT_FOUND\"","items":[{"const":"action"}],"additionalItems":{"title":"Filter events by threat activity action","type":"string","enum":["THREAT_CLEANED","THREAT_FOUND"]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Device control","properties":{"category":{"enum":["device_control"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Device control output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version","path","date","action","device_name","manufacturer","volume_serial","serial_number","physical_disk_name","disk_interface","file_system","volume_name","volume_device_path","last_user","active_directory_ou"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Device control output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version","path","date","action","device_name","manufacturer","volume_serial","serial_number","physical_disk_name","disk_interface","file_system","volume_name","volume_device_path","last_user","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","group_id","group_name","machine_id","machine_name","os_platform","os_release_name","policy_id","policy_name"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"action\". 1: \"blocked\", \"read-only\"","items":[{"const":"action"}],"additionalItems":{"title":"Filter events by action","type":"string","enum":["blocked","read-only"]}},{"title":"0: \"device_name\". 1: string","items":[{"const":"device_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"manufacturer\". 1: string","items":[{"const":"manufacturer"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"device_name\". 1: string","items":[{"const":"device_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"manufacturer\". 1: string","items":[{"const":"manufacturer"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","anyOf":[{"title":"0: \"device_name\". 1: string","items":[{"const":"device_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"manufacturer\". 1: string","items":[{"const":"manufacturer"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_contains":{"type":"array","anyOf":[{"title":"0: \"device_name\". 1: string","items":[{"const":"device_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"manufacturer\". 1: string","items":[{"const":"manufacturer"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Site end date","properties":{"category":{"enum":["license_expiring"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Site end date output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status","licensed_seats","used_seats","license_key","catalog_code","combo_product","licensed_product","license_expires_at","days_left"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Site end date output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status","licensed_seats","used_seats","license_key","catalog_code","combo_product","licensed_product","license_expires_at","days_left"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"days_left\". 1: 0,1,3,5,7,14,30","items":[{"const":"days_left"}],"additionalItems":{"title":"Filter events by days left before the license expiration","type":"number","enum":[0,1,3,5,7,14,30]}},{"title":"0: \"license_term_type\". 1: \"cloud_evaluation\",\"evaluation\",\"freemium\",\"nfr\",\"site_license\",\"subscription\",\"utility\"","items":[{"const":"license_term_type"}],"additionalItems":{"title":"Filter events by license term type","type":"string","enum":["cloud_evaluation","evaluation","freemium","nfr","site_license","subscription","utility"]}}]},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Site over deployed","properties":{"category":{"enum":["license_over_deployment"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Site over deployed output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status","licensed_seats","used_seats","license_key","catalog_code","combo_product"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Site over deployed output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status","licensed_seats","used_seats","license_key","catalog_code","combo_product"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"license_term_type\". 1: \"cloud_evaluation\",\"evaluation\",\"freemium\",\"nfr\",\"site_license\",\"subscription\",\"utility\"","items":[{"const":"license_term_type"}],"additionalItems":{"title":"Filter events by license term type","type":"string","enum":["cloud_evaluation","evaluation","freemium","nfr","site_license","subscription","utility"]}}]},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Vulnerability status","properties":{"category":{"enum":["cve_found"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Vulnerability status output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","product","vendor","installed_version","machine_id","machine_name","group_id","group_name","policy_id","policy_name","cve_id","severity","created_at","os_platform","os_release_name","os_version","cisa_exploitable","known_ransomware_campaign_use","description","published_at","severity_score","active_directory_ou"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Vulnerability status output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","product","vendor","installed_version","machine_id","machine_name","group_id","group_name","policy_id","policy_name","cve_id","severity","created_at","os_platform","os_release_name","os_version","cisa_exploitable","known_ransomware_campaign_use","description","published_at","severity_score","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","cve_id","product","os_platform"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"severity\". 1: \"unknown\",\"low\",\"medium\",\"high\",\"critical\"","items":[{"const":"severity"}],"additionalItems":{"title":"Filter events by severity","type":"string","enum":["unknown","low","medium","high","critical"]}},{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"cisa_exploitable\". 1: true, false","items":[{"const":"cisa_exploitable"},{"title":"Filter events by CISA exploitable"}],"additionalItems":false,"if":{"items":[{"const":"cisa_exploitable"}]},"then":{"items":[{"const":"cisa_exploitable"},{"type":"boolean"}]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","anyOf":[{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_contains":{"type":"array","anyOf":[{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","anyOf":[{"title":"Filter events by available patch exists","const":"available_patch"}]},"not_exists":{"type":"string","anyOf":[{"title":"Filter events by available patch not exists","const":"available_patch"}]},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"CVE Ignored","properties":{"category":{"enum":["cve_ignored"]},"delivery":{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}},"output_fields":{"title":"CVE Ignored output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","cve_id","ignored_reason","display_product","ignored_at","ignored_until","ignored_by","ignored_by_name"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","cve_id"]}}}}}},{"title":"Patch applied","properties":{"category":{"enum":["patch_applied"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Patch applied output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","title","description","product","vendor","severity","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_version","reboot_required","preview_patch","date","status","category","active_directory_ou"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Patch applied output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","title","description","product","vendor","severity","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_version","reboot_required","preview_patch","date","status","category","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","os_platform"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"status\". 1: \"COMPLETED\",\"FAILED\",\"REBOOT_REQUIRED\"","items":[{"const":"status"}],"additionalItems":{"title":"Filter events by status","type":"string","enum":["COMPLETED","FAILED","REBOOT_REQUIRED"]}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"preview_patch\". 1: true, false","items":[{"const":"preview_patch"},{"title":"Filter events by preview_patch"}],"additionalItems":false,"if":{"items":[{"const":"preview_patch"}]},"then":{"items":[{"const":"preview_patch"},{"type":"boolean"}]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Software update applied","properties":{"category":{"enum":["software_update"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Software update applied output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","product","vendor","current_version","new_version","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_version","date","status","signature_id","active_directory_ou"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Software update applied output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","product","vendor","current_version","new_version","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_version","date","status","signature_id","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","os_platform"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"status\". 1: \"COMPLETED\",\"FAILED\"","items":[{"const":"status"}],"additionalItems":{"title":"Filter events by status","type":"string","enum":["COMPLETED","FAILED"]}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Patch or software update available","properties":{"category":{"enum":["patch_available"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Patch or software update available","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","title","description","product","vendor","severity","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_version","reboot_required","preview_patch","date","category","patch_id","kb_id","released_at","size","active_directory_ou"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Patch or software update available","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","title","description","product","vendor","severity","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_version","reboot_required","preview_patch","date","category","patch_id","kb_id","released_at","size","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","os_platform"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"severity\". 1: \"unknown\",\"moderate\",\"low\",\"important\",\"critical\"","items":[{"const":"severity"}],"additionalItems":{"title":"Filter events by severity","type":"string","enum":["unknown","moderate","low","important","critical"]}},{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"reboot_required\". 1: true, false","items":[{"const":"reboot_required"},{"title":"Filter events by reboot_required"}],"additionalItems":false,"if":{"items":[{"const":"reboot_required"}]},"then":{"items":[{"const":"reboot_required"},{"type":"boolean"}]}},{"title":"0: \"preview_patch\". 1: true, false","items":[{"const":"preview_patch"},{"title":"Filter events by preview_patch"}],"additionalItems":false,"if":{"items":[{"const":"preview_patch"}]},"then":{"items":[{"const":"preview_patch"},{"type":"boolean"}]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","anyOf":[{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_contains":{"type":"array","anyOf":[{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"begins_with":{"type":"array","anyOf":[{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}}]},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"CSS detection","properties":{"category":{"enum":["css_detection"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"CSS detection output fields","minItems":1,"type":"array","items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name","file_name","css_threat_name","action_taken","file_location","file_owner","timestamp"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"CSS detection output fields","minItems":1,"type":"array","items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name","file_name","css_threat_name","action_taken","file_location","file_owner","timestamp"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","action_taken","cloud_provider","scan_configuration_name"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"action_taken\". 1: \"Found\", \"Quarantined\"","items":[{"const":"action_taken"}],"additionalItems":{"title":"Filter events by action taken","type":"string","enum":["Found","Quarantined"]}},{"title":"0: \"cloud_provider\". 1: \"BOX\", \"ONEDRIVE\", \"GOOGLEDRIVE\"","items":[{"const":"cloud_provider"}],"additionalItems":{"title":"Filter events by cloud provider","type":"string","enum":["BOX","ONEDRIVE","GOOGLEDRIVE"]}},{"title":"0: \"scan_configuration_name\". 1: string","items":[{"const":"scan_configuration_name"}],"additionalItems":{"title":"Filter events by scan configuration name","type":"string"}}]},"not_eq":{"type":"array","title":"0: \"scan_configuration_name\". 1: string","items":[{"const":"scan_configuration_name"}],"additionalItems":{"title":"Filter events by scan_configuration_name","type":"string"}},"contains":{"title":"0: \"scan_configuration_name\". 1: string","type":"array","items":[{"const":"scan_configuration_name"}],"additionalItems":{"title":"Filter events by scan_configuration_name","type":"string"}},"not_contains":{"title":"0: \"scan_configuration_name\". 1: string","type":"array","items":[{"const":"scan_configuration_name"}],"additionalItems":{"title":"Filter events by scan_configuration_name","type":"string"}},"begins_with":{"title":"0: \"scan_configuration_name\". 1: string","type":"array","items":[{"const":"scan_configuration_name"}],"additionalItems":{"title":"Filter events by scan_configuration_name","type":"string"}},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"CSS capacity approached","properties":{"category":{"enum":["css_capacity_approached"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"CSS capacity approached output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name","timestamp"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"CSS capacity approached output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name","timestamp"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name"]}}}}}},{"title":"CSS capacity reached","properties":{"category":{"enum":["css_capacity_reached"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"CSS capacity reached output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name","timestamp"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"CSS capacity reached output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name","timestamp"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name"]}}}}}},{"title":"CSS capacity exceeded","properties":{"category":{"enum":["css_capacity_exceeded"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"CSS capacity exceeded output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name","timestamp"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"CSS capacity exceeded output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name","timestamp"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name"]}}}}}},{"title":"DNS blocked","properties":{"category":{"enum":["dns_blocked"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"DNS blocked output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","timestamp","group_id","group_name","policy_id","policy_name","colo_id","device_id","user_id","dst_ip","src_ip","email","location","policy","rule_name","action","protocol","query_name","query_name_reversed","resolver_decision","query_category_ids","query_size","query_type","src_port","dst_port","os_platform","os_release_name","os_type","os_version","os_architecture"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"DNS blocked output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","timestamp","group_id","group_name","policy_id","policy_name","colo_id","device_id","user_id","dst_ip","src_ip","email","location","policy","rule_name","action","protocol","query_name","query_name_reversed","resolver_decision","query_category_ids","query_size","query_type","src_port","dst_port","os_platform","os_release_name","os_type","os_version","os_architecture"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"policy_id\". 1: string","items":[{"const":"policy_id"}],"additionalItems":{"title":"Filter events by policy_id","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"policy_id\". 1: string","items":[{"const":"policy_id"}],"additionalItems":{"title":"Filter events by policy_id","type":"string"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Case management","properties":{"category":{"enum":["siemplify_case"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Case management output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","case_id","case_name","case_status","case_created_at","priority","action_required","event","endpoints","detections"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Case management output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","case_id","case_name","case_status","case_created_at","priority","action_required","event","endpoints","detections"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","case_id"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"event\". 1: \"case_created\",\"case_updated\",\"case_closed\"","items":[{"const":"event"}],"additionalItems":{"title":"Filter events by status","type":"string","enum":["case_created","case_updated","case_closed"]}},{"title":"0: \"priority\". 1: \"Critical\", \"High\", \"Medium\", \"Low\"","items":[{"const":"priority"}],"additionalItems":{"title":"Filter events by status","type":"string","enum":["Critical","High","Medium","Low"]}},{"title":"0: \"action_required\". 1: true, false","items":[{"const":"action_required"},{"title":"Filter events by CISA exploitable"}],"additionalItems":false,"if":{"items":[{"const":"action_required"}]},"then":{"items":[{"const":"action_required"},{"type":"boolean"}]}}]},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Application block","properties":{"category":{"enum":["app_block"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Application block output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","app_block_rules","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version","scanned_at","file_path","last_user","active_directory_ou"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Application block output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","app_block_rules","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version","scanned_at","file_path","last_user","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"policy_id\". 1: string","items":[{"const":"policy_id"}],"additionalItems":{"title":"Filter events by policy_id","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"policy_id\". 1: string","items":[{"const":"policy_id"}],"additionalItems":{"title":"Filter events by policy_id","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","additionalItems":false},"lte":{"type":"array","const":""},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Entitlement changed","properties":{"category":{"enum":["license_entitlement_changed"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Entitlement changed output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status","licensed_seats","used_seats","license_key","catalog_code","combo_product","licensed_product","license_expires_at","license_key_status","auto_renew","status"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Entitlement changed output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status","licensed_seats","used_seats","license_key","catalog_code","combo_product","licensed_product","license_expires_at","license_key_status","auto_renew","status"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"status\". 1: \"added\",\"updated\",\"removed\"","items":[{"const":"status"}],"additionalItems":{"title":"Filter events by status","type":"string","enum":["added","updated","removed"]}},{"title":"0: \"license_term_type\". 1: \"cloud_evaluation\",\"evaluation\",\"freemium\",\"nfr\",\"site_license\",\"subscription\",\"utility\"","items":[{"const":"license_term_type"}],"additionalItems":{"title":"Filter events by license term type","type":"string","enum":["cloud_evaluation","evaluation","freemium","nfr","site_license","subscription","utility"]}}]},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Entitlement usage changed","properties":{"category":{"enum":["license_entitlement_usage_changed"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Entitlement usage changed output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status","licensed_seats","used_seats","license_key","catalog_code","combo_product","licensed_product","license_expires_at","license_key_status","auto_renew"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Entitlement usage changed output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status","licensed_seats","used_seats","license_key","catalog_code","combo_product","licensed_product","license_expires_at","license_key_status","auto_renew"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","title":"0: \"license_term_type\". 1: \"cloud_evaluation\",\"evaluation\",\"freemium\",\"nfr\",\"site_license\",\"subscription\",\"utility\"","items":[{"const":"license_term_type"}],"additionalItems":{"title":"Filter events by license term type","type":"string","enum":["cloud_evaluation","evaluation","freemium","nfr","site_license","subscription","utility"]}},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Endpoint status changed","properties":{"category":{"enum":["endpoint_status_changed"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Endpoint status changed","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","status_change","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version","codes"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Endpoint status changed","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","status_change","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version","codes"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","status_change","machine_id","machine_name"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"status_change\". 1: \"ENDPOINT_REBOOT_REQUIRED\",\"ENDPOINT_REBOOT_REQUIRED_CLEARED\",\"ENDPOINT_INFECTED\",\"ENDPOINT_REMEDIATED\",\"ENDPOINT_ISOLATED\",\"ENDPOINT_UNISOLATED\",\"ENDPOINT_SUSPICIOUS_ACTIVITY_FOUND\",\"ENDPOINT_SUSPICIOUS_ACTIVITY_CLEARED\",\"AGENT_ALERTS_CHANGED\"","items":[{"const":"status_change"}],"additionalItems":{"title":"Filter the type of status_change to be notified","type":"string","enum":["ENDPOINT_REBOOT_REQUIRED","ENDPOINT_REBOOT_REQUIRED_CLEARED","ENDPOINT_INFECTED","ENDPOINT_REMEDIATED","ENDPOINT_ISOLATED","ENDPOINT_UNISOLATED","ENDPOINT_SUSPICIOUS_ACTIVITY_FOUND","ENDPOINT_SUSPICIOUS_ACTIVITY_CLEARED","AGENT_ALERTS_CHANGED"]}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Inactive endpoint","properties":{"category":{"enum":["inactive_endpoint"]},"delivery":{"properties":{"output_fields":{"title":"Information to include in the JSON body. If omitted, include all","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version","last_seen_at"]}}}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"os_type\". 1: \"1\"(Workstation), \"2\"(Server), \"3\"(Mobile)","items":[{"const":"os_type"}],"additionalItems":{"title":"Filter events by OS type","type":"number","enum":[1,2,3]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"policy_id\". 1: string","items":[{"const":"policy_id"}],"additionalItems":{"title":"Filter events by policy_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"contains":{"type":"array","anyOf":[{"title":"0: \"policy_name\". 1: string","items":[{"const":"policy_name"}],"additionalItems":{"title":"Filter events by policy_name","type":"string"}},{"title":"0: \"group_name\". 1: string","items":[{"const":"group_name"}],"additionalItems":{"title":"Filter events by group_name","type":"string"}}]},"not_contains":{"type":"array","anyOf":[{"title":"0: \"policy_name\". 1: string","items":[{"const":"policy_name"}],"additionalItems":{"title":"Filter events by policy_name","type":"string"}},{"title":"0: \"group_name\". 1: string","items":[{"const":"group_name"}],"additionalItems":{"title":"Filter events by group_name","type":"string"}}]},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","anyOf":[{"title":"0: \"last_seen_at\"","items":[{"const":"last_seen_at"}],"additionalItems":{"title":"Filter inactive machines by less than equals days since last active","type":"number","minimum":1}}]},"gte":{"type":"array","anyOf":[{"title":"0: \"last_seen_at\"","items":[{"const":"last_seen_at"}],"additionalItems":{"title":"Filter inactive machines by less than equals days since last active","type":"number","minimum":1}}]}}}}}}}}}}},{"title":"Firewall activity","properties":{"category":{"enum":["firewall_activity"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Firewall activity output fields","type":"array","minItems":1,"items":{"type":"string","enum":["start_time","end_time","rule_id","rule_name","ruleset_id","ruleset_name","direction","action","protocol","location","program","service","hits","account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Firewall activity output fields","type":"array","minItems":1,"items":{"type":"string","enum":["start_time","end_time","rule_id","rule_name","ruleset_id","ruleset_name","direction","action","protocol","location","program","service","hits","account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"action\". 1: \"ALLOW\", \"BLOCK\"","items":[{"const":"action"}],"additionalItems":{"title":"Filter events by action","type":"string","enum":["ALLOW","BLOCK"]}},{"title":"0: \"direction\". 1: \"Inbound\", \"Outbound\"","items":[{"const":"direction"}],"additionalItems":{"title":"Filter events by direction","type":"string","enum":["Inbound","Outbound"]}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"policy_id\". 1: string","items":[{"const":"policy_id"}],"additionalItems":{"title":"Filter events by policy_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"policy_id\". 1: string","items":[{"const":"policy_id"}],"additionalItems":{"title":"Filter events by policy_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Endpoint isolation","properties":{"category":{"enum":["endpoint_isolation"]},"delivery":{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}},"output_fields":{"title":"Endpoint isolation output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","status","created_at","updated_at","expires_at","machine_id","machine_name","os_release_name","os_platform","os_type","os_version","rule_id","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","status","machine_id","machine_name"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"status\". 1: \"COMPLETED\",\"EXPIRED\",\"FAILED\",\"CANCELLED\"","items":[{"const":"status"}],"additionalItems":{"title":"Filter the type of the status update to be notified","type":"string","enum":["COMPLETED","EXPIRED","FAILED","CANCELLED"]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","anyOf":[{"title":"Filter events by rule_ud exists. If it exists, it indicates that it's an auto-isolation job","const":"rule_id"}]},"not_exists":{"type":"string","anyOf":[{"title":"Filter events by rule_ud exists. If it exists, it indicates that it's an auto-isolation job","const":"rule_id"}]},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Record (notification/report) audit","properties":{"category":{"enum":["record_audit"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Record audit output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","record_type","record_name","record_action","timestamp","user_email","owner"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Record audit output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","record_type","record_name","record_action","timestamp","user_email","owner"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","additionalItems":false},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","anyOf":[{"title":"0: \"record_action\". 1: \"REPORT\", \"NOTIFICATION\", \"UPDATED\", \"DELETED\"","items":[{"const":"record_action"}],"additionalItems":{"title":"Filter events by record action","type":"string","enum":["REPORT","NOTIFICATION","UPDATED","DELETED"]}}]},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"MXDR integration communication inactive","properties":{"category":{"enum":["mxdr_integration_inactive"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"mxdr_integration_inactive output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","source","last_log_seen","inactive_hours"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"mxdr_integration_inactive output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","source","last_log_seen","inactive_hours"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"source\". 1: \"okta\", \"entra\", \"msgraphapi\", \"meraki\", \"watchguard\", \"fortinet\"","items":[{"const":"source"}],"additionalItems":{"title":"Filter events by source","type":"string","enum":["okta","entra","msgraphapi","meraki","watchguard","fortinet"]}},{"title":"0: \"inactive_hours\". 1: 1, 24","items":[{"const":"inactive_hours"}],"additionalItems":{"title":"Filter events by inactive_hours","type":"number","enum":[1,24]}}]},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Audit log activity","properties":{"category":{"enum":["audit_log_activity"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Audit log activity output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","user_id","user_name","action","patch_titles","application_names","expires_at","reason","ignore_rule_name","application_version","ignore_rule_applies_to"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Audit log activity output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","user_id","user_name","action","patch_titles","application_names","expires_at","reason","ignore_rule_name","application_version","ignore_rule_applies_to"]}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"resource_type\". 1: \"ignore_rule\"","items":[{"const":"resource_type"}],"additionalItems":{"title":"Filter events by resource type","type":"string","enum":["ignore_rule"]}},{"title":"0: \"action\". 1: \"create\", \"update\"","items":[{"const":"action"}],"additionalItems":{"title":"Filter events by action","type":"string","enum":["create","update"]}}]}}}}}}}}}}},{"title":"XDR alert","properties":{"category":{"enum":["xdr_alert"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"xdr_alert output fields","type":"array","minItems":1,"items":{"type":"string","enum":["source","severity","account_id","account_name","created_at","category","alert_id","rule_name","attack_category","attack_detection_type","identity_primary_identifier","identity_group_name"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"xdr_alert output fields","type":"array","minItems":1,"items":{"type":"string","enum":["source","severity","account_id","account_name","created_at","category","alert_id","rule_name","attack_category","attack_detection_type","identity_primary_identifier","identity_group_name"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","source"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"source\". 1: \"okta\", \"entra\", \"edr\"","items":[{"const":"source"}],"additionalItems":{"title":"Filter events by source","type":"string","enum":["okta","entra","edr"]}},{"title":"0: \"severity\". 1: \"information\", \"low\", \"medium\", \"high\", \"critical\"","items":[{"const":"severity"}],"additionalItems":{"title":"Filter events by severity","type":"string","enum":["information","low","medium","high","critical"]}},{"title":"0: \"attack_category\". 1: string","items":[{"const":"attack_category"}],"additionalItems":{"title":"Filter events by attack_category","type":"string"}},{"title":"0: \"identity_primary_identifier\". 1: string","items":[{"const":"identity_primary_identifier"}],"additionalItems":{"title":"Filter events by identity_primary_identifier","type":"string"}},{"title":"0: \"identity_group_name\". 1: string","items":[{"const":"identity_group_name"}],"additionalItems":{"title":"Filter events by identity_group_name","type":"string"}}]},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","anyOf":[{"title":"0: \"attack_category\". 1: string","items":[{"const":"attack_category"}],"additionalItems":{"title":"Filter events by attack_category","type":"string"}},{"title":"0: \"identity_primary_identifier\". 1: string","items":[{"const":"identity_primary_identifier"}],"additionalItems":{"title":"Filter events by identity_primary_identifier","type":"string"}},{"title":"0: \"identity_group_name\". 1: string","items":[{"const":"identity_group_name"}],"additionalItems":{"title":"Filter events by identity_group_name","type":"string"}}]},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Drive encryption","properties":{"category":{"enum":["drive_encryption"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Drive encryption output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","action","machine_name","policy_name","encryption_method","drive_label","timestamp"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Drive encryption output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","action","machine_name","policy_name","encryption_method","drive_label","timestamp"]}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"action\". 1: \"MACHINE_DRIVE_ENCRYPTION_ENCRYPTION_FAILED\", \"MACHINE_DRIVE_ENCRYPTION_SUSPENDED\", or \"MACHINE_DRIVE_ENCRYPTION_RECOVERY_DETECTED\"","items":[{"const":"action"}],"additionalItems":{"title":"Filter events by action type","type":"string","enum":["MACHINE_DRIVE_ENCRYPTION_ENCRYPTION_FAILED","MACHINE_DRIVE_ENCRYPTION_SUSPENDED","MACHINE_DRIVE_ENCRYPTION_RECOVERY_DETECTED"]}}]}}}}}}}}}}}],"if":{"properties":{"category":{"enum":["user_added","user_deleted","user_verified","license_over_deployment","css_capacity_approached","css_capacity_reached","css_capacity_exceeded"]}}},"then":{"properties":{"conditions":{"additionalProperties":false}}}},{"type":"object","properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]},{"allOf":[{"required":["name","category","delivery"],"properties":{"name":{"title":"Notification name. Must be unique","type":"string"},"description":{"title":"Notification description","type":"string","default":""},"category":{"title":"The category of the events to be notified","type":"string"},"delivery":{},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object"},"aggregation":{"title":"Aggregate multiple events in a single notifications","type":"object","properties":{"interval":{"title":"Interval in seconds for aggregating events in a single notification. It must be defined to apply aggregation","type":"integer","minimum":10,"maximum":86400}}},"enabled":{"title":"enable/disable notification","type":"boolean","default":true},"owner":{"title":"the identifier of the owner of the subscription","type":"string"}}},{"anyOf":[{"title":"OneView user added","properties":{"category":{"enum":["oneview_user_added"]},"delivery":{"anyOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"OneView user added output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","user_id","user_name","user_email","user_role","ip_address","timestamp","sites","invited_by_email"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["invited_by_email"]}}}}}},{"title":"OneView user verified","properties":{"category":{"enum":["oneview_user_verified"]},"delivery":{"anyOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"OneView user verified output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","user_id","user_name","user_email","ip_address","timestamp"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"Not available for this category","maxItems":0}}}}},{"title":"OneView user deleted","properties":{"category":{"enum":["oneview_user_deleted"]},"delivery":{"anyOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"OneView user deleted output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","user_id","user_name","user_email","user_role","ip_address","timestamp","sites","deleted_by_email"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["deleted_by_email"]}}}}}},{"title":"OneView sites assigned","allOf":[{"properties":{"category":{"enum":["oneview_sites_assigned"]},"delivery":{"anyOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"OneView sites assigned output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","user_id","user_name","user_email","user_role","ip_address","timestamp","sites","assigned_by_email","added_sites","removed_sites"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["assigned_by_email","user_email"]}}}}}},{"type":"object","properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]},{"title":"OneView trial to paid status","allOf":[{"properties":{"category":{"enum":["oneview_trial_to_paid_status"]},"delivery":{"anyOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"OneView trial to paid status output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","timestamp","max_protection","device_type","conversion_status","sites"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["device_type","conversion_status","max_protection"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"nebula_account_id\". 1: string","items":[{"const":"nebula_account_id"}],"additionalItems":{"title":"Filter events by nebula_account_id","type":"string"}},{"title":"0: \"conversion_status\". 1: \"FAILED\", \"SUCCESS\"","items":[{"const":"conversion_status"}],"additionalItems":{"title":"Filter events by conversion status","type":"string","enum":["FAILED","SUCCESS"]}}]},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""}}}}}}}}}}},{"type":"object","properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]},{"title":"OneView site end date approaching","properties":{"category":{"enum":["oneview_site_end_date_approaching"]},"delivery":{"anyOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"OneView site end date approachnig output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","timestamp","sites","days_left","site_end_date"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","maxItems":0}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"days_left\". 1: 0,1,7,14,30","items":[{"const":"days_left"}],"additionalItems":{"title":"Filter events by days left before the license expiration","type":"number","enum":[0,1,7,14,30]}}]},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""}}}}}}}}}}}]},{"if":{"properties":{"category":{"enum":["oneview_user_added","oneview_user_deleted","oneview_user_verified","oneview_sites_assigned"]}}},"then":{"properties":{"conditions":{"additionalProperties":false}}}}]}]}],"if":{"properties":{"category":{"enum":["oneview_user_added","oneview_user_verified","oneview_user_deleted","oneview_sites_assigned","oneview_trial_to_paid_status","oneview_site_end_date_approaching"]}}},"then":{"required":["parent_account_id"]}},{"required":["id"],"properties":{"id":{"title":"Notification Id","type":"string"}}}]}}}}}}},"responses":{"202":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"The get all notification Body","required":["records","next_cursor"],"properties":{"records":{"type":"array","items":{"type":"object","title":"RMM notification response","allOf":[{"type":"object","title":"The Schema For Notifications Creation","anyOf":[{"allOf":[{"type":"object","title":"The create notification Body","required":["name","category","delivery"],"properties":{"name":{"title":"Notification name. Must be unique","type":"string"},"description":{"title":"Notification description","type":"string","default":""},"category":{"title":"The category of the events to be notified","type":"string"},"delivery":{},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object"},"aggregation":{"title":"Aggregate multiple events in a single notifications","type":"object","properties":{"interval":{"title":"Interval in seconds for aggregating events in a single notification. It must be defined to apply aggregation","type":"integer","minimum":10,"maximum":86400}}},"enabled":{"title":"enable/disable notification","type":"boolean","default":true},"owner":{"title":"the identifier of the owner of the subscription. Not available for read-only users","type":"string"}},"anyOf":[{"title":"Detections","properties":{"category":{"enum":["threat_detections"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Detections output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","os_release_name","os_platform","os_type","os_version","category","type","path","status","scanned_at","reported_at","resource_created_at","resource_modified_at","threat_name","affected_application","process_name","machine_id","machine_name","machine_ip","group_id","group_name","policy_id","policy_name","nics","md5","sha256","engine_version","last_user","active_directory_ou","id"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Detections output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","os_release_name","os_platform","os_type","os_version","category","type","path","status","scanned_at","reported_at","resource_created_at","resource_modified_at","threat_name","affected_application","process_name","machine_id","machine_name","machine_ip","group_id","group_name","policy_id","policy_name","nics","md5","sha256","engine_version","last_user","active_directory_ou","id"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","affected_application","category","group_id","group_name","machine_id","machine_ip","machine_name","os_platform","os_release_name","path","policy_id","policy_name","process_name","status","threat_name","type"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"category\". 1: \"MALWARE\",\"PUP\",\"PUM\",\"AE\",\"ARW\",\"MWAC\",\"RID\",\"VULNERABLE_DRIVER\"","items":[{"const":"category"}],"additionalItems":{"title":"Filter events by detection category","type":"string","enum":["MALWARE","PUP","PUM","AE","ARW","MWAC","RID","VULNERABLE_DRIVER"]}},{"title":"0: \"action\". 1: \"blocked\", \"deleted\", \"deletedAutoPrune\", \"found\", \"quarantined\", \"restored\"","items":[{"const":"action"}],"additionalItems":{"title":"Filter events by action","type":"string","enum":["blocked","deleted","deletedAutoPrune","found","quarantined","restored"]}},{"title":"0: \"threat_name\". 1: string","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux), \"4\"(Android), \"3\"(IOS), \"3\"(ChromeOS)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3,4,5,6]}},{"title":"0: \"rtp\". 1: true, false","items":[{"const":"rtp"},{"title":"Filter events by real time protection"}],"additionalItems":false,"if":{"items":[{"const":"rtp"}]},"then":{"items":[{"const":"rtp"},{"type":"boolean"}]}},{"title":"0: \"type\". 1: \"application\", \"exploit\", \"extension\", \"file\", \"folder\", \"InboundConnection\", \"module\", \"OutboundConnection\", \"process\", \"reg_key\", \"reg_value\"","items":[{"const":"type"}],"additionalItems":{"title":"Filter events by type","type":"string","enum":["application","exploit","extension","file","folder","InboundConnection","module","OutboundConnection","process","reg_key","reg_value"]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"threat_name\". 1: string","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","anyOf":[{"title":"0: \"threat_name\". 1: string","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_contains":{"type":"array","anyOf":[{"title":"0: \"threat_name\". 1: string","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"begins_with":{"title":"0: \"threat_name\". 1: string","type":"array","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Suspicious activity","properties":{"category":{"enum":["threat_suspicious_activity"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Suspicious activity","type":"array","minItems":1,"items":{"type":"string","enum":["severity","account_id","account_name","os_release_name","os_platform","type","path","status","scanned_at","reported_at","threat_name","machine_id","machine_name","machine_ip","group_id","group_name","policy_id","policy_name","nics","last_user","first_activity","last_activity","isolation_type","id"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Suspicious activity","type":"array","minItems":1,"items":{"type":"string","enum":["severity","account_id","account_name","os_release_name","os_platform","type","path","status","scanned_at","reported_at","threat_name","machine_id","machine_name","machine_ip","group_id","group_name","policy_id","policy_name","nics","last_user","first_activity","last_activity","isolation_type","id"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","group_id","group_name","machine_id","machine_ip","machine_name","os_platform","os_release_name","path","policy_id","policy_name","severity","status","threat_name"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"level\". 1: \"low\", \"medium\", \"high\", \"critical\"","items":[{"const":"level"}],"additionalItems":{"title":"Filter events by severity level","type":"string","enum":["low","medium","high","critical"]}},{"title":"0: \"threat_name\". 1: string","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux), \"4\"(Android), \"3\"(IOS), \"3\"(ChromeOS)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3,4,5,6]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"threat_name\". 1: string","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"contains":{"title":"0: \"threat_name\". 1: string","type":"array","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},"not_contains":{"title":"0: \"threat_name\". 1: string","type":"array","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},"begins_with":{"title":"0: \"threat_name\". 1: string","type":"array","items":[{"const":"threat_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},"exists":{"type":"string","anyOf":[{"title":"Filter events by isolation_type exists","const":"isolation_type"}]},"not_exists":{"anyOf":[{"title":"Filter events by isolation_type not exists","const":"isolation_type"}]},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"User added","properties":{"category":{"enum":["user_added"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"User added","type":"array","minItems":1,"items":{"type":"string","enum":["ip_address","invited_by","role","email","full_group_access","timestamp","account_id"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"User added","type":"array","minItems":1,"items":{"type":"string","enum":["ip_address","invited_by","role","email","full_group_access","timestamp","account_id"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","invited_by","ip_address","role"]}}}}}},{"title":"User deleted","properties":{"category":{"enum":["user_deleted"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"User deleted output fields","type":"array","minItems":1,"items":{"type":"string","enum":["ip_address","timestamp","account_id","deleted_by","email"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"User deleted output fields","type":"array","minItems":1,"items":{"type":"string","enum":["ip_address","timestamp","account_id","deleted_by","email"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","ip_address","deleted_by"]}}}}}},{"title":"User verified","properties":{"category":{"enum":["user_verified"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"User verified","type":"array","minItems":1,"items":{"type":"string","enum":["email","timestamp","account_id"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"User verified","type":"array","minItems":1,"items":{"type":"string","enum":["email","timestamp","account_id"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name"]}}}}}},{"title":"Endpoint registered","properties":{"category":{"enum":["endpoint_registered"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Endpoint registered output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","created_at"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Endpoint registered output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","created_at"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Endpoint deleted","properties":{"category":{"enum":["endpoint_unregistered"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Endpoint deleted output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","timestamp","timeout"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Endpoint deleted output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","timestamp","timeout"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"timeout\". 1: true, false","items":[{"const":"timeout"},{"title":"Filter events by timeout (true if the machine was deleted because marked_for_deletion and never connected again until a timeout)"}],"additionalItems":false,"if":{"items":[{"const":"timeout"}]},"then":{"items":[{"const":"timeout"},{"type":"boolean"}]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Command update","properties":{"category":{"enum":["endpoint_command_update"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Command update output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","command","status","created_at","updated_at","expires_at","machine_id","machine_name","group_id","active_directory_ou"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Command update output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","command","status","created_at","updated_at","expires_at","machine_id","machine_name","group_id","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","command","status","machine_id","machine_name"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"status\". 1: \"CREATED\",\"SENT\",\"RECEIVED\",\"STARTED\",\"TIMED_OUT\",\"COMPLETED\",\"EXPIRED\",\"FAILED\",\"CANCELLED\"","items":[{"const":"status"}],"additionalItems":{"title":"Filter the type of the machine_events to be notified","type":"string","enum":["CREATED","SENT","RECEIVED","STARTED","TIMED_OUT","COMPLETED","EXPIRED","FAILED","CANCELLED"]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Quarantine","properties":{"category":{"enum":["quarantine"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Quarantine output fields","type":"array","minItems":1,"items":{"type":"string","enum":["path","machine_name","created_at","status"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Quarantine output fields","type":"array","minItems":1,"items":{"type":"string","enum":["path","machine_name","created_at","status"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","status"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","title":"0: \"quarantine_action\". 1: \"QUARANTINE_DELETED\",\"QUARANTINE_RESTORED\"","items":[{"const":"quarantine_action"}],"additionalItems":{"title":"Filter the type of the quarantine_events to be notified","type":"string","enum":["QUARANTINE_DELETED","QUARANTINE_RESTORED"]}},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Threat scan","properties":{"category":{"enum":["threat_scan"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Threat scan output_fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","scan_date","scan_id","machine_id","machine_name","group_id","group_name","policy_id","policy_name","ip_address","detections","active_directory_ou"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Threat scan output_fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","scan_date","scan_id","machine_id","machine_name","group_id","group_name","policy_id","policy_name","ip_address","detections","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","ip_address","policy_id","policy_name"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"action\". 1: \"THREAT_CLEANED\",\"THREAT_FOUND\"","items":[{"const":"action"}],"additionalItems":{"title":"Filter events by threat activity action","type":"string","enum":["THREAT_CLEANED","THREAT_FOUND"]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Device control","properties":{"category":{"enum":["device_control"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Device control output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version","path","date","action","device_name","manufacturer","volume_serial","serial_number","physical_disk_name","disk_interface","file_system","volume_name","volume_device_path","last_user","active_directory_ou"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Device control output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version","path","date","action","device_name","manufacturer","volume_serial","serial_number","physical_disk_name","disk_interface","file_system","volume_name","volume_device_path","last_user","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","group_id","group_name","machine_id","machine_name","os_platform","os_release_name","policy_id","policy_name"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"action\". 1: \"blocked\", \"read-only\"","items":[{"const":"action"}],"additionalItems":{"title":"Filter events by action","type":"string","enum":["blocked","read-only"]}},{"title":"0: \"device_name\". 1: string","items":[{"const":"device_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"manufacturer\". 1: string","items":[{"const":"manufacturer"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"device_name\". 1: string","items":[{"const":"device_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"manufacturer\". 1: string","items":[{"const":"manufacturer"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","anyOf":[{"title":"0: \"device_name\". 1: string","items":[{"const":"device_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"manufacturer\". 1: string","items":[{"const":"manufacturer"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_contains":{"type":"array","anyOf":[{"title":"0: \"device_name\". 1: string","items":[{"const":"device_name"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"manufacturer\". 1: string","items":[{"const":"manufacturer"}],"additionalItems":{"title":"Filter events by threat_name","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Site end date","properties":{"category":{"enum":["license_expiring"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Site end date output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status","licensed_seats","used_seats","license_key","catalog_code","combo_product","licensed_product","license_expires_at","days_left"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Site end date output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status","licensed_seats","used_seats","license_key","catalog_code","combo_product","licensed_product","license_expires_at","days_left"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"days_left\". 1: 0,1,3,5,7,14,30","items":[{"const":"days_left"}],"additionalItems":{"title":"Filter events by days left before the license expiration","type":"number","enum":[0,1,3,5,7,14,30]}},{"title":"0: \"license_term_type\". 1: \"cloud_evaluation\",\"evaluation\",\"freemium\",\"nfr\",\"site_license\",\"subscription\",\"utility\"","items":[{"const":"license_term_type"}],"additionalItems":{"title":"Filter events by license term type","type":"string","enum":["cloud_evaluation","evaluation","freemium","nfr","site_license","subscription","utility"]}}]},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Site over deployed","properties":{"category":{"enum":["license_over_deployment"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Site over deployed output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status","licensed_seats","used_seats","license_key","catalog_code","combo_product"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Site over deployed output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status","licensed_seats","used_seats","license_key","catalog_code","combo_product"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"license_term_type\". 1: \"cloud_evaluation\",\"evaluation\",\"freemium\",\"nfr\",\"site_license\",\"subscription\",\"utility\"","items":[{"const":"license_term_type"}],"additionalItems":{"title":"Filter events by license term type","type":"string","enum":["cloud_evaluation","evaluation","freemium","nfr","site_license","subscription","utility"]}}]},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Vulnerability status","properties":{"category":{"enum":["cve_found"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Vulnerability status output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","product","vendor","installed_version","machine_id","machine_name","group_id","group_name","policy_id","policy_name","cve_id","severity","created_at","os_platform","os_release_name","os_version","cisa_exploitable","known_ransomware_campaign_use","description","published_at","severity_score","active_directory_ou"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Vulnerability status output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","product","vendor","installed_version","machine_id","machine_name","group_id","group_name","policy_id","policy_name","cve_id","severity","created_at","os_platform","os_release_name","os_version","cisa_exploitable","known_ransomware_campaign_use","description","published_at","severity_score","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","cve_id","product","os_platform"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"severity\". 1: \"unknown\",\"low\",\"medium\",\"high\",\"critical\"","items":[{"const":"severity"}],"additionalItems":{"title":"Filter events by severity","type":"string","enum":["unknown","low","medium","high","critical"]}},{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"cisa_exploitable\". 1: true, false","items":[{"const":"cisa_exploitable"},{"title":"Filter events by CISA exploitable"}],"additionalItems":false,"if":{"items":[{"const":"cisa_exploitable"}]},"then":{"items":[{"const":"cisa_exploitable"},{"type":"boolean"}]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","anyOf":[{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_contains":{"type":"array","anyOf":[{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","anyOf":[{"title":"Filter events by available patch exists","const":"available_patch"}]},"not_exists":{"type":"string","anyOf":[{"title":"Filter events by available patch not exists","const":"available_patch"}]},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"CVE Ignored","properties":{"category":{"enum":["cve_ignored"]},"delivery":{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}},"output_fields":{"title":"CVE Ignored output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","cve_id","ignored_reason","display_product","ignored_at","ignored_until","ignored_by","ignored_by_name"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","cve_id"]}}}}}},{"title":"Patch applied","properties":{"category":{"enum":["patch_applied"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Patch applied output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","title","description","product","vendor","severity","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_version","reboot_required","preview_patch","date","status","category","active_directory_ou"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Patch applied output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","title","description","product","vendor","severity","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_version","reboot_required","preview_patch","date","status","category","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","os_platform"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"status\". 1: \"COMPLETED\",\"FAILED\",\"REBOOT_REQUIRED\"","items":[{"const":"status"}],"additionalItems":{"title":"Filter events by status","type":"string","enum":["COMPLETED","FAILED","REBOOT_REQUIRED"]}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"preview_patch\". 1: true, false","items":[{"const":"preview_patch"},{"title":"Filter events by preview_patch"}],"additionalItems":false,"if":{"items":[{"const":"preview_patch"}]},"then":{"items":[{"const":"preview_patch"},{"type":"boolean"}]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Software update applied","properties":{"category":{"enum":["software_update"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Software update applied output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","product","vendor","current_version","new_version","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_version","date","status","signature_id","active_directory_ou"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Software update applied output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","product","vendor","current_version","new_version","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_version","date","status","signature_id","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","os_platform"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"status\". 1: \"COMPLETED\",\"FAILED\"","items":[{"const":"status"}],"additionalItems":{"title":"Filter events by status","type":"string","enum":["COMPLETED","FAILED"]}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Patch or software update available","properties":{"category":{"enum":["patch_available"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Patch or software update available","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","title","description","product","vendor","severity","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_version","reboot_required","preview_patch","date","category","patch_id","kb_id","released_at","size","active_directory_ou"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Patch or software update available","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","title","description","product","vendor","severity","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_version","reboot_required","preview_patch","date","category","patch_id","kb_id","released_at","size","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","os_platform"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"severity\". 1: \"unknown\",\"moderate\",\"low\",\"important\",\"critical\"","items":[{"const":"severity"}],"additionalItems":{"title":"Filter events by severity","type":"string","enum":["unknown","moderate","low","important","critical"]}},{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"reboot_required\". 1: true, false","items":[{"const":"reboot_required"},{"title":"Filter events by reboot_required"}],"additionalItems":false,"if":{"items":[{"const":"reboot_required"}]},"then":{"items":[{"const":"reboot_required"},{"type":"boolean"}]}},{"title":"0: \"preview_patch\". 1: true, false","items":[{"const":"preview_patch"},{"title":"Filter events by preview_patch"}],"additionalItems":false,"if":{"items":[{"const":"preview_patch"}]},"then":{"items":[{"const":"preview_patch"},{"type":"boolean"}]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","anyOf":[{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_contains":{"type":"array","anyOf":[{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"begins_with":{"type":"array","anyOf":[{"title":"0: \"product\". 1: string","items":[{"const":"product"}],"additionalItems":{"title":"Filter events by product","type":"string"}},{"title":"0: \"vendor\". 1: string","items":[{"const":"vendor"}],"additionalItems":{"title":"Filter events by vendor","type":"string"}}]},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"CSS detection","properties":{"category":{"enum":["css_detection"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"CSS detection output fields","minItems":1,"type":"array","items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name","file_name","css_threat_name","action_taken","file_location","file_owner","timestamp"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"CSS detection output fields","minItems":1,"type":"array","items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name","file_name","css_threat_name","action_taken","file_location","file_owner","timestamp"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","action_taken","cloud_provider","scan_configuration_name"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"action_taken\". 1: \"Found\", \"Quarantined\"","items":[{"const":"action_taken"}],"additionalItems":{"title":"Filter events by action taken","type":"string","enum":["Found","Quarantined"]}},{"title":"0: \"cloud_provider\". 1: \"BOX\", \"ONEDRIVE\", \"GOOGLEDRIVE\"","items":[{"const":"cloud_provider"}],"additionalItems":{"title":"Filter events by cloud provider","type":"string","enum":["BOX","ONEDRIVE","GOOGLEDRIVE"]}},{"title":"0: \"scan_configuration_name\". 1: string","items":[{"const":"scan_configuration_name"}],"additionalItems":{"title":"Filter events by scan configuration name","type":"string"}}]},"not_eq":{"type":"array","title":"0: \"scan_configuration_name\". 1: string","items":[{"const":"scan_configuration_name"}],"additionalItems":{"title":"Filter events by scan_configuration_name","type":"string"}},"contains":{"title":"0: \"scan_configuration_name\". 1: string","type":"array","items":[{"const":"scan_configuration_name"}],"additionalItems":{"title":"Filter events by scan_configuration_name","type":"string"}},"not_contains":{"title":"0: \"scan_configuration_name\". 1: string","type":"array","items":[{"const":"scan_configuration_name"}],"additionalItems":{"title":"Filter events by scan_configuration_name","type":"string"}},"begins_with":{"title":"0: \"scan_configuration_name\". 1: string","type":"array","items":[{"const":"scan_configuration_name"}],"additionalItems":{"title":"Filter events by scan_configuration_name","type":"string"}},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"CSS capacity approached","properties":{"category":{"enum":["css_capacity_approached"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"CSS capacity approached output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name","timestamp"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"CSS capacity approached output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name","timestamp"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name"]}}}}}},{"title":"CSS capacity reached","properties":{"category":{"enum":["css_capacity_reached"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"CSS capacity reached output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name","timestamp"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"CSS capacity reached output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name","timestamp"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name"]}}}}}},{"title":"CSS capacity exceeded","properties":{"category":{"enum":["css_capacity_exceeded"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"CSS capacity exceeded output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name","timestamp"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"CSS capacity exceeded output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name","timestamp"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","cloud_provider","scan_configuration_name"]}}}}}},{"title":"DNS blocked","properties":{"category":{"enum":["dns_blocked"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"DNS blocked output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","timestamp","group_id","group_name","policy_id","policy_name","colo_id","device_id","user_id","dst_ip","src_ip","email","location","policy","rule_name","action","protocol","query_name","query_name_reversed","resolver_decision","query_category_ids","query_size","query_type","src_port","dst_port","os_platform","os_release_name","os_type","os_version","os_architecture"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"DNS blocked output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","timestamp","group_id","group_name","policy_id","policy_name","colo_id","device_id","user_id","dst_ip","src_ip","email","location","policy","rule_name","action","protocol","query_name","query_name_reversed","resolver_decision","query_category_ids","query_size","query_type","src_port","dst_port","os_platform","os_release_name","os_type","os_version","os_architecture"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"policy_id\". 1: string","items":[{"const":"policy_id"}],"additionalItems":{"title":"Filter events by policy_id","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"policy_id\". 1: string","items":[{"const":"policy_id"}],"additionalItems":{"title":"Filter events by policy_id","type":"string"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Case management","properties":{"category":{"enum":["siemplify_case"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Case management output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","case_id","case_name","case_status","case_created_at","priority","action_required","event","endpoints","detections"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Case management output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","case_id","case_name","case_status","case_created_at","priority","action_required","event","endpoints","detections"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","case_id"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"event\". 1: \"case_created\",\"case_updated\",\"case_closed\"","items":[{"const":"event"}],"additionalItems":{"title":"Filter events by status","type":"string","enum":["case_created","case_updated","case_closed"]}},{"title":"0: \"priority\". 1: \"Critical\", \"High\", \"Medium\", \"Low\"","items":[{"const":"priority"}],"additionalItems":{"title":"Filter events by status","type":"string","enum":["Critical","High","Medium","Low"]}},{"title":"0: \"action_required\". 1: true, false","items":[{"const":"action_required"},{"title":"Filter events by CISA exploitable"}],"additionalItems":false,"if":{"items":[{"const":"action_required"}]},"then":{"items":[{"const":"action_required"},{"type":"boolean"}]}}]},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Application block","properties":{"category":{"enum":["app_block"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Application block output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","app_block_rules","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version","scanned_at","file_path","last_user","active_directory_ou"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Application block output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","app_block_rules","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version","scanned_at","file_path","last_user","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"policy_id\". 1: string","items":[{"const":"policy_id"}],"additionalItems":{"title":"Filter events by policy_id","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"policy_id\". 1: string","items":[{"const":"policy_id"}],"additionalItems":{"title":"Filter events by policy_id","type":"string"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","additionalItems":false},"lte":{"type":"array","const":""},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Entitlement changed","properties":{"category":{"enum":["license_entitlement_changed"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Entitlement changed output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status","licensed_seats","used_seats","license_key","catalog_code","combo_product","licensed_product","license_expires_at","license_key_status","auto_renew","status"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Entitlement changed output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status","licensed_seats","used_seats","license_key","catalog_code","combo_product","licensed_product","license_expires_at","license_key_status","auto_renew","status"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"status\". 1: \"added\",\"updated\",\"removed\"","items":[{"const":"status"}],"additionalItems":{"title":"Filter events by status","type":"string","enum":["added","updated","removed"]}},{"title":"0: \"license_term_type\". 1: \"cloud_evaluation\",\"evaluation\",\"freemium\",\"nfr\",\"site_license\",\"subscription\",\"utility\"","items":[{"const":"license_term_type"}],"additionalItems":{"title":"Filter events by license term type","type":"string","enum":["cloud_evaluation","evaluation","freemium","nfr","site_license","subscription","utility"]}}]},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Entitlement usage changed","properties":{"category":{"enum":["license_entitlement_usage_changed"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Entitlement usage changed output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status","licensed_seats","used_seats","license_key","catalog_code","combo_product","licensed_product","license_expires_at","license_key_status","auto_renew"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Entitlement usage changed output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status","licensed_seats","used_seats","license_key","catalog_code","combo_product","licensed_product","license_expires_at","license_key_status","auto_renew"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","license_term_type","license_status"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","title":"0: \"license_term_type\". 1: \"cloud_evaluation\",\"evaluation\",\"freemium\",\"nfr\",\"site_license\",\"subscription\",\"utility\"","items":[{"const":"license_term_type"}],"additionalItems":{"title":"Filter events by license term type","type":"string","enum":["cloud_evaluation","evaluation","freemium","nfr","site_license","subscription","utility"]}},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Endpoint status changed","properties":{"category":{"enum":["endpoint_status_changed"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Endpoint status changed","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","status_change","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version","codes"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Endpoint status changed","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","status_change","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version","codes"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","status_change","machine_id","machine_name"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"status_change\". 1: \"ENDPOINT_REBOOT_REQUIRED\",\"ENDPOINT_REBOOT_REQUIRED_CLEARED\",\"ENDPOINT_INFECTED\",\"ENDPOINT_REMEDIATED\",\"ENDPOINT_ISOLATED\",\"ENDPOINT_UNISOLATED\",\"ENDPOINT_SUSPICIOUS_ACTIVITY_FOUND\",\"ENDPOINT_SUSPICIOUS_ACTIVITY_CLEARED\",\"AGENT_ALERTS_CHANGED\"","items":[{"const":"status_change"}],"additionalItems":{"title":"Filter the type of status_change to be notified","type":"string","enum":["ENDPOINT_REBOOT_REQUIRED","ENDPOINT_REBOOT_REQUIRED_CLEARED","ENDPOINT_INFECTED","ENDPOINT_REMEDIATED","ENDPOINT_ISOLATED","ENDPOINT_UNISOLATED","ENDPOINT_SUSPICIOUS_ACTIVITY_FOUND","ENDPOINT_SUSPICIOUS_ACTIVITY_CLEARED","AGENT_ALERTS_CHANGED"]}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Inactive endpoint","properties":{"category":{"enum":["inactive_endpoint"]},"delivery":{"properties":{"output_fields":{"title":"Information to include in the JSON body. If omitted, include all","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version","last_seen_at"]}}}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"os_type\". 1: \"1\"(Workstation), \"2\"(Server), \"3\"(Mobile)","items":[{"const":"os_type"}],"additionalItems":{"title":"Filter events by OS type","type":"number","enum":[1,2,3]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"policy_id\". 1: string","items":[{"const":"policy_id"}],"additionalItems":{"title":"Filter events by policy_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"contains":{"type":"array","anyOf":[{"title":"0: \"policy_name\". 1: string","items":[{"const":"policy_name"}],"additionalItems":{"title":"Filter events by policy_name","type":"string"}},{"title":"0: \"group_name\". 1: string","items":[{"const":"group_name"}],"additionalItems":{"title":"Filter events by group_name","type":"string"}}]},"not_contains":{"type":"array","anyOf":[{"title":"0: \"policy_name\". 1: string","items":[{"const":"policy_name"}],"additionalItems":{"title":"Filter events by policy_name","type":"string"}},{"title":"0: \"group_name\". 1: string","items":[{"const":"group_name"}],"additionalItems":{"title":"Filter events by group_name","type":"string"}}]},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","anyOf":[{"title":"0: \"last_seen_at\"","items":[{"const":"last_seen_at"}],"additionalItems":{"title":"Filter inactive machines by less than equals days since last active","type":"number","minimum":1}}]},"gte":{"type":"array","anyOf":[{"title":"0: \"last_seen_at\"","items":[{"const":"last_seen_at"}],"additionalItems":{"title":"Filter inactive machines by less than equals days since last active","type":"number","minimum":1}}]}}}}}}}}}}},{"title":"Firewall activity","properties":{"category":{"enum":["firewall_activity"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Firewall activity output fields","type":"array","minItems":1,"items":{"type":"string","enum":["start_time","end_time","rule_id","rule_name","ruleset_id","ruleset_name","direction","action","protocol","location","program","service","hits","account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Firewall activity output fields","type":"array","minItems":1,"items":{"type":"string","enum":["start_time","end_time","rule_id","rule_name","ruleset_id","ruleset_name","direction","action","protocol","location","program","service","hits","account_id","account_name","machine_id","machine_name","group_id","group_name","policy_id","policy_name","os_platform","os_release_name","os_type","os_version"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","machine_id","machine_name"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"action\". 1: \"ALLOW\", \"BLOCK\"","items":[{"const":"action"}],"additionalItems":{"title":"Filter events by action","type":"string","enum":["ALLOW","BLOCK"]}},{"title":"0: \"direction\". 1: \"Inbound\", \"Outbound\"","items":[{"const":"direction"}],"additionalItems":{"title":"Filter events by direction","type":"string","enum":["Inbound","Outbound"]}},{"title":"0: \"os_platform\". 1: \"1\"(Windows), \"2\"(MacOS), \"3\"(Linux)","items":[{"const":"os_platform"}],"additionalItems":{"title":"Filter events by OS platform","type":"number","enum":[1,2,3]}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"policy_id\". 1: string","items":[{"const":"policy_id"}],"additionalItems":{"title":"Filter events by policy_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"policy_id\". 1: string","items":[{"const":"policy_id"}],"additionalItems":{"title":"Filter events by policy_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Endpoint isolation","properties":{"category":{"enum":["endpoint_isolation"]},"delivery":{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}},"output_fields":{"title":"Endpoint isolation output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","status","created_at","updated_at","expires_at","machine_id","machine_name","os_release_name","os_platform","os_type","os_version","rule_id","active_directory_ou"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","status","machine_id","machine_name"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"status\". 1: \"COMPLETED\",\"EXPIRED\",\"FAILED\",\"CANCELLED\"","items":[{"const":"status"}],"additionalItems":{"title":"Filter the type of the status update to be notified","type":"string","enum":["COMPLETED","EXPIRED","FAILED","CANCELLED"]}},{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"not_eq":{"type":"array","anyOf":[{"title":"0: \"machine_id\". 1: string","items":[{"const":"machine_id"}],"additionalItems":{"title":"Filter events by machine_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"group_id\". 1: string","items":[{"const":"group_id"}],"additionalItems":{"title":"Filter events by group_id","type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"title":"0: \"active_directory_ou\". 1: string","items":[{"const":"active_directory_ou"}],"additionalItems":{"title":"Filter events by active_directory_ou","type":"string"}}]},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","anyOf":[{"title":"Filter events by rule_ud exists. If it exists, it indicates that it's an auto-isolation job","const":"rule_id"}]},"not_exists":{"type":"string","anyOf":[{"title":"Filter events by rule_ud exists. If it exists, it indicates that it's an auto-isolation job","const":"rule_id"}]},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Record (notification/report) audit","properties":{"category":{"enum":["record_audit"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Record audit output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","record_type","record_name","record_action","timestamp","user_email","owner"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Record audit output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","record_type","record_name","record_action","timestamp","user_email","owner"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","additionalItems":false},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","anyOf":[{"title":"0: \"record_action\". 1: \"REPORT\", \"NOTIFICATION\", \"UPDATED\", \"DELETED\"","items":[{"const":"record_action"}],"additionalItems":{"title":"Filter events by record action","type":"string","enum":["REPORT","NOTIFICATION","UPDATED","DELETED"]}}]},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"MXDR integration communication inactive","properties":{"category":{"enum":["mxdr_integration_inactive"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"mxdr_integration_inactive output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","source","last_log_seen","inactive_hours"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"mxdr_integration_inactive output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","source","last_log_seen","inactive_hours"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"source\". 1: \"okta\", \"entra\", \"msgraphapi\", \"meraki\", \"watchguard\", \"fortinet\"","items":[{"const":"source"}],"additionalItems":{"title":"Filter events by source","type":"string","enum":["okta","entra","msgraphapi","meraki","watchguard","fortinet"]}},{"title":"0: \"inactive_hours\". 1: 1, 24","items":[{"const":"inactive_hours"}],"additionalItems":{"title":"Filter events by inactive_hours","type":"number","enum":[1,24]}}]},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Audit log activity","properties":{"category":{"enum":["audit_log_activity"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Audit log activity output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","user_id","user_name","action","patch_titles","application_names","expires_at","reason","ignore_rule_name","application_version","ignore_rule_applies_to"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Audit log activity output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","user_id","user_name","action","patch_titles","application_names","expires_at","reason","ignore_rule_name","application_version","ignore_rule_applies_to"]}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"resource_type\". 1: \"ignore_rule\"","items":[{"const":"resource_type"}],"additionalItems":{"title":"Filter events by resource type","type":"string","enum":["ignore_rule"]}},{"title":"0: \"action\". 1: \"create\", \"update\"","items":[{"const":"action"}],"additionalItems":{"title":"Filter events by action","type":"string","enum":["create","update"]}}]}}}}}}}}}}},{"title":"XDR alert","properties":{"category":{"enum":["xdr_alert"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"xdr_alert output fields","type":"array","minItems":1,"items":{"type":"string","enum":["source","severity","account_id","account_name","created_at","category","alert_id","rule_name","attack_category","attack_detection_type","identity_primary_identifier","identity_group_name"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"xdr_alert output fields","type":"array","minItems":1,"items":{"type":"string","enum":["source","severity","account_id","account_name","created_at","category","alert_id","rule_name","attack_category","attack_detection_type","identity_primary_identifier","identity_group_name"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["account_id","account_name","source"]}}}},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object","properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"source\". 1: \"okta\", \"entra\", \"edr\"","items":[{"const":"source"}],"additionalItems":{"title":"Filter events by source","type":"string","enum":["okta","entra","edr"]}},{"title":"0: \"severity\". 1: \"information\", \"low\", \"medium\", \"high\", \"critical\"","items":[{"const":"severity"}],"additionalItems":{"title":"Filter events by severity","type":"string","enum":["information","low","medium","high","critical"]}},{"title":"0: \"attack_category\". 1: string","items":[{"const":"attack_category"}],"additionalItems":{"title":"Filter events by attack_category","type":"string"}},{"title":"0: \"identity_primary_identifier\". 1: string","items":[{"const":"identity_primary_identifier"}],"additionalItems":{"title":"Filter events by identity_primary_identifier","type":"string"}},{"title":"0: \"identity_group_name\". 1: string","items":[{"const":"identity_group_name"}],"additionalItems":{"title":"Filter events by identity_group_name","type":"string"}}]},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","anyOf":[{"title":"0: \"attack_category\". 1: string","items":[{"const":"attack_category"}],"additionalItems":{"title":"Filter events by attack_category","type":"string"}},{"title":"0: \"identity_primary_identifier\". 1: string","items":[{"const":"identity_primary_identifier"}],"additionalItems":{"title":"Filter events by identity_primary_identifier","type":"string"}},{"title":"0: \"identity_group_name\". 1: string","items":[{"const":"identity_group_name"}],"additionalItems":{"title":"Filter events by identity_group_name","type":"string"}}]},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""},"lte":{"type":"array","additionalItems":false},"gte":{"type":"array","additionalItems":false}}}}}}}}}}},{"title":"Drive encryption","properties":{"category":{"enum":["drive_encryption"]},"delivery":{"anyOf":[{"allOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"properties":{"output_fields":{"title":"Drive encryption output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","action","machine_name","policy_name","encryption_method","drive_label","timestamp"]}}}}]},{"type":"array","items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"Drive encryption output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","action","machine_name","policy_name","encryption_method","drive_label","timestamp"]}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"action\". 1: \"MACHINE_DRIVE_ENCRYPTION_ENCRYPTION_FAILED\", \"MACHINE_DRIVE_ENCRYPTION_SUSPENDED\", or \"MACHINE_DRIVE_ENCRYPTION_RECOVERY_DETECTED\"","items":[{"const":"action"}],"additionalItems":{"title":"Filter events by action type","type":"string","enum":["MACHINE_DRIVE_ENCRYPTION_ENCRYPTION_FAILED","MACHINE_DRIVE_ENCRYPTION_SUSPENDED","MACHINE_DRIVE_ENCRYPTION_RECOVERY_DETECTED"]}}]}}}}}}}}}}}],"if":{"properties":{"category":{"enum":["user_added","user_deleted","user_verified","license_over_deployment","css_capacity_approached","css_capacity_reached","css_capacity_exceeded"]}}},"then":{"properties":{"conditions":{"additionalProperties":false}}}},{"type":"object","properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]},{"allOf":[{"required":["name","category","delivery"],"properties":{"name":{"title":"Notification name. Must be unique","type":"string"},"description":{"title":"Notification description","type":"string","default":""},"category":{"title":"The category of the events to be notified","type":"string"},"delivery":{},"conditions":{"title":"Filters the events that will be notified. It depends on category","type":"object"},"aggregation":{"title":"Aggregate multiple events in a single notifications","type":"object","properties":{"interval":{"title":"Interval in seconds for aggregating events in a single notification. It must be defined to apply aggregation","type":"integer","minimum":10,"maximum":86400}}},"enabled":{"title":"enable/disable notification","type":"boolean","default":true},"owner":{"title":"the identifier of the owner of the subscription","type":"string"}}},{"anyOf":[{"title":"OneView user added","properties":{"category":{"enum":["oneview_user_added"]},"delivery":{"anyOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"OneView user added output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","user_id","user_name","user_email","user_role","ip_address","timestamp","sites","invited_by_email"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["invited_by_email"]}}}}}},{"title":"OneView user verified","properties":{"category":{"enum":["oneview_user_verified"]},"delivery":{"anyOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"OneView user verified output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","user_id","user_name","user_email","ip_address","timestamp"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"Not available for this category","maxItems":0}}}}},{"title":"OneView user deleted","properties":{"category":{"enum":["oneview_user_deleted"]},"delivery":{"anyOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"OneView user deleted output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","user_id","user_name","user_email","user_role","ip_address","timestamp","sites","deleted_by_email"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["deleted_by_email"]}}}}}},{"title":"OneView sites assigned","allOf":[{"properties":{"category":{"enum":["oneview_sites_assigned"]},"delivery":{"anyOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"OneView sites assigned output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","user_id","user_name","user_email","user_role","ip_address","timestamp","sites","assigned_by_email","added_sites","removed_sites"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["assigned_by_email","user_email"]}}}}}},{"type":"object","properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]},{"title":"OneView trial to paid status","allOf":[{"properties":{"category":{"enum":["oneview_trial_to_paid_status"]},"delivery":{"anyOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"OneView trial to paid status output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","timestamp","max_protection","device_type","conversion_status","sites"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","items":{"type":"string","enum":["device_type","conversion_status","max_protection"]}}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"nebula_account_id\". 1: string","items":[{"const":"nebula_account_id"}],"additionalItems":{"title":"Filter events by nebula_account_id","type":"string"}},{"title":"0: \"conversion_status\". 1: \"FAILED\", \"SUCCESS\"","items":[{"const":"conversion_status"}],"additionalItems":{"title":"Filter events by conversion status","type":"string","enum":["FAILED","SUCCESS"]}}]},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""}}}}}}}}}}},{"type":"object","properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]},{"title":"OneView site end date approaching","properties":{"category":{"enum":["oneview_site_end_date_approaching"]},"delivery":{"anyOf":[{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]},{"items":{"title":"Notification delivery schema","type":"object","required":["type"],"anyOf":[{"title":"Webhook delivery","required":["url"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["webhook"]},"url":{"title":"Webhook url","type":"string","format":"uri"},"custom_headers":{"title":"Custom headers that will be included in the request","type":"object","additionalProperties":{"type":"string"}},"max_retries":{"title":"Maximum number of retries if the delivery is not successful","type":"number"},"secret_token":{"title":"The secret token that will be used to sign the message","type":"string"}}},{"title":"Email delivery","required":["recipients","subject"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["email"]},"recipients":{"title":"Recipients list","type":"array","minItems":1,"items":{"type":"string","format":"email"}},"subject":{"title":"The subject of the email","type":"string"},"display_table":{"title":"Display table with the records in the email (only for aggregated notifications)","type":"boolean"}}},{"title":"Slack delivery","required":["channels"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["slack"]},"channels":{"title":"Slack channels list","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"MS Teams delivery","required":["conversations"],"properties":{"type":{"title":"Delivery method","type":"string","enum":["teams"]},"conversations":{"title":"MS Teams conversations IDs","type":"array","minItems":1,"items":{"type":"string"}}}},{"title":"Mobile push notification delivery","properties":{"type":{"title":"Delivery method","type":"string","enum":["mobile"]}}}]}}]},"output_fields":{"title":"OneView site end date approachnig output fields","type":"array","minItems":1,"items":{"type":"string","enum":["account_id","account_name","timestamp","sites","days_left","site_end_date"]}},"aggregation":{"properties":{"group_by":{"type":"array","title":"If specified, events will be aggregated by these fields, so there will be a different notification for every fields' value","maxItems":0}}},"conditions":{"type":"object","additionalProperties":false,"properties":{"or":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"and":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"properties":{"eq":{"type":"array","anyOf":[{"title":"0: \"days_left\". 1: 0,1,7,14,30","items":[{"const":"days_left"}],"additionalItems":{"title":"Filter events by days left before the license expiration","type":"number","enum":[0,1,7,14,30]}}]},"not_eq":{"type":"array","additionalItems":false},"contains":{"type":"array","additionalItems":false},"not_contains":{"type":"array","additionalItems":false},"begins_with":{"type":"array","additionalItems":false},"exists":{"type":"string","const":""},"not_exists":{"type":"string","const":""}}}}}}}}}}}]},{"if":{"properties":{"category":{"enum":["oneview_user_added","oneview_user_deleted","oneview_user_verified","oneview_sites_assigned"]}}},"then":{"properties":{"conditions":{"additionalProperties":false}}}}]}]},{"required":["id"],"properties":{"id":{"title":"Notification Id","type":"string"},"owner":{"title":"Notification owner","type":"string"},"account_id":{"title":"Account Id of the owner of the notification","type":"string"},"created_at":{"title":"Created at timestamp","format":"date-time"},"updated_at":{"title":"Updated at timestamp","format":"date-time"},"created_by":{"title":"Created by","type":"string"},"updated_by":{"title":"Created by","type":"string"}}}]}},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}}}}},"tags":["Notifications"],"operationId":"api.v2.rmm.put-bulk.notification"}},"/oneview/v1/accounts/{account_id}/notifications/subscriptions/delete-by-owner/{owner}":{"delete":{"description":"Delete all notifications owned by a given owner.","summary":"Delete notifications by owner","security":[{"client_credentials":["write"]},{"user_permissions":["notifications.deleteOwn","notifications.deleteOthers"]}],"status":{"outage":["auth","webhooks_subscriptions","subscriptions_db"]},"parameters":[{"name":"owner","required":false,"in":"path","description":"Notification owner","schema":{"type":"string"}},{"name":"account_id","required":false,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{}}}},"tags":["Notifications"],"operationId":"api.v2.rmm.delete-by-owner.notification"}},"/oneview/v1/accounts/{account_id}/notifications/subscriptions/remove-email/{email}":{"delete":{"description":"Remove an email address from all the recipients of the notification subscriptions of the account. If the subscription had only one delivery method and 1 recipient, delete the subscription.","summary":"Remove email from recipients","security":[{"client_credentials":["write"]},{"user_permissions":["notifications.editOthers","notifications.editOwn","notifications.deleteOwn","notifications.deleteOthers"]}],"status":{"outage":["auth","webhooks_subscriptions","subscriptions_db"]},"parameters":[{"name":"email","required":false,"in":"path","description":"email","schema":{"type":"string"}},{"name":"account_id","required":false,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{}}}},"tags":["Notifications"],"operationId":"api.v2.rmm.remove-email.notification"}},"/oneview/v1/installation-token/{account_id}/{token}":{"delete":{"description":"Revoke an installation token that has not been used yet.","summary":"Revoke installation token","security":[{"client_credentials":["execute"]},{"user_permissions":["endpoints.install"]}],"status":{"outage":["auth"]},"parameters":[{"name":"token","required":false,"in":"path","description":"The token id that is going to be revoked","schema":{"type":"string"}},{"name":"account_id","required":false,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Installation token","examples":[{"account_id":"550a20b8-6d36-4222-afbc-54d100f2e894","id":"7qM4","token":"7qM4-aSdF","created_by":"5583ddb6-bb2f-42f1-b455-819d373a1b15","created_at":"2022-09-14T15:10:48.68866Z","used_at":null,"expires_at":"2022-10-14T15:10:48.68866Z","sent_to":"aatakan@malwarebytes.com"}],"properties":{"account_id":{"type":"string","title":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"id":{"type":"string","title":"ID of the Token"},"token":{"type":"string","title":"Token (only visible during creation)"},"created_by":{"type":"string","title":"User ID that created the token (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"created_at":{"type":"string","title":"The time when token is created"},"used_at":{"type":["string","null"],"title":"The time when token is used"},"expires_at":{"type":"string","title":"The time when token will be expired"},"sent_to":{"type":["string","null"],"title":"The email address token is sent to"}}}}}}},"tags":["Installation Tokens"],"operationId":"api.v2.rmm.revoke.installation-token"}},"/oneview/v1/installation-token/{account_id}":{"post":{"description":"Generate an installation token to be used. The token will be only visible during this operation.","summary":"Generate an installation token","security":[{"client_credentials":["read"]},{"user_permissions":["endpoints.install"]}],"status":{"outage":["auth"]},"parameters":[{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Installation token","examples":[{"account_id":"550a20b8-6d36-4222-afbc-54d100f2e894","id":"7qM4","token":"7qM4-aSdF","created_by":"5583ddb6-bb2f-42f1-b455-819d373a1b15","created_at":"2022-09-14T15:10:48.68866Z","used_at":null,"expires_at":"2022-10-14T15:10:48.68866Z","sent_to":"aatakan@malwarebytes.com"}],"properties":{"account_id":{"type":"string","title":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"id":{"type":"string","title":"ID of the Token"},"token":{"type":"string","title":"Token (only visible during creation)"},"created_by":{"type":"string","title":"User ID that created the token (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"created_at":{"type":"string","title":"The time when token is created"},"used_at":{"type":["string","null"],"title":"The time when token is used"},"expires_at":{"type":"string","title":"The time when token will be expired"},"sent_to":{"type":["string","null"],"title":"The email address token is sent to"}}}}}}},"tags":["Installation Tokens"],"operationId":"api.v2.rmm.create.installation-token"}},"/oneview/v1/installation-token":{"post":{"description":"List the installation tokens generated or used across multiple accounts","summary":"Get installation tokens across multiple accounts","security":[{"client_credentials":["read"]},{"user_permissions":["endpoints.install"]}],"status":{"outage":["auth"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Get installation tokens for multiple account ids","allOf":[{"type":"object","title":"Paging parameters for listing installation tokens","properties":{"sort_by":{"type":"string","title":"Field to sort with","enum":["created_at","used_at","expires_at"]},"sort_order":{"type":"string","title":"Sort order","enum":["asc","desc"]},"include_used":{"type":"boolean","title":"Include or exclude the used tokens","default":true},"include_expired":{"type":"boolean","title":"Include or exclude the expired tokens","default":true},"populate":{"type":"object","title":"Specify whether you need to populate the server's response with additional data, like account info or last task","properties":{"account":{"type":"boolean","title":"The account data"}}},"page_size":{"type":"string","title":"The size of the page","pattern":"^1?\\d{1,3}$"},"start_index":{"type":"string","title":"The index of the first element","pattern":"\\d+$"}}},{"type":"object","required":["account_ids"],"properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"List all installation tokens","required":["installation_tokens","total_count"],"properties":{"installation_tokens":{"type":"array","title":"List of installation tokens","items":{"type":"object","title":"Installation token","examples":[{"account_id":"550a20b8-6d36-4222-afbc-54d100f2e894","id":"7qM4","token":"7qM4-aSdF","created_by":"5583ddb6-bb2f-42f1-b455-819d373a1b15","created_at":"2022-09-14T15:10:48.68866Z","used_at":null,"expires_at":"2022-10-14T15:10:48.68866Z","sent_to":"aatakan@malwarebytes.com"}],"properties":{"account_id":{"type":"string","title":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"id":{"type":"string","title":"ID of the Token"},"token":{"type":"string","title":"Token (only visible during creation)"},"created_by":{"type":"string","title":"User ID that created the token (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"created_at":{"type":"string","title":"The time when token is created"},"used_at":{"type":["string","null"],"title":"The time when token is used"},"expires_at":{"type":"string","title":"The time when token will be expired"},"sent_to":{"type":["string","null"],"title":"The email address token is sent to"}}}},"total_count":{"type":"integer","title":"Total Count","description":"Total count of results."}}}}}}},"tags":["Installation Tokens"],"operationId":"api.v2.rmm.search.installation-token"}},"/oneview/v1/installation-token/{account_id}/send":{"post":{"description":"Send installation tokens to batches of emails","summary":"Send installation tokens","security":[{"client_credentials":["read"]},{"user_permissions":["endpoints.install"]}],"status":{"outage":["auth"]},"parameters":[{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"List of emails that installation tokens will be delivered to","additionalProperties":false,"required":["emails"],"properties":{"emails":{"type":"array","title":"List of emails","items":{"type":"string","pattern":"^[a-zA-Z0-9.!#$%&'*+/=?^_`{|}~-]+@[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(?:\\.[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*$"}}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Installation token","examples":[{"account_id":"550a20b8-6d36-4222-afbc-54d100f2e894","id":"7qM4","token":"7qM4-aSdF","created_by":"5583ddb6-bb2f-42f1-b455-819d373a1b15","created_at":"2022-09-14T15:10:48.68866Z","used_at":null,"expires_at":"2022-10-14T15:10:48.68866Z","sent_to":"aatakan@malwarebytes.com"}],"properties":{"account_id":{"type":"string","title":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"id":{"type":"string","title":"ID of the Token"},"token":{"type":"string","title":"Token (only visible during creation)"},"created_by":{"type":"string","title":"User ID that created the token (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"created_at":{"type":"string","title":"The time when token is created"},"used_at":{"type":["string","null"],"title":"The time when token is used"},"expires_at":{"type":"string","title":"The time when token will be expired"},"sent_to":{"type":["string","null"],"title":"The email address token is sent to"}}}}}}},"tags":["Installation Tokens"],"operationId":"api.v2.rmm.send.installation-token"}},"/oneview/v1/accounts/{account_id}/preferences/account_logo":{"get":{"description":"Get account logo preferences","summary":"Get account logo preferences","security":[{"client_credentials":["read"]},{"user_permissions":["account.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Get account logo preferences response","required":["reports","emails"],"properties":{"emails":{"type":"boolean","title":"Include account logo in emails"},"reports":{"type":"boolean","title":"Include account logo in reports"}}}}}}},"tags":["Preferences"],"operationId":"api.rmm.get.preferences.account.logo"},"put":{"description":"Put account logo preferences","summary":"Put account logo preferences","security":[{"client_credentials":["write"]},{"user_permissions":["account.manage"]}],"status":{"outage":["auth"]},"parameters":[{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Get account logo preferences response","required":["reports","emails"],"properties":{"emails":{"type":"boolean","title":"Include account logo in emails"},"reports":{"type":"boolean","title":"Include account logo in reports"}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Get account logo preferences response","required":["reports","emails"],"properties":{"emails":{"type":"boolean","title":"Include account logo in emails"},"reports":{"type":"boolean","title":"Include account logo in reports"}}}}}}},"tags":["Preferences"],"operationId":"api.rmm.put.preferences.account.logo"}},"/oneview/v1/accounts/{account_id}/preferences/notifications":{"get":{"description":"Get notification delivery preferences.","summary":"Get notifications preferences","security":[{"client_credentials":["read"]},{"user_permissions":["notifications.viewOthers"]}],"status":{"outage":["auth"]},"parameters":[{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"$schema":"http://json-schema.org/draft-07/schema#","title":"Notifications options","type":"object","properties":{"webhook":{"title":"Webhook","type":"boolean","default":true},"email":{"title":"Email","type":"boolean","default":true},"slack":{"title":"Slack","type":"boolean","default":true},"teams":{"title":"Teams","type":"boolean","default":true},"mobile":{"title":"Mobile App (for Nebula only)","type":"boolean","default":true}}}}}}},"tags":["Preferences"],"operationId":"api.rmm.get.preferences.notifications"},"put":{"description":"Modify notification delivery preferences.","summary":"Put notifications preferences","security":[{"client_credentials":["read","write"]},{"user_permissions":["notifications.editOthers"]}],"status":{"outage":["auth"]},"parameters":[{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$schema":"http://json-schema.org/draft-07/schema#","title":"Notifications options","type":"object","properties":{"webhook":{"title":"Webhook","type":"boolean","default":true},"email":{"title":"Email","type":"boolean","default":true},"slack":{"title":"Slack","type":"boolean","default":true},"teams":{"title":"Teams","type":"boolean","default":true},"mobile":{"title":"Mobile App (for Nebula only)","type":"boolean","default":true}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"$schema":"http://json-schema.org/draft-07/schema#","title":"Notifications options","type":"object","properties":{"webhook":{"title":"Webhook","type":"boolean","default":true},"email":{"title":"Email","type":"boolean","default":true},"slack":{"title":"Slack","type":"boolean","default":true},"teams":{"title":"Teams","type":"boolean","default":true},"mobile":{"title":"Mobile App (for Nebula only)","type":"boolean","default":true}}}}}}},"tags":["Preferences"],"operationId":"api.rmm.put.preferences.notifications"}},"/oneview/v1/accounts/{account_id}/usage/changelogs/{machine_id}":{"post":{"description":"Get entitlement history for an endpoint","summary":"Get entitlement history for an endpoint","security":[{"client_credentials":["read"]},{"user_permissions":["account.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Search logs","description":"Search logs.","examples":[{"start_date":"2022-04-01","end_date":"2022-04-30"}],"required":["start_date","end_date"],"properties":{"start_date":{"type":"string","title":"Start date","description":"Start date.","examples":["2022-04-01"]},"end_date":{"type":"string","title":"End date","description":"End date.","examples":["2022-04-30"]}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"array","title":"Root Schema","items":{"type":"object","title":"A Schema","required":["machine_id","machine_name","policy_id","policy_name","group_id","group_name","created_at","license_term_type","protection","modules"],"properties":{"machine_id":{"type":"string","title":"The machine_id Schema","examples":["687560a3-57d9-4c1d-aa82-6d4890e859c6"]},"machine_name":{"type":"string","title":"The machine_name Schema","examples":["Windows server 76fab277-4ad8-40bc-a700-6151e3dfb5cc"]},"policy_id":{"type":"string","title":"The policy_id Schema","examples":["d68b2d8a-ae5e-4df2-baa7-275f8ad62a16","4c19e10a-df4c-4d5a-bd14-111b025c62d1"]},"policy_name":{"type":"string","title":"The policy_name Schema","examples":["EPS with EDR Policy dad6d891-f761-4829-8a8c-05262c57eb48","Default Policy"]},"group_id":{"type":"string","title":"The group_id Schema","examples":["4298ff68-b68b-4faa-bae6-c3810c5be8a9"]},"group_name":{"type":"string","title":"The group_name Schema","examples":["Default Group"]},"created_at":{"type":"string","title":"The created_at Schema","examples":["2023-01-30T17:47:05Z","2023-01-30T17:45:45Z","2023-01-30T17:45:28Z"]},"license_term_type":{"type":"string","title":"The license_term_type Schema. It is unknown when the first entitlment change is a module addition/removal","examples":["cloud_evaluation","usage_billing","unknown"]},"protection":{"type":"string","title":"The protection Schema. It is unknown when the first entitlment change is a module addition/removal","enum":["IR","EDR","EP","MOB","unknown"],"examples":["IR","EDR","EP"]},"modules":{"type":"array","title":"The modules Schema","items":{"type":"string"}}},"examples":[{"machine_id":"687560a3-57d9-4c1d-aa82-6d4890e859c6","machine_name":"Windows server 76fab277-4ad8-40bc-a700-6151e3dfb5cc","policy_id":"d68b2d8a-ae5e-4df2-baa7-275f8ad62a16","policy_name":"EPS with EDR Policy dad6d891-f761-4829-8a8c-05262c57eb48","group_id":"4298ff68-b68b-4faa-bae6-c3810c5be8a9","group_name":"Default Group","created_at":"2023-01-30T17:47:05Z","license_term_type":"cloud_evaluation","protection":"EDR","modules":["MBDNS-B"]}]}}}}}},"tags":["Usage"],"operationId":"api.rmm.search.changelogs"}},"/oneview/v1/usage/logs/summary/export":{"post":{"description":"Export usage data","summary":"Export usage data","security":[{"client_credentials":["read"]},{"user_permissions":["account.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Export request","required":["select","format","start_date","end_date","account_ids"],"properties":{"start_date":{"type":"string","title":"Start date","description":"Start date.","default":"","examples":["2022-04-01"]},"end_date":{"type":"string","title":"End date","description":"End date.","default":"","examples":["2022-04-30"]},"account_ids":{"type":"array","title":"MSP ids","description":"MSP ids.","examples":[["account_id"]],"items":{"type":"string","title":"The first anyOf schema","default":"","examples":["account_id"]}},"format":{"type":"string","title":"The output file","enum":["csv","xlsx","html","ods","txt","rtf","json"]},"download":{"type":"boolean","title":"Whether to instruct the client to download the response as a file. Only clients like browsers are supported"},"type":{"type":"string","title":"The encoding of the output","enum":["string","base64","binary"],"default":"string"},"select":{"type":"array","title":"Which fields to select from the response","items":{"type":"object","title":"Field","required":["field","newField"],"properties":{"newField":{"type":"string","title":"the new value"},"field":{"type":"string","title":"The response field to map to a new value","enum":["site","site_license","product_name","billable_usage_count","report_month"]}}}}}}}}},"responses":{"200":{"description":"Successful response"}},"tags":["Usage"],"operationId":"api.rmm.search.usage.summary.export"}},"/oneview/v1/usage/histogram":{"post":{"description":"Search usage histogram","summary":"Search usage histogram","security":[{"client_credentials":["read"]},{"user_permissions":["account.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Search logs","description":"Search logs.","examples":[{"account_ids":["account_id"]}],"required":["account_ids"],"properties":{"account_ids":{"type":"array","title":"Account ids","description":"Account ids.","examples":[["account_id"]],"items":{"type":"string","description":"Account IDs.","default":"","examples":["account_id"]}}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Get histogram summary","description":"Get histogram summary.","additionalProperties":true,"examples":[{"2022-03":{"BUS-CLOUD-EPR-01":{"entitlement_id":"520b00cd-e00e-4f3d-b6c4-367e468c1791","usage":1},"BUS-MBVPM-01":{"entitlement_id":"cbc82111-00d4-412c-bf2f-cda422ce8796","usage":1}},"2022-04":{"BUS-CLOUD-EDR-SER-01":{"entitlement_id":"edec6e1d-f041-4237-8a58-ceb6ec728faa","usage":10},"BUS-CLOUD-EPR-01":{"entitlement_id":"57c5651a-7056-4dc4-a4ca-bf9b1f21bf50","usage":1},"BUS-MBVM-01":{"entitlement_id":"0af22979-d910-4112-8f80-e5998f2f48ed","usage":43},"BUS-MBVPM-01":{"entitlement_id":"cbc82111-00d4-412c-bf2f-cda422ce8796","usage":1}},"2022-05":{"BUS-CLOUD-EDR-SER-01":{"entitlement_id":"edec6e1d-f041-4237-8a58-ceb6ec728faa","usage":9},"BUS-CLOUD-EPR-01":{"entitlement_id":"57c5651a-7056-4dc4-a4ca-bf9b1f21bf50","usage":1},"BUS-CLOUD-IRSL-01":{"entitlement_id":"8cc10d67-5476-456e-bce0-1cf58163d69d","usage":12},"BUS-MBVM-01":{"entitlement_id":"0af22979-d910-4112-8f80-e5998f2f48ed","usage":43},"BUS-MBVPM-01":{"entitlement_id":"cbc82111-00d4-412c-bf2f-cda422ce8796","usage":1}}}],"properties":{"BUS-CLOUD-IR-01":{"type":"object","title":"Entitlement usage","properties":{"entitlement_id":{"type":"string","title":"Identifier of the entitlement"},"usage":{"type":"number","title":"Number of seats used"}}},"BUS-CLOUD-EPP-01":{"type":"object","title":"Entitlement usage","properties":{"entitlement_id":{"type":"string","title":"Identifier of the entitlement"},"usage":{"type":"number","title":"Number of seats used"}}},"BUS-CLOUD-EPR-01":{"type":"object","title":"Entitlement usage","properties":{"entitlement_id":{"type":"string","title":"Identifier of the entitlement"},"usage":{"type":"number","title":"Number of seats used"}}},"BUS-CLOUD-EPP-SER-01":{"type":"object","title":"Entitlement usage","properties":{"entitlement_id":{"type":"string","title":"Identifier of the entitlement"},"usage":{"type":"number","title":"Number of seats used"}}},"BUS-CLOUD-EDR-SER-01":{"type":"object","title":"Entitlement usage","properties":{"entitlement_id":{"type":"string","title":"Identifier of the entitlement"},"usage":{"type":"number","title":"Number of seats used"}}}}}}}}},"tags":["Usage"],"operationId":"api.rmm.search.usage.histogram"}},"/oneview/v1/usage/logs/summary":{"post":{"description":"Search summary of usage","summary":"Search summary of usage","security":[{"client_credentials":["read"]},{"user_permissions":["account.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"The root schema","description":"The root schema comprises the entire JSON document.","examples":[{"start_date":"2022-04-01","end_date":"2022-04-30","account_ids":["account_id"]}],"required":["start_date","end_date","account_ids"],"properties":{"start_date":{"type":"string","title":"Start date","description":"Start date.","default":"","examples":["2022-04-01"]},"end_date":{"type":"string","title":"End date","description":"End date.","default":"","examples":["2022-04-30"]},"account_ids":{"type":"array","title":"MSP ids","description":"MSP ids.","examples":[["account_id"]],"items":{"type":"string","title":"The first anyOf schema","default":"","examples":["account_id"]}}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Get usage summary","description":"Get usage summary.","additionalProperties":true,"examples":[{"2dc6485d-f80e-4f59-bd81-b2436853452a":{"BUS-CLOUD-IR-01":{"catalog_code":"BUS-CLOUD-EPR-01","billable_catalog_code":"BUS-CLOUD-EPR-01","combo_code":"NEBULA-EPR-COMBO","billable_combo_code":"NEBULA-EPR-COMBO","entitlement_id":"de21d245-ccfe-4361-89e8-95108613f9dd","billable_entitlement_id":"de21d245-ccfe-4361-89e8-95108613f9dd","license_term_type":"usage_billing","billable_term_type":"usage_billing","licensed_seats":10,"usage":1}}}],"properties":{}}}}}},"tags":["Usage"],"operationId":"api.rmm.search.usage.summary"}},"/oneview/v1/usage/two-tier/logs/summary/export":{"post":{"description":"Two tier usage summary export","summary":"Two tier usage summary export","security":[{"client_credentials":["read"]},{"user_permissions":["account.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Export request","required":["select","format","start_date","end_date","account_ids","details"],"properties":{"start_date":{"type":"string","title":"Start date","description":"Start date.","default":"","examples":["2022-04-01"]},"end_date":{"type":"string","title":"End date","description":"End date.","default":"","examples":["2022-04-30"]},"account_ids":{"type":"array","title":"MSP ids","description":"MSP ids.","examples":[["account_id"]],"items":{"type":"string","title":"The first anyOf schema","default":"","examples":["account_id"]}},"details":{"type":"array","items":{"type":"object","properties":{"msp_account_id":{"type":"string"},"msp_company_name":{"type":"string"},"license_type":{"type":"string"},"account_status":{"type":"string"},"test_account":{"type":"boolean"},"user_count":{"type":"integer"},"users":{"type":"array","items":{"type":"object","properties":{"user_id":{"type":"string"},"user_email":{"type":"string"},"user_firstname":{"type":"string"},"user_lastname":{"type":"string"},"user_status":{"type":"string"}}}},"site_count":{"type":"integer"},"sites":{"type":"array","items":{"type":"object"}},"nebula_account_id":{"type":"string"},"owner":{"oneOf":[{"type":"object"},{"type":"null"}]},"license_key":{"type":"string"}},"required":["msp_account_id","msp_company_name","license_type","account_status","owner"]}},"format":{"type":"string","title":"The output file","enum":["csv","xlsx","html","ods","txt","rtf","json"]},"download":{"type":"boolean","title":"Whether to instruct the client to download the response as a file. Only clients like browsers are supported"},"type":{"type":"string","title":"The encoding of the output","enum":["string","base64","binary"],"default":"string"},"select":{"type":"array","title":"Which fields to select from the response","items":{"type":"object","title":"Field","required":["field","newField"],"properties":{"newField":{"type":"string","title":"the new value"},"field":{"type":"string","title":"The response field to map to a new value","enum":["account_name","contact","email","account_id","subscription_type","account_status","product_name","usage"]}}}}}}}}},"responses":{"200":{"description":"Successful response"}},"tags":["Usage"],"operationId":"api.rmm.search.usage.two_tier.summary.export"}},"/oneview/v1/usage/logs":{"post":{"description":"Search logs of usage","summary":"Search logs of usage","security":[{"client_credentials":["read"]},{"user_permissions":["account.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Search logs","description":"Search logs.","examples":[{"start_date":"2022-04-01","end_date":"2022-04-30","entity_type":"machine","page_size":50,"account_ids":["account_id"],"next_cursor":0}],"required":["start_date","end_date","account_ids"],"properties":{"start_date":{"type":"string","title":"Start date","description":"Start date.","default":"","examples":["2022-04-01"]},"end_date":{"type":"string","title":"End date","description":"End date.","default":"","examples":["2022-04-30"]},"populate":{"type":"object","properties":{"deleted_status":{"type":"boolean","description":"Populates the response with is_deleted and deleted_at fields"}}},"account_ids":{"type":"array","title":"Account ids","description":"Account ids.","examples":[["account_id"]],"items":{"type":"string","title":"The first anyOf schema","default":"","examples":["account_id"]}},"page_size":{"type":"integer","title":"The page_size schema","default":0,"examples":[50]},"entity_type":{"type":"string","enum":["machine","identity"],"description":"Optional entity type filter. Defaults to machine."},"next_cursor":{"type":"integer","title":"The next_cursor schema"}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Get logs","description":"Usage logs response for a single entity type.","additionalProperties":true,"examples":[{"results":[{"id":6080220,"machine_id":"48ec2d74-ae08-44d6-9154-c05569466f64","entitlement_id":"216b796d-e7f4-46b8-80c6-f1bbb232fa35","billable_entitlement_id":"216b796d-e7f4-46b8-80c6-f1bbb232fa35","license_term_type":"usage_billing","billable_term_type":"usage_billing","policy_id":"4ce76b02-5f43-4170-a204-80685c408e06","group_id":"4744fb43-a481-4dc5-a335-655268957655","created_at":"2022-04-06T17:48:30Z","installed_at":"2021-11-01T12:00:00Z","account_id":"e59ce7be-6172-4b3a-b1da-6eede7d110b3","parent_account_id":"e59ce7be-6172-4b3a-b1da-6eede7d110b3","os_type":1,"os_platform":2,"catalog_code":"BUS-CLOUD-IRSL-01","billable_catalog_code":"BUS-CLOUD-IRSL-01","combo_code":"NEBULA-IRSL-COMBO","billable_combo_code":"NEBULA-IRSL-COMBO","product_code":"NCEPR-B","endpoint_name":"Mac 2","policy_name":"Default Policy","site_name":"JCP-DEV"}],"next_cursor":6080220},{"results":[{"id":2000058922,"machine_id":null,"entitlement_id":"35a6f53e-4c39-4631-8e0f-d641c7270241","billable_entitlement_id":"35a6f53e-4c39-4631-8e0f-d641c7270241","license_term_type":"usage_billing","billable_term_type":"usage_billing","policy_id":null,"group_id":null,"created_at":"2026-03-10T16:55:58Z","installed_at":"2026-03-10T16:55:58Z","account_id":"3a1fe16c-fa8d-415b-9680-d079666d005f","parent_account_id":"3a1fe16c-fa8d-415b-9680-d079666d005f","os_type":null,"os_platform":null,"catalog_code":"BUS-TDITDR-01","billable_catalog_code":"BUS-TDITDR-01","combo_code":"NEBULA-ITDR-COMBO","billable_combo_code":"NEBULA-ITDR-COMBO","product_code":"NCCA-B,TDITD-B","serial_number":null,"endpoint_name":null,"policy_name":null,"site_name":"srao_quMTLjyLQ","entity_type":"identity","global_identity_id":103335,"user_type":"guest","identity_type":"user","user_email":"dcontini-test@td-eso.com"}],"next_cursor":2000058922}],"properties":{"next_cursor":{"type":["integer","null"],"description":"Numeric pagination cursor. Returns 0 when there are no more results."},"results":{"type":["array","object","null"],"description":"Array by default. Object/null allowed for backward compatibility.","items":{"type":"object","additionalProperties":true},"additionalProperties":true}}}}}}},"tags":["Usage"],"operationId":"api.rmm.search.usagelogs"}},"/oneview/v1/sites/{id}/mdr":{"get":{"description":"Get a site's MDR settings","summary":"Get site MDR settings","security":[{"client_credentials":["read"]},{"user_permissions":["mss.view"]}],"status":{"outage":["auth","ov"]},"parameters":[{"name":"id","required":true,"in":"path","description":"Valid OneView site ID (Ex. \"30616562663436302D643733312D346238622D623338332D613031343538363566383333\")","schema":{"type":"string","pattern":"^[A-Fa-f0-9]+$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"MDR site configuration payload","description":"Response payload for fetching MDR site configuration","examples":[{"mdrEnabled":true,"primaryContactId":"6263666230393563383834616534303833376361633835336465653132643431","primaryContactPhone":"(111) 111 - 5555","endpointIsolation":true,"isTrial":false,"consent":true,"remediationType":"DoItForMe","product":"mdr"}],"required":["mdrEnabled"],"properties":{"mdrEnabled":{"type":"boolean","title":"MDR enabled","description":"Enable or disable mdr environment.","examples":[true,false]},"primaryContactId":{"type":"string","title":"MDR Primary Contact Id","description":"The id of primary contact for an MDR environment.","examples":["6263666230393563383834616534303833376361633835336465653132643431"]},"primaryContactPhone":{"type":"string","title":"Primary Contact Phone number","description":"The phone number of the primary contact.","examples":["(111) 111 - 5555"]},"endpointIsolation":{"type":"boolean","title":"Endpoint Isolation","description":"Allow MDR Analysts to isolate a suspected infected endpoint.","examples":[true,false]},"isTrial":{"type":"boolean","title":"Is the subscription for the site a trial or paid.","description":"Is the environment a trial environment.","examples":[true,false]},"consent":{"type":"boolean","title":"Accept Managed Services agreement","description":"https://www.threatdown.com/legal/managed-services-agreement/.","examples":[true,false]},"remediationType":{"type":"string","title":"Remediation Type","description":"The type of remediation for the site.","examples":["DoItForMe","Collaborate","NotifyOnly","MTH / Managed Threat Hunting"]},"product":{"type":"string","title":"Product Type","description":"The type of MDR product associated with the site.","examples":["mdr","mth"]}}}}}}},"tags":["MDR"],"operationId":"api.v2.oneview.get.mdr.siteconfig.id"},"post":{"description":"Set a site's MDR settings","summary":"Set site MDR settings","security":[{"client_credentials":["read"]},{"user_permissions":["mss.manage"]}],"status":{"outage":["auth","ov"]},"parameters":[{"name":"id","required":true,"in":"path","description":"Valid OneView site ID (Ex. \"30616562663436302D643733312D346238622D623338332D613031343538363566383333\")","schema":{"type":"string","pattern":"^[A-Fa-f0-9]+$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"MDR configuration request payload","description":"Payload for setting MDR configuration for a given site","examples":[{"primaryContactId":"6263666230393563383834616534303833376361633835336465653132643431","primaryContactPhone":"(111) 111 - 1111","mdrEnabled":true,"consent":true,"remediationType":"NotifyOnly","product":"mdr","endpointIsolation":false},{"primaryContactId":"6263666230393563383834616534303833376361633835336465653132643431","primaryContactPhone":"(111) 111 - 1111","secondaryContact":"6263666230393563383834616534303833376361633835336465653132643431","secondaryContactPhone":"(222) 222 - 2222","tertiaryContact":null,"tertiaryContactPhone":null,"mdrEnabled":true,"consent":true,"remediationType":"NotifyOnly","product":"mdr","endpointIsolation":true}],"required":["primaryContactId","primaryContactPhone","mdrEnabled","region","consent","remediationType","product","endpointIsolation"],"properties":{"primaryContactId":{"type":"string","title":"Primary contact Id","description":"Id of primary contact.","examples":["6263666230393563383834616534303833376361633835336465653132643431"]},"primaryContactPhone":{"type":"string","title":"Primary contact phone number","description":"Phone number of the primary contact.","examples":["(111) 111 - 1111"]},"secondaryContactId":{"type":"string","title":"Secondary contact Id","description":"Id of secondary contact.","examples":["6263666230393563383834616534303833376361633835336465653132643431"]},"secondaryContactPhone":{"type":"string","title":"Secondary contact phone number","description":"Phone number of the secondary contact.","examples":["(222) 222 - 2222"]},"tertiaryContactId":{"type":"string","title":"Tertiary contact Id","description":"Id of tertiary contact.","examples":["6263666230393563383834616534303833376361633835336465653132643431"]},"tertiaryContactPhone":{"type":"string","title":"Tertiary contact phone number","description":"Phone number of the tertiary contact.","examples":["(333) 333 - 3333"]},"mdrEnabled":{"type":"boolean","title":"MDR enabled","description":"MDR is enabled or disabled for a given site.","default":true,"examples":[true,false]},"region":{"type":"string","title":"MDR environment region","description":"Region where MDR environment is. Select emea for GDPR compliance","examples":["emea","americas","sec_ops"],"enum":["emea","americas","sec_ops"]},"consent":{"type":"boolean","title":"Consent","description":"Set to true to give consent to MDR analysts. Setting to false will not allow us to manage your endpoints","default":true,"examples":[true,false]},"remediationType":{"type":"string","title":"Remediation type","description":"Set the type of remediation for a given site.","default":"DoItForMe","examples":["DoItForMe","Collaborate","NotifyOnly"],"enum":["DoItForMe","Collaborate","NotifyOnly"]},"product":{"type":"string","title":"Product type","description":"Set the product type, MDR or Managed Threat Hunting (MTH)","default":"mdr","examples":["mdr","mth"],"enum":["mdr","mth"]},"endpointIsolation":{"type":"boolean","title":"Endpoint Isolation","description":"Allow our MDR analysts to isolate an endpoint upon suspicious activity.","default":true,"examples":[true,false]}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"MDR site configuration payload","description":"Response payload for fetching MDR site configuration","examples":[{"mdrEnabled":true,"primaryContactId":"6263666230393563383834616534303833376361633835336465653132643431","primaryContactPhone":"(111) 111 - 5555","endpointIsolation":true,"isTrial":false,"consent":true,"remediationType":"DoItForMe","product":"mdr"}],"required":["mdrEnabled"],"properties":{"mdrEnabled":{"type":"boolean","title":"MDR enabled","description":"Enable or disable mdr environment.","examples":[true,false]},"primaryContactId":{"type":"string","title":"MDR Primary Contact Id","description":"The id of primary contact for an MDR environment.","examples":["6263666230393563383834616534303833376361633835336465653132643431"]},"primaryContactPhone":{"type":"string","title":"Primary Contact Phone number","description":"The phone number of the primary contact.","examples":["(111) 111 - 5555"]},"endpointIsolation":{"type":"boolean","title":"Endpoint Isolation","description":"Allow MDR Analysts to isolate a suspected infected endpoint.","examples":[true,false]},"isTrial":{"type":"boolean","title":"Is the subscription for the site a trial or paid.","description":"Is the environment a trial environment.","examples":[true,false]},"consent":{"type":"boolean","title":"Accept Managed Services agreement","description":"https://www.threatdown.com/legal/managed-services-agreement/.","examples":[true,false]},"remediationType":{"type":"string","title":"Remediation Type","description":"The type of remediation for the site.","examples":["DoItForMe","Collaborate","NotifyOnly","MTH / Managed Threat Hunting"]},"product":{"type":"string","title":"Product Type","description":"The type of MDR product associated with the site.","examples":["mdr","mth"]}}}}}}},"tags":["MDR"],"operationId":"api.v2.oneview.post.mdr.siteconfig.id"}},"/oneview/v1/accounts/{account_id}/syslog":{"get":{"description":"Get syslog config records by account id.","summary":"Get syslog config records.","security":[{"client_credentials":["read"]},{"user_permissions":["syslog.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"array","title":"SyslogConfigsList","items":{"type":"object","title":"SyslogConfig","additionalProperties":true,"properties":{"id":{"type":"string","title":"The Id of syslog"},"account_id":{"type":"string","title":"The account id to which this syslog config belong"},"name":{"type":"string","title":"The name of the syslog"},"host":{"type":"string","title":"Host ip"},"port":{"type":"number","title":"Host port"},"protocol":{"type":"string","title":"Protocol","enum":["TCP","UDP"]},"interval":{"type":"number","title":"Interval in minutes (5-1440)"},"format":{"type":"string","title":"Format of logs"},"severity":{"type":"number","title":"Severity of events (0-10)"},"machines":{"type":"array","title":"Array of machines","items":{"type":"object","title":"Machine object","properties":{"id":{"type":"string","title":"The Id of machine"},"enabled":{"type":"boolean","title":"Is endpoint syslog enabled"}}}}}}}}}}},"tags":["Syslog"],"operationId":"api.rmm.get.syslog"},"post":{"description":"Create new syslog config record.","summary":"Create new syslog config record.","security":[{"client_credentials":["write"]},{"user_permissions":["syslog.manage"]}],"status":{"outage":["auth"]},"parameters":[{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"SyslogCreate","additionalProperties":true,"properties":{"name":{"type":"string","title":"The name of the syslog"},"host":{"type":"string","title":"Host ip"},"port":{"type":"number","title":"Host port"},"protocol":{"type":"string","title":"Protocol","enum":["TCP","UDP"]},"interval":{"type":"number","title":"Interval in minutes (5-1440)"},"format":{"type":"string","title":"Format of logs"},"severity":{"type":"number","title":"Severity of events (0-10)"}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"SyslogConfig","additionalProperties":true,"properties":{"id":{"type":"string","title":"The Id of syslog"},"account_id":{"type":"string","title":"The account id to which this syslog config belong"},"name":{"type":"string","title":"The name of the syslog"},"host":{"type":"string","title":"Host ip"},"port":{"type":"number","title":"Host port"},"protocol":{"type":"string","title":"Protocol","enum":["TCP","UDP"]},"interval":{"type":"number","title":"Interval in minutes (5-1440)"},"format":{"type":"string","title":"Format of logs"},"severity":{"type":"number","title":"Severity of events (0-10)"},"machines":{"type":"array","title":"Array of machines","items":{"type":"object","title":"Machine object","properties":{"id":{"type":"string","title":"The Id of machine"},"enabled":{"type":"boolean","title":"Is endpoint syslog enabled"}}}}}}}}}},"tags":["Syslog"],"operationId":"api.rmm.post.syslog"}},"/oneview/v1/accounts/{account_id}/syslog/{id}":{"get":{"description":"Get syslog config record by account id and config id.","summary":"Get syslog config record by id.","security":[{"client_credentials":["read"]},{"user_permissions":["syslog.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":true,"in":"path","description":"ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"SyslogConfig","additionalProperties":true,"properties":{"id":{"type":"string","title":"The Id of syslog"},"account_id":{"type":"string","title":"The account id to which this syslog config belong"},"name":{"type":"string","title":"The name of the syslog"},"host":{"type":"string","title":"Host ip"},"port":{"type":"number","title":"Host port"},"protocol":{"type":"string","title":"Protocol","enum":["TCP","UDP"]},"interval":{"type":"number","title":"Interval in minutes (5-1440)"},"format":{"type":"string","title":"Format of logs"},"severity":{"type":"number","title":"Severity of events (0-10)"},"machines":{"type":"array","title":"Array of machines","items":{"type":"object","title":"Machine object","properties":{"id":{"type":"string","title":"The Id of machine"},"enabled":{"type":"boolean","title":"Is endpoint syslog enabled"}}}}}}}}}},"tags":["Syslog"],"operationId":"api.rmm.getbyid.syslog"},"put":{"description":"Update syslog config by account_id and config id.","summary":"Update syslog config.","security":[{"client_credentials":["write"]},{"user_permissions":["syslog.manage"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":true,"in":"path","description":"ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"SyslogUpdate","additionalProperties":true,"properties":{"id":{"type":"string","title":"The Id of syslog"},"name":{"type":"string","title":"The name of the syslog"},"host":{"type":"string","title":"Host ip"},"port":{"type":"number","title":"Host port"},"protocol":{"type":"string","title":"Protocol","enum":["TCP","UDP"]},"interval":{"type":"number","title":"Interval in minutes (5-1440)"},"format":{"type":"string","title":"Format of logs"},"severity":{"type":"number","title":"Severity of events (0-10)"}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"SyslogConfig","additionalProperties":true,"properties":{"id":{"type":"string","title":"The Id of syslog"},"account_id":{"type":"string","title":"The account id to which this syslog config belong"},"name":{"type":"string","title":"The name of the syslog"},"host":{"type":"string","title":"Host ip"},"port":{"type":"number","title":"Host port"},"protocol":{"type":"string","title":"Protocol","enum":["TCP","UDP"]},"interval":{"type":"number","title":"Interval in minutes (5-1440)"},"format":{"type":"string","title":"Format of logs"},"severity":{"type":"number","title":"Severity of events (0-10)"},"machines":{"type":"array","title":"Array of machines","items":{"type":"object","title":"Machine object","properties":{"id":{"type":"string","title":"The Id of machine"},"enabled":{"type":"boolean","title":"Is endpoint syslog enabled"}}}}}}}}}},"tags":["Syslog"],"operationId":"api.rmm.put.syslog"}},"/oneview/v1/syslog":{"post":{"description":"Search syslog configs by multiple accounts.","summary":"Search syslog configs by multiple accounts.","security":[{"client_credentials":["read"]},{"user_permissions":["syslog.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","required":["account_ids"],"properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Syslog search reponse.","properties":{"syslog":{"type":"array","title":"syslogs","items":{"type":"object","title":"SyslogConfig","additionalProperties":true,"properties":{"id":{"type":"string","title":"The Id of syslog"},"account_id":{"type":"string","title":"The account id to which this syslog config belong"},"name":{"type":"string","title":"The name of the syslog"},"host":{"type":"string","title":"Host ip"},"port":{"type":"number","title":"Host port"},"protocol":{"type":"string","title":"Protocol","enum":["TCP","UDP"]},"interval":{"type":"number","title":"Interval in minutes (5-1440)"},"format":{"type":"string","title":"Format of logs"},"severity":{"type":"number","title":"Severity of events (0-10)"},"machines":{"type":"array","title":"Array of machines","items":{"type":"object","title":"Machine object","properties":{"id":{"type":"string","title":"The Id of machine"},"enabled":{"type":"boolean","title":"Is endpoint syslog enabled"}}}}}}},"total_count":{"type":"number","title":"Total count"},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}},"additionalProperties":false}}}}},"tags":["Syslog"],"operationId":"api.rmm.post.syslog.search"}},"/oneview/v1/accounts/{account_id}/syslog/{id}/machines":{"post":{"description":"Assign syslog config machines.","summary":"Assign syslog config machines.","security":[{"client_credentials":["write"]},{"user_permissions":["syslog.manage"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":true,"in":"path","description":"ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"SyslogMachines","additionalProperties":true,"properties":{"machine_ids":{"type":"array","title":"Array of machine ids","items":{"type":"string","title":"Machine Id"}}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"SyslogConfig","additionalProperties":true,"properties":{"id":{"type":"string","title":"The Id of syslog"},"account_id":{"type":"string","title":"The account id to which this syslog config belong"},"name":{"type":"string","title":"The name of the syslog"},"host":{"type":"string","title":"Host ip"},"port":{"type":"number","title":"Host port"},"protocol":{"type":"string","title":"Protocol","enum":["TCP","UDP"]},"interval":{"type":"number","title":"Interval in minutes (5-1440)"},"format":{"type":"string","title":"Format of logs"},"severity":{"type":"number","title":"Severity of events (0-10)"},"machines":{"type":"array","title":"Array of machines","items":{"type":"object","title":"Machine object","properties":{"id":{"type":"string","title":"The Id of machine"},"enabled":{"type":"boolean","title":"Is endpoint syslog enabled"}}}}}}}}}},"tags":["Syslog"],"operationId":"api.rmm.post.syslog.machines"}},"/oneview/v1/accounts/{account_id}/syslog/{id}/machines/{machine_id}":{"post":{"description":"Set syslog machine enabled/disabled.","summary":"Set syslog machine enabled.","security":[{"client_credentials":["write"]},{"user_permissions":["syslog.manage"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":true,"in":"path","description":"Valid UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"machine_id","required":true,"in":"path","description":"Valid UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Syslog toggle machine body","properties":{"enabled":{"type":"boolean","title":"Enable syslog for machine"}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"SyslogConfig","additionalProperties":true,"properties":{"id":{"type":"string","title":"The Id of syslog"},"account_id":{"type":"string","title":"The account id to which this syslog config belong"},"name":{"type":"string","title":"The name of the syslog"},"host":{"type":"string","title":"Host ip"},"port":{"type":"number","title":"Host port"},"protocol":{"type":"string","title":"Protocol","enum":["TCP","UDP"]},"interval":{"type":"number","title":"Interval in minutes (5-1440)"},"format":{"type":"string","title":"Format of logs"},"severity":{"type":"number","title":"Severity of events (0-10)"},"machines":{"type":"array","title":"Array of machines","items":{"type":"object","title":"Machine object","properties":{"id":{"type":"string","title":"The Id of machine"},"enabled":{"type":"boolean","title":"Is endpoint syslog enabled"}}}}}}}}}},"tags":["Syslog"],"operationId":"api.rmm.nebula.post.syslog.machines.enable"}},"/oneview/v1/grid/action-logs/export":{"post":{"description":"Export action logs","summary":"Export action logs","simple_schema":"action-log-export-grid-rmm-simple","security":[{"client_credentials":["execute"]},{"user_permissions":["activityLogs.view"]}],"status":{"outage":["auth","search_stateless"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"title":"Action Log Export Schema","type":"object","allOf":[{"type":"object","title":"Base Export Schema","required":["groups","select","format"],"properties":{"format":{"type":"string","title":"The output file","enum":["csv","xlsx","html","ods","txt","rtf","json"]},"download":{"type":"boolean","title":"Whether to instruct the client to download the response as a file. Only clients like browsers are supported"},"type":{"type":"string","title":"The encoding of the output","enum":["string","base64","binary"],"default":"string"},"select":{"type":"array","title":"Which fields to select from the response","items":{"type":"object","title":"Field","required":["field","newField"],"properties":{"newField":{"type":"string","title":"the new value"},"field":{"type":"string","title":"The response field to map to a new value"}}}},"groups":{"type":"array","title":"List of queries","items":{"type":"object"}}}},{"properties":{"select":{"items":{"properties":{"field":{"type":"string","title":"Action Log Select Fields","enum":["logged_at","action_type","action_source","resource_type","resource_id","resource_name","affected_property_names","account_id","parent_account_id","account_name","machine_id","user_id","user_name","user_email","user_mode","ip_address"]}}}},"groups":{"items":{"title":"List of queries to fetch action logs","allOf":[{"type":"object","allOf":[{"type":"object","allOf":[{"properties":{"constraints":{"type":"array","items":{"title":"Action Log Constraints","type":"object","required":["field"],"anyOf":[{"title":"String (Equals, Not Equals) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"title":"Action Log String Fields","type":"string","enum":["account_name","user_name","user_email","user_mode","resource_name","affected_property_names"]},{"title":"Action Log Enum String Fields","type":"string","enum":["action_type","action_source","resource_type"]},{"title":"Action Log UID String Fields","type":"string","enum":["document_id","resource_id","account_id","parent_account_id","machine_id","user_id"]},{"title":"Action Log IP Fields","type":"string","enum":["ip_address"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["equals","not_equals"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}}},"if":{"properties":{"field":{"title":"Action Log UID String Fields","type":"string","enum":["document_id","resource_id","account_id","parent_account_id","machine_id","user_id"]}}},"then":{"properties":{"value":{"type":["string","array"],"format":"uuid","items":{"type":"string","format":"uuid"}}}}},{"title":"String (Contains, Not Contains) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"title":"Action Log String Fields","type":"string","enum":["account_name","user_name","user_email","user_mode","resource_name","affected_property_names"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["contains","not_contains"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}}}},{"title":"Date (start, end) Constraints","properties":{"field":{"oneOf":[{"title":"Action Log Date Fields","type":"string","enum":["logged_at"]}]}},"oneOf":[{"minProperties":1,"title":"Specify Date Range","not":{"anyOf":[{"required":["operator"]},{"required":["value"]}]},"properties":{"start":{"type":"string","format":"date-time","title":"Start Date"},"end":{"type":"string","format":"date-time","title":"End Date"}}},{"title":"Specify Exact Date","not":{"anyOf":[{"required":["start"]},{"required":["end"]}]},"required":["operator","value"],"properties":{"operator":{"type":"string","enum":["equals"]},"value":{"type":["string","array"],"format":"date-time","title":"Value to search","items":{"format":"date-time"}}}}]},{"title":"IP Constraints","properties":{"field":{"oneOf":[{"title":"Action Log IP Fields","type":"string","enum":["ip_address"]}]},"operator":{"type":"string","enum":["ip"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}}}},{"title":"Field Exists/Not Exists Constraints","required":["operator"],"properties":{"field":{"type":"string","oneOf":[{"title":"Action Log String Fields","type":"string","enum":["account_name","user_name","user_email","user_mode","resource_name","affected_property_names"]},{"title":"Action Log Enum String Fields","type":"string","enum":["action_type","action_source","resource_type"]},{"title":"Action Log UID String Fields","type":"string","enum":["document_id","resource_id","account_id","parent_account_id","machine_id","user_id"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["exists","not_exists"]}}}]}},"aggregations":{"items":{"type":"string","title":"Action log aggregation fields","enum":["action_type","action_source","resource_type","resource_id","resource_name","account_id","parent_account_id","account_name","machine_id","user_id","user_name","user_email","user_mode","ip_address"]}},"sort_field":{"type":"string","title":"Action Log Sort Fields","enum":["logged_at","action_type","action_source","resource_type","resource_name","account_name","user_name","user_email","user_mode","ip_address"]}}},{"type":"object","title":"Base Search Schema","properties":{"aggregations":{"type":"array","title":"The fields onto which you can perform aggregations","items":{"type":"string","title":"The Items Schema"}},"page_size":{"type":"number","title":"The page size. If you just need to aggregate, set it to 0","minimum":0,"maximum":2000},"sort_field":{"title":"Sort Fields","type":"string"},"sort_order":{"type":"string","title":"Whether sorting should be ascending or descending","enum":["asc","desc"]},"aggregate_by_account":{"type":"boolean","title":"Indicates whether aggregations should be scoped by account"},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}]},{"type":"object","required":["account_ids"],"properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]}]}}}}]}}}},"responses":{"200":{"description":"Successful response"}},"tags":["Grid"],"operationId":"api.rmm.grid.export.action-logs"}},"/oneview/v1/grid/action-logs/export/async":{"post":{"description":"Export action logs","summary":"Export action logs asynchronously","simple_schema":"action-log-export-grid-rmm-simple","security":[{"client_credentials":["execute"]},{"user_permissions":["activityLogs.view"]}],"status":{"outage":["auth","search_stateless"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"title":"Action Log Export Schema","type":"object","allOf":[{"type":"object","title":"Base Export Schema","required":["groups","select","format"],"properties":{"format":{"type":"string","title":"The output file","enum":["csv","xlsx","html","ods","txt","rtf","json"]},"download":{"type":"boolean","title":"Whether to instruct the client to download the response as a file. Only clients like browsers are supported"},"type":{"type":"string","title":"The encoding of the output","enum":["string","base64","binary"],"default":"string"},"select":{"type":"array","title":"Which fields to select from the response","items":{"type":"object","title":"Field","required":["field","newField"],"properties":{"newField":{"type":"string","title":"the new value"},"field":{"type":"string","title":"The response field to map to a new value"}}}},"groups":{"type":"array","title":"List of queries","items":{"type":"object"}}}},{"properties":{"select":{"items":{"properties":{"field":{"type":"string","title":"Action Log Select Fields","enum":["logged_at","action_type","action_source","resource_type","resource_id","resource_name","affected_property_names","account_id","parent_account_id","account_name","machine_id","user_id","user_name","user_email","user_mode","ip_address"]}}}},"groups":{"items":{"title":"List of queries to fetch action logs","allOf":[{"type":"object","allOf":[{"type":"object","allOf":[{"properties":{"constraints":{"type":"array","items":{"title":"Action Log Constraints","type":"object","required":["field"],"anyOf":[{"title":"String (Equals, Not Equals) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"title":"Action Log String Fields","type":"string","enum":["account_name","user_name","user_email","user_mode","resource_name","affected_property_names"]},{"title":"Action Log Enum String Fields","type":"string","enum":["action_type","action_source","resource_type"]},{"title":"Action Log UID String Fields","type":"string","enum":["document_id","resource_id","account_id","parent_account_id","machine_id","user_id"]},{"title":"Action Log IP Fields","type":"string","enum":["ip_address"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["equals","not_equals"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}}},"if":{"properties":{"field":{"title":"Action Log UID String Fields","type":"string","enum":["document_id","resource_id","account_id","parent_account_id","machine_id","user_id"]}}},"then":{"properties":{"value":{"type":["string","array"],"format":"uuid","items":{"type":"string","format":"uuid"}}}}},{"title":"String (Contains, Not Contains) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"title":"Action Log String Fields","type":"string","enum":["account_name","user_name","user_email","user_mode","resource_name","affected_property_names"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["contains","not_contains"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}}}},{"title":"Date (start, end) Constraints","properties":{"field":{"oneOf":[{"title":"Action Log Date Fields","type":"string","enum":["logged_at"]}]}},"oneOf":[{"minProperties":1,"title":"Specify Date Range","not":{"anyOf":[{"required":["operator"]},{"required":["value"]}]},"properties":{"start":{"type":"string","format":"date-time","title":"Start Date"},"end":{"type":"string","format":"date-time","title":"End Date"}}},{"title":"Specify Exact Date","not":{"anyOf":[{"required":["start"]},{"required":["end"]}]},"required":["operator","value"],"properties":{"operator":{"type":"string","enum":["equals"]},"value":{"type":["string","array"],"format":"date-time","title":"Value to search","items":{"format":"date-time"}}}}]},{"title":"IP Constraints","properties":{"field":{"oneOf":[{"title":"Action Log IP Fields","type":"string","enum":["ip_address"]}]},"operator":{"type":"string","enum":["ip"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}}}},{"title":"Field Exists/Not Exists Constraints","required":["operator"],"properties":{"field":{"type":"string","oneOf":[{"title":"Action Log String Fields","type":"string","enum":["account_name","user_name","user_email","user_mode","resource_name","affected_property_names"]},{"title":"Action Log Enum String Fields","type":"string","enum":["action_type","action_source","resource_type"]},{"title":"Action Log UID String Fields","type":"string","enum":["document_id","resource_id","account_id","parent_account_id","machine_id","user_id"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["exists","not_exists"]}}}]}},"aggregations":{"items":{"type":"string","title":"Action log aggregation fields","enum":["action_type","action_source","resource_type","resource_id","resource_name","account_id","parent_account_id","account_name","machine_id","user_id","user_name","user_email","user_mode","ip_address"]}},"sort_field":{"type":"string","title":"Action Log Sort Fields","enum":["logged_at","action_type","action_source","resource_type","resource_name","account_name","user_name","user_email","user_mode","ip_address"]}}},{"type":"object","title":"Base Search Schema","properties":{"aggregations":{"type":"array","title":"The fields onto which you can perform aggregations","items":{"type":"string","title":"The Items Schema"}},"page_size":{"type":"number","title":"The page size. If you just need to aggregate, set it to 0","minimum":0,"maximum":2000},"sort_field":{"title":"Sort Fields","type":"string"},"sort_order":{"type":"string","title":"Whether sorting should be ascending or descending","enum":["asc","desc"]},"aggregate_by_account":{"type":"boolean","title":"Indicates whether aggregations should be scoped by account"},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}]},{"type":"object","required":["account_ids"],"properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]}]}}}}]}}}},"responses":{"200":{"description":"Successful response"}},"tags":["Grid"],"operationId":"api.rmm.grid.export.action-logs.async"}},"/oneview/v1/grid/action-logs/search":{"post":{"description":"Search action logs","summary":"Search action logs","simple_schema":"action-log-search-grid-rmm-simple","security":[{"client_credentials":["read"]},{"user_permissions":["activityLogs.view"]}],"status":{"outage":["auth","search_stateless"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","allOf":[{"type":"object","allOf":[{"properties":{"constraints":{"type":"array","items":{"title":"Action Log Constraints","type":"object","required":["field"],"anyOf":[{"title":"String (Equals, Not Equals) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"title":"Action Log String Fields","type":"string","enum":["account_name","user_name","user_email","user_mode","resource_name","affected_property_names"]},{"title":"Action Log Enum String Fields","type":"string","enum":["action_type","action_source","resource_type"]},{"title":"Action Log UID String Fields","type":"string","enum":["document_id","resource_id","account_id","parent_account_id","machine_id","user_id"]},{"title":"Action Log IP Fields","type":"string","enum":["ip_address"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["equals","not_equals"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}}},"if":{"properties":{"field":{"title":"Action Log UID String Fields","type":"string","enum":["document_id","resource_id","account_id","parent_account_id","machine_id","user_id"]}}},"then":{"properties":{"value":{"type":["string","array"],"format":"uuid","items":{"type":"string","format":"uuid"}}}}},{"title":"String (Contains, Not Contains) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"title":"Action Log String Fields","type":"string","enum":["account_name","user_name","user_email","user_mode","resource_name","affected_property_names"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["contains","not_contains"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}}}},{"title":"Date (start, end) Constraints","properties":{"field":{"oneOf":[{"title":"Action Log Date Fields","type":"string","enum":["logged_at"]}]}},"oneOf":[{"minProperties":1,"title":"Specify Date Range","not":{"anyOf":[{"required":["operator"]},{"required":["value"]}]},"properties":{"start":{"type":"string","format":"date-time","title":"Start Date"},"end":{"type":"string","format":"date-time","title":"End Date"}}},{"title":"Specify Exact Date","not":{"anyOf":[{"required":["start"]},{"required":["end"]}]},"required":["operator","value"],"properties":{"operator":{"type":"string","enum":["equals"]},"value":{"type":["string","array"],"format":"date-time","title":"Value to search","items":{"format":"date-time"}}}}]},{"title":"IP Constraints","properties":{"field":{"oneOf":[{"title":"Action Log IP Fields","type":"string","enum":["ip_address"]}]},"operator":{"type":"string","enum":["ip"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}}}},{"title":"Field Exists/Not Exists Constraints","required":["operator"],"properties":{"field":{"type":"string","oneOf":[{"title":"Action Log String Fields","type":"string","enum":["account_name","user_name","user_email","user_mode","resource_name","affected_property_names"]},{"title":"Action Log Enum String Fields","type":"string","enum":["action_type","action_source","resource_type"]},{"title":"Action Log UID String Fields","type":"string","enum":["document_id","resource_id","account_id","parent_account_id","machine_id","user_id"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["exists","not_exists"]}}}]}},"aggregations":{"items":{"type":"string","title":"Action log aggregation fields","enum":["action_type","action_source","resource_type","resource_id","resource_name","account_id","parent_account_id","account_name","machine_id","user_id","user_name","user_email","user_mode","ip_address"]}},"sort_field":{"type":"string","title":"Action Log Sort Fields","enum":["logged_at","action_type","action_source","resource_type","resource_name","account_name","user_name","user_email","user_mode","ip_address"]}}},{"type":"object","title":"Base Search Schema","properties":{"aggregations":{"type":"array","title":"The fields onto which you can perform aggregations","items":{"type":"string","title":"The Items Schema"}},"page_size":{"type":"number","title":"The page size. If you just need to aggregate, set it to 0","minimum":0,"maximum":2000},"sort_field":{"title":"Sort Fields","type":"string"},"sort_order":{"type":"string","title":"Whether sorting should be ascending or descending","enum":["asc","desc"]},"aggregate_by_account":{"type":"boolean","title":"Indicates whether aggregations should be scoped by account"},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}]},{"type":"object","required":["account_ids"],"properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","properties":{"results":{"type":"array","title":"Action logs","items":{"type":"object","properties":{"document_id":{"type":"string","description":"Unique identifier for the action log document"},"logged_at":{"type":"string","description":"Timestamp when the action was logged"},"action_type":{"type":"string","description":"Type of the action performed"},"action_source":{"type":"string","description":"Source of the action"},"resource_type":{"type":"string","description":"Type of the resource affected by the action"},"resource_id":{"type":"array","items":{"type":"string","description":"List of resource IDs affected by the action"}},"account_id":{"type":"string","description":"Account ID"},"parent_account_id":{"type":"string","description":"Parent account ID"},"account_name":{"type":"string","description":"Account name"},"machine_id":{"type":"string","description":"Endpoint ID"},"user_id":{"type":"string","description":"User ID"},"user_name":{"type":"string","description":"User name"},"user_email":{"type":"string","description":"User email"},"user_mode":{"type":"string","description":"User mode"},"ip_address":{"type":"string","description":"IP address"},"affected_properties":{"type":"object","additionalProperties":{"type":"object","properties":{"prev_value":{},"new_value":{}}}},"affected_property_names":{"type":"array","items":{"type":"string"}},"new_resource":{"type":"object","description":"New resource state after the action"},"metadata":{"type":"object","description":"Additional metadata related to the action log"}}}},"aggregations":{"type":"object","title":"Aggregations","additionalProperties":true},"total_count":{"type":"integer","title":"Total count of found action logs"},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}}}}},"tags":["Grid"],"operationId":"api.rmm.grid.search.action-logs"}},"/oneview/v1/grid/action-logs/search-groupby":{"post":{"description":"Search grouped action logs","summary":"Search grouped action logs","simple_schema":"action-log-search-groupby-grid-rmm-simple","security":[{"client_credentials":["read"]},{"user_permissions":["activityLogs.view"]}],"status":{"outage":["auth","search_stateful"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"title":"Action Log Search Groupby Schema","type":"object","allOf":[{"type":"object","required":["group_by","page_size"],"properties":{"group_by":{"title":"Group by the following fields","type":"array","minItems":1,"uniqueItems":true,"items":{"type":"string"}},"page_size":{"type":"number","title":"The page_size Schema","minimum":50,"maximum":2000}}},{"type":"object","allOf":[{"type":"object","allOf":[{"properties":{"constraints":{"type":"array","items":{"title":"Action Log Constraints","type":"object","required":["field"],"anyOf":[{"title":"String (Equals, Not Equals) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"title":"Action Log String Fields","type":"string","enum":["account_name","user_name","user_email","user_mode","resource_name","affected_property_names"]},{"title":"Action Log Enum String Fields","type":"string","enum":["action_type","action_source","resource_type"]},{"title":"Action Log UID String Fields","type":"string","enum":["document_id","resource_id","account_id","parent_account_id","machine_id","user_id"]},{"title":"Action Log IP Fields","type":"string","enum":["ip_address"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["equals","not_equals"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}}},"if":{"properties":{"field":{"title":"Action Log UID String Fields","type":"string","enum":["document_id","resource_id","account_id","parent_account_id","machine_id","user_id"]}}},"then":{"properties":{"value":{"type":["string","array"],"format":"uuid","items":{"type":"string","format":"uuid"}}}}},{"title":"String (Contains, Not Contains) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"title":"Action Log String Fields","type":"string","enum":["account_name","user_name","user_email","user_mode","resource_name","affected_property_names"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["contains","not_contains"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}}}},{"title":"Date (start, end) Constraints","properties":{"field":{"oneOf":[{"title":"Action Log Date Fields","type":"string","enum":["logged_at"]}]}},"oneOf":[{"minProperties":1,"title":"Specify Date Range","not":{"anyOf":[{"required":["operator"]},{"required":["value"]}]},"properties":{"start":{"type":"string","format":"date-time","title":"Start Date"},"end":{"type":"string","format":"date-time","title":"End Date"}}},{"title":"Specify Exact Date","not":{"anyOf":[{"required":["start"]},{"required":["end"]}]},"required":["operator","value"],"properties":{"operator":{"type":"string","enum":["equals"]},"value":{"type":["string","array"],"format":"date-time","title":"Value to search","items":{"format":"date-time"}}}}]},{"title":"IP Constraints","properties":{"field":{"oneOf":[{"title":"Action Log IP Fields","type":"string","enum":["ip_address"]}]},"operator":{"type":"string","enum":["ip"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}}}},{"title":"Field Exists/Not Exists Constraints","required":["operator"],"properties":{"field":{"type":"string","oneOf":[{"title":"Action Log String Fields","type":"string","enum":["account_name","user_name","user_email","user_mode","resource_name","affected_property_names"]},{"title":"Action Log Enum String Fields","type":"string","enum":["action_type","action_source","resource_type"]},{"title":"Action Log UID String Fields","type":"string","enum":["document_id","resource_id","account_id","parent_account_id","machine_id","user_id"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["exists","not_exists"]}}}]}},"aggregations":{"items":{"type":"string","title":"Action log aggregation fields","enum":["action_type","action_source","resource_type","resource_id","resource_name","account_id","parent_account_id","account_name","machine_id","user_id","user_name","user_email","user_mode","ip_address"]}},"sort_field":{"type":"string","title":"Action Log Sort Fields","enum":["logged_at","action_type","action_source","resource_type","resource_name","account_name","user_name","user_email","user_mode","ip_address"]}}},{"type":"object","title":"Base Search Schema","properties":{"aggregations":{"type":"array","title":"The fields onto which you can perform aggregations","items":{"type":"string","title":"The Items Schema"}},"page_size":{"type":"number","title":"The page size. If you just need to aggregate, set it to 0","minimum":0,"maximum":2000},"sort_field":{"title":"Sort Fields","type":"string"},"sort_order":{"type":"string","title":"Whether sorting should be ascending or descending","enum":["asc","desc"]},"aggregate_by_account":{"type":"boolean","title":"Indicates whether aggregations should be scoped by account"},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}]},{"type":"object","required":["account_ids"],"properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]},{"properties":{"group_by":{"type":"array","title":"Group results by indicated field(s)","items":{"type":"string","title":"Action Log Groupby Fields","enum":["action_type","action_source","resource_type","resource_id","resource_name","account_id","parent_account_id","account_name","machine_id","user_id","user_name","user_email","user_mode","ip_address"]}}}}]}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Search Grouped Action Log Response","required":["results","next_cursor"],"properties":{"results":{"type":"array","title":"The Results Schema","default":[]},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}}}}},"tags":["Grid"],"operationId":"api.rmm.grid.search.action-logs.group"}},"/oneview/v1/grid/ai-domains/export":{"post":{"description":"Placeholder. Please extend this","summary":"Placeholder. Please extend this","deprecated":false,"security":[{"client_credentials":["execute"]},{"user_permissions":["aidr.view"]}],"status":{"outage":["auth","search_stateless"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{}}},"responses":{"200":{"description":"Successful response"}},"tags":["Grid"],"operationId":"api.rmm.grid.export.ai_domains"}},"/oneview/v1/grid/ai-domains/export/async":{"post":{"description":"Placeholder. Please extend this","summary":"Placeholder. Please extend this","deprecated":false,"security":[{"client_credentials":["execute"]},{"user_permissions":["aidr.view"]}],"status":{"outage":["auth","search_stateless"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{}}},"responses":{"200":{"description":"Successful response"}},"tags":["Grid"],"operationId":"api.rmm.grid.export.ai_domains.async"}},"/oneview/v1/grid/ai-domains/search":{"post":{"description":"Placeholder. Please extend this","summary":"Placeholder. Please extend this","deprecated":false,"security":[{"client_credentials":["read"]},{"user_permissions":["aidr.view"]}],"status":{"outage":["auth","search_stateless"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Search AI domains response","required":["results","total_count"],"properties":{"results":{"type":"array","items":{"type":"object","properties":{"machine_id":{"type":"string","title":"Machine ID"},"account_id":{"type":"string","title":"Account ID"},"group_id":{"type":"string","title":"Group ID"},"group_name":{"type":"string","title":"Group name"},"policy_id":{"type":"string","title":"Policy ID"},"policy_name":{"type":"string","title":"Policy name"},"host_name":{"type":"string","title":"Host name"},"alias":{"type":"string","title":"Machine alias"},"last_user":{"type":"string","title":"Last user"},"os_type":{"type":"string","title":"OS type"},"os_platform":{"type":"string","title":"OS platform"},"process_name":{"type":"string","title":"Process name"},"domain":{"type":"string","title":"Network domain"},"query_count":{"type":"integer","title":"Query count"},"first_seen":{"type":"string","format":"date-time","title":"First seen"},"last_seen":{"type":"string","format":"date-time","title":"Last seen"},"ai_tool_id":{"type":"string","title":"AI tool ID"},"ai_tool":{"type":"string","title":"AI tool name"},"ai_tool_provider":{"type":"string","title":"AI tool provider"},"ai_category":{"type":"string","title":"AI tool category"},"ai_status":{"type":"string","title":"AI tool disposition","enum":["authorized","unauthorized","pending"]}}}},"aggregations":{"type":"object","title":"Aggregations","additionalProperties":true},"total_count":{"type":"integer","title":"Total count of matching AI domain records"},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]},"aggregation_next_cursor":{"type":"string","title":"Opaque cursor for the next page of a paginated aggregation (machine_detail or machine_and_policy). Absent when all pages have been returned."},"endpoint_details":{"type":"object","title":"Per-endpoint enrichment. Present only when populate.machine_details is true and machine_detail is in aggregations.","additionalProperties":{"type":"object","properties":{"host_name":{"type":"string"},"alias":{"type":"string"},"last_user":{"type":"string"},"account_id":{"type":"string","format":"uuid"},"account_name":{"type":"string"},"group_id":{"type":"string"},"group_name":{"type":"string"},"policy_id":{"type":"string"},"policy_name":{"type":"string"},"site":{"type":"string"},"os_info":{"type":"object","properties":{"os_type":{"type":"string"},"os_platform":{"type":"string"}}},"device_type":{"type":"string"},"installed_ai_tools":{"type":"array","title":"AI tools currently installed on this endpoint from the software inventory.","items":{"type":"string"}}}}}}}}}}},"tags":["Grid"],"operationId":"api.rmm.grid.search.ai_domains"}},"/oneview/v1/grid/ai-domains/search-groupby":{"post":{"description":"Placeholder. Please extend this","summary":"Placeholder. Please extend this","deprecated":false,"security":[{"client_credentials":["read"]},{"user_permissions":["aidr.view"]}],"status":{"incident":["read_nebula_data"],"outage":["auth","search_stateful"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Group AI domains response","required":["results","next_cursor"],"properties":{"results":{"type":"array","title":"The Results Schema","default":[]},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}}}}},"tags":["Grid"],"operationId":"api.rmm.grid.search.ai_domains.group"}},"/oneview/v1/grid/assets/software/export":{"post":{"description":"Export software assets across accounts","summary":"Export software assets","simple_schema":"asset-export-grid-rmm-simple","security":[{"client_credentials":["execute"]},{"user_permissions":["softwareInventory.view"]}],"status":{"outage":["auth","search_stateless"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"title":"Asset Export Schema RMM","type":"object","allOf":[{"type":"object","title":"Base Export Schema","required":["groups","select","format"],"properties":{"format":{"type":"string","title":"The output file","enum":["csv","xlsx","html","ods","txt","rtf","json"]},"download":{"type":"boolean","title":"Whether to instruct the client to download the response as a file. Only clients like browsers are supported"},"type":{"type":"string","title":"The encoding of the output","enum":["string","base64","binary"],"default":"string"},"select":{"type":"array","title":"Which fields to select from the response","items":{"type":"object","title":"Field","required":["field","newField"],"properties":{"newField":{"type":"string","title":"the new value"},"field":{"type":"string","title":"The response field to map to a new value"}}}},"groups":{"type":"array","title":"List of queries","items":{"type":"object"}}}},{"properties":{"select":{"items":{"properties":{"field":{"type":"string","title":"Asset select fields","enum":["account_id","parent_account_id","group_id","root_group_id","machine_id","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","installed_version","normalized_installed_version","display_installed_version","installation_date","account_name","host_name","fully_qualified_host_name","alias","created_at","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","group_name","object_guid","latest_version_available","cves","cves_by_status.unknown","cves_by_status.low","cves_by_status.medium","cves_by_status.high","cves_by_status.critical","cves_score","cves_count","cves_count_by_status.unknown","cves_count_by_status.low","cves_count_by_status.medium","cves_count_by_status.high","cves_count_by_status.critical","language","architecture","product_signature","categories","supports_update","supports_uninstall","update_available","online","active_directory.user.display_name","active_directory.user.distinguished_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.machine.display_name","active_directory.machine.distinguished_name","active_directory.machine.sam_account_name","active_directory.machine.ou","domain_name","ignored_until"]}}}},"groups":{"items":{"title":"List of queries to fetch dns activity","allOf":[{"type":"object","allOf":[{"type":"object","allOf":[{"properties":{"constraints":{"type":"array","items":{"title":"Asset Constraints","type":"object","required":["field"],"anyOf":[{"title":"String (Equals, Not Equals) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"title":"Assets Simple String Fields","type":"string","enum":["account_name","group_name","host_name","fully_qualified_host_name","domain_name","alias","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","installed_version","normalized_installed_version","display_installed_version","latest_version_available","os_info.os_version","os_info.os_release_name","cves","cves_by_status.unknown","cves_by_status.low","cves_by_status.medium","cves_by_status.high","cves_by_status.critical","architecture","active_directory.user.display_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.user.ou.path","active_directory.machine.display_name","active_directory.machine.sam_account_name","active_directory.machine.ou","active_directory.machine.ou.path","document_id","ai_tool"]},{"title":"Assets Enum String Fields","type":"string","enum":["os_info.os_type","os_info.os_platform","os_info.os_architecture","language","ai_category","ai_risk","ai_status"]},{"title":"Assets UID String Fields","type":"string","enum":["account_id","parent_account_id","group_id","root_group_id","machine_id","object_guid"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["equals","not_equals"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}}},"if":{"properties":{"field":{"title":"Assets UID String Fields","type":"string","enum":["account_id","parent_account_id","group_id","root_group_id","machine_id","object_guid"]}}},"then":{"properties":{"value":{"type":["string","array"],"format":"uuid","items":{"type":"string","format":"uuid"}}}}},{"title":"String (Contains, Not Contains) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"title":"Assets Simple String Fields","type":"string","enum":["account_name","group_name","host_name","fully_qualified_host_name","domain_name","alias","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","installed_version","normalized_installed_version","display_installed_version","latest_version_available","os_info.os_version","os_info.os_release_name","cves","cves_by_status.unknown","cves_by_status.low","cves_by_status.medium","cves_by_status.high","cves_by_status.critical","architecture","active_directory.user.display_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.user.ou.path","active_directory.machine.display_name","active_directory.machine.sam_account_name","active_directory.machine.ou","active_directory.machine.ou.path","document_id","ai_tool"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["contains","not_contains"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}}}},{"title":"Boolean (Equals) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"title":"Assets boolean fields","type":"string","enum":["supports_update","supports_uninstall","update_available"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["equals"]},"value":{"title":"Value to search. Must be true or false","type":"boolean"}}},{"title":"Number Constraints (gt, gte, lt, lte, equals)","properties":{"field":{"type":"string","oneOf":[{"title":"Assets Number Fields","type":"string","enum":["cves_score","cves_count","product_signature","categories","cves_count_by_status.unknown","cves_count_by_status.low","cves_count_by_status.medium","cves_count_by_status.high","cves_count_by_status.critical"]}]}},"oneOf":[{"minProperties":1,"title":"Specify Number Range","not":{"anyOf":[{"required":["operator"]},{"required":["value"]}]},"properties":{"gt":{"type":"number","title":"Greater than"},"lt":{"type":"number","title":"Less than"},"gte":{"type":"number","title":"Greater than or equals"},"lte":{"type":"number","title":"Less than or equals"}}},{"title":"Specify Exact Number","not":{"anyOf":[{"required":["gt"]},{"required":["lt"]},{"required":["gte"]},{"required":["lte"]}]},"required":["operator","value"],"properties":{"operator":{"type":"string","enum":["equals"]},"value":{"type":["number","array"],"title":"Value to search","items":{"type":"number"}}}}]},{"title":"Date (start, end) Constraints","properties":{"field":{"oneOf":[{"title":"Assets Date Fields","type":"string","enum":["installation_date","created_at","ignored_until"]}]}},"oneOf":[{"minProperties":1,"title":"Specify Date Range","not":{"anyOf":[{"required":["operator"]},{"required":["value"]}]},"properties":{"start":{"type":"string","format":"date-time","title":"Start Date"},"end":{"type":"string","format":"date-time","title":"End Date"}}},{"title":"Specify Exact Date","not":{"anyOf":[{"required":["start"]},{"required":["end"]}]},"required":["operator","value"],"properties":{"operator":{"type":"string","enum":["equals"]},"value":{"type":["string","array"],"format":"date-time","title":"Value to search","items":{"format":"date-time"}}}}]},{"title":"Field Exists/Not Exists Constraints","required":["operator"],"properties":{"field":{"type":"string","oneOf":[{"title":"Assets Simple String Fields","type":"string","enum":["account_name","group_name","host_name","fully_qualified_host_name","domain_name","alias","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","installed_version","normalized_installed_version","display_installed_version","latest_version_available","os_info.os_version","os_info.os_release_name","cves","cves_by_status.unknown","cves_by_status.low","cves_by_status.medium","cves_by_status.high","cves_by_status.critical","architecture","active_directory.user.display_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.user.ou.path","active_directory.machine.display_name","active_directory.machine.sam_account_name","active_directory.machine.ou","active_directory.machine.ou.path","document_id","ai_tool"]},{"title":"Assets Enum String Fields","type":"string","enum":["os_info.os_type","os_info.os_platform","os_info.os_architecture","language","ai_category","ai_risk","ai_status"]},{"title":"Assets UID String Fields","type":"string","enum":["account_id","parent_account_id","group_id","root_group_id","machine_id","object_guid"]},{"title":"Assets Date Fields","type":"string","enum":["installation_date","created_at","ignored_until"]},{"title":"Assets Number Fields","type":"string","enum":["cves_score","cves_count","product_signature","categories","cves_count_by_status.unknown","cves_count_by_status.low","cves_count_by_status.medium","cves_count_by_status.high","cves_count_by_status.critical"]},{"title":"Assets boolean fields","type":"string","enum":["supports_update","supports_uninstall","update_available"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["exists","not_exists"]}}}]},"examples":[[{"field":"account_name","value":"Test Account","operator":"equals"}]]},"aggregations":{"items":{"type":"string","title":"Asset aggregation fields","enum":["account_id","parent_account_id","group_id","root_group_id","machine_id","host_name","fully_qualified_host_name","alias","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","installed_version","normalized_installed_version","display_installed_version","object_guid","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","latest_version_available","cves","cves_by_status.unknown","cves_by_status.low","cves_by_status.medium","cves_by_status.high","cves_by_status.critical","ai_tool","ai_category","ai_status","machine","machines","machine_ai_tool"]}},"sort_field":{"type":"string","title":"Asset sort fields","enum":["account_id","parent_account_id","group_id","root_group_id","machine_id","account_name","host_name","fully_qualified_host_name","alias","name_multi_search","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","installed_version","normalized_installed_version","display_installed_version","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","installation_date","created_at","object_guid","latest_version_available","cves","cves_by_status.unknown","cves_by_status.low","cves_by_status.medium","cves_by_status.high","cves_by_status.critical","cves_score","cves_count","cves_count_by_status.unknown","cves_count_by_status.low","cves_count_by_status.medium","cves_count_by_status.high","cves_count_by_status.critical","language","architecture","product_signature","categories","supports_update","supports_uninstall","update_available","active_directory.user.display_name","active_directory.user.ou","active_directory.user.sam_account_name","active_directory.machine.display_name","active_directory.machine.ou","active_directory.machine.sam_account_name","ignored_until","ai_tool","ai_category","ai_risk","ai_status"]}}},{"type":"object","title":"Base Search Schema","properties":{"aggregations":{"type":"array","title":"The fields onto which you can perform aggregations","items":{"type":"string","title":"The Items Schema"}},"page_size":{"type":"number","title":"The page size. If you just need to aggregate, set it to 0","minimum":0,"maximum":2000},"sort_field":{"title":"Sort Fields","type":"string"},"sort_order":{"type":"string","title":"Whether sorting should be ascending or descending","enum":["asc","desc"]},"aggregate_by_account":{"type":"boolean","title":"Indicates whether aggregations should be scoped by account"},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}]},{"type":"object","required":["account_ids"],"properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]}]}}}}]}}}},"responses":{"200":{"description":"Successful response"}},"tags":["Grid"],"operationId":"api.rmm.grid.export.assets.software"}},"/oneview/v1/grid/assets/software/export/async":{"post":{"description":"Export software assets across accounts","summary":"Export software assets asynchronously","simple_schema":"asset-export-grid-rmm-simple","security":[{"client_credentials":["execute"]},{"user_permissions":["softwareInventory.view"]}],"status":{"outage":["auth","search_stateless"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"title":"Asset Export Schema RMM","type":"object","allOf":[{"type":"object","title":"Base Export Schema","required":["groups","select","format"],"properties":{"format":{"type":"string","title":"The output file","enum":["csv","xlsx","html","ods","txt","rtf","json"]},"download":{"type":"boolean","title":"Whether to instruct the client to download the response as a file. Only clients like browsers are supported"},"type":{"type":"string","title":"The encoding of the output","enum":["string","base64","binary"],"default":"string"},"select":{"type":"array","title":"Which fields to select from the response","items":{"type":"object","title":"Field","required":["field","newField"],"properties":{"newField":{"type":"string","title":"the new value"},"field":{"type":"string","title":"The response field to map to a new value"}}}},"groups":{"type":"array","title":"List of queries","items":{"type":"object"}}}},{"properties":{"select":{"items":{"properties":{"field":{"type":"string","title":"Asset select fields","enum":["account_id","parent_account_id","group_id","root_group_id","machine_id","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","installed_version","normalized_installed_version","display_installed_version","installation_date","account_name","host_name","fully_qualified_host_name","alias","created_at","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","group_name","object_guid","latest_version_available","cves","cves_by_status.unknown","cves_by_status.low","cves_by_status.medium","cves_by_status.high","cves_by_status.critical","cves_score","cves_count","cves_count_by_status.unknown","cves_count_by_status.low","cves_count_by_status.medium","cves_count_by_status.high","cves_count_by_status.critical","language","architecture","product_signature","categories","supports_update","supports_uninstall","update_available","online","active_directory.user.display_name","active_directory.user.distinguished_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.machine.display_name","active_directory.machine.distinguished_name","active_directory.machine.sam_account_name","active_directory.machine.ou","domain_name","ignored_until"]}}}},"groups":{"items":{"title":"List of queries to fetch dns activity","allOf":[{"type":"object","allOf":[{"type":"object","allOf":[{"properties":{"constraints":{"type":"array","items":{"title":"Asset Constraints","type":"object","required":["field"],"anyOf":[{"title":"String (Equals, Not Equals) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"title":"Assets Simple String Fields","type":"string","enum":["account_name","group_name","host_name","fully_qualified_host_name","domain_name","alias","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","installed_version","normalized_installed_version","display_installed_version","latest_version_available","os_info.os_version","os_info.os_release_name","cves","cves_by_status.unknown","cves_by_status.low","cves_by_status.medium","cves_by_status.high","cves_by_status.critical","architecture","active_directory.user.display_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.user.ou.path","active_directory.machine.display_name","active_directory.machine.sam_account_name","active_directory.machine.ou","active_directory.machine.ou.path","document_id","ai_tool"]},{"title":"Assets Enum String Fields","type":"string","enum":["os_info.os_type","os_info.os_platform","os_info.os_architecture","language","ai_category","ai_risk","ai_status"]},{"title":"Assets UID String Fields","type":"string","enum":["account_id","parent_account_id","group_id","root_group_id","machine_id","object_guid"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["equals","not_equals"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}}},"if":{"properties":{"field":{"title":"Assets UID String Fields","type":"string","enum":["account_id","parent_account_id","group_id","root_group_id","machine_id","object_guid"]}}},"then":{"properties":{"value":{"type":["string","array"],"format":"uuid","items":{"type":"string","format":"uuid"}}}}},{"title":"String (Contains, Not Contains) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"title":"Assets Simple String Fields","type":"string","enum":["account_name","group_name","host_name","fully_qualified_host_name","domain_name","alias","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","installed_version","normalized_installed_version","display_installed_version","latest_version_available","os_info.os_version","os_info.os_release_name","cves","cves_by_status.unknown","cves_by_status.low","cves_by_status.medium","cves_by_status.high","cves_by_status.critical","architecture","active_directory.user.display_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.user.ou.path","active_directory.machine.display_name","active_directory.machine.sam_account_name","active_directory.machine.ou","active_directory.machine.ou.path","document_id","ai_tool"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["contains","not_contains"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}}}},{"title":"Boolean (Equals) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"title":"Assets boolean fields","type":"string","enum":["supports_update","supports_uninstall","update_available"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["equals"]},"value":{"title":"Value to search. Must be true or false","type":"boolean"}}},{"title":"Number Constraints (gt, gte, lt, lte, equals)","properties":{"field":{"type":"string","oneOf":[{"title":"Assets Number Fields","type":"string","enum":["cves_score","cves_count","product_signature","categories","cves_count_by_status.unknown","cves_count_by_status.low","cves_count_by_status.medium","cves_count_by_status.high","cves_count_by_status.critical"]}]}},"oneOf":[{"minProperties":1,"title":"Specify Number Range","not":{"anyOf":[{"required":["operator"]},{"required":["value"]}]},"properties":{"gt":{"type":"number","title":"Greater than"},"lt":{"type":"number","title":"Less than"},"gte":{"type":"number","title":"Greater than or equals"},"lte":{"type":"number","title":"Less than or equals"}}},{"title":"Specify Exact Number","not":{"anyOf":[{"required":["gt"]},{"required":["lt"]},{"required":["gte"]},{"required":["lte"]}]},"required":["operator","value"],"properties":{"operator":{"type":"string","enum":["equals"]},"value":{"type":["number","array"],"title":"Value to search","items":{"type":"number"}}}}]},{"title":"Date (start, end) Constraints","properties":{"field":{"oneOf":[{"title":"Assets Date Fields","type":"string","enum":["installation_date","created_at","ignored_until"]}]}},"oneOf":[{"minProperties":1,"title":"Specify Date Range","not":{"anyOf":[{"required":["operator"]},{"required":["value"]}]},"properties":{"start":{"type":"string","format":"date-time","title":"Start Date"},"end":{"type":"string","format":"date-time","title":"End Date"}}},{"title":"Specify Exact Date","not":{"anyOf":[{"required":["start"]},{"required":["end"]}]},"required":["operator","value"],"properties":{"operator":{"type":"string","enum":["equals"]},"value":{"type":["string","array"],"format":"date-time","title":"Value to search","items":{"format":"date-time"}}}}]},{"title":"Field Exists/Not Exists Constraints","required":["operator"],"properties":{"field":{"type":"string","oneOf":[{"title":"Assets Simple String Fields","type":"string","enum":["account_name","group_name","host_name","fully_qualified_host_name","domain_name","alias","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","installed_version","normalized_installed_version","display_installed_version","latest_version_available","os_info.os_version","os_info.os_release_name","cves","cves_by_status.unknown","cves_by_status.low","cves_by_status.medium","cves_by_status.high","cves_by_status.critical","architecture","active_directory.user.display_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.user.ou.path","active_directory.machine.display_name","active_directory.machine.sam_account_name","active_directory.machine.ou","active_directory.machine.ou.path","document_id","ai_tool"]},{"title":"Assets Enum String Fields","type":"string","enum":["os_info.os_type","os_info.os_platform","os_info.os_architecture","language","ai_category","ai_risk","ai_status"]},{"title":"Assets UID String Fields","type":"string","enum":["account_id","parent_account_id","group_id","root_group_id","machine_id","object_guid"]},{"title":"Assets Date Fields","type":"string","enum":["installation_date","created_at","ignored_until"]},{"title":"Assets Number Fields","type":"string","enum":["cves_score","cves_count","product_signature","categories","cves_count_by_status.unknown","cves_count_by_status.low","cves_count_by_status.medium","cves_count_by_status.high","cves_count_by_status.critical"]},{"title":"Assets boolean fields","type":"string","enum":["supports_update","supports_uninstall","update_available"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["exists","not_exists"]}}}]},"examples":[[{"field":"account_name","value":"Test Account","operator":"equals"}]]},"aggregations":{"items":{"type":"string","title":"Asset aggregation fields","enum":["account_id","parent_account_id","group_id","root_group_id","machine_id","host_name","fully_qualified_host_name","alias","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","installed_version","normalized_installed_version","display_installed_version","object_guid","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","latest_version_available","cves","cves_by_status.unknown","cves_by_status.low","cves_by_status.medium","cves_by_status.high","cves_by_status.critical","ai_tool","ai_category","ai_status","machine","machines","machine_ai_tool"]}},"sort_field":{"type":"string","title":"Asset sort fields","enum":["account_id","parent_account_id","group_id","root_group_id","machine_id","account_name","host_name","fully_qualified_host_name","alias","name_multi_search","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","installed_version","normalized_installed_version","display_installed_version","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","installation_date","created_at","object_guid","latest_version_available","cves","cves_by_status.unknown","cves_by_status.low","cves_by_status.medium","cves_by_status.high","cves_by_status.critical","cves_score","cves_count","cves_count_by_status.unknown","cves_count_by_status.low","cves_count_by_status.medium","cves_count_by_status.high","cves_count_by_status.critical","language","architecture","product_signature","categories","supports_update","supports_uninstall","update_available","active_directory.user.display_name","active_directory.user.ou","active_directory.user.sam_account_name","active_directory.machine.display_name","active_directory.machine.ou","active_directory.machine.sam_account_name","ignored_until","ai_tool","ai_category","ai_risk","ai_status"]}}},{"type":"object","title":"Base Search Schema","properties":{"aggregations":{"type":"array","title":"The fields onto which you can perform aggregations","items":{"type":"string","title":"The Items Schema"}},"page_size":{"type":"number","title":"The page size. If you just need to aggregate, set it to 0","minimum":0,"maximum":2000},"sort_field":{"title":"Sort Fields","type":"string"},"sort_order":{"type":"string","title":"Whether sorting should be ascending or descending","enum":["asc","desc"]},"aggregate_by_account":{"type":"boolean","title":"Indicates whether aggregations should be scoped by account"},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}]},{"type":"object","required":["account_ids"],"properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]}]}}}}]}}}},"responses":{"200":{"description":"Successful response"}},"tags":["Grid"],"operationId":"api.rmm.grid.export.assets.software.async"}},"/oneview/v1/grid/assets/software/search":{"post":{"description":"Search software assets across accounts","summary":"Search software assets","simple_schema":"asset-search-grid-rmm-simple","security":[{"client_credentials":["read"]},{"user_permissions":["softwareInventory.view"]}],"status":{"outage":["auth","search_stateless"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","allOf":[{"type":"object","allOf":[{"properties":{"constraints":{"type":"array","items":{"title":"Asset Constraints","type":"object","required":["field"],"anyOf":[{"title":"String (Equals, Not Equals) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"title":"Assets Simple String Fields","type":"string","enum":["account_name","group_name","host_name","fully_qualified_host_name","domain_name","alias","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","installed_version","normalized_installed_version","display_installed_version","latest_version_available","os_info.os_version","os_info.os_release_name","cves","cves_by_status.unknown","cves_by_status.low","cves_by_status.medium","cves_by_status.high","cves_by_status.critical","architecture","active_directory.user.display_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.user.ou.path","active_directory.machine.display_name","active_directory.machine.sam_account_name","active_directory.machine.ou","active_directory.machine.ou.path","document_id","ai_tool"]},{"title":"Assets Enum String Fields","type":"string","enum":["os_info.os_type","os_info.os_platform","os_info.os_architecture","language","ai_category","ai_risk","ai_status"]},{"title":"Assets UID String Fields","type":"string","enum":["account_id","parent_account_id","group_id","root_group_id","machine_id","object_guid"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["equals","not_equals"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}}},"if":{"properties":{"field":{"title":"Assets UID String Fields","type":"string","enum":["account_id","parent_account_id","group_id","root_group_id","machine_id","object_guid"]}}},"then":{"properties":{"value":{"type":["string","array"],"format":"uuid","items":{"type":"string","format":"uuid"}}}}},{"title":"String (Contains, Not Contains) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"title":"Assets Simple String Fields","type":"string","enum":["account_name","group_name","host_name","fully_qualified_host_name","domain_name","alias","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","installed_version","normalized_installed_version","display_installed_version","latest_version_available","os_info.os_version","os_info.os_release_name","cves","cves_by_status.unknown","cves_by_status.low","cves_by_status.medium","cves_by_status.high","cves_by_status.critical","architecture","active_directory.user.display_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.user.ou.path","active_directory.machine.display_name","active_directory.machine.sam_account_name","active_directory.machine.ou","active_directory.machine.ou.path","document_id","ai_tool"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["contains","not_contains"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}}}},{"title":"Boolean (Equals) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"title":"Assets boolean fields","type":"string","enum":["supports_update","supports_uninstall","update_available"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["equals"]},"value":{"title":"Value to search. Must be true or false","type":"boolean"}}},{"title":"Number Constraints (gt, gte, lt, lte, equals)","properties":{"field":{"type":"string","oneOf":[{"title":"Assets Number Fields","type":"string","enum":["cves_score","cves_count","product_signature","categories","cves_count_by_status.unknown","cves_count_by_status.low","cves_count_by_status.medium","cves_count_by_status.high","cves_count_by_status.critical"]}]}},"oneOf":[{"minProperties":1,"title":"Specify Number Range","not":{"anyOf":[{"required":["operator"]},{"required":["value"]}]},"properties":{"gt":{"type":"number","title":"Greater than"},"lt":{"type":"number","title":"Less than"},"gte":{"type":"number","title":"Greater than or equals"},"lte":{"type":"number","title":"Less than or equals"}}},{"title":"Specify Exact Number","not":{"anyOf":[{"required":["gt"]},{"required":["lt"]},{"required":["gte"]},{"required":["lte"]}]},"required":["operator","value"],"properties":{"operator":{"type":"string","enum":["equals"]},"value":{"type":["number","array"],"title":"Value to search","items":{"type":"number"}}}}]},{"title":"Date (start, end) Constraints","properties":{"field":{"oneOf":[{"title":"Assets Date Fields","type":"string","enum":["installation_date","created_at","ignored_until"]}]}},"oneOf":[{"minProperties":1,"title":"Specify Date Range","not":{"anyOf":[{"required":["operator"]},{"required":["value"]}]},"properties":{"start":{"type":"string","format":"date-time","title":"Start Date"},"end":{"type":"string","format":"date-time","title":"End Date"}}},{"title":"Specify Exact Date","not":{"anyOf":[{"required":["start"]},{"required":["end"]}]},"required":["operator","value"],"properties":{"operator":{"type":"string","enum":["equals"]},"value":{"type":["string","array"],"format":"date-time","title":"Value to search","items":{"format":"date-time"}}}}]},{"title":"Field Exists/Not Exists Constraints","required":["operator"],"properties":{"field":{"type":"string","oneOf":[{"title":"Assets Simple String Fields","type":"string","enum":["account_name","group_name","host_name","fully_qualified_host_name","domain_name","alias","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","installed_version","normalized_installed_version","display_installed_version","latest_version_available","os_info.os_version","os_info.os_release_name","cves","cves_by_status.unknown","cves_by_status.low","cves_by_status.medium","cves_by_status.high","cves_by_status.critical","architecture","active_directory.user.display_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.user.ou.path","active_directory.machine.display_name","active_directory.machine.sam_account_name","active_directory.machine.ou","active_directory.machine.ou.path","document_id","ai_tool"]},{"title":"Assets Enum String Fields","type":"string","enum":["os_info.os_type","os_info.os_platform","os_info.os_architecture","language","ai_category","ai_risk","ai_status"]},{"title":"Assets UID String Fields","type":"string","enum":["account_id","parent_account_id","group_id","root_group_id","machine_id","object_guid"]},{"title":"Assets Date Fields","type":"string","enum":["installation_date","created_at","ignored_until"]},{"title":"Assets Number Fields","type":"string","enum":["cves_score","cves_count","product_signature","categories","cves_count_by_status.unknown","cves_count_by_status.low","cves_count_by_status.medium","cves_count_by_status.high","cves_count_by_status.critical"]},{"title":"Assets boolean fields","type":"string","enum":["supports_update","supports_uninstall","update_available"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["exists","not_exists"]}}}]},"examples":[[{"field":"account_name","value":"Test Account","operator":"equals"}]]},"aggregations":{"items":{"type":"string","title":"Asset aggregation fields","enum":["account_id","parent_account_id","group_id","root_group_id","machine_id","host_name","fully_qualified_host_name","alias","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","installed_version","normalized_installed_version","display_installed_version","object_guid","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","latest_version_available","cves","cves_by_status.unknown","cves_by_status.low","cves_by_status.medium","cves_by_status.high","cves_by_status.critical","ai_tool","ai_category","ai_status","machine","machines","machine_ai_tool"]}},"sort_field":{"type":"string","title":"Asset sort fields","enum":["account_id","parent_account_id","group_id","root_group_id","machine_id","account_name","host_name","fully_qualified_host_name","alias","name_multi_search","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","installed_version","normalized_installed_version","display_installed_version","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","installation_date","created_at","object_guid","latest_version_available","cves","cves_by_status.unknown","cves_by_status.low","cves_by_status.medium","cves_by_status.high","cves_by_status.critical","cves_score","cves_count","cves_count_by_status.unknown","cves_count_by_status.low","cves_count_by_status.medium","cves_count_by_status.high","cves_count_by_status.critical","language","architecture","product_signature","categories","supports_update","supports_uninstall","update_available","active_directory.user.display_name","active_directory.user.ou","active_directory.user.sam_account_name","active_directory.machine.display_name","active_directory.machine.ou","active_directory.machine.sam_account_name","ignored_until","ai_tool","ai_category","ai_risk","ai_status"]}}},{"type":"object","title":"Base Search Schema","properties":{"aggregations":{"type":"array","title":"The fields onto which you can perform aggregations","items":{"type":"string","title":"The Items Schema"}},"page_size":{"type":"number","title":"The page size. If you just need to aggregate, set it to 0","minimum":0,"maximum":2000},"sort_field":{"title":"Sort Fields","type":"string"},"sort_order":{"type":"string","title":"Whether sorting should be ascending or descending","enum":["asc","desc"]},"aggregate_by_account":{"type":"boolean","title":"Indicates whether aggregations should be scoped by account"},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}]},{"type":"object","required":["account_ids"],"properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Search assets software result","properties":{"assets":{"type":"array","items":{"properties":{"account_id":{"type":"string"},"parent_account_id":{"type":"string"},"group_id":{"type":"string"},"root_group_id":{"type":"string"},"machine_id":{"type":"string"},"vendor":{"type":"string"},"normalized_vendor":{"type":"string"},"display_vendor":{"type":"string"},"product":{"type":"string"},"normalized_product":{"type":"string"},"display_product":{"type":"string"},"installed_version":{"type":"string"},"normalized_installed_version":{"type":"string"},"display_installed_version":{"type":"string"},"installation_date":{"type":"string"},"language":{"type":"string"},"architecture":{"type":"string"},"product_signature":{"type":"integer"},"categories":{"type":"array","items":{"type":"integer"}},"account_name":{"type":"string"},"host_name":{"type":"string"},"fully_qualified_host_name":{"type":"string"},"domain_name":{"type":"string"},"alias":{"type":"string"},"created_at":{"type":"string"},"object_guid":{"type":"string"},"os_info":{"properties":{"os_type":{"type":"string"},"os_version":{"type":"string"},"os_platform":{"type":"string"},"os_architecture":{"type":"string"},"os_release_name":{"type":"string"}}},"group_name":{"type":"string"},"policy_id":{"type":"string"},"policy_name":{"type":"string"},"cves":{"type":"array","items":{"type":"string"}},"cves_count":{"type":"integer"},"cves_score":{"type":"number"},"cves_by_status":{"properties":{"none":{"type":"array","items":{"type":"string"}},"low":{"type":"array","items":{"type":"string"}},"medium":{"type":"array","items":{"type":"string"}},"high":{"type":"array","items":{"type":"string"}},"critical":{"type":"array","items":{"type":"string"}}}},"cves_count_by_status":{"properties":{"none":{"type":"integer"},"low":{"type":"integer"},"medium":{"type":"integer"},"high":{"type":"integer"},"critical":{"type":"integer"}}},"latest_version_available":{"type":"string"},"ignored_until":{"type":"string","format":"date-time"},"ignore_rule_ids":{"type":"array","items":{"type":"string","format":"uuid"}},"active_directory":{"type":"object","patternProperties":{"^(user|machine)$":{"type":"object","properties":{"display_name":{"type":"string"},"distinguished_name":{"type":"string"},"sam_account_name":{"type":"string"},"ou":{"type":"string"}}}}},"ai_tool":{"type":["string","null"],"title":"Canonical AI tool name. null if not an AI tool."},"ai_category":{"type":["string","null"],"title":"AI tool category, e.g. \"AI Assistant\", \"AI Code Tool\"."},"ai_risk":{"type":["string","null"],"title":"Risk level from the AI whitelist.","enum":["Low","Medium","High",null]},"ai_tier":{"type":["string","null"],"title":"Confidence/tier from the AI whitelist."},"ai_flags":{"type":"array","title":"Zero or more AI whitelist flags, e.g. \"browser_access\", \"local_llm_execution\".","items":{"type":"string"}},"ai_status":{"type":["string","null"],"title":"Effective governance status resolved from AIDR rules. null when ai_tool is null.","enum":["authorized","unauthorized","pending",null]}}}},"aggregations":{"type":"object","title":"Aggregations","additionalProperties":true},"total_count":{"type":"integer","title":"Total count of found detections"},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}},"required":["assets","total_count"]}}}}},"tags":["Grid"],"operationId":"api.rmm.grid.search.assets.software"}},"/oneview/v1/grid/assets/software/search-groupby":{"post":{"description":"Search grouped software assets across accounts","summary":"Search grouped software assets","simple_schema":"asset-search-groupby-grid-rmm-simple","security":[{"client_credentials":["read"]},{"user_permissions":["softwareInventory.view"]}],"status":{"incident":["read_nebula_data"],"outage":["auth","search_stateful"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"title":"Asset Search Groupby Schema","type":"object","allOf":[{"type":"object","required":["group_by","page_size"],"properties":{"group_by":{"title":"Group by the following fields","type":"array","minItems":1,"uniqueItems":true,"items":{"type":"string"}},"page_size":{"type":"number","title":"The page_size Schema","minimum":50,"maximum":2000}}},{"type":"object","allOf":[{"type":"object","allOf":[{"properties":{"constraints":{"type":"array","items":{"title":"Asset Constraints","type":"object","required":["field"],"anyOf":[{"title":"String (Equals, Not Equals) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"title":"Assets Simple String Fields","type":"string","enum":["account_name","group_name","host_name","fully_qualified_host_name","domain_name","alias","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","installed_version","normalized_installed_version","display_installed_version","latest_version_available","os_info.os_version","os_info.os_release_name","cves","cves_by_status.unknown","cves_by_status.low","cves_by_status.medium","cves_by_status.high","cves_by_status.critical","architecture","active_directory.user.display_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.user.ou.path","active_directory.machine.display_name","active_directory.machine.sam_account_name","active_directory.machine.ou","active_directory.machine.ou.path","document_id","ai_tool"]},{"title":"Assets Enum String Fields","type":"string","enum":["os_info.os_type","os_info.os_platform","os_info.os_architecture","language","ai_category","ai_risk","ai_status"]},{"title":"Assets UID String Fields","type":"string","enum":["account_id","parent_account_id","group_id","root_group_id","machine_id","object_guid"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["equals","not_equals"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}}},"if":{"properties":{"field":{"title":"Assets UID String Fields","type":"string","enum":["account_id","parent_account_id","group_id","root_group_id","machine_id","object_guid"]}}},"then":{"properties":{"value":{"type":["string","array"],"format":"uuid","items":{"type":"string","format":"uuid"}}}}},{"title":"String (Contains, Not Contains) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"title":"Assets Simple String Fields","type":"string","enum":["account_name","group_name","host_name","fully_qualified_host_name","domain_name","alias","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","installed_version","normalized_installed_version","display_installed_version","latest_version_available","os_info.os_version","os_info.os_release_name","cves","cves_by_status.unknown","cves_by_status.low","cves_by_status.medium","cves_by_status.high","cves_by_status.critical","architecture","active_directory.user.display_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.user.ou.path","active_directory.machine.display_name","active_directory.machine.sam_account_name","active_directory.machine.ou","active_directory.machine.ou.path","document_id","ai_tool"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["contains","not_contains"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}}}},{"title":"Boolean (Equals) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"title":"Assets boolean fields","type":"string","enum":["supports_update","supports_uninstall","update_available"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["equals"]},"value":{"title":"Value to search. Must be true or false","type":"boolean"}}},{"title":"Number Constraints (gt, gte, lt, lte, equals)","properties":{"field":{"type":"string","oneOf":[{"title":"Assets Number Fields","type":"string","enum":["cves_score","cves_count","product_signature","categories","cves_count_by_status.unknown","cves_count_by_status.low","cves_count_by_status.medium","cves_count_by_status.high","cves_count_by_status.critical"]}]}},"oneOf":[{"minProperties":1,"title":"Specify Number Range","not":{"anyOf":[{"required":["operator"]},{"required":["value"]}]},"properties":{"gt":{"type":"number","title":"Greater than"},"lt":{"type":"number","title":"Less than"},"gte":{"type":"number","title":"Greater than or equals"},"lte":{"type":"number","title":"Less than or equals"}}},{"title":"Specify Exact Number","not":{"anyOf":[{"required":["gt"]},{"required":["lt"]},{"required":["gte"]},{"required":["lte"]}]},"required":["operator","value"],"properties":{"operator":{"type":"string","enum":["equals"]},"value":{"type":["number","array"],"title":"Value to search","items":{"type":"number"}}}}]},{"title":"Date (start, end) Constraints","properties":{"field":{"oneOf":[{"title":"Assets Date Fields","type":"string","enum":["installation_date","created_at","ignored_until"]}]}},"oneOf":[{"minProperties":1,"title":"Specify Date Range","not":{"anyOf":[{"required":["operator"]},{"required":["value"]}]},"properties":{"start":{"type":"string","format":"date-time","title":"Start Date"},"end":{"type":"string","format":"date-time","title":"End Date"}}},{"title":"Specify Exact Date","not":{"anyOf":[{"required":["start"]},{"required":["end"]}]},"required":["operator","value"],"properties":{"operator":{"type":"string","enum":["equals"]},"value":{"type":["string","array"],"format":"date-time","title":"Value to search","items":{"format":"date-time"}}}}]},{"title":"Field Exists/Not Exists Constraints","required":["operator"],"properties":{"field":{"type":"string","oneOf":[{"title":"Assets Simple String Fields","type":"string","enum":["account_name","group_name","host_name","fully_qualified_host_name","domain_name","alias","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","installed_version","normalized_installed_version","display_installed_version","latest_version_available","os_info.os_version","os_info.os_release_name","cves","cves_by_status.unknown","cves_by_status.low","cves_by_status.medium","cves_by_status.high","cves_by_status.critical","architecture","active_directory.user.display_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.user.ou.path","active_directory.machine.display_name","active_directory.machine.sam_account_name","active_directory.machine.ou","active_directory.machine.ou.path","document_id","ai_tool"]},{"title":"Assets Enum String Fields","type":"string","enum":["os_info.os_type","os_info.os_platform","os_info.os_architecture","language","ai_category","ai_risk","ai_status"]},{"title":"Assets UID String Fields","type":"string","enum":["account_id","parent_account_id","group_id","root_group_id","machine_id","object_guid"]},{"title":"Assets Date Fields","type":"string","enum":["installation_date","created_at","ignored_until"]},{"title":"Assets Number Fields","type":"string","enum":["cves_score","cves_count","product_signature","categories","cves_count_by_status.unknown","cves_count_by_status.low","cves_count_by_status.medium","cves_count_by_status.high","cves_count_by_status.critical"]},{"title":"Assets boolean fields","type":"string","enum":["supports_update","supports_uninstall","update_available"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["exists","not_exists"]}}}]},"examples":[[{"field":"account_name","value":"Test Account","operator":"equals"}]]},"aggregations":{"items":{"type":"string","title":"Asset aggregation fields","enum":["account_id","parent_account_id","group_id","root_group_id","machine_id","host_name","fully_qualified_host_name","alias","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","installed_version","normalized_installed_version","display_installed_version","object_guid","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","latest_version_available","cves","cves_by_status.unknown","cves_by_status.low","cves_by_status.medium","cves_by_status.high","cves_by_status.critical","ai_tool","ai_category","ai_status","machine","machines","machine_ai_tool"]}},"sort_field":{"type":"string","title":"Asset sort fields","enum":["account_id","parent_account_id","group_id","root_group_id","machine_id","account_name","host_name","fully_qualified_host_name","alias","name_multi_search","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","installed_version","normalized_installed_version","display_installed_version","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","installation_date","created_at","object_guid","latest_version_available","cves","cves_by_status.unknown","cves_by_status.low","cves_by_status.medium","cves_by_status.high","cves_by_status.critical","cves_score","cves_count","cves_count_by_status.unknown","cves_count_by_status.low","cves_count_by_status.medium","cves_count_by_status.high","cves_count_by_status.critical","language","architecture","product_signature","categories","supports_update","supports_uninstall","update_available","active_directory.user.display_name","active_directory.user.ou","active_directory.user.sam_account_name","active_directory.machine.display_name","active_directory.machine.ou","active_directory.machine.sam_account_name","ignored_until","ai_tool","ai_category","ai_risk","ai_status"]}}},{"type":"object","title":"Base Search Schema","properties":{"aggregations":{"type":"array","title":"The fields onto which you can perform aggregations","items":{"type":"string","title":"The Items Schema"}},"page_size":{"type":"number","title":"The page size. If you just need to aggregate, set it to 0","minimum":0,"maximum":2000},"sort_field":{"title":"Sort Fields","type":"string"},"sort_order":{"type":"string","title":"Whether sorting should be ascending or descending","enum":["asc","desc"]},"aggregate_by_account":{"type":"boolean","title":"Indicates whether aggregations should be scoped by account"},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}]},{"type":"object","required":["account_ids"],"properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]},{"properties":{"group_by":{"type":"array","title":"Group results by indicated field(s)","items":{"type":"string","title":"Asset Groupby Fields","enum":["account_id","parent_account_id","group_id","root_group_id","machine_id","account_name","host_name","fully_qualified_host_name","alias","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","installed_version","normalized_installed_version","display_installed_version","object_guid","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","latest_version_available","cves","cves_by_status.unknown","cves_by_status.low","cves_by_status.medium","cves_by_status.high","cves_by_status.critical","cves_score","cves_count","cves_count_by_status.unknown","cves_count_by_status.low","cves_count_by_status.medium","cves_count_by_status.high","cves_count_by_status.critical","language","architecture","product_signature","categories","created_at","domain_name","active_directory.user.display_name","active_directory.user.ou","active_directory.machine.display_name","active_directory.machine.ou","supports_update","supports_uninstall","ai_tool"]}}}}]}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"The Post Assets Search GroupBy Response Schema","required":["results","next_cursor"],"properties":{"results":{"type":"array","title":"The Results Schema","default":[]},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}}}}},"tags":["Grid"],"operationId":"api.rmm.grid.search.assets.software.group"}},"/oneview/v1/grid/cve/export":{"post":{"description":"Export CVEs across accounts","summary":"Export CVEs","simple_schema":"cve-export-grid-rmm-simple","security":[{"client_credentials":["execute"]},{"user_permissions":["vulnerabilities.view"]}],"status":{"outage":["auth","search_stateless"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"title":"CVE Export Schema","type":"object","allOf":[{"type":"object","title":"Base Export Schema","required":["groups","select","format"],"properties":{"format":{"type":"string","title":"The output file","enum":["csv","xlsx","html","ods","txt","rtf","json"]},"download":{"type":"boolean","title":"Whether to instruct the client to download the response as a file. Only clients like browsers are supported"},"type":{"type":"string","title":"The encoding of the output","enum":["string","base64","binary"],"default":"string"},"select":{"type":"array","title":"Which fields to select from the response","items":{"type":"object","title":"Field","required":["field","newField"],"properties":{"newField":{"type":"string","title":"the new value"},"field":{"type":"string","title":"The response field to map to a new value"}}}},"groups":{"type":"array","title":"List of queries","items":{"type":"object"}}}},{"properties":{"select":{"items":{"properties":{"field":{"type":"string","title":"CVE select fields","anyOf":[{"enum":["account_id","account_name","parent_account_id","group_id","root_group_id","machine_id","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","installed_version","normalized_installed_version","display_installed_version","installation_date","host_name","fully_qualified_host_name","alias","created_at","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","cve_id","cisa_exploitable","known_ransomware_campaign_use","severity","severity_score","published_at","description","cvss20_score","cvss30_score","online","ignored_until","ignored_by","ignored_by_name","ignored_reason","architecture","domain_name","group_name","ignored_at","supports_update"]},{"type":"string","title":"Active Directory Select Fields","enum":["active_directory.user.display_name","active_directory.user.distinguished_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.machine.display_name","active_directory.machine.distinguished_name","active_directory.machine.sam_account_name","active_directory.machine.ou"]}]}}}},"groups":{"items":{"title":"List of queries to fetch dns activity","allOf":[{"type":"object","allOf":[{"type":"object","allOf":[{"properties":{"constraints":{"type":"array","items":{"title":"CVE Constraints","type":"object","required":["field"],"anyOf":[{"title":"String (Equals, Not Equals) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"type":"string","title":"CVE Simple String Fields","anyOf":[{"enum":["account_name","group_name","host_name","fully_qualified_host_name","os_info.os_type","os_info.os_version","os_info.os_release_name","domain_name","alias","sort_name","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","display_installed_version","cve_id","document_id","language","ignored_by_name","ignored_reason"]},{"title":"Active Directory Simple String Fields","type":"string","enum":["active_directory.user.display_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.user.ou.path","active_directory.machine.display_name","active_directory.machine.sam_account_name","active_directory.machine.ou","active_directory.machine.ou.path"]}]},{"type":"string","title":"CVE Enum String Fields","enum":["os_info.os_platform","os_info.os_architecture","severity","architecture"]},{"type":"string","title":"CVE UID String Fields","enum":["account_id","parent_account_id","group_id","root_group_id","machine_id","object_guid","ignored_by"]},{"type":"string","title":"CVE Version Fields","enum":["installed_version","normalized_installed_version","latest_version_available"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["equals","not_equals"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}}},"if":{"properties":{"field":{"type":"string","title":"CVE UID String Fields","enum":["account_id","parent_account_id","group_id","root_group_id","machine_id","object_guid","ignored_by"]}}},"then":{"properties":{"value":{"type":["string","array"],"format":"uuid","items":{"type":"string","format":"uuid"}}}}},{"title":"String (Contains, Not Contains) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"type":"string","title":"CVE Simple String Fields","anyOf":[{"enum":["account_name","group_name","host_name","fully_qualified_host_name","os_info.os_type","os_info.os_version","os_info.os_release_name","domain_name","alias","sort_name","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","display_installed_version","cve_id","document_id","language","ignored_by_name","ignored_reason"]},{"title":"Active Directory Simple String Fields","type":"string","enum":["active_directory.user.display_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.user.ou.path","active_directory.machine.display_name","active_directory.machine.sam_account_name","active_directory.machine.ou","active_directory.machine.ou.path"]}]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["contains","not_contains"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}}}},{"title":"Boolean (Equals) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"type":"string","title":"CVE Boolean Fields","enum":["cisa_exploitable","known_ransomware_campaign_use","supports_update","supports_uninstall"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["equals"]},"value":{"title":"Value to search. Must be true or false","type":"boolean"}}},{"title":"Number Constraints (gt, gte, lt, lte, equals)","properties":{"field":{"type":"string","oneOf":[{"type":"string","title":"CVE Number String Fields","enum":["severity_score","cvss20_score","cvss30_score","product_signature"]}]}},"oneOf":[{"minProperties":1,"title":"Specify Number Range","not":{"anyOf":[{"required":["operator"]},{"required":["value"]}]},"properties":{"gt":{"type":"number","title":"Greater than"},"lt":{"type":"number","title":"Less than"},"gte":{"type":"number","title":"Greater than or equals"},"lte":{"type":"number","title":"Less than or equals"}}},{"title":"Specify Exact Number","not":{"anyOf":[{"required":["gt"]},{"required":["lt"]},{"required":["gte"]},{"required":["lte"]}]},"required":["operator","value"],"properties":{"operator":{"type":"string","enum":["equals"]},"value":{"type":["number","array"],"title":"Value to search","items":{"type":"number"}}}}]},{"title":"Date (start, end) Constraints","properties":{"field":{"oneOf":[{"type":"string","title":"CVE Date Fields","enum":["installation_date","created_at","published_at","ignored_until","ignored_at"]}]}},"oneOf":[{"minProperties":1,"title":"Specify Date Range","not":{"anyOf":[{"required":["operator"]},{"required":["value"]}]},"properties":{"start":{"type":"string","format":"date-time","title":"Start Date"},"end":{"type":"string","format":"date-time","title":"End Date"}}},{"title":"Specify Exact Date","not":{"anyOf":[{"required":["start"]},{"required":["end"]}]},"required":["operator","value"],"properties":{"operator":{"type":"string","enum":["equals"]},"value":{"type":["string","array"],"format":"date-time","title":"Value to search","items":{"format":"date-time"}}}}]},{"title":"Field Exists/Not Exists Constraints","required":["operator"],"properties":{"field":{"type":"string","oneOf":[{"type":"string","title":"CVE Simple String Fields","anyOf":[{"enum":["account_name","group_name","host_name","fully_qualified_host_name","os_info.os_type","os_info.os_version","os_info.os_release_name","domain_name","alias","sort_name","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","display_installed_version","cve_id","document_id","language","ignored_by_name","ignored_reason"]},{"title":"Active Directory Simple String Fields","type":"string","enum":["active_directory.user.display_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.user.ou.path","active_directory.machine.display_name","active_directory.machine.sam_account_name","active_directory.machine.ou","active_directory.machine.ou.path"]}]},{"type":"string","title":"CVE Enum String Fields","enum":["os_info.os_platform","os_info.os_architecture","severity","architecture"]},{"type":"string","title":"CVE UID String Fields","enum":["account_id","parent_account_id","group_id","root_group_id","machine_id","object_guid","ignored_by"]},{"type":"string","title":"CVE Version Fields","enum":["installed_version","normalized_installed_version","latest_version_available"]},{"type":"string","title":"CVE Number String Fields","enum":["severity_score","cvss20_score","cvss30_score","product_signature"]},{"type":"string","title":"CVE Boolean Fields","enum":["cisa_exploitable","known_ransomware_campaign_use","supports_update","supports_uninstall"]},{"type":"string","title":"CVE Date Fields","enum":["installation_date","created_at","published_at","ignored_until","ignored_at"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["exists","not_exists"]}}}]},"examples":[[{"field":"product","value":"Example Product","operator":"equals"}]]},"aggregations":{"items":{"type":"string","title":"CVE aggregation fields","enum":["account_id","account_name","parent_account_id","group_id","root_group_id","machine_id","endpoints","object_guid","host_name","fully_qualified_host_name","alias","sort_name","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","installed_version","normalized_installed_version","display_installed_version","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","cve_id","severity","severity_score","cisa_exploitable","known_ransomware_campaign_use","cvss20_score","cvss30_score"]}},"sort_field":{"type":"string","title":"CVE sort fields","enum":["account_id","account_name","parent_account_id","group_id","root_group_id","machine_id","object_guid","host_name","fully_qualified_host_name","alias","sort_name","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","installed_version","normalized_installed_version","display_installed_version","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","cve_id","severity","installation_date","created_at","published_at","cisa_exploitable","known_ransomware_campaign_use","severity_score","cvss20_score","cvss30_score","supports_update","supports_uninstall","ignored_until","active_directory.user.display_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.machine.display_name","active_directory.machine.sam_account_name","active_directory.machine.ou"]}}},{"type":"object","title":"Base Search Schema","properties":{"aggregations":{"type":"array","title":"The fields onto which you can perform aggregations","items":{"type":"string","title":"The Items Schema"}},"page_size":{"type":"number","title":"The page size. If you just need to aggregate, set it to 0","minimum":0,"maximum":2000},"sort_field":{"title":"Sort Fields","type":"string"},"sort_order":{"type":"string","title":"Whether sorting should be ascending or descending","enum":["asc","desc"]},"aggregate_by_account":{"type":"boolean","title":"Indicates whether aggregations should be scoped by account"},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}]},{"type":"object","required":["account_ids"],"properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]}]}}}}]}}}},"responses":{"200":{"description":"Successful response"}},"tags":["Grid"],"operationId":"api.rmm.grid.export.cve"}},"/oneview/v1/grid/cve/export/async":{"post":{"description":"Export CVEs across accounts","summary":"Export CVEs asynchronously","simple_schema":"cve-export-grid-rmm-simple","security":[{"client_credentials":["execute"]},{"user_permissions":["vulnerabilities.view"]}],"status":{"outage":["auth","search_stateless"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"title":"CVE Export Schema","type":"object","allOf":[{"type":"object","title":"Base Export Schema","required":["groups","select","format"],"properties":{"format":{"type":"string","title":"The output file","enum":["csv","xlsx","html","ods","txt","rtf","json"]},"download":{"type":"boolean","title":"Whether to instruct the client to download the response as a file. Only clients like browsers are supported"},"type":{"type":"string","title":"The encoding of the output","enum":["string","base64","binary"],"default":"string"},"select":{"type":"array","title":"Which fields to select from the response","items":{"type":"object","title":"Field","required":["field","newField"],"properties":{"newField":{"type":"string","title":"the new value"},"field":{"type":"string","title":"The response field to map to a new value"}}}},"groups":{"type":"array","title":"List of queries","items":{"type":"object"}}}},{"properties":{"select":{"items":{"properties":{"field":{"type":"string","title":"CVE select fields","anyOf":[{"enum":["account_id","account_name","parent_account_id","group_id","root_group_id","machine_id","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","installed_version","normalized_installed_version","display_installed_version","installation_date","host_name","fully_qualified_host_name","alias","created_at","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","cve_id","cisa_exploitable","known_ransomware_campaign_use","severity","severity_score","published_at","description","cvss20_score","cvss30_score","online","ignored_until","ignored_by","ignored_by_name","ignored_reason","architecture","domain_name","group_name","ignored_at","supports_update"]},{"type":"string","title":"Active Directory Select Fields","enum":["active_directory.user.display_name","active_directory.user.distinguished_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.machine.display_name","active_directory.machine.distinguished_name","active_directory.machine.sam_account_name","active_directory.machine.ou"]}]}}}},"groups":{"items":{"title":"List of queries to fetch dns activity","allOf":[{"type":"object","allOf":[{"type":"object","allOf":[{"properties":{"constraints":{"type":"array","items":{"title":"CVE Constraints","type":"object","required":["field"],"anyOf":[{"title":"String (Equals, Not Equals) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"type":"string","title":"CVE Simple String Fields","anyOf":[{"enum":["account_name","group_name","host_name","fully_qualified_host_name","os_info.os_type","os_info.os_version","os_info.os_release_name","domain_name","alias","sort_name","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","display_installed_version","cve_id","document_id","language","ignored_by_name","ignored_reason"]},{"title":"Active Directory Simple String Fields","type":"string","enum":["active_directory.user.display_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.user.ou.path","active_directory.machine.display_name","active_directory.machine.sam_account_name","active_directory.machine.ou","active_directory.machine.ou.path"]}]},{"type":"string","title":"CVE Enum String Fields","enum":["os_info.os_platform","os_info.os_architecture","severity","architecture"]},{"type":"string","title":"CVE UID String Fields","enum":["account_id","parent_account_id","group_id","root_group_id","machine_id","object_guid","ignored_by"]},{"type":"string","title":"CVE Version Fields","enum":["installed_version","normalized_installed_version","latest_version_available"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["equals","not_equals"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}}},"if":{"properties":{"field":{"type":"string","title":"CVE UID String Fields","enum":["account_id","parent_account_id","group_id","root_group_id","machine_id","object_guid","ignored_by"]}}},"then":{"properties":{"value":{"type":["string","array"],"format":"uuid","items":{"type":"string","format":"uuid"}}}}},{"title":"String (Contains, Not Contains) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"type":"string","title":"CVE Simple String Fields","anyOf":[{"enum":["account_name","group_name","host_name","fully_qualified_host_name","os_info.os_type","os_info.os_version","os_info.os_release_name","domain_name","alias","sort_name","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","display_installed_version","cve_id","document_id","language","ignored_by_name","ignored_reason"]},{"title":"Active Directory Simple String Fields","type":"string","enum":["active_directory.user.display_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.user.ou.path","active_directory.machine.display_name","active_directory.machine.sam_account_name","active_directory.machine.ou","active_directory.machine.ou.path"]}]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["contains","not_contains"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}}}},{"title":"Boolean (Equals) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"type":"string","title":"CVE Boolean Fields","enum":["cisa_exploitable","known_ransomware_campaign_use","supports_update","supports_uninstall"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["equals"]},"value":{"title":"Value to search. Must be true or false","type":"boolean"}}},{"title":"Number Constraints (gt, gte, lt, lte, equals)","properties":{"field":{"type":"string","oneOf":[{"type":"string","title":"CVE Number String Fields","enum":["severity_score","cvss20_score","cvss30_score","product_signature"]}]}},"oneOf":[{"minProperties":1,"title":"Specify Number Range","not":{"anyOf":[{"required":["operator"]},{"required":["value"]}]},"properties":{"gt":{"type":"number","title":"Greater than"},"lt":{"type":"number","title":"Less than"},"gte":{"type":"number","title":"Greater than or equals"},"lte":{"type":"number","title":"Less than or equals"}}},{"title":"Specify Exact Number","not":{"anyOf":[{"required":["gt"]},{"required":["lt"]},{"required":["gte"]},{"required":["lte"]}]},"required":["operator","value"],"properties":{"operator":{"type":"string","enum":["equals"]},"value":{"type":["number","array"],"title":"Value to search","items":{"type":"number"}}}}]},{"title":"Date (start, end) Constraints","properties":{"field":{"oneOf":[{"type":"string","title":"CVE Date Fields","enum":["installation_date","created_at","published_at","ignored_until","ignored_at"]}]}},"oneOf":[{"minProperties":1,"title":"Specify Date Range","not":{"anyOf":[{"required":["operator"]},{"required":["value"]}]},"properties":{"start":{"type":"string","format":"date-time","title":"Start Date"},"end":{"type":"string","format":"date-time","title":"End Date"}}},{"title":"Specify Exact Date","not":{"anyOf":[{"required":["start"]},{"required":["end"]}]},"required":["operator","value"],"properties":{"operator":{"type":"string","enum":["equals"]},"value":{"type":["string","array"],"format":"date-time","title":"Value to search","items":{"format":"date-time"}}}}]},{"title":"Field Exists/Not Exists Constraints","required":["operator"],"properties":{"field":{"type":"string","oneOf":[{"type":"string","title":"CVE Simple String Fields","anyOf":[{"enum":["account_name","group_name","host_name","fully_qualified_host_name","os_info.os_type","os_info.os_version","os_info.os_release_name","domain_name","alias","sort_name","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","display_installed_version","cve_id","document_id","language","ignored_by_name","ignored_reason"]},{"title":"Active Directory Simple String Fields","type":"string","enum":["active_directory.user.display_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.user.ou.path","active_directory.machine.display_name","active_directory.machine.sam_account_name","active_directory.machine.ou","active_directory.machine.ou.path"]}]},{"type":"string","title":"CVE Enum String Fields","enum":["os_info.os_platform","os_info.os_architecture","severity","architecture"]},{"type":"string","title":"CVE UID String Fields","enum":["account_id","parent_account_id","group_id","root_group_id","machine_id","object_guid","ignored_by"]},{"type":"string","title":"CVE Version Fields","enum":["installed_version","normalized_installed_version","latest_version_available"]},{"type":"string","title":"CVE Number String Fields","enum":["severity_score","cvss20_score","cvss30_score","product_signature"]},{"type":"string","title":"CVE Boolean Fields","enum":["cisa_exploitable","known_ransomware_campaign_use","supports_update","supports_uninstall"]},{"type":"string","title":"CVE Date Fields","enum":["installation_date","created_at","published_at","ignored_until","ignored_at"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["exists","not_exists"]}}}]},"examples":[[{"field":"product","value":"Example Product","operator":"equals"}]]},"aggregations":{"items":{"type":"string","title":"CVE aggregation fields","enum":["account_id","account_name","parent_account_id","group_id","root_group_id","machine_id","endpoints","object_guid","host_name","fully_qualified_host_name","alias","sort_name","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","installed_version","normalized_installed_version","display_installed_version","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","cve_id","severity","severity_score","cisa_exploitable","known_ransomware_campaign_use","cvss20_score","cvss30_score"]}},"sort_field":{"type":"string","title":"CVE sort fields","enum":["account_id","account_name","parent_account_id","group_id","root_group_id","machine_id","object_guid","host_name","fully_qualified_host_name","alias","sort_name","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","installed_version","normalized_installed_version","display_installed_version","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","cve_id","severity","installation_date","created_at","published_at","cisa_exploitable","known_ransomware_campaign_use","severity_score","cvss20_score","cvss30_score","supports_update","supports_uninstall","ignored_until","active_directory.user.display_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.machine.display_name","active_directory.machine.sam_account_name","active_directory.machine.ou"]}}},{"type":"object","title":"Base Search Schema","properties":{"aggregations":{"type":"array","title":"The fields onto which you can perform aggregations","items":{"type":"string","title":"The Items Schema"}},"page_size":{"type":"number","title":"The page size. If you just need to aggregate, set it to 0","minimum":0,"maximum":2000},"sort_field":{"title":"Sort Fields","type":"string"},"sort_order":{"type":"string","title":"Whether sorting should be ascending or descending","enum":["asc","desc"]},"aggregate_by_account":{"type":"boolean","title":"Indicates whether aggregations should be scoped by account"},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}]},{"type":"object","required":["account_ids"],"properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]}]}}}}]}}}},"responses":{"200":{"description":"Successful response"}},"tags":["Grid"],"operationId":"api.rmm.grid.export.cve.async"}},"/oneview/v1/grid/cve/search":{"post":{"description":"Search CVEs across accounts","summary":"Search CVEs","simple_schema":"cve-search-grid-rmm-simple","security":[{"client_credentials":["read"]},{"user_permissions":["vulnerabilities.view"]}],"status":{"outage":["auth","search_stateless"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","allOf":[{"type":"object","allOf":[{"properties":{"constraints":{"type":"array","items":{"title":"CVE Constraints","type":"object","required":["field"],"anyOf":[{"title":"String (Equals, Not Equals) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"type":"string","title":"CVE Simple String Fields","anyOf":[{"enum":["account_name","group_name","host_name","fully_qualified_host_name","os_info.os_type","os_info.os_version","os_info.os_release_name","domain_name","alias","sort_name","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","display_installed_version","cve_id","document_id","language","ignored_by_name","ignored_reason"]},{"title":"Active Directory Simple String Fields","type":"string","enum":["active_directory.user.display_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.user.ou.path","active_directory.machine.display_name","active_directory.machine.sam_account_name","active_directory.machine.ou","active_directory.machine.ou.path"]}]},{"type":"string","title":"CVE Enum String Fields","enum":["os_info.os_platform","os_info.os_architecture","severity","architecture"]},{"type":"string","title":"CVE UID String Fields","enum":["account_id","parent_account_id","group_id","root_group_id","machine_id","object_guid","ignored_by"]},{"type":"string","title":"CVE Version Fields","enum":["installed_version","normalized_installed_version","latest_version_available"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["equals","not_equals"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}}},"if":{"properties":{"field":{"type":"string","title":"CVE UID String Fields","enum":["account_id","parent_account_id","group_id","root_group_id","machine_id","object_guid","ignored_by"]}}},"then":{"properties":{"value":{"type":["string","array"],"format":"uuid","items":{"type":"string","format":"uuid"}}}}},{"title":"String (Contains, Not Contains) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"type":"string","title":"CVE Simple String Fields","anyOf":[{"enum":["account_name","group_name","host_name","fully_qualified_host_name","os_info.os_type","os_info.os_version","os_info.os_release_name","domain_name","alias","sort_name","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","display_installed_version","cve_id","document_id","language","ignored_by_name","ignored_reason"]},{"title":"Active Directory Simple String Fields","type":"string","enum":["active_directory.user.display_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.user.ou.path","active_directory.machine.display_name","active_directory.machine.sam_account_name","active_directory.machine.ou","active_directory.machine.ou.path"]}]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["contains","not_contains"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}}}},{"title":"Boolean (Equals) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"type":"string","title":"CVE Boolean Fields","enum":["cisa_exploitable","known_ransomware_campaign_use","supports_update","supports_uninstall"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["equals"]},"value":{"title":"Value to search. Must be true or false","type":"boolean"}}},{"title":"Number Constraints (gt, gte, lt, lte, equals)","properties":{"field":{"type":"string","oneOf":[{"type":"string","title":"CVE Number String Fields","enum":["severity_score","cvss20_score","cvss30_score","product_signature"]}]}},"oneOf":[{"minProperties":1,"title":"Specify Number Range","not":{"anyOf":[{"required":["operator"]},{"required":["value"]}]},"properties":{"gt":{"type":"number","title":"Greater than"},"lt":{"type":"number","title":"Less than"},"gte":{"type":"number","title":"Greater than or equals"},"lte":{"type":"number","title":"Less than or equals"}}},{"title":"Specify Exact Number","not":{"anyOf":[{"required":["gt"]},{"required":["lt"]},{"required":["gte"]},{"required":["lte"]}]},"required":["operator","value"],"properties":{"operator":{"type":"string","enum":["equals"]},"value":{"type":["number","array"],"title":"Value to search","items":{"type":"number"}}}}]},{"title":"Date (start, end) Constraints","properties":{"field":{"oneOf":[{"type":"string","title":"CVE Date Fields","enum":["installation_date","created_at","published_at","ignored_until","ignored_at"]}]}},"oneOf":[{"minProperties":1,"title":"Specify Date Range","not":{"anyOf":[{"required":["operator"]},{"required":["value"]}]},"properties":{"start":{"type":"string","format":"date-time","title":"Start Date"},"end":{"type":"string","format":"date-time","title":"End Date"}}},{"title":"Specify Exact Date","not":{"anyOf":[{"required":["start"]},{"required":["end"]}]},"required":["operator","value"],"properties":{"operator":{"type":"string","enum":["equals"]},"value":{"type":["string","array"],"format":"date-time","title":"Value to search","items":{"format":"date-time"}}}}]},{"title":"Field Exists/Not Exists Constraints","required":["operator"],"properties":{"field":{"type":"string","oneOf":[{"type":"string","title":"CVE Simple String Fields","anyOf":[{"enum":["account_name","group_name","host_name","fully_qualified_host_name","os_info.os_type","os_info.os_version","os_info.os_release_name","domain_name","alias","sort_name","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","display_installed_version","cve_id","document_id","language","ignored_by_name","ignored_reason"]},{"title":"Active Directory Simple String Fields","type":"string","enum":["active_directory.user.display_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.user.ou.path","active_directory.machine.display_name","active_directory.machine.sam_account_name","active_directory.machine.ou","active_directory.machine.ou.path"]}]},{"type":"string","title":"CVE Enum String Fields","enum":["os_info.os_platform","os_info.os_architecture","severity","architecture"]},{"type":"string","title":"CVE UID String Fields","enum":["account_id","parent_account_id","group_id","root_group_id","machine_id","object_guid","ignored_by"]},{"type":"string","title":"CVE Version Fields","enum":["installed_version","normalized_installed_version","latest_version_available"]},{"type":"string","title":"CVE Number String Fields","enum":["severity_score","cvss20_score","cvss30_score","product_signature"]},{"type":"string","title":"CVE Boolean Fields","enum":["cisa_exploitable","known_ransomware_campaign_use","supports_update","supports_uninstall"]},{"type":"string","title":"CVE Date Fields","enum":["installation_date","created_at","published_at","ignored_until","ignored_at"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["exists","not_exists"]}}}]},"examples":[[{"field":"product","value":"Example Product","operator":"equals"}]]},"aggregations":{"items":{"type":"string","title":"CVE aggregation fields","enum":["account_id","account_name","parent_account_id","group_id","root_group_id","machine_id","endpoints","object_guid","host_name","fully_qualified_host_name","alias","sort_name","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","installed_version","normalized_installed_version","display_installed_version","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","cve_id","severity","severity_score","cisa_exploitable","known_ransomware_campaign_use","cvss20_score","cvss30_score"]}},"sort_field":{"type":"string","title":"CVE sort fields","enum":["account_id","account_name","parent_account_id","group_id","root_group_id","machine_id","object_guid","host_name","fully_qualified_host_name","alias","sort_name","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","installed_version","normalized_installed_version","display_installed_version","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","cve_id","severity","installation_date","created_at","published_at","cisa_exploitable","known_ransomware_campaign_use","severity_score","cvss20_score","cvss30_score","supports_update","supports_uninstall","ignored_until","active_directory.user.display_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.machine.display_name","active_directory.machine.sam_account_name","active_directory.machine.ou"]}}},{"type":"object","title":"Base Search Schema","properties":{"aggregations":{"type":"array","title":"The fields onto which you can perform aggregations","items":{"type":"string","title":"The Items Schema"}},"page_size":{"type":"number","title":"The page size. If you just need to aggregate, set it to 0","minimum":0,"maximum":2000},"sort_field":{"title":"Sort Fields","type":"string"},"sort_order":{"type":"string","title":"Whether sorting should be ascending or descending","enum":["asc","desc"]},"aggregate_by_account":{"type":"boolean","title":"Indicates whether aggregations should be scoped by account"},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}]},{"type":"object","required":["account_ids"],"properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Search assets CVE result","properties":{"results":{"type":"array","items":{"type":"object","properties":{"account_id":{"type":"string"},"parent_account_id":{"type":"string"},"group_id":{"type":"string"},"root_group_id":{"type":"string"},"machine_id":{"type":"string"},"vendor":{"type":"string"},"normalized_vendor":{"type":"string"},"display_vendor":{"type":"string"},"product":{"type":"string"},"normalized_product":{"type":"string"},"display_product":{"type":"string"},"installed_version":{"type":"string"},"normalized_installed_version":{"type":"string"},"display_installed_version":{"type":"string"},"installation_date":{"type":"string"},"host_name":{"type":"string"},"fully_qualified_host_name":{"type":"string"},"alias":{"type":"string"},"created_at":{"type":"string"},"os_info":{"properties":{"os_type":{"type":"string"},"os_version":{"type":"string"},"os_platform":{"type":"string"},"os_architecture":{"type":"string"},"os_release_name":{"type":"string"}}},"cve_id":{"type":"string"},"cisa_exploitable":{"type":"boolean"},"known_ransomware_campaign_use":{"type":"boolean"},"severity":{"type":"string"},"severity_score":{"type":"number"},"published_at":{"type":"string"},"cvss30_score":{"type":"number"},"cvss20_score":{"type":"number"},"description":{"type":"string"},"ignored_until":{"type":"string","format":"date-time"},"ignored_by":{"type":"string"},"ignored_by_name":{"type":"string"},"ignored_reason":{"type":"string"},"active_directory":{"type":"object","patternProperties":{"^(user|machine)$":{"type":"object","properties":{"display_name":{"type":"string"},"distinguished_name":{"type":"string"},"sam_account_name":{"type":"string"},"ou":{"type":"string"}}}}}}}},"aggregations":{"type":"object","title":"Aggregations","additionalProperties":true},"total_count":{"type":"integer","title":"Total count of found detections"},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}},"required":["results","total_count"]}}}}},"tags":["Grid"],"operationId":"api.rmm.grid.search.cve"}},"/oneview/v1/grid/cve/search-groupby":{"post":{"description":"Search grouped CVEs across accounts","summary":"Search grouped CVEs","simple_schema":"cve-search-groupby-grid-rmm-simple","security":[{"client_credentials":["read"]},{"user_permissions":["vulnerabilities.view"]}],"status":{"incident":["read_nebula_data"],"outage":["auth","search_stateful"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"title":"CVE Search Groupby Schema","type":"object","allOf":[{"type":"object","required":["group_by","page_size"],"properties":{"group_by":{"title":"Group by the following fields","type":"array","minItems":1,"uniqueItems":true,"items":{"type":"string"}},"page_size":{"type":"number","title":"The page_size Schema","minimum":50,"maximum":2000}}},{"type":"object","allOf":[{"type":"object","allOf":[{"properties":{"constraints":{"type":"array","items":{"title":"CVE Constraints","type":"object","required":["field"],"anyOf":[{"title":"String (Equals, Not Equals) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"type":"string","title":"CVE Simple String Fields","anyOf":[{"enum":["account_name","group_name","host_name","fully_qualified_host_name","os_info.os_type","os_info.os_version","os_info.os_release_name","domain_name","alias","sort_name","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","display_installed_version","cve_id","document_id","language","ignored_by_name","ignored_reason"]},{"title":"Active Directory Simple String Fields","type":"string","enum":["active_directory.user.display_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.user.ou.path","active_directory.machine.display_name","active_directory.machine.sam_account_name","active_directory.machine.ou","active_directory.machine.ou.path"]}]},{"type":"string","title":"CVE Enum String Fields","enum":["os_info.os_platform","os_info.os_architecture","severity","architecture"]},{"type":"string","title":"CVE UID String Fields","enum":["account_id","parent_account_id","group_id","root_group_id","machine_id","object_guid","ignored_by"]},{"type":"string","title":"CVE Version Fields","enum":["installed_version","normalized_installed_version","latest_version_available"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["equals","not_equals"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}}},"if":{"properties":{"field":{"type":"string","title":"CVE UID String Fields","enum":["account_id","parent_account_id","group_id","root_group_id","machine_id","object_guid","ignored_by"]}}},"then":{"properties":{"value":{"type":["string","array"],"format":"uuid","items":{"type":"string","format":"uuid"}}}}},{"title":"String (Contains, Not Contains) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"type":"string","title":"CVE Simple String Fields","anyOf":[{"enum":["account_name","group_name","host_name","fully_qualified_host_name","os_info.os_type","os_info.os_version","os_info.os_release_name","domain_name","alias","sort_name","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","display_installed_version","cve_id","document_id","language","ignored_by_name","ignored_reason"]},{"title":"Active Directory Simple String Fields","type":"string","enum":["active_directory.user.display_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.user.ou.path","active_directory.machine.display_name","active_directory.machine.sam_account_name","active_directory.machine.ou","active_directory.machine.ou.path"]}]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["contains","not_contains"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}}}},{"title":"Boolean (Equals) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"type":"string","title":"CVE Boolean Fields","enum":["cisa_exploitable","known_ransomware_campaign_use","supports_update","supports_uninstall"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["equals"]},"value":{"title":"Value to search. Must be true or false","type":"boolean"}}},{"title":"Number Constraints (gt, gte, lt, lte, equals)","properties":{"field":{"type":"string","oneOf":[{"type":"string","title":"CVE Number String Fields","enum":["severity_score","cvss20_score","cvss30_score","product_signature"]}]}},"oneOf":[{"minProperties":1,"title":"Specify Number Range","not":{"anyOf":[{"required":["operator"]},{"required":["value"]}]},"properties":{"gt":{"type":"number","title":"Greater than"},"lt":{"type":"number","title":"Less than"},"gte":{"type":"number","title":"Greater than or equals"},"lte":{"type":"number","title":"Less than or equals"}}},{"title":"Specify Exact Number","not":{"anyOf":[{"required":["gt"]},{"required":["lt"]},{"required":["gte"]},{"required":["lte"]}]},"required":["operator","value"],"properties":{"operator":{"type":"string","enum":["equals"]},"value":{"type":["number","array"],"title":"Value to search","items":{"type":"number"}}}}]},{"title":"Date (start, end) Constraints","properties":{"field":{"oneOf":[{"type":"string","title":"CVE Date Fields","enum":["installation_date","created_at","published_at","ignored_until","ignored_at"]}]}},"oneOf":[{"minProperties":1,"title":"Specify Date Range","not":{"anyOf":[{"required":["operator"]},{"required":["value"]}]},"properties":{"start":{"type":"string","format":"date-time","title":"Start Date"},"end":{"type":"string","format":"date-time","title":"End Date"}}},{"title":"Specify Exact Date","not":{"anyOf":[{"required":["start"]},{"required":["end"]}]},"required":["operator","value"],"properties":{"operator":{"type":"string","enum":["equals"]},"value":{"type":["string","array"],"format":"date-time","title":"Value to search","items":{"format":"date-time"}}}}]},{"title":"Field Exists/Not Exists Constraints","required":["operator"],"properties":{"field":{"type":"string","oneOf":[{"type":"string","title":"CVE Simple String Fields","anyOf":[{"enum":["account_name","group_name","host_name","fully_qualified_host_name","os_info.os_type","os_info.os_version","os_info.os_release_name","domain_name","alias","sort_name","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","display_installed_version","cve_id","document_id","language","ignored_by_name","ignored_reason"]},{"title":"Active Directory Simple String Fields","type":"string","enum":["active_directory.user.display_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.user.ou.path","active_directory.machine.display_name","active_directory.machine.sam_account_name","active_directory.machine.ou","active_directory.machine.ou.path"]}]},{"type":"string","title":"CVE Enum String Fields","enum":["os_info.os_platform","os_info.os_architecture","severity","architecture"]},{"type":"string","title":"CVE UID String Fields","enum":["account_id","parent_account_id","group_id","root_group_id","machine_id","object_guid","ignored_by"]},{"type":"string","title":"CVE Version Fields","enum":["installed_version","normalized_installed_version","latest_version_available"]},{"type":"string","title":"CVE Number String Fields","enum":["severity_score","cvss20_score","cvss30_score","product_signature"]},{"type":"string","title":"CVE Boolean Fields","enum":["cisa_exploitable","known_ransomware_campaign_use","supports_update","supports_uninstall"]},{"type":"string","title":"CVE Date Fields","enum":["installation_date","created_at","published_at","ignored_until","ignored_at"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["exists","not_exists"]}}}]},"examples":[[{"field":"product","value":"Example Product","operator":"equals"}]]},"aggregations":{"items":{"type":"string","title":"CVE aggregation fields","enum":["account_id","account_name","parent_account_id","group_id","root_group_id","machine_id","endpoints","object_guid","host_name","fully_qualified_host_name","alias","sort_name","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","installed_version","normalized_installed_version","display_installed_version","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","cve_id","severity","severity_score","cisa_exploitable","known_ransomware_campaign_use","cvss20_score","cvss30_score"]}},"sort_field":{"type":"string","title":"CVE sort fields","enum":["account_id","account_name","parent_account_id","group_id","root_group_id","machine_id","object_guid","host_name","fully_qualified_host_name","alias","sort_name","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","installed_version","normalized_installed_version","display_installed_version","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","cve_id","severity","installation_date","created_at","published_at","cisa_exploitable","known_ransomware_campaign_use","severity_score","cvss20_score","cvss30_score","supports_update","supports_uninstall","ignored_until","active_directory.user.display_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.machine.display_name","active_directory.machine.sam_account_name","active_directory.machine.ou"]}}},{"type":"object","title":"Base Search Schema","properties":{"aggregations":{"type":"array","title":"The fields onto which you can perform aggregations","items":{"type":"string","title":"The Items Schema"}},"page_size":{"type":"number","title":"The page size. If you just need to aggregate, set it to 0","minimum":0,"maximum":2000},"sort_field":{"title":"Sort Fields","type":"string"},"sort_order":{"type":"string","title":"Whether sorting should be ascending or descending","enum":["asc","desc"]},"aggregate_by_account":{"type":"boolean","title":"Indicates whether aggregations should be scoped by account"},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}]},{"type":"object","required":["account_ids"],"properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]},{"properties":{"group_by":{"type":"array","title":"Group results by indicated field(s)","items":{"type":"string","title":"CVE Groupby Fields","anyOf":[{"enum":["account_id","parent_account_id","group_id","root_group_id","machine_id","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","installed_version","normalized_installed_version","display_installed_version","installation_date","host_name","fully_qualified_host_name","alias","created_at","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","cve_id","cisa_exploitable","known_ransomware_campaign_use","severity","severity_score","published_at","cvss20_score","cvss30_score","domain_name","ignored_reason","ignored_by_name"]},{"type":"string","title":"Active Directory Group By Fields","enum":["active_directory.user.display_name","active_directory.user.ou","active_directory.machine.display_name","active_directory.machine.ou"]}]}}}}]}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"The Post CVE Search GroupBy Response Schema","required":["results","next_cursor"],"properties":{"results":{"type":"array","title":"The Results Schema","default":[]},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}}}}},"tags":["Grid"],"operationId":"api.rmm.grid.search.cve.group"}},"/oneview/v1/grid/cve/events/export":{"post":{"description":"Placeholder. Please extend this","summary":"Placeholder. Please extend this","deprecated":false,"security":[{"client_credentials":["execute"]},{"user_permissions":["vulnerabilities.view"]}],"status":{"outage":["auth","search_stateless"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{}}},"responses":{"200":{"description":"Successful response"}},"tags":["Grid"],"operationId":"api.rmm.grid.export.cve.events"}},"/oneview/v1/grid/cve/events/search":{"post":{"description":"Placeholder. Please extend this","summary":"Placeholder. Please extend this","deprecated":false,"security":[{"client_credentials":["read"]},{"user_permissions":["vulnerabilities.view"]}],"status":{"outage":["auth","search_stateless"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Search assets CVE result","properties":{"results":{"type":"array","items":{"type":"object","properties":{"account_id":{"type":"string"},"parent_account_id":{"type":"string"},"group_id":{"type":"string"},"root_group_id":{"type":"string"},"machine_id":{"type":"string"},"vendor":{"type":"string"},"normalized_vendor":{"type":"string"},"display_vendor":{"type":"string"},"product":{"type":"string"},"normalized_product":{"type":"string"},"display_product":{"type":"string"},"installed_version":{"type":"string"},"normalized_installed_version":{"type":"string"},"display_installed_version":{"type":"string"},"installation_date":{"type":"string"},"host_name":{"type":"string"},"fully_qualified_host_name":{"type":"string"},"alias":{"type":"string"},"created_at":{"type":"string"},"os_info":{"properties":{"os_type":{"type":"string"},"os_version":{"type":"string"},"os_platform":{"type":"string"},"os_architecture":{"type":"string"},"os_release_name":{"type":"string"}}},"cve_id":{"type":"string"},"cisa_exploitable":{"type":"boolean"},"known_ransomware_campaign_use":{"type":"boolean"},"severity":{"type":"string"},"severity_score":{"type":"number"},"published_at":{"type":"string"},"cvss30_score":{"type":"number"},"cvss20_score":{"type":"number"},"description":{"type":"string"},"ignored_until":{"type":"string","format":"date-time"},"ignored_by":{"type":"string"},"ignored_by_name":{"type":"string"},"ignored_reason":{"type":"string"},"active_directory":{"type":"object","patternProperties":{"^(user|machine)$":{"type":"object","properties":{"display_name":{"type":"string"},"distinguished_name":{"type":"string"},"sam_account_name":{"type":"string"},"ou":{"type":"string"}}}}}}}},"aggregations":{"type":"object","title":"Aggregations","additionalProperties":true},"total_count":{"type":"integer","title":"Total count of found detections"},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}},"required":["results","total_count"]}}}}},"tags":["Grid"],"operationId":"api.rmm.grid.search.cve.events"}},"/oneview/v1/grid/cve/events/search-groupby":{"post":{"description":"Placeholder. Please extend this","summary":"Placeholder. Please extend this","deprecated":false,"security":[{"client_credentials":["read"]},{"user_permissions":["vulnerabilities.view"]}],"status":{"incident":["read_nebula_data"],"outage":["auth","search_stateless"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"The Post CVE Search GroupBy Response Schema","required":["results","next_cursor"],"properties":{"results":{"type":"array","title":"The Results Schema","default":[]},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}}}}},"tags":["Grid"],"operationId":"api.rmm.grid.search.cve.events.group"}},"/oneview/v1/grid/detections/export":{"post":{"description":"Export detections across accounts","summary":"Export detections","simple_schema":"detection-export-grid-rmm-simple","security":[{"client_credentials":["execute"]},{"user_permissions":["detections.view"]}],"status":{"outage":["auth","search_stateless"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{}}},"responses":{"200":{"description":"Successful response"}},"tags":["Grid"],"operationId":"api.rmm.grid.export.detections"}},"/oneview/v1/grid/detections/export/async":{"post":{"description":"Export detections across accounts","summary":"Export detections asynchronously","simple_schema":"detection-export-grid-rmm-simple","security":[{"client_credentials":["execute"]},{"user_permissions":["detections.view"]}],"status":{"outage":["auth","search_stateless"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{}}},"responses":{"200":{"description":"Successful response"}},"tags":["Grid"],"operationId":"api.rmm.grid.export.detections.async"}},"/oneview/v1/grid/detections/search":{"post":{"description":"Search detections across accounts","summary":"Search detections","simple_schema":"detection-search-grid-rmm-simple","security":[{"client_credentials":["read"]},{"user_permissions":["detections.view"]}],"status":{"outage":["auth","search_stateless"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","allOf":[{"type":"object","allOf":[{"properties":{"constraints":{"type":"array","items":{"title":"Detection Constraints","type":"object","required":["field"],"anyOf":[{"title":"String (Equals, Not Equals) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"type":"string","title":"Detection UID String Fields","enum":["trace_id","scan_id","group_id","account_id","detection_id","parent_detection_id","id","machine_id","schedule_id","job_id"]},{"title":"Detection Simple String Fields","type":"string","anyOf":[{"enum":["correlation_hash","threat_name","machine_name","group_name","path","md5","sha256","affected_application","process_name","schedule_etag","device_control.physical_disk_name","device_control.disk_interface","device_control.manufacturer","device_control.serial_number","device_control.file_system","device_control.volume_name","device_control.volume_serial","device_control.volume_device_path","scan_result.device.disk_model"]},{"title":"Active Directory Simple String Fields","type":"string","enum":["active_directory.user.display_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.user.ou.path","active_directory.machine.display_name","active_directory.machine.sam_account_name","active_directory.machine.ou","active_directory.machine.ou.path"]}]},{"type":"string","title":"Detection Enum String Fields","enum":["status","type","category","scan_result.scan_type","action_taken"]},{"title":"Agent Simple String Fields","type":"string","enum":["agent.nics.mac_address","agent.nics.description","agent.os_info.os_version","agent.os_info.os_release_name","agent.os_info.os_architecture","agent.plugins.asset_manager.plugin_version","agent.plugins.asset_manager.alerts.codes","agent.plugins.endpoint_protection.plugin_version","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.plugins.endpoint_protection.update_package_version","agent.plugins.endpoint_protection.alerts.codes","agent.plugins.endpoint_detection_and_response.plugin_version","agent.plugins.endpoint_detection_and_response.alerts.codes","agent.plugins.incident_response.plugin_version","agent.plugins.incident_response.update_package_version","agent.plugins.incident_response.alerts.codes","agent.plugins.siem.plugin_version","agent.plugins.siem.alerts.codes","agent.plugins.browser_phishing_protection.plugin_version","agent.plugins.browser_phishing_protection.alerts.codes","agent.engine_version","agent.source_location.city","agent.source_location.country","agent.source_location.subdivisions","agent.source_location.time_zone","agent.domain_name","agent.alias","agent.policy_etag","agent.serial_number","agent.available_software_updates.sdk_version.currentVersion","agent.available_software_updates.sdk_version.newVersion","agent.alerts.codes","agent.host_name","agent.fully_qualified_host_name","agent.object_guid","agent.last_user","agent.active_directory.user.display_name","agent.active_directory.user.ou","agent.active_directory.user.ou.path","agent.active_directory.user.sam_account_name","agent.active_directory.machine.display_name","agent.active_directory.machine.ou","agent.active_directory.machine.ou.path","agent.active_directory.machine.sam_account_name"]},{"title":"Agent Enum String Fields","type":"string","enum":["agent.os_info.os_type","agent.os_info.os_platform"]},{"title":"Agent Version fields","type":"string","enum":["agent.plugins.asset_manager.plugin_version","agent.plugins.endpoint_protection.plugin_version","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.plugins.endpoint_protection.update_package_version","agent.plugins.endpoint_detection_and_response.plugin_version","agent.plugins.incident_response.plugin_version","agent.plugins.incident_response.update_package_version","agent.available_software_updates.sdk_version.currentVersion","agent.available_software_updates.sdk_version.newVersion"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["equals","not_equals"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}}},"if":{"properties":{"field":{"type":"string","title":"Detection UID String Fields","enum":["trace_id","scan_id","group_id","account_id","detection_id","parent_detection_id","id","machine_id","schedule_id","job_id"]}}},"then":{"properties":{"value":{"type":["string","array"],"format":"uuid","items":{"type":"string","format":"uuid"}}}}},{"title":"String (Contains, Not Contains) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"title":"Detection Simple String Fields","type":"string","anyOf":[{"enum":["correlation_hash","threat_name","machine_name","group_name","path","md5","sha256","affected_application","process_name","schedule_etag","device_control.physical_disk_name","device_control.disk_interface","device_control.manufacturer","device_control.serial_number","device_control.file_system","device_control.volume_name","device_control.volume_serial","device_control.volume_device_path","scan_result.device.disk_model"]},{"title":"Active Directory Simple String Fields","type":"string","enum":["active_directory.user.display_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.user.ou.path","active_directory.machine.display_name","active_directory.machine.sam_account_name","active_directory.machine.ou","active_directory.machine.ou.path"]}]},{"title":"Agent Simple String Fields","type":"string","enum":["agent.nics.mac_address","agent.nics.description","agent.os_info.os_version","agent.os_info.os_release_name","agent.os_info.os_architecture","agent.plugins.asset_manager.plugin_version","agent.plugins.asset_manager.alerts.codes","agent.plugins.endpoint_protection.plugin_version","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.plugins.endpoint_protection.update_package_version","agent.plugins.endpoint_protection.alerts.codes","agent.plugins.endpoint_detection_and_response.plugin_version","agent.plugins.endpoint_detection_and_response.alerts.codes","agent.plugins.incident_response.plugin_version","agent.plugins.incident_response.update_package_version","agent.plugins.incident_response.alerts.codes","agent.plugins.siem.plugin_version","agent.plugins.siem.alerts.codes","agent.plugins.browser_phishing_protection.plugin_version","agent.plugins.browser_phishing_protection.alerts.codes","agent.engine_version","agent.source_location.city","agent.source_location.country","agent.source_location.subdivisions","agent.source_location.time_zone","agent.domain_name","agent.alias","agent.policy_etag","agent.serial_number","agent.available_software_updates.sdk_version.currentVersion","agent.available_software_updates.sdk_version.newVersion","agent.alerts.codes","agent.host_name","agent.fully_qualified_host_name","agent.object_guid","agent.last_user","agent.active_directory.user.display_name","agent.active_directory.user.ou","agent.active_directory.user.ou.path","agent.active_directory.user.sam_account_name","agent.active_directory.machine.display_name","agent.active_directory.machine.ou","agent.active_directory.machine.ou.path","agent.active_directory.machine.sam_account_name"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["contains","not_contains"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}}}},{"title":"Boolean (Equals) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"type":"string","title":"Detection Boolean Fields","enum":["is_root_detection","is_rtp_stream_event"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["equals"]},"value":{"title":"Value to search. Must be true or false","type":"boolean"}}},{"title":"Number Constraints (gt, gte, lt, lte, equals)","properties":{"field":{"type":"string","oneOf":[{"title":"Agent Number Fields","type":"string","enum":["agent.started_at_offset","agent.plugins.asset_manager.reboot_reasons","agent.plugins.endpoint_protection.reboot_reasons","agent.plugins.endpoint_detection_and_response.reboot_reasons","agent.plugins.incident_response.reboot_reasons","agent.plugins.siem.reboot_reasons","agent.os_version_major","agent.os_version_minor"]}]}},"oneOf":[{"minProperties":1,"title":"Specify Number Range","not":{"anyOf":[{"required":["operator"]},{"required":["value"]}]},"properties":{"gt":{"type":"number","title":"Greater than"},"lt":{"type":"number","title":"Less than"},"gte":{"type":"number","title":"Greater than or equals"},"lte":{"type":"number","title":"Less than or equals"}}},{"title":"Specify Exact Number","not":{"anyOf":[{"required":["gt"]},{"required":["lt"]},{"required":["gte"]},{"required":["lte"]}]},"required":["operator","value"],"properties":{"operator":{"type":"string","enum":["equals"]},"value":{"type":["number","array"],"title":"Value to search","items":{"type":"number"}}}}]},{"title":"Date (start, end) Constraints","properties":{"field":{"oneOf":[{"title":"Agent Date Fields","type":"string","enum":["agent.at","agent.started_at_local"]},{"type":"string","title":"Detection Date Fields","enum":["scanned_at","reported_at","cleaned_at","resource_created_at","resource_modified_at"]}]}},"oneOf":[{"minProperties":1,"title":"Specify Date Range","not":{"anyOf":[{"required":["operator"]},{"required":["value"]}]},"properties":{"start":{"type":"string","format":"date-time","title":"Start Date"},"end":{"type":"string","format":"date-time","title":"End Date"}}},{"title":"Specify Exact Date","not":{"anyOf":[{"required":["start"]},{"required":["end"]}]},"required":["operator","value"],"properties":{"operator":{"type":"string","enum":["equals"]},"value":{"type":["string","array"],"format":"date-time","title":"Value to search","items":{"format":"date-time"}}}}]},{"title":"IP Constraints","properties":{"field":{"oneOf":[{"title":"Agent IP Fields","type":"string","enum":["agent.nics.ips","agent.machine_ip"]}]},"operator":{"type":"string","enum":["ip"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}}}},{"title":"Field Exists/Not Exists Constraints","required":["operator"],"properties":{"field":{"type":"string","oneOf":[{"type":"string","title":"Detection UID String Fields","enum":["trace_id","scan_id","group_id","account_id","detection_id","parent_detection_id","id","machine_id","schedule_id","job_id"]},{"title":"Detection Simple String Fields","type":"string","anyOf":[{"enum":["correlation_hash","threat_name","machine_name","group_name","path","md5","sha256","affected_application","process_name","schedule_etag","device_control.physical_disk_name","device_control.disk_interface","device_control.manufacturer","device_control.serial_number","device_control.file_system","device_control.volume_name","device_control.volume_serial","device_control.volume_device_path","scan_result.device.disk_model"]},{"title":"Active Directory Simple String Fields","type":"string","enum":["active_directory.user.display_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.user.ou.path","active_directory.machine.display_name","active_directory.machine.sam_account_name","active_directory.machine.ou","active_directory.machine.ou.path"]}]},{"type":"string","title":"Detection Enum String Fields","enum":["status","type","category","scan_result.scan_type","action_taken"]},{"title":"Agent Simple String Fields","type":"string","enum":["agent.nics.mac_address","agent.nics.description","agent.os_info.os_version","agent.os_info.os_release_name","agent.os_info.os_architecture","agent.plugins.asset_manager.plugin_version","agent.plugins.asset_manager.alerts.codes","agent.plugins.endpoint_protection.plugin_version","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.plugins.endpoint_protection.update_package_version","agent.plugins.endpoint_protection.alerts.codes","agent.plugins.endpoint_detection_and_response.plugin_version","agent.plugins.endpoint_detection_and_response.alerts.codes","agent.plugins.incident_response.plugin_version","agent.plugins.incident_response.update_package_version","agent.plugins.incident_response.alerts.codes","agent.plugins.siem.plugin_version","agent.plugins.siem.alerts.codes","agent.plugins.browser_phishing_protection.plugin_version","agent.plugins.browser_phishing_protection.alerts.codes","agent.engine_version","agent.source_location.city","agent.source_location.country","agent.source_location.subdivisions","agent.source_location.time_zone","agent.domain_name","agent.alias","agent.policy_etag","agent.serial_number","agent.available_software_updates.sdk_version.currentVersion","agent.available_software_updates.sdk_version.newVersion","agent.alerts.codes","agent.host_name","agent.fully_qualified_host_name","agent.object_guid","agent.last_user","agent.active_directory.user.display_name","agent.active_directory.user.ou","agent.active_directory.user.ou.path","agent.active_directory.user.sam_account_name","agent.active_directory.machine.display_name","agent.active_directory.machine.ou","agent.active_directory.machine.ou.path","agent.active_directory.machine.sam_account_name"]},{"title":"Agent Enum String Fields","type":"string","enum":["agent.os_info.os_type","agent.os_info.os_platform"]},{"title":"Agent Version fields","type":"string","enum":["agent.plugins.asset_manager.plugin_version","agent.plugins.endpoint_protection.plugin_version","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.plugins.endpoint_protection.update_package_version","agent.plugins.endpoint_detection_and_response.plugin_version","agent.plugins.incident_response.plugin_version","agent.plugins.incident_response.update_package_version","agent.available_software_updates.sdk_version.currentVersion","agent.available_software_updates.sdk_version.newVersion"]},{"title":"Agent Date Fields","type":"string","enum":["agent.at","agent.started_at_local"]},{"type":"string","title":"Detection Date Fields","enum":["scanned_at","reported_at","cleaned_at","resource_created_at","resource_modified_at"]},{"type":"string","title":"Detection Boolean Fields","enum":["is_root_detection","is_rtp_stream_event"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["exists","not_exists"]}}},{"title":"Number Constraints (gt, gte, lt, lte, equals)","properties":{"field":{"type":"string","oneOf":[{"title":"Detection Number Fields","type":"string","enum":["rid_details.port","rid_details.attempts","rid_details.duration"]}]}},"oneOf":[{"minProperties":1,"title":"Specify Number Range","not":{"anyOf":[{"required":["operator"]},{"required":["value"]}]},"properties":{"gt":{"type":"number","title":"Greater than"},"lt":{"type":"number","title":"Less than"},"gte":{"type":"number","title":"Greater than or equals"},"lte":{"type":"number","title":"Less than or equals"}}},{"title":"Specify Exact Number","not":{"anyOf":[{"required":["gt"]},{"required":["lt"]},{"required":["gte"]},{"required":["lte"]}]},"required":["operator","value"],"properties":{"operator":{"type":"string","enum":["equals"]},"value":{"type":["number","array"],"title":"Value to search","items":{"type":"number"}}}}]}]},"examples":[[{"field":"trace_id","value":"ccb84b33-2d8e-4dcb-94a0-922fc669ce4a","operator":"equals"}]]},"aggregations":{"items":{"type":"string","title":"Detection aggregation fields","enum":["trace_id","scan_id","machine_id","group_id","account_id","detection_id","parent_detection_id","correlation_hash","status","threat_name","type","path","category","md5","affected_application","process_name","machine_name","daily_detections_by_category","protection_status","agent.os_info.os_release_name","agent.nics.ips","agent.nics.mac_address","agent.nics.description","agent.os_info.os_type","agent.os_info.os_version","agent.os_info.os_platform","agent.os_info.os_architecture","agent.host_name","agent.fully_qualified_host_name","agent.plugins.asset_manager.plugin_version","agent.plugins.asset_manager.reboot_reason","agent.plugins.endpoint_protection.plugin_version","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.plugins.endpoint_protection.update_package_version","agent.plugins.endpoint_protection.reboot_reason","agent.plugins.endpoint_detection_response.plugin_version","agent.plugins.endpoint_detection_response.reboot_reason","agent.plugins.endpoint_detection_and_response.plugin_version","agent.plugins.endpoint_detection_and_response.reboot_reason","agent.plugins.incident_response.plugin_version","agent.plugins.incident_response.reboot_reason","agent.plugins.siem.plugin_version","agent.plugins.browser_phishing_protection.plugin_version","agent.plugins.siem.reboot_reason","agent.engine_version","agent.domain_name","agent.policy_etag","agent.last_user","agent.object_guid","scan_result.device.disk_model","category_by_status"]}},"sort_field":{"type":"string","title":"Detection sort fields","anyOf":[{"enum":["trace_id","scan_id","machine_id","group_id","group_name","account_id","account_name","detection_id","parent_detection_id","correlation_hash","status","threat_name","type","path","category","md5","sha256","affected_application","process_name","machine_name","scanned_at","reported_at","resource_created_at","resource_modified_at","cleaned_at","is_root_detection","is_rtp_stream_event","agent.object_guid","agent.last_user","agent.engine_version","agent.os_info.os_type","agent.os_info.os_version","agent.os_info.os_platform","agent.os_info.os_architecture","agent.os_info.os_release_name","agent.nics.ips","scan_result.device.disk_model"]},{"type":"string","title":"Active Directory Sort Fields","enum":["active_directory.user.display_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.machine.display_name","active_directory.machine.sam_account_name","active_directory.machine.ou"]}]},"start_date":{"type":"string","title":"Get results after this date","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"end_date":{"type":"string","title":"Get results before this date","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]}}},{"type":"object","title":"Base Search Schema","properties":{"aggregations":{"type":"array","title":"The fields onto which you can perform aggregations","items":{"type":"string","title":"The Items Schema"}},"page_size":{"type":"number","title":"The page size. If you just need to aggregate, set it to 0","minimum":0,"maximum":2000},"sort_field":{"title":"Sort Fields","type":"string"},"sort_order":{"type":"string","title":"Whether sorting should be ascending or descending","enum":["asc","desc"]},"aggregate_by_account":{"type":"boolean","title":"Indicates whether aggregations should be scoped by account"},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}]},{"type":"object","required":["account_ids"],"properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Search detections result","properties":{"detections":{"type":"array","title":"Detections","items":{"type":"object","title":"Detection items","additionalProperties":false,"properties":{"id":{"type":"string","title":"ID"},"type":{"type":"array","title":"Type","items":{"type":"string","title":"Type items"}},"status":{"type":"string","title":"Status"},"path":{"type":"string","title":"Path"},"group_id":{"type":"string","title":"Group ID"},"group":{"type":"object","title":"The Group Schema","additionalProperties":true},"is_root_detection":{"type":"boolean","title":"Is root detection"},"machine_id":{"type":"string","title":"Endpoint ID"},"account_id":{"type":"string","title":"Account ID"},"detection_id":{"type":"string","title":"Detection ID"},"scanned_at":{"type":"string","title":"Scanned at"},"scanned_at_offset_seconds":{"type":"integer","title":"Scanned at offset seconds"},"reported_at":{"type":"string","title":"Reported at"},"resource_created_at":{"type":"string","title":"The creation timestamp of the original quarantined file","format":"date-time"},"resource_modified_at":{"type":"string","title":"The modification timestamp of the original quarantined file","format":"date-time"},"threat_name":{"type":"string","title":"Threat name"},"category":{"type":"string","title":"Category"},"action_taken":{"type":"string","title":"Action taken"},"is_rtp_stream_event":{"type":"boolean","title":"Is rtp stream event"},"process_name":{"type":"string","title":"Process name"},"cleaned_at":{"type":"string","title":"Cleaned at"},"machine_name":{"type":"string","title":"Endpoint name"},"trace_id":{"type":"string","title":"Trace ID"},"scan_id":{"type":"string","title":"Scan ID"},"affected_application":{"type":"string","title":"Affected application"},"last_user":{"type":"string","title":"Last user"},"md5":{"type":"string","title":"MD5"},"sha256":{"type":"string","title":"SHA256"},"machine_ip":{"type":"string","title":"Machine IP address"},"child_trace_count":{"type":"integer","title":"Child trace count"},"agent":{"allOf":[{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"The root schema","description":"The root schema comprises the entire JSON document.","default":{},"examples":[{"at":"2020-10-23T14:20:51.006558Z","is_software_update_available":false,"started_at_local":"2020-10-23T14:20:50.920306Z","started_at_offset":-25200,"nics":[{"ips":["10.151.110.52"],"description":"Intel(R) 82574L Gigabit Network Connection","mac_address":"005056B91173"}],"os_info":{"os_type":"Workstation","os_version":"6.3.9600","os_platform":"Windows","os_architecture":"x86","os_release_name":"Microsoft Windows 8.1 Pro"},"fully_qualified_host_name":"sahamedw8-1x86","plugins":{"windows_remote_intrusion_detection_and_prevention":{"product_name":"Windows Remote Intrusion Detection and Prevention","plugin_version":"1.2.0.21"},"endpoint_protection":{"sdk_version":"4.2.1.90","product_name":"Endpoint Protection","plugin_version":"1.2.0.844","update_package_version":"1.0.31870","component_package_version":"1.0.1085","reboot_reasons":0},"asset_manager":{"product_name":"Asset Manager","plugin_version":"1.2.0.330","reboot_reasons":0},"endpoint_detection_and_response":{"product_name":"Endpoint Detection and Response","plugin_version":"1.2.0.297","reboot_reasons":0}},"engine_version":"1.2.0.821","policy_etag":"c6ea44914b72c92cba939ac3bd369dc4","last_user":"SAHAMEDW8-1X86\\Administrator","serial_number":"c02thb32g8wn","host_name":"sahamedw8-1x86","machine_id":"f2bcafe1-cb2b-4833-b6c9-6148b9511c8f","machine_ip":"216.75.233.210"}],"properties":{"at":{"type":"string","title":"The at schema","default":"","examples":["2020-10-23T14:20:51.006558Z"]},"is_software_update_available":{"type":"boolean","title":"The is_software_update_available schema","default":false,"examples":[false]},"started_at_local":{"type":"string","title":"The started_at_local schema","default":"","examples":["2020-10-23T14:20:50.920306Z"]},"started_at_offset":{"type":"integer","title":"The started_at_offset schema","default":0,"examples":[-25200]},"nics":{"type":"array","title":"The nics schema","default":[],"examples":[[{"ips":["10.151.110.52"],"description":"Intel(R) 82574L Gigabit Network Connection","mac_address":"005056B91173"}]],"additionalItems":true,"items":{"anyOf":[{"type":"object","title":"The first anyOf schema","default":{},"examples":[{"ips":["10.151.110.52"],"description":"Intel(R) 82574L Gigabit Network Connection","mac_address":"005056B91173"}],"properties":{"ips":{"type":"array","title":"The ips schema","default":[],"examples":[["10.151.110.52"]],"additionalItems":true,"items":{"anyOf":[{"type":"string","title":"The first anyOf schema","default":"","examples":["10.151.110.52"]}]}},"description":{"type":"string","title":"The description schema","default":"","examples":["Intel(R) 82574L Gigabit Network Connection"]},"mac_address":{"type":"string","title":"The mac_address schema","default":"","examples":["005056B91173"]}},"additionalProperties":true}]}},"os_info":{"type":"object","title":"The os_info schema","default":{},"examples":[{"os_type":"Workstation","os_version":"6.3.9600","os_platform":"Windows","os_architecture":"x86","os_release_name":"Microsoft Windows 8.1 Pro"}],"properties":{"os_type":{"type":"string","title":"The os_type schema","default":"","examples":["Workstation"]},"os_version":{"type":"string","title":"The os_version schema","default":"","examples":["6.3.9600"]},"os_platform":{"type":"string","title":"The os_platform schema","default":"","examples":["Windows"]},"os_architecture":{"type":"string","title":"The os_architecture schema","default":"","examples":["x86"]},"os_release_name":{"type":"string","title":"The os_release_name schema","default":"","examples":["Microsoft Windows 8.1 Pro"]}},"additionalProperties":true},"fully_qualified_host_name":{"type":"string","title":"The fully_qualified_host_name schema","default":"","examples":["sahamedw8-1x86"]},"plugins":{"type":"object","title":"The plugins schema","default":{},"examples":[{"windows_remote_intrusion_detection_and_prevention":{"product_name":"Windows Remote Intrusion Detection and Prevention","plugin_version":"1.2.0.21"},"endpoint_protection":{"sdk_version":"4.2.1.90","product_name":"Endpoint Protection","plugin_version":"1.2.0.844","update_package_version":"1.0.31870","component_package_version":"1.0.1085","reboot_reasons":0},"asset_manager":{"product_name":"Asset Manager","plugin_version":"1.2.0.330","reboot_reasons":0},"endpoint_detection_and_response":{"product_name":"Endpoint Detection and Response","plugin_version":"1.2.0.297","reboot_reasons":0}}],"properties":{"windows_remote_intrusion_detection_and_prevention":{"type":"object","title":"The windows_remote_intrusion_detection_and_prevention schema","default":{},"examples":[{"product_name":"Windows Remote Intrusion Detection and Prevention","plugin_version":"1.2.0.21"}],"properties":{"product_name":{"type":"string","title":"The product_name schema","default":"","examples":["Windows Remote Intrusion Detection and Prevention"]},"plugin_version":{"type":"string","title":"The plugin_version schema","default":"","examples":["1.2.0.21"]}},"additionalProperties":true},"endpoint_protection":{"type":"object","title":"The endpoint_protection schema","default":{},"examples":[{"sdk_version":"4.2.1.90","product_name":"Endpoint Protection","plugin_version":"1.2.0.844","update_package_version":"1.0.31870","component_package_version":"1.0.1085","reboot_reasons":0}],"properties":{"sdk_version":{"type":"string","title":"The sdk_version schema","default":"","examples":["4.2.1.90"]},"product_name":{"type":"string","title":"The product_name schema","default":"","examples":["Endpoint Protection"]},"plugin_version":{"type":"string","title":"The plugin_version schema","default":"","examples":["1.2.0.844"]},"update_package_version":{"type":"string","title":"The update_package_version schema","default":"","examples":["1.0.31870"]},"component_package_version":{"type":"string","title":"The component_package_version schema","default":"","examples":["1.0.1085"]},"reboot_reasons":{"type":"integer","title":"The reboot_reasons schema","default":0,"examples":[0]}},"additionalProperties":true},"asset_manager":{"type":"object","title":"The asset_manager schema","default":{},"examples":[{"product_name":"Asset Manager","plugin_version":"1.2.0.330","reboot_reasons":0}],"properties":{"product_name":{"type":"string","title":"The product_name schema","default":"","examples":["Asset Manager"]},"plugin_version":{"type":"string","title":"The plugin_version schema","default":"","examples":["1.2.0.330"]},"reboot_reasons":{"type":"integer","title":"The reboot_reasons schema","default":0,"examples":[0]}},"additionalProperties":true},"endpoint_detection_and_response":{"type":"object","title":"The endpoint_detection_and_response schema","default":{},"examples":[{"product_name":"Endpoint Detection and Response","plugin_version":"1.2.0.297","reboot_reasons":0}],"properties":{"product_name":{"type":"string","title":"The product_name schema","default":"","examples":["Endpoint Detection and Response"]},"plugin_version":{"type":"string","title":"The plugin_version schema","default":"","examples":["1.2.0.297"]},"reboot_reasons":{"type":"integer","title":"The reboot_reasons schema","default":0,"examples":[0]}},"additionalProperties":true}},"additionalProperties":true},"engine_version":{"type":"string","title":"The engine_version schema","default":"","examples":["1.2.0.821"]},"policy_etag":{"type":"string","title":"The policy_etag schema","default":"","examples":["c6ea44914b72c92cba939ac3bd369dc4"]},"last_user":{"type":"string","title":"The last_user schema","default":"","examples":["SAHAMEDW8-1X86\\Administrator"]},"host_name":{"type":"string","title":"The host_name schema","default":"","examples":["sahamedw8-1x86"]},"machine_id":{"type":"string","title":"The machine_id schema","default":"","examples":["f2bcafe1-cb2b-4833-b6c9-6148b9511c8f"]},"machine_ip":{"type":"string","title":"The machine_ip schema","default":"","examples":["216.75.233.210"]},"object_guid":{"type":"string","title":"The object_guid schema","default":""}}},{"title":"Agent information. Included if the request includes populate 'endpoint'"}]},"machine_location":{"allOf":[{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"The root schema","description":"The root schema comprises the entire JSON document.","default":{},"examples":[{"city":"Santa Clara","continent":"North America","subdivisions":["California"],"country":"United States","country_iso":"US","accuracy_radius":10,"point":{"lat":37.3417,"lon":-121.9753},"postal_code":"95051","anonymous_proxy":false,"time_zone":"America/Los_Angeles"}],"properties":{"city":{"type":"string","title":"The city schema","default":"","examples":["Santa Clara"]},"continent":{"type":"string","title":"The continent schema","default":"","examples":["North America"]},"subdivisions":{"type":"array","title":"The subdivisions schema","default":[],"examples":[["California"]],"items":{"anyOf":[{"type":"string","title":"The first anyOf schema","default":"","examples":["California"]}]}},"country":{"type":"string","title":"The country schema","default":"","examples":["United States"]},"country_iso":{"type":"string","title":"The country_iso schema","default":"","examples":["United States"]},"accuracy_radius":{"type":"integer","title":"The accuracy_radius schema","default":0,"examples":[10]},"point":{"type":"object","title":"The point schema","default":{},"examples":[{"lat":37.3417,"lon":-121.9753}],"properties":{"lat":{"allOf":[{"bignumber":true},{"type":"number","title":"The latitude","default":0,"examples":[37.3417]}]},"lon":{"allOf":[{"bignumber":true},{"type":"number","title":"The longitude","default":0,"examples":[-121.9753]}]}}},"postal_code":{"type":"string","title":"The postal_code schema","default":"","examples":["95051"]},"anonymous_proxy":{"type":"boolean","title":"The anonymous_proxy schema","default":false,"examples":[false]},"time_zone":{"type":"string","title":"The time_zone schema","default":"","examples":["America/Los_Angeles"]}}},{"title":"Machine location. Included if the request includes populate 'endpoint'"}]},"source_location":{"allOf":[{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"The root schema","description":"The root schema comprises the entire JSON document.","default":{},"examples":[{"city":"Santa Clara","continent":"North America","subdivisions":["California"],"country":"United States","country_iso":"US","accuracy_radius":10,"point":{"lat":37.3417,"lon":-121.9753},"postal_code":"95051","anonymous_proxy":false,"time_zone":"America/Los_Angeles"}],"properties":{"city":{"type":"string","title":"The city schema","default":"","examples":["Santa Clara"]},"continent":{"type":"string","title":"The continent schema","default":"","examples":["North America"]},"subdivisions":{"type":"array","title":"The subdivisions schema","default":[],"examples":[["California"]],"items":{"anyOf":[{"type":"string","title":"The first anyOf schema","default":"","examples":["California"]}]}},"country":{"type":"string","title":"The country schema","default":"","examples":["United States"]},"country_iso":{"type":"string","title":"The country_iso schema","default":"","examples":["United States"]},"accuracy_radius":{"type":"integer","title":"The accuracy_radius schema","default":0,"examples":[10]},"point":{"type":"object","title":"The point schema","default":{},"examples":[{"lat":37.3417,"lon":-121.9753}],"properties":{"lat":{"allOf":[{"bignumber":true},{"type":"number","title":"The latitude","default":0,"examples":[37.3417]}]},"lon":{"allOf":[{"bignumber":true},{"type":"number","title":"The longitude","default":0,"examples":[-121.9753]}]}}},"postal_code":{"type":"string","title":"The postal_code schema","default":"","examples":["95051"]},"anonymous_proxy":{"type":"boolean","title":"The anonymous_proxy schema","default":false,"examples":[false]},"time_zone":{"type":"string","title":"The time_zone schema","default":"","examples":["America/Los_Angeles"]}}},{"title":"Source location for RID category"}]},"destination_location":{"allOf":[{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"The root schema","description":"The root schema comprises the entire JSON document.","default":{},"examples":[{"city":"Santa Clara","continent":"North America","subdivisions":["California"],"country":"United States","country_iso":"US","accuracy_radius":10,"point":{"lat":37.3417,"lon":-121.9753},"postal_code":"95051","anonymous_proxy":false,"time_zone":"America/Los_Angeles"}],"properties":{"city":{"type":"string","title":"The city schema","default":"","examples":["Santa Clara"]},"continent":{"type":"string","title":"The continent schema","default":"","examples":["North America"]},"subdivisions":{"type":"array","title":"The subdivisions schema","default":[],"examples":[["California"]],"items":{"anyOf":[{"type":"string","title":"The first anyOf schema","default":"","examples":["California"]}]}},"country":{"type":"string","title":"The country schema","default":"","examples":["United States"]},"country_iso":{"type":"string","title":"The country_iso schema","default":"","examples":["United States"]},"accuracy_radius":{"type":"integer","title":"The accuracy_radius schema","default":0,"examples":[10]},"point":{"type":"object","title":"The point schema","default":{},"examples":[{"lat":37.3417,"lon":-121.9753}],"properties":{"lat":{"allOf":[{"bignumber":true},{"type":"number","title":"The latitude","default":0,"examples":[37.3417]}]},"lon":{"allOf":[{"bignumber":true},{"type":"number","title":"The longitude","default":0,"examples":[-121.9753]}]}}},"postal_code":{"type":"string","title":"The postal_code schema","default":"","examples":["95051"]},"anonymous_proxy":{"type":"boolean","title":"The anonymous_proxy schema","default":false,"examples":[false]},"time_zone":{"type":"string","title":"The time_zone schema","default":"","examples":["America/Los_Angeles"]}}},{"title":"Destination location for RID category"}]},"account":{"parent":{"title":"Parent account ID","type":"string"},"name":{"title":"Account name","type":"string"},"deleted":{"title":"Account deleted","type":"boolean"},"options":{"type":"object","properties":{"msp":{"type":"object","properties":{"name":{"type":"string"}}}}}},"active_directory":{"type":"object","patternProperties":{"^(user|machine)$":{"type":"object","properties":{"display_name":{"type":"string"},"distinguished_name":{"type":"string"},"sam_account_name":{"type":"string"},"ou":{"type":"string"}}}}},"rid_details":{"type":"object","title":"Remote intrusion detection details","properties":{"rule_id":{"type":"string"},"ip":{"type":"string"},"attack_user":{"type":"string"},"protocol":{"type":"string"},"port":{"type":"integer"},"attempts":{"type":"integer"},"duration":{"type":"integer"},"create_time":{"type":"string"},"expire_time":{"type":"string"},"deleted":{"type":"boolean"},"document_id":{"type":"string"},"version":{"type":"integer"}}},"device_control":{"type":"object","title":"Device control object schema","properties":{"timestamp":{"type":"string","description":"Timestamp of the detection"},"physical_disk_name":{"type":"string","description":"Physical disk name"},"device_id":{"type":"string","description":"Device ID"},"disk_interface":{"type":"string","description":"Disk interface"},"manufacturer":{"type":"string","decription":"Manufacturer"},"serial_number":{"type":"string","description":"Serial number"},"drive_compressed":{"type":"boolean","description":"Boolean field to indicate if drive is compressed"},"file_system":{"type":"string","description":"File system"},"volume_name":{"type":"string","description":"Volume name"},"volume_serial":{"type":"string","description":"Volume serial number"},"volume_device_path":{"type":"string","description":"Volume device path"},"block_status":{"type":"string","description":"Block status"},"drive_metadata":{"type":"object","decription":"Drive metadata","additionalProperties":true},"pnp_device_id":{"type":"string","decription":"PNP device ID"},"scanned_at":{"type":"string","description":"Scanned at"}}},"scan_result":{"title":"Scan Result. Included if the request includes populate 'scan_result'","type":"object","properties":{"scan_id":{"type":"string"},"account_id":{"type":"string"},"machine_id":{"type":"string"},"reported_at":{"type":"string"},"scan_type":{"type":"string"},"started_at":{"type":"string"},"started_at_offset_seconds":{"type":"integer"},"duration":{"allOf":[{"bignumber":true},{"type":"number"}]},"found_count":{"type":"integer"},"quarantined_count":{"type":"integer"},"deleted_count":{"type":"integer"},"device":{"type":"object","title":"Device control object schema","properties":{"timestamp":{"type":"string","description":"Timestamp of the detection"},"physical_disk_name":{"type":"string","description":"Physical disk name"},"device_id":{"type":"string","description":"Device ID"},"disk_interface":{"type":"string","description":"Disk interface"},"manufacturer":{"type":"string","decription":"Manufacturer"},"serial_number":{"type":"string","description":"Serial number"},"drive_compressed":{"type":"boolean","description":"Boolean field to indicate if drive is compressed"},"file_system":{"type":"string","description":"File system"},"volume_name":{"type":"string","description":"Volume name"},"volume_serial":{"type":"string","description":"Volume serial number"},"volume_device_path":{"type":"string","description":"Volume device path"},"block_status":{"type":"string","description":"Block status"},"drive_metadata":{"type":"object","decription":"Drive metadata","additionalProperties":true},"pnp_device_id":{"type":"string","decription":"PNP device ID"},"scanned_at":{"type":"string","description":"Scanned at"}}},"metadata":{"properties":{"application_version":{"type":"string"},"components_update_package_version":{"type":"string"},"cpu":{"type":"string"},"db_sdk_update_package_version":{"type":"string"},"detection_date_time":{"type":"string"},"file_system":{"type":"string"},"files_detected":{"type":"integer"},"folders_detected":{"type":"integer"},"id":{"type":"string"},"license_state":{"type":"string"},"logged_on_user_name":{"type":"string"},"modules_detected":{"type":"integer"},"os":{"type":"string"},"processes_detected":{"type":"integer"},"registry_data_detected":{"type":"integer"},"registry_keys_detected":{"type":"integer"},"registry_values_detected":{"type":"integer"},"schema_version":{"type":"integer"},"source_details":{"properties":{"objects_scanned":{"type":"integer"},"scan_duration_secs":{"type":"integer"},"scan_options":{"properties":{"pum_handling":{"type":"string"},"pup_handling":{"type":"string"},"scan_archives":{"type":"boolean"},"scan_file_system":{"type":"boolean"},"scan_memory_objects":{"type":"boolean"},"scan_pums":{"type":"boolean"},"scan_pups":{"type":"boolean"},"scan_rootkits":{"type":"boolean"},"scan_startup_and_registry":{"type":"boolean"},"scan_type":{"type":"string"},"use_heuristics":{"type":"boolean"}}},"scan_result":{"type":"string"},"type":{"type":"string"}}},"user_admin":{"type":"boolean"}}},"schedule_id":{"type":"string"},"schedule_etag":{"type":"string"},"job_id":{"type":"string"}}}}}},"aggregations":{"type":"object","title":"Aggregations","additionalProperties":true},"total_count":{"type":"integer","title":"Total count of found detections"},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}}}}},"tags":["Grid"],"operationId":"api.rmm.grid.search.detections"}},"/oneview/v1/grid/detections/search-groupby":{"post":{"description":"Search grouped detections across accounts","summary":"Search grouped detections","simple_schema":"detection-search-groupby-grid-rmm-simple","security":[{"client_credentials":["read"]},{"user_permissions":["detections.view"]}],"status":{"incident":["read_nebula_data"],"outage":["auth","search_stateful"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"title":"Detection Search Groupby Schema","type":"object","allOf":[{"type":"object","required":["group_by","page_size"],"properties":{"group_by":{"title":"Group by the following fields","type":"array","minItems":1,"uniqueItems":true,"items":{"type":"string"}},"page_size":{"type":"number","title":"The page_size Schema","minimum":50,"maximum":2000}}},{"type":"object","allOf":[{"type":"object","allOf":[{"properties":{"constraints":{"type":"array","items":{"title":"Detection Constraints","type":"object","required":["field"],"anyOf":[{"title":"String (Equals, Not Equals) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"type":"string","title":"Detection UID String Fields","enum":["trace_id","scan_id","group_id","account_id","detection_id","parent_detection_id","id","machine_id","schedule_id","job_id"]},{"title":"Detection Simple String Fields","type":"string","anyOf":[{"enum":["correlation_hash","threat_name","machine_name","group_name","path","md5","sha256","affected_application","process_name","schedule_etag","device_control.physical_disk_name","device_control.disk_interface","device_control.manufacturer","device_control.serial_number","device_control.file_system","device_control.volume_name","device_control.volume_serial","device_control.volume_device_path","scan_result.device.disk_model"]},{"title":"Active Directory Simple String Fields","type":"string","enum":["active_directory.user.display_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.user.ou.path","active_directory.machine.display_name","active_directory.machine.sam_account_name","active_directory.machine.ou","active_directory.machine.ou.path"]}]},{"type":"string","title":"Detection Enum String Fields","enum":["status","type","category","scan_result.scan_type","action_taken"]},{"title":"Agent Simple String Fields","type":"string","enum":["agent.nics.mac_address","agent.nics.description","agent.os_info.os_version","agent.os_info.os_release_name","agent.os_info.os_architecture","agent.plugins.asset_manager.plugin_version","agent.plugins.asset_manager.alerts.codes","agent.plugins.endpoint_protection.plugin_version","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.plugins.endpoint_protection.update_package_version","agent.plugins.endpoint_protection.alerts.codes","agent.plugins.endpoint_detection_and_response.plugin_version","agent.plugins.endpoint_detection_and_response.alerts.codes","agent.plugins.incident_response.plugin_version","agent.plugins.incident_response.update_package_version","agent.plugins.incident_response.alerts.codes","agent.plugins.siem.plugin_version","agent.plugins.siem.alerts.codes","agent.plugins.browser_phishing_protection.plugin_version","agent.plugins.browser_phishing_protection.alerts.codes","agent.engine_version","agent.source_location.city","agent.source_location.country","agent.source_location.subdivisions","agent.source_location.time_zone","agent.domain_name","agent.alias","agent.policy_etag","agent.serial_number","agent.available_software_updates.sdk_version.currentVersion","agent.available_software_updates.sdk_version.newVersion","agent.alerts.codes","agent.host_name","agent.fully_qualified_host_name","agent.object_guid","agent.last_user","agent.active_directory.user.display_name","agent.active_directory.user.ou","agent.active_directory.user.ou.path","agent.active_directory.user.sam_account_name","agent.active_directory.machine.display_name","agent.active_directory.machine.ou","agent.active_directory.machine.ou.path","agent.active_directory.machine.sam_account_name"]},{"title":"Agent Enum String Fields","type":"string","enum":["agent.os_info.os_type","agent.os_info.os_platform"]},{"title":"Agent Version fields","type":"string","enum":["agent.plugins.asset_manager.plugin_version","agent.plugins.endpoint_protection.plugin_version","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.plugins.endpoint_protection.update_package_version","agent.plugins.endpoint_detection_and_response.plugin_version","agent.plugins.incident_response.plugin_version","agent.plugins.incident_response.update_package_version","agent.available_software_updates.sdk_version.currentVersion","agent.available_software_updates.sdk_version.newVersion"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["equals","not_equals"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}}},"if":{"properties":{"field":{"type":"string","title":"Detection UID String Fields","enum":["trace_id","scan_id","group_id","account_id","detection_id","parent_detection_id","id","machine_id","schedule_id","job_id"]}}},"then":{"properties":{"value":{"type":["string","array"],"format":"uuid","items":{"type":"string","format":"uuid"}}}}},{"title":"String (Contains, Not Contains) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"title":"Detection Simple String Fields","type":"string","anyOf":[{"enum":["correlation_hash","threat_name","machine_name","group_name","path","md5","sha256","affected_application","process_name","schedule_etag","device_control.physical_disk_name","device_control.disk_interface","device_control.manufacturer","device_control.serial_number","device_control.file_system","device_control.volume_name","device_control.volume_serial","device_control.volume_device_path","scan_result.device.disk_model"]},{"title":"Active Directory Simple String Fields","type":"string","enum":["active_directory.user.display_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.user.ou.path","active_directory.machine.display_name","active_directory.machine.sam_account_name","active_directory.machine.ou","active_directory.machine.ou.path"]}]},{"title":"Agent Simple String Fields","type":"string","enum":["agent.nics.mac_address","agent.nics.description","agent.os_info.os_version","agent.os_info.os_release_name","agent.os_info.os_architecture","agent.plugins.asset_manager.plugin_version","agent.plugins.asset_manager.alerts.codes","agent.plugins.endpoint_protection.plugin_version","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.plugins.endpoint_protection.update_package_version","agent.plugins.endpoint_protection.alerts.codes","agent.plugins.endpoint_detection_and_response.plugin_version","agent.plugins.endpoint_detection_and_response.alerts.codes","agent.plugins.incident_response.plugin_version","agent.plugins.incident_response.update_package_version","agent.plugins.incident_response.alerts.codes","agent.plugins.siem.plugin_version","agent.plugins.siem.alerts.codes","agent.plugins.browser_phishing_protection.plugin_version","agent.plugins.browser_phishing_protection.alerts.codes","agent.engine_version","agent.source_location.city","agent.source_location.country","agent.source_location.subdivisions","agent.source_location.time_zone","agent.domain_name","agent.alias","agent.policy_etag","agent.serial_number","agent.available_software_updates.sdk_version.currentVersion","agent.available_software_updates.sdk_version.newVersion","agent.alerts.codes","agent.host_name","agent.fully_qualified_host_name","agent.object_guid","agent.last_user","agent.active_directory.user.display_name","agent.active_directory.user.ou","agent.active_directory.user.ou.path","agent.active_directory.user.sam_account_name","agent.active_directory.machine.display_name","agent.active_directory.machine.ou","agent.active_directory.machine.ou.path","agent.active_directory.machine.sam_account_name"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["contains","not_contains"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}}}},{"title":"Boolean (Equals) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"type":"string","title":"Detection Boolean Fields","enum":["is_root_detection","is_rtp_stream_event"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["equals"]},"value":{"title":"Value to search. Must be true or false","type":"boolean"}}},{"title":"Number Constraints (gt, gte, lt, lte, equals)","properties":{"field":{"type":"string","oneOf":[{"title":"Agent Number Fields","type":"string","enum":["agent.started_at_offset","agent.plugins.asset_manager.reboot_reasons","agent.plugins.endpoint_protection.reboot_reasons","agent.plugins.endpoint_detection_and_response.reboot_reasons","agent.plugins.incident_response.reboot_reasons","agent.plugins.siem.reboot_reasons","agent.os_version_major","agent.os_version_minor"]}]}},"oneOf":[{"minProperties":1,"title":"Specify Number Range","not":{"anyOf":[{"required":["operator"]},{"required":["value"]}]},"properties":{"gt":{"type":"number","title":"Greater than"},"lt":{"type":"number","title":"Less than"},"gte":{"type":"number","title":"Greater than or equals"},"lte":{"type":"number","title":"Less than or equals"}}},{"title":"Specify Exact Number","not":{"anyOf":[{"required":["gt"]},{"required":["lt"]},{"required":["gte"]},{"required":["lte"]}]},"required":["operator","value"],"properties":{"operator":{"type":"string","enum":["equals"]},"value":{"type":["number","array"],"title":"Value to search","items":{"type":"number"}}}}]},{"title":"Date (start, end) Constraints","properties":{"field":{"oneOf":[{"title":"Agent Date Fields","type":"string","enum":["agent.at","agent.started_at_local"]},{"type":"string","title":"Detection Date Fields","enum":["scanned_at","reported_at","cleaned_at","resource_created_at","resource_modified_at"]}]}},"oneOf":[{"minProperties":1,"title":"Specify Date Range","not":{"anyOf":[{"required":["operator"]},{"required":["value"]}]},"properties":{"start":{"type":"string","format":"date-time","title":"Start Date"},"end":{"type":"string","format":"date-time","title":"End Date"}}},{"title":"Specify Exact Date","not":{"anyOf":[{"required":["start"]},{"required":["end"]}]},"required":["operator","value"],"properties":{"operator":{"type":"string","enum":["equals"]},"value":{"type":["string","array"],"format":"date-time","title":"Value to search","items":{"format":"date-time"}}}}]},{"title":"IP Constraints","properties":{"field":{"oneOf":[{"title":"Agent IP Fields","type":"string","enum":["agent.nics.ips","agent.machine_ip"]}]},"operator":{"type":"string","enum":["ip"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}}}},{"title":"Field Exists/Not Exists Constraints","required":["operator"],"properties":{"field":{"type":"string","oneOf":[{"type":"string","title":"Detection UID String Fields","enum":["trace_id","scan_id","group_id","account_id","detection_id","parent_detection_id","id","machine_id","schedule_id","job_id"]},{"title":"Detection Simple String Fields","type":"string","anyOf":[{"enum":["correlation_hash","threat_name","machine_name","group_name","path","md5","sha256","affected_application","process_name","schedule_etag","device_control.physical_disk_name","device_control.disk_interface","device_control.manufacturer","device_control.serial_number","device_control.file_system","device_control.volume_name","device_control.volume_serial","device_control.volume_device_path","scan_result.device.disk_model"]},{"title":"Active Directory Simple String Fields","type":"string","enum":["active_directory.user.display_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.user.ou.path","active_directory.machine.display_name","active_directory.machine.sam_account_name","active_directory.machine.ou","active_directory.machine.ou.path"]}]},{"type":"string","title":"Detection Enum String Fields","enum":["status","type","category","scan_result.scan_type","action_taken"]},{"title":"Agent Simple String Fields","type":"string","enum":["agent.nics.mac_address","agent.nics.description","agent.os_info.os_version","agent.os_info.os_release_name","agent.os_info.os_architecture","agent.plugins.asset_manager.plugin_version","agent.plugins.asset_manager.alerts.codes","agent.plugins.endpoint_protection.plugin_version","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.plugins.endpoint_protection.update_package_version","agent.plugins.endpoint_protection.alerts.codes","agent.plugins.endpoint_detection_and_response.plugin_version","agent.plugins.endpoint_detection_and_response.alerts.codes","agent.plugins.incident_response.plugin_version","agent.plugins.incident_response.update_package_version","agent.plugins.incident_response.alerts.codes","agent.plugins.siem.plugin_version","agent.plugins.siem.alerts.codes","agent.plugins.browser_phishing_protection.plugin_version","agent.plugins.browser_phishing_protection.alerts.codes","agent.engine_version","agent.source_location.city","agent.source_location.country","agent.source_location.subdivisions","agent.source_location.time_zone","agent.domain_name","agent.alias","agent.policy_etag","agent.serial_number","agent.available_software_updates.sdk_version.currentVersion","agent.available_software_updates.sdk_version.newVersion","agent.alerts.codes","agent.host_name","agent.fully_qualified_host_name","agent.object_guid","agent.last_user","agent.active_directory.user.display_name","agent.active_directory.user.ou","agent.active_directory.user.ou.path","agent.active_directory.user.sam_account_name","agent.active_directory.machine.display_name","agent.active_directory.machine.ou","agent.active_directory.machine.ou.path","agent.active_directory.machine.sam_account_name"]},{"title":"Agent Enum String Fields","type":"string","enum":["agent.os_info.os_type","agent.os_info.os_platform"]},{"title":"Agent Version fields","type":"string","enum":["agent.plugins.asset_manager.plugin_version","agent.plugins.endpoint_protection.plugin_version","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.plugins.endpoint_protection.update_package_version","agent.plugins.endpoint_detection_and_response.plugin_version","agent.plugins.incident_response.plugin_version","agent.plugins.incident_response.update_package_version","agent.available_software_updates.sdk_version.currentVersion","agent.available_software_updates.sdk_version.newVersion"]},{"title":"Agent Date Fields","type":"string","enum":["agent.at","agent.started_at_local"]},{"type":"string","title":"Detection Date Fields","enum":["scanned_at","reported_at","cleaned_at","resource_created_at","resource_modified_at"]},{"type":"string","title":"Detection Boolean Fields","enum":["is_root_detection","is_rtp_stream_event"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["exists","not_exists"]}}},{"title":"Number Constraints (gt, gte, lt, lte, equals)","properties":{"field":{"type":"string","oneOf":[{"title":"Detection Number Fields","type":"string","enum":["rid_details.port","rid_details.attempts","rid_details.duration"]}]}},"oneOf":[{"minProperties":1,"title":"Specify Number Range","not":{"anyOf":[{"required":["operator"]},{"required":["value"]}]},"properties":{"gt":{"type":"number","title":"Greater than"},"lt":{"type":"number","title":"Less than"},"gte":{"type":"number","title":"Greater than or equals"},"lte":{"type":"number","title":"Less than or equals"}}},{"title":"Specify Exact Number","not":{"anyOf":[{"required":["gt"]},{"required":["lt"]},{"required":["gte"]},{"required":["lte"]}]},"required":["operator","value"],"properties":{"operator":{"type":"string","enum":["equals"]},"value":{"type":["number","array"],"title":"Value to search","items":{"type":"number"}}}}]}]},"examples":[[{"field":"trace_id","value":"ccb84b33-2d8e-4dcb-94a0-922fc669ce4a","operator":"equals"}]]},"aggregations":{"items":{"type":"string","title":"Detection aggregation fields","enum":["trace_id","scan_id","machine_id","group_id","account_id","detection_id","parent_detection_id","correlation_hash","status","threat_name","type","path","category","md5","affected_application","process_name","machine_name","daily_detections_by_category","protection_status","agent.os_info.os_release_name","agent.nics.ips","agent.nics.mac_address","agent.nics.description","agent.os_info.os_type","agent.os_info.os_version","agent.os_info.os_platform","agent.os_info.os_architecture","agent.host_name","agent.fully_qualified_host_name","agent.plugins.asset_manager.plugin_version","agent.plugins.asset_manager.reboot_reason","agent.plugins.endpoint_protection.plugin_version","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.plugins.endpoint_protection.update_package_version","agent.plugins.endpoint_protection.reboot_reason","agent.plugins.endpoint_detection_response.plugin_version","agent.plugins.endpoint_detection_response.reboot_reason","agent.plugins.endpoint_detection_and_response.plugin_version","agent.plugins.endpoint_detection_and_response.reboot_reason","agent.plugins.incident_response.plugin_version","agent.plugins.incident_response.reboot_reason","agent.plugins.siem.plugin_version","agent.plugins.browser_phishing_protection.plugin_version","agent.plugins.siem.reboot_reason","agent.engine_version","agent.domain_name","agent.policy_etag","agent.last_user","agent.object_guid","scan_result.device.disk_model","category_by_status"]}},"sort_field":{"type":"string","title":"Detection sort fields","anyOf":[{"enum":["trace_id","scan_id","machine_id","group_id","group_name","account_id","account_name","detection_id","parent_detection_id","correlation_hash","status","threat_name","type","path","category","md5","sha256","affected_application","process_name","machine_name","scanned_at","reported_at","resource_created_at","resource_modified_at","cleaned_at","is_root_detection","is_rtp_stream_event","agent.object_guid","agent.last_user","agent.engine_version","agent.os_info.os_type","agent.os_info.os_version","agent.os_info.os_platform","agent.os_info.os_architecture","agent.os_info.os_release_name","agent.nics.ips","scan_result.device.disk_model"]},{"type":"string","title":"Active Directory Sort Fields","enum":["active_directory.user.display_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.machine.display_name","active_directory.machine.sam_account_name","active_directory.machine.ou"]}]},"start_date":{"type":"string","title":"Get results after this date","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"end_date":{"type":"string","title":"Get results before this date","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]}}},{"type":"object","title":"Base Search Schema","properties":{"aggregations":{"type":"array","title":"The fields onto which you can perform aggregations","items":{"type":"string","title":"The Items Schema"}},"page_size":{"type":"number","title":"The page size. If you just need to aggregate, set it to 0","minimum":0,"maximum":2000},"sort_field":{"title":"Sort Fields","type":"string"},"sort_order":{"type":"string","title":"Whether sorting should be ascending or descending","enum":["asc","desc"]},"aggregate_by_account":{"type":"boolean","title":"Indicates whether aggregations should be scoped by account"},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}]},{"type":"object","required":["account_ids"],"properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]},{"properties":{"group_by":{"type":"array","title":"Group results by indicated field(s)","items":{"type":"string","title":"Detection Groupby Fields","anyOf":[{"enum":["account_id","group_id","group_name","machine_id","type","status","category","affected_application","threat_name","process_name","agent.os_info.os_type","agent.os_info.os_version","agent.os_info.os_release_name","agent.os_info.os_platform","agent.object_guid","agent.last_user","agent.engine_version","sha256","md5","scan_result.device.disk_model","action_taken","path"]},{"type":"string","title":"Active Directory Group By Fields","enum":["active_directory.user.display_name","active_directory.user.ou","active_directory.machine.display_name","active_directory.machine.ou"]}]}}}}]}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"The Post Detections Search GroupBy Response Schema","required":["results","next_cursor"],"properties":{"results":{"type":"array","title":"The Results Schema","default":[]},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}}}}},"tags":["Grid"],"operationId":"api.rmm.grid.search.detections.group"}},"/oneview/v1/grid/device-control/export":{"post":{"description":"Search DNS activity across accounts","summary":"Export device control events","simple_schema":"device-control-export-grid-rmm-simple","security":[{"client_credentials":["read"]},{"user_permissions":["deviceControl.view"]}],"status":{"outage":["auth","search_stateless"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"title":"Device Control Export Schema","type":"object","allOf":[{"type":"object","title":"Base Export Schema","required":["groups","select","format"],"properties":{"format":{"type":"string","title":"The output file","enum":["csv","xlsx","html","ods","txt","rtf","json"]},"download":{"type":"boolean","title":"Whether to instruct the client to download the response as a file. Only clients like browsers are supported"},"type":{"type":"string","title":"The encoding of the output","enum":["string","base64","binary"],"default":"string"},"select":{"type":"array","title":"Which fields to select from the response","items":{"type":"object","title":"Field","required":["field","newField"],"properties":{"newField":{"type":"string","title":"the new value"},"field":{"type":"string","title":"The response field to map to a new value"}}}},"groups":{"type":"array","title":"List of queries","items":{"type":"object"}}}},{"properties":{"select":{"items":{"properties":{"field":{"field":{"type":"string","title":"Device control select fields","anyOf":[{"enum":["type","group_id","path","status","id","machine_id","account_id","account.name","group.name","detection_id","scanned_at","scanned_at_offset_seconds","reported_at","category","is_rtp_stream_event","process_name","cleaned_at","machine_name","machine_ip","child_trace_count","source_location","destination_location","machine_location","trace_ip","trace_port","threat_name","is_root_detection","agent.at","agent.last_user","agent.fully_qualified_host_name","agent.started_at_local","agent.started_at_offset","agent.os_info.os_type","agent.os_info.os_version","agent.os_info.os_platform","agent.os_info.os_architecture","agent.os_info.os_release_name","agent.domain_name","agent.engine_version","agent.policy_etag","agent.host_name","agent.nics.ips","agent.nics.mac_address","agent.protection_status","agent.object_guid","sha256","md5","device_control.physical_disk_name","device_control.pnp_device_id","device_control.device_id","device_control.disk_interface","device_control.manufacturer","device_control.serial_number","device_control.file_system","device_control.volume_name","device_control.volume_serial","device_control.volume_device_path","device_control.block_status","device_control.timestamp","device_control.drive_compressed","action_taken","agent.online"]},{"type":"string","title":"Active Directory Select Fields","enum":["active_directory.user.display_name","active_directory.user.distinguished_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.machine.display_name","active_directory.machine.distinguished_name","active_directory.machine.sam_account_name","active_directory.machine.ou"]}]}}}}},"groups":{"items":{"title":"List of queries to fetch device control events","allOf":[{"type":"object","allOf":[{"type":"object","allOf":[{"properties":{"constraints":{"type":"array","items":{"title":"Device Control Constraints","type":"object","required":["field"],"anyOf":[{"title":"String (Equals, Not Equals) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"type":"string","title":"Detection UID String Fields","enum":["trace_id","scan_id","group_id","account_id","detection_id","parent_detection_id","id","machine_id","schedule_id","job_id"]},{"title":"Detection Simple String Fields","type":"string","anyOf":[{"enum":["correlation_hash","threat_name","machine_name","group_name","path","md5","sha256","affected_application","process_name","schedule_etag","device_control.physical_disk_name","device_control.disk_interface","device_control.manufacturer","device_control.serial_number","device_control.file_system","device_control.volume_name","device_control.volume_serial","device_control.volume_device_path","scan_result.device.disk_model"]},{"title":"Active Directory Simple String Fields","type":"string","enum":["active_directory.user.display_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.user.ou.path","active_directory.machine.display_name","active_directory.machine.sam_account_name","active_directory.machine.ou","active_directory.machine.ou.path"]}]},{"type":"string","title":"Detection Enum String Fields","enum":["status","type","category","scan_result.scan_type","action_taken"]},{"title":"Agent Simple String Fields","type":"string","enum":["agent.nics.mac_address","agent.nics.description","agent.os_info.os_version","agent.os_info.os_release_name","agent.os_info.os_architecture","agent.plugins.asset_manager.plugin_version","agent.plugins.asset_manager.alerts.codes","agent.plugins.endpoint_protection.plugin_version","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.plugins.endpoint_protection.update_package_version","agent.plugins.endpoint_protection.alerts.codes","agent.plugins.endpoint_detection_and_response.plugin_version","agent.plugins.endpoint_detection_and_response.alerts.codes","agent.plugins.incident_response.plugin_version","agent.plugins.incident_response.update_package_version","agent.plugins.incident_response.alerts.codes","agent.plugins.siem.plugin_version","agent.plugins.siem.alerts.codes","agent.plugins.browser_phishing_protection.plugin_version","agent.plugins.browser_phishing_protection.alerts.codes","agent.engine_version","agent.source_location.city","agent.source_location.country","agent.source_location.subdivisions","agent.source_location.time_zone","agent.domain_name","agent.alias","agent.policy_etag","agent.serial_number","agent.available_software_updates.sdk_version.currentVersion","agent.available_software_updates.sdk_version.newVersion","agent.alerts.codes","agent.host_name","agent.fully_qualified_host_name","agent.object_guid","agent.last_user","agent.active_directory.user.display_name","agent.active_directory.user.ou","agent.active_directory.user.ou.path","agent.active_directory.user.sam_account_name","agent.active_directory.machine.display_name","agent.active_directory.machine.ou","agent.active_directory.machine.ou.path","agent.active_directory.machine.sam_account_name"]},{"title":"Agent Enum String Fields","type":"string","enum":["agent.os_info.os_type","agent.os_info.os_platform"]},{"title":"Agent Version fields","type":"string","enum":["agent.plugins.asset_manager.plugin_version","agent.plugins.endpoint_protection.plugin_version","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.plugins.endpoint_protection.update_package_version","agent.plugins.endpoint_detection_and_response.plugin_version","agent.plugins.incident_response.plugin_version","agent.plugins.incident_response.update_package_version","agent.available_software_updates.sdk_version.currentVersion","agent.available_software_updates.sdk_version.newVersion"]},{"type":"string","title":"Device Control UID String Fields","enum":["device_control.pnp_device_id","device_control.device_id"]},{"title":"Device Control Simple String Fields","type":"string","enum":["device_control.physical_disk_name","device_control.disk_interface","device_control.manufacturer","device_control.serial_number","device_control.file_system","device_control.volume_name","device_control.volume_serial","device_control.volume_device_path","device_control.access"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["equals","not_equals"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}}},"if":{"properties":{"field":{"type":"string","title":"Detection UID String Fields","enum":["trace_id","scan_id","group_id","account_id","detection_id","parent_detection_id","id","machine_id","schedule_id","job_id"]}}},"then":{"properties":{"value":{"type":["string","array"],"format":"uuid","items":{"type":"string","format":"uuid"}}}}},{"title":"String (Contains, Not Contains) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"title":"Detection Simple String Fields","type":"string","anyOf":[{"enum":["correlation_hash","threat_name","machine_name","group_name","path","md5","sha256","affected_application","process_name","schedule_etag","device_control.physical_disk_name","device_control.disk_interface","device_control.manufacturer","device_control.serial_number","device_control.file_system","device_control.volume_name","device_control.volume_serial","device_control.volume_device_path","scan_result.device.disk_model"]},{"title":"Active Directory Simple String Fields","type":"string","enum":["active_directory.user.display_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.user.ou.path","active_directory.machine.display_name","active_directory.machine.sam_account_name","active_directory.machine.ou","active_directory.machine.ou.path"]}]},{"title":"Agent Simple String Fields","type":"string","enum":["agent.nics.mac_address","agent.nics.description","agent.os_info.os_version","agent.os_info.os_release_name","agent.os_info.os_architecture","agent.plugins.asset_manager.plugin_version","agent.plugins.asset_manager.alerts.codes","agent.plugins.endpoint_protection.plugin_version","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.plugins.endpoint_protection.update_package_version","agent.plugins.endpoint_protection.alerts.codes","agent.plugins.endpoint_detection_and_response.plugin_version","agent.plugins.endpoint_detection_and_response.alerts.codes","agent.plugins.incident_response.plugin_version","agent.plugins.incident_response.update_package_version","agent.plugins.incident_response.alerts.codes","agent.plugins.siem.plugin_version","agent.plugins.siem.alerts.codes","agent.plugins.browser_phishing_protection.plugin_version","agent.plugins.browser_phishing_protection.alerts.codes","agent.engine_version","agent.source_location.city","agent.source_location.country","agent.source_location.subdivisions","agent.source_location.time_zone","agent.domain_name","agent.alias","agent.policy_etag","agent.serial_number","agent.available_software_updates.sdk_version.currentVersion","agent.available_software_updates.sdk_version.newVersion","agent.alerts.codes","agent.host_name","agent.fully_qualified_host_name","agent.object_guid","agent.last_user","agent.active_directory.user.display_name","agent.active_directory.user.ou","agent.active_directory.user.ou.path","agent.active_directory.user.sam_account_name","agent.active_directory.machine.display_name","agent.active_directory.machine.ou","agent.active_directory.machine.ou.path","agent.active_directory.machine.sam_account_name"]},{"title":"Device Control Simple String Fields","type":"string","enum":["device_control.physical_disk_name","device_control.disk_interface","device_control.manufacturer","device_control.serial_number","device_control.file_system","device_control.volume_name","device_control.volume_serial","device_control.volume_device_path","device_control.access"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["contains","not_contains"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}}}},{"title":"Number Constraints (gt, gte, lt, lte, equals)","properties":{"field":{"type":"string","oneOf":[{"title":"Agent Number Fields","type":"string","enum":["agent.started_at_offset","agent.plugins.asset_manager.reboot_reasons","agent.plugins.endpoint_protection.reboot_reasons","agent.plugins.endpoint_detection_and_response.reboot_reasons","agent.plugins.incident_response.reboot_reasons","agent.plugins.siem.reboot_reasons","agent.os_version_major","agent.os_version_minor"]}]}},"oneOf":[{"minProperties":1,"title":"Specify Number Range","not":{"anyOf":[{"required":["operator"]},{"required":["value"]}]},"properties":{"gt":{"type":"number","title":"Greater than"},"lt":{"type":"number","title":"Less than"},"gte":{"type":"number","title":"Greater than or equals"},"lte":{"type":"number","title":"Less than or equals"}}},{"title":"Specify Exact Number","not":{"anyOf":[{"required":["gt"]},{"required":["lt"]},{"required":["gte"]},{"required":["lte"]}]},"required":["operator","value"],"properties":{"operator":{"type":"string","enum":["equals"]},"value":{"type":["number","array"],"title":"Value to search","items":{"type":"number"}}}}]},{"title":"Boolean (Equals) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"type":"string","title":"Detection Boolean Fields","enum":["is_root_detection","is_rtp_stream_event"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["equals"]},"value":{"title":"Value to search. Must be true or false","type":"boolean"}}},{"title":"Date (start, end) Constraints","properties":{"field":{"oneOf":[{"title":"Agent Date Fields","type":"string","enum":["agent.at","agent.started_at_local"]},{"type":"string","title":"Detection Date Fields","enum":["scanned_at","reported_at","cleaned_at","resource_created_at","resource_modified_at"]},{"type":"string","title":"Device Control Date Fields","enum":["device_control.timestamp"]}]}},"oneOf":[{"minProperties":1,"title":"Specify Date Range","not":{"anyOf":[{"required":["operator"]},{"required":["value"]}]},"properties":{"start":{"type":"string","format":"date-time","title":"Start Date"},"end":{"type":"string","format":"date-time","title":"End Date"}}},{"title":"Specify Exact Date","not":{"anyOf":[{"required":["start"]},{"required":["end"]}]},"required":["operator","value"],"properties":{"operator":{"type":"string","enum":["equals"]},"value":{"type":["string","array"],"format":"date-time","title":"Value to search","items":{"format":"date-time"}}}}]},{"title":"IP Constraints","properties":{"field":{"oneOf":[{"title":"Agent IP Fields","type":"string","enum":["agent.nics.ips","agent.machine_ip"]}]},"operator":{"type":"string","enum":["ip"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}}}},{"title":"Field Exists/Not Exists Constraints","required":["operator"],"properties":{"field":{"type":"string","oneOf":[{"type":"string","title":"Detection UID String Fields","enum":["trace_id","scan_id","group_id","account_id","detection_id","parent_detection_id","id","machine_id","schedule_id","job_id"]},{"title":"Detection Simple String Fields","type":"string","anyOf":[{"enum":["correlation_hash","threat_name","machine_name","group_name","path","md5","sha256","affected_application","process_name","schedule_etag","device_control.physical_disk_name","device_control.disk_interface","device_control.manufacturer","device_control.serial_number","device_control.file_system","device_control.volume_name","device_control.volume_serial","device_control.volume_device_path","scan_result.device.disk_model"]},{"title":"Active Directory Simple String Fields","type":"string","enum":["active_directory.user.display_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.user.ou.path","active_directory.machine.display_name","active_directory.machine.sam_account_name","active_directory.machine.ou","active_directory.machine.ou.path"]}]},{"type":"string","title":"Detection Enum String Fields","enum":["status","type","category","scan_result.scan_type","action_taken"]},{"title":"Agent Simple String Fields","type":"string","enum":["agent.nics.mac_address","agent.nics.description","agent.os_info.os_version","agent.os_info.os_release_name","agent.os_info.os_architecture","agent.plugins.asset_manager.plugin_version","agent.plugins.asset_manager.alerts.codes","agent.plugins.endpoint_protection.plugin_version","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.plugins.endpoint_protection.update_package_version","agent.plugins.endpoint_protection.alerts.codes","agent.plugins.endpoint_detection_and_response.plugin_version","agent.plugins.endpoint_detection_and_response.alerts.codes","agent.plugins.incident_response.plugin_version","agent.plugins.incident_response.update_package_version","agent.plugins.incident_response.alerts.codes","agent.plugins.siem.plugin_version","agent.plugins.siem.alerts.codes","agent.plugins.browser_phishing_protection.plugin_version","agent.plugins.browser_phishing_protection.alerts.codes","agent.engine_version","agent.source_location.city","agent.source_location.country","agent.source_location.subdivisions","agent.source_location.time_zone","agent.domain_name","agent.alias","agent.policy_etag","agent.serial_number","agent.available_software_updates.sdk_version.currentVersion","agent.available_software_updates.sdk_version.newVersion","agent.alerts.codes","agent.host_name","agent.fully_qualified_host_name","agent.object_guid","agent.last_user","agent.active_directory.user.display_name","agent.active_directory.user.ou","agent.active_directory.user.ou.path","agent.active_directory.user.sam_account_name","agent.active_directory.machine.display_name","agent.active_directory.machine.ou","agent.active_directory.machine.ou.path","agent.active_directory.machine.sam_account_name"]},{"title":"Agent Enum String Fields","type":"string","enum":["agent.os_info.os_type","agent.os_info.os_platform"]},{"title":"Agent Version fields","type":"string","enum":["agent.plugins.asset_manager.plugin_version","agent.plugins.endpoint_protection.plugin_version","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.plugins.endpoint_protection.update_package_version","agent.plugins.endpoint_detection_and_response.plugin_version","agent.plugins.incident_response.plugin_version","agent.plugins.incident_response.update_package_version","agent.available_software_updates.sdk_version.currentVersion","agent.available_software_updates.sdk_version.newVersion"]},{"title":"Agent Date Fields","type":"string","enum":["agent.at","agent.started_at_local"]},{"type":"string","title":"Detection Date Fields","enum":["scanned_at","reported_at","cleaned_at","resource_created_at","resource_modified_at"]},{"type":"string","title":"Detection Boolean Fields","enum":["is_root_detection","is_rtp_stream_event"]},{"type":"string","title":"Device Control UID String Fields","enum":["device_control.pnp_device_id","device_control.device_id"]},{"title":"Device Control Simple String Fields","type":"string","enum":["device_control.physical_disk_name","device_control.disk_interface","device_control.manufacturer","device_control.serial_number","device_control.file_system","device_control.volume_name","device_control.volume_serial","device_control.volume_device_path","device_control.access"]},{"type":"string","title":"Device Control Date Fields","enum":["device_control.timestamp"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["exists","not_exists"]}}}]},"examples":[[{"field":"trace_id","value":"ccb84b33-2d8e-4dcb-94a0-922fc669ce4a","operator":"equals"}]]},"aggregations":{"items":{"type":"string","title":"Device Control aggregation fields","enum":["trace_id","scan_id","machine_id","group_id","account_id","detection_id","parent_detection_id","correlation_hash","status","threat_name","type","path","category","md5","affected_application","process_name","machine_name","daily_detections_by_category","protection_status","agent.os_info.os_release_name","agent.nics.ips","agent.nics.mac_address","agent.nics.description","agent.os_info.os_type","agent.os_info.os_version","agent.os_info.os_platform","agent.os_info.os_architecture","agent.host_name","agent.fully_qualified_host_name","agent.plugins.asset_manager.plugin_version","agent.plugins.asset_manager.reboot_reason","agent.plugins.endpoint_protection.plugin_version","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.plugins.endpoint_protection.update_package_version","agent.plugins.endpoint_protection.reboot_reason","agent.plugins.endpoint_detection_response.plugin_version","agent.plugins.endpoint_detection_response.reboot_reason","agent.plugins.endpoint_detection_and_response.plugin_version","agent.plugins.endpoint_detection_and_response.reboot_reason","agent.plugins.incident_response.plugin_version","agent.plugins.incident_response.reboot_reason","agent.plugins.siem.plugin_version","agent.plugins.browser_phishing_protection.plugin_version","agent.plugins.siem.reboot_reason","agent.engine_version","agent.domain_name","agent.policy_etag","agent.last_user","agent.object_guid","device_control.physical_disk_name","device_control.pnp_device_id","device_control.device_id","device_control.disk_interface","device_control.manufacturer","device_control.serial_number","device_control.file_system","device_control.volume_name","device_control.volume_serial","device_control.volume_device_path","device_control.block_status","device_control.drive_compressed","device_control.timestamp"]}},"sort_field":{"type":"string","title":"If the sort field is used, then sort_order is required.","enum":["trace_id","scan_id","machine_id","group_id","account_id","detection_id","parent_detection_id","correlation_hash","status","threat_name.keyword","type","path.keyword","category","md5","sha256","affected_application.keyword","process_name.keyword","machine_name.keyword","scanned_at","reported_at","cleaned_at","is_root_detection","is_rtp_stream_event","object_guid","device_control.physical_disk_name","device_control.pnp_device_id","device_control.device_id","device_control.disk_interface","device_control.manufacturer","device_control.serial_number","device_control.file_system","device_control.volume_name","device_control.volume_serial","device_control.volume_device_path","device_control.block_status","device_control.drive_compressed","device_control.timestamp"]}}},{"type":"object","title":"Base Search Schema","properties":{"aggregations":{"type":"array","title":"The fields onto which you can perform aggregations","items":{"type":"string","title":"The Items Schema"}},"page_size":{"type":"number","title":"The page size. If you just need to aggregate, set it to 0","minimum":0,"maximum":2000},"sort_field":{"title":"Sort Fields","type":"string"},"sort_order":{"type":"string","title":"Whether sorting should be ascending or descending","enum":["asc","desc"]},"aggregate_by_account":{"type":"boolean","title":"Indicates whether aggregations should be scoped by account"},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}]},{"type":"object","required":["account_ids"],"properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]}]}}}}]}}}},"responses":{"200":{"description":"Successful response"}},"tags":["Grid"],"operationId":"api.rmm.grid.export.device_control"}},"/oneview/v1/grid/device-control/export/async":{"post":{"description":"Search DNS activity across accounts","summary":"Export device control events asynchronously","simple_schema":"device-control-export-grid-rmm-simple","security":[{"client_credentials":["read"]},{"user_permissions":["deviceControl.view"]}],"status":{"outage":["auth","search_stateless"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"title":"Device Control Export Schema","type":"object","allOf":[{"type":"object","title":"Base Export Schema","required":["groups","select","format"],"properties":{"format":{"type":"string","title":"The output file","enum":["csv","xlsx","html","ods","txt","rtf","json"]},"download":{"type":"boolean","title":"Whether to instruct the client to download the response as a file. Only clients like browsers are supported"},"type":{"type":"string","title":"The encoding of the output","enum":["string","base64","binary"],"default":"string"},"select":{"type":"array","title":"Which fields to select from the response","items":{"type":"object","title":"Field","required":["field","newField"],"properties":{"newField":{"type":"string","title":"the new value"},"field":{"type":"string","title":"The response field to map to a new value"}}}},"groups":{"type":"array","title":"List of queries","items":{"type":"object"}}}},{"properties":{"select":{"items":{"properties":{"field":{"field":{"type":"string","title":"Device control select fields","anyOf":[{"enum":["type","group_id","path","status","id","machine_id","account_id","account.name","group.name","detection_id","scanned_at","scanned_at_offset_seconds","reported_at","category","is_rtp_stream_event","process_name","cleaned_at","machine_name","machine_ip","child_trace_count","source_location","destination_location","machine_location","trace_ip","trace_port","threat_name","is_root_detection","agent.at","agent.last_user","agent.fully_qualified_host_name","agent.started_at_local","agent.started_at_offset","agent.os_info.os_type","agent.os_info.os_version","agent.os_info.os_platform","agent.os_info.os_architecture","agent.os_info.os_release_name","agent.domain_name","agent.engine_version","agent.policy_etag","agent.host_name","agent.nics.ips","agent.nics.mac_address","agent.protection_status","agent.object_guid","sha256","md5","device_control.physical_disk_name","device_control.pnp_device_id","device_control.device_id","device_control.disk_interface","device_control.manufacturer","device_control.serial_number","device_control.file_system","device_control.volume_name","device_control.volume_serial","device_control.volume_device_path","device_control.block_status","device_control.timestamp","device_control.drive_compressed","action_taken","agent.online"]},{"type":"string","title":"Active Directory Select Fields","enum":["active_directory.user.display_name","active_directory.user.distinguished_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.machine.display_name","active_directory.machine.distinguished_name","active_directory.machine.sam_account_name","active_directory.machine.ou"]}]}}}}},"groups":{"items":{"title":"List of queries to fetch device control events","allOf":[{"type":"object","allOf":[{"type":"object","allOf":[{"properties":{"constraints":{"type":"array","items":{"title":"Device Control Constraints","type":"object","required":["field"],"anyOf":[{"title":"String (Equals, Not Equals) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"type":"string","title":"Detection UID String Fields","enum":["trace_id","scan_id","group_id","account_id","detection_id","parent_detection_id","id","machine_id","schedule_id","job_id"]},{"title":"Detection Simple String Fields","type":"string","anyOf":[{"enum":["correlation_hash","threat_name","machine_name","group_name","path","md5","sha256","affected_application","process_name","schedule_etag","device_control.physical_disk_name","device_control.disk_interface","device_control.manufacturer","device_control.serial_number","device_control.file_system","device_control.volume_name","device_control.volume_serial","device_control.volume_device_path","scan_result.device.disk_model"]},{"title":"Active Directory Simple String Fields","type":"string","enum":["active_directory.user.display_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.user.ou.path","active_directory.machine.display_name","active_directory.machine.sam_account_name","active_directory.machine.ou","active_directory.machine.ou.path"]}]},{"type":"string","title":"Detection Enum String Fields","enum":["status","type","category","scan_result.scan_type","action_taken"]},{"title":"Agent Simple String Fields","type":"string","enum":["agent.nics.mac_address","agent.nics.description","agent.os_info.os_version","agent.os_info.os_release_name","agent.os_info.os_architecture","agent.plugins.asset_manager.plugin_version","agent.plugins.asset_manager.alerts.codes","agent.plugins.endpoint_protection.plugin_version","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.plugins.endpoint_protection.update_package_version","agent.plugins.endpoint_protection.alerts.codes","agent.plugins.endpoint_detection_and_response.plugin_version","agent.plugins.endpoint_detection_and_response.alerts.codes","agent.plugins.incident_response.plugin_version","agent.plugins.incident_response.update_package_version","agent.plugins.incident_response.alerts.codes","agent.plugins.siem.plugin_version","agent.plugins.siem.alerts.codes","agent.plugins.browser_phishing_protection.plugin_version","agent.plugins.browser_phishing_protection.alerts.codes","agent.engine_version","agent.source_location.city","agent.source_location.country","agent.source_location.subdivisions","agent.source_location.time_zone","agent.domain_name","agent.alias","agent.policy_etag","agent.serial_number","agent.available_software_updates.sdk_version.currentVersion","agent.available_software_updates.sdk_version.newVersion","agent.alerts.codes","agent.host_name","agent.fully_qualified_host_name","agent.object_guid","agent.last_user","agent.active_directory.user.display_name","agent.active_directory.user.ou","agent.active_directory.user.ou.path","agent.active_directory.user.sam_account_name","agent.active_directory.machine.display_name","agent.active_directory.machine.ou","agent.active_directory.machine.ou.path","agent.active_directory.machine.sam_account_name"]},{"title":"Agent Enum String Fields","type":"string","enum":["agent.os_info.os_type","agent.os_info.os_platform"]},{"title":"Agent Version fields","type":"string","enum":["agent.plugins.asset_manager.plugin_version","agent.plugins.endpoint_protection.plugin_version","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.plugins.endpoint_protection.update_package_version","agent.plugins.endpoint_detection_and_response.plugin_version","agent.plugins.incident_response.plugin_version","agent.plugins.incident_response.update_package_version","agent.available_software_updates.sdk_version.currentVersion","agent.available_software_updates.sdk_version.newVersion"]},{"type":"string","title":"Device Control UID String Fields","enum":["device_control.pnp_device_id","device_control.device_id"]},{"title":"Device Control Simple String Fields","type":"string","enum":["device_control.physical_disk_name","device_control.disk_interface","device_control.manufacturer","device_control.serial_number","device_control.file_system","device_control.volume_name","device_control.volume_serial","device_control.volume_device_path","device_control.access"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["equals","not_equals"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}}},"if":{"properties":{"field":{"type":"string","title":"Detection UID String Fields","enum":["trace_id","scan_id","group_id","account_id","detection_id","parent_detection_id","id","machine_id","schedule_id","job_id"]}}},"then":{"properties":{"value":{"type":["string","array"],"format":"uuid","items":{"type":"string","format":"uuid"}}}}},{"title":"String (Contains, Not Contains) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"title":"Detection Simple String Fields","type":"string","anyOf":[{"enum":["correlation_hash","threat_name","machine_name","group_name","path","md5","sha256","affected_application","process_name","schedule_etag","device_control.physical_disk_name","device_control.disk_interface","device_control.manufacturer","device_control.serial_number","device_control.file_system","device_control.volume_name","device_control.volume_serial","device_control.volume_device_path","scan_result.device.disk_model"]},{"title":"Active Directory Simple String Fields","type":"string","enum":["active_directory.user.display_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.user.ou.path","active_directory.machine.display_name","active_directory.machine.sam_account_name","active_directory.machine.ou","active_directory.machine.ou.path"]}]},{"title":"Agent Simple String Fields","type":"string","enum":["agent.nics.mac_address","agent.nics.description","agent.os_info.os_version","agent.os_info.os_release_name","agent.os_info.os_architecture","agent.plugins.asset_manager.plugin_version","agent.plugins.asset_manager.alerts.codes","agent.plugins.endpoint_protection.plugin_version","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.plugins.endpoint_protection.update_package_version","agent.plugins.endpoint_protection.alerts.codes","agent.plugins.endpoint_detection_and_response.plugin_version","agent.plugins.endpoint_detection_and_response.alerts.codes","agent.plugins.incident_response.plugin_version","agent.plugins.incident_response.update_package_version","agent.plugins.incident_response.alerts.codes","agent.plugins.siem.plugin_version","agent.plugins.siem.alerts.codes","agent.plugins.browser_phishing_protection.plugin_version","agent.plugins.browser_phishing_protection.alerts.codes","agent.engine_version","agent.source_location.city","agent.source_location.country","agent.source_location.subdivisions","agent.source_location.time_zone","agent.domain_name","agent.alias","agent.policy_etag","agent.serial_number","agent.available_software_updates.sdk_version.currentVersion","agent.available_software_updates.sdk_version.newVersion","agent.alerts.codes","agent.host_name","agent.fully_qualified_host_name","agent.object_guid","agent.last_user","agent.active_directory.user.display_name","agent.active_directory.user.ou","agent.active_directory.user.ou.path","agent.active_directory.user.sam_account_name","agent.active_directory.machine.display_name","agent.active_directory.machine.ou","agent.active_directory.machine.ou.path","agent.active_directory.machine.sam_account_name"]},{"title":"Device Control Simple String Fields","type":"string","enum":["device_control.physical_disk_name","device_control.disk_interface","device_control.manufacturer","device_control.serial_number","device_control.file_system","device_control.volume_name","device_control.volume_serial","device_control.volume_device_path","device_control.access"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["contains","not_contains"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}}}},{"title":"Number Constraints (gt, gte, lt, lte, equals)","properties":{"field":{"type":"string","oneOf":[{"title":"Agent Number Fields","type":"string","enum":["agent.started_at_offset","agent.plugins.asset_manager.reboot_reasons","agent.plugins.endpoint_protection.reboot_reasons","agent.plugins.endpoint_detection_and_response.reboot_reasons","agent.plugins.incident_response.reboot_reasons","agent.plugins.siem.reboot_reasons","agent.os_version_major","agent.os_version_minor"]}]}},"oneOf":[{"minProperties":1,"title":"Specify Number Range","not":{"anyOf":[{"required":["operator"]},{"required":["value"]}]},"properties":{"gt":{"type":"number","title":"Greater than"},"lt":{"type":"number","title":"Less than"},"gte":{"type":"number","title":"Greater than or equals"},"lte":{"type":"number","title":"Less than or equals"}}},{"title":"Specify Exact Number","not":{"anyOf":[{"required":["gt"]},{"required":["lt"]},{"required":["gte"]},{"required":["lte"]}]},"required":["operator","value"],"properties":{"operator":{"type":"string","enum":["equals"]},"value":{"type":["number","array"],"title":"Value to search","items":{"type":"number"}}}}]},{"title":"Boolean (Equals) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"type":"string","title":"Detection Boolean Fields","enum":["is_root_detection","is_rtp_stream_event"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["equals"]},"value":{"title":"Value to search. Must be true or false","type":"boolean"}}},{"title":"Date (start, end) Constraints","properties":{"field":{"oneOf":[{"title":"Agent Date Fields","type":"string","enum":["agent.at","agent.started_at_local"]},{"type":"string","title":"Detection Date Fields","enum":["scanned_at","reported_at","cleaned_at","resource_created_at","resource_modified_at"]},{"type":"string","title":"Device Control Date Fields","enum":["device_control.timestamp"]}]}},"oneOf":[{"minProperties":1,"title":"Specify Date Range","not":{"anyOf":[{"required":["operator"]},{"required":["value"]}]},"properties":{"start":{"type":"string","format":"date-time","title":"Start Date"},"end":{"type":"string","format":"date-time","title":"End Date"}}},{"title":"Specify Exact Date","not":{"anyOf":[{"required":["start"]},{"required":["end"]}]},"required":["operator","value"],"properties":{"operator":{"type":"string","enum":["equals"]},"value":{"type":["string","array"],"format":"date-time","title":"Value to search","items":{"format":"date-time"}}}}]},{"title":"IP Constraints","properties":{"field":{"oneOf":[{"title":"Agent IP Fields","type":"string","enum":["agent.nics.ips","agent.machine_ip"]}]},"operator":{"type":"string","enum":["ip"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}}}},{"title":"Field Exists/Not Exists Constraints","required":["operator"],"properties":{"field":{"type":"string","oneOf":[{"type":"string","title":"Detection UID String Fields","enum":["trace_id","scan_id","group_id","account_id","detection_id","parent_detection_id","id","machine_id","schedule_id","job_id"]},{"title":"Detection Simple String Fields","type":"string","anyOf":[{"enum":["correlation_hash","threat_name","machine_name","group_name","path","md5","sha256","affected_application","process_name","schedule_etag","device_control.physical_disk_name","device_control.disk_interface","device_control.manufacturer","device_control.serial_number","device_control.file_system","device_control.volume_name","device_control.volume_serial","device_control.volume_device_path","scan_result.device.disk_model"]},{"title":"Active Directory Simple String Fields","type":"string","enum":["active_directory.user.display_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.user.ou.path","active_directory.machine.display_name","active_directory.machine.sam_account_name","active_directory.machine.ou","active_directory.machine.ou.path"]}]},{"type":"string","title":"Detection Enum String Fields","enum":["status","type","category","scan_result.scan_type","action_taken"]},{"title":"Agent Simple String Fields","type":"string","enum":["agent.nics.mac_address","agent.nics.description","agent.os_info.os_version","agent.os_info.os_release_name","agent.os_info.os_architecture","agent.plugins.asset_manager.plugin_version","agent.plugins.asset_manager.alerts.codes","agent.plugins.endpoint_protection.plugin_version","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.plugins.endpoint_protection.update_package_version","agent.plugins.endpoint_protection.alerts.codes","agent.plugins.endpoint_detection_and_response.plugin_version","agent.plugins.endpoint_detection_and_response.alerts.codes","agent.plugins.incident_response.plugin_version","agent.plugins.incident_response.update_package_version","agent.plugins.incident_response.alerts.codes","agent.plugins.siem.plugin_version","agent.plugins.siem.alerts.codes","agent.plugins.browser_phishing_protection.plugin_version","agent.plugins.browser_phishing_protection.alerts.codes","agent.engine_version","agent.source_location.city","agent.source_location.country","agent.source_location.subdivisions","agent.source_location.time_zone","agent.domain_name","agent.alias","agent.policy_etag","agent.serial_number","agent.available_software_updates.sdk_version.currentVersion","agent.available_software_updates.sdk_version.newVersion","agent.alerts.codes","agent.host_name","agent.fully_qualified_host_name","agent.object_guid","agent.last_user","agent.active_directory.user.display_name","agent.active_directory.user.ou","agent.active_directory.user.ou.path","agent.active_directory.user.sam_account_name","agent.active_directory.machine.display_name","agent.active_directory.machine.ou","agent.active_directory.machine.ou.path","agent.active_directory.machine.sam_account_name"]},{"title":"Agent Enum String Fields","type":"string","enum":["agent.os_info.os_type","agent.os_info.os_platform"]},{"title":"Agent Version fields","type":"string","enum":["agent.plugins.asset_manager.plugin_version","agent.plugins.endpoint_protection.plugin_version","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.plugins.endpoint_protection.update_package_version","agent.plugins.endpoint_detection_and_response.plugin_version","agent.plugins.incident_response.plugin_version","agent.plugins.incident_response.update_package_version","agent.available_software_updates.sdk_version.currentVersion","agent.available_software_updates.sdk_version.newVersion"]},{"title":"Agent Date Fields","type":"string","enum":["agent.at","agent.started_at_local"]},{"type":"string","title":"Detection Date Fields","enum":["scanned_at","reported_at","cleaned_at","resource_created_at","resource_modified_at"]},{"type":"string","title":"Detection Boolean Fields","enum":["is_root_detection","is_rtp_stream_event"]},{"type":"string","title":"Device Control UID String Fields","enum":["device_control.pnp_device_id","device_control.device_id"]},{"title":"Device Control Simple String Fields","type":"string","enum":["device_control.physical_disk_name","device_control.disk_interface","device_control.manufacturer","device_control.serial_number","device_control.file_system","device_control.volume_name","device_control.volume_serial","device_control.volume_device_path","device_control.access"]},{"type":"string","title":"Device Control Date Fields","enum":["device_control.timestamp"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["exists","not_exists"]}}}]},"examples":[[{"field":"trace_id","value":"ccb84b33-2d8e-4dcb-94a0-922fc669ce4a","operator":"equals"}]]},"aggregations":{"items":{"type":"string","title":"Device Control aggregation fields","enum":["trace_id","scan_id","machine_id","group_id","account_id","detection_id","parent_detection_id","correlation_hash","status","threat_name","type","path","category","md5","affected_application","process_name","machine_name","daily_detections_by_category","protection_status","agent.os_info.os_release_name","agent.nics.ips","agent.nics.mac_address","agent.nics.description","agent.os_info.os_type","agent.os_info.os_version","agent.os_info.os_platform","agent.os_info.os_architecture","agent.host_name","agent.fully_qualified_host_name","agent.plugins.asset_manager.plugin_version","agent.plugins.asset_manager.reboot_reason","agent.plugins.endpoint_protection.plugin_version","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.plugins.endpoint_protection.update_package_version","agent.plugins.endpoint_protection.reboot_reason","agent.plugins.endpoint_detection_response.plugin_version","agent.plugins.endpoint_detection_response.reboot_reason","agent.plugins.endpoint_detection_and_response.plugin_version","agent.plugins.endpoint_detection_and_response.reboot_reason","agent.plugins.incident_response.plugin_version","agent.plugins.incident_response.reboot_reason","agent.plugins.siem.plugin_version","agent.plugins.browser_phishing_protection.plugin_version","agent.plugins.siem.reboot_reason","agent.engine_version","agent.domain_name","agent.policy_etag","agent.last_user","agent.object_guid","device_control.physical_disk_name","device_control.pnp_device_id","device_control.device_id","device_control.disk_interface","device_control.manufacturer","device_control.serial_number","device_control.file_system","device_control.volume_name","device_control.volume_serial","device_control.volume_device_path","device_control.block_status","device_control.drive_compressed","device_control.timestamp"]}},"sort_field":{"type":"string","title":"If the sort field is used, then sort_order is required.","enum":["trace_id","scan_id","machine_id","group_id","account_id","detection_id","parent_detection_id","correlation_hash","status","threat_name.keyword","type","path.keyword","category","md5","sha256","affected_application.keyword","process_name.keyword","machine_name.keyword","scanned_at","reported_at","cleaned_at","is_root_detection","is_rtp_stream_event","object_guid","device_control.physical_disk_name","device_control.pnp_device_id","device_control.device_id","device_control.disk_interface","device_control.manufacturer","device_control.serial_number","device_control.file_system","device_control.volume_name","device_control.volume_serial","device_control.volume_device_path","device_control.block_status","device_control.drive_compressed","device_control.timestamp"]}}},{"type":"object","title":"Base Search Schema","properties":{"aggregations":{"type":"array","title":"The fields onto which you can perform aggregations","items":{"type":"string","title":"The Items Schema"}},"page_size":{"type":"number","title":"The page size. If you just need to aggregate, set it to 0","minimum":0,"maximum":2000},"sort_field":{"title":"Sort Fields","type":"string"},"sort_order":{"type":"string","title":"Whether sorting should be ascending or descending","enum":["asc","desc"]},"aggregate_by_account":{"type":"boolean","title":"Indicates whether aggregations should be scoped by account"},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}]},{"type":"object","required":["account_ids"],"properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]}]}}}}]}}}},"responses":{"200":{"description":"Successful response"}},"tags":["Grid"],"operationId":"api.rmm.grid.export.device_control.async"}},"/oneview/v1/grid/device-control/search":{"post":{"description":"Search device control events across accounts","summary":"Search device control events","simple_schema":"device-control-search-grid-rmm-simple","security":[{"client_credentials":["read"]},{"user_permissions":["deviceControl.view"]}],"status":{"outage":["auth","search_stateless"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","allOf":[{"type":"object","allOf":[{"properties":{"constraints":{"type":"array","items":{"title":"Device Control Constraints","type":"object","required":["field"],"anyOf":[{"title":"String (Equals, Not Equals) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"type":"string","title":"Detection UID String Fields","enum":["trace_id","scan_id","group_id","account_id","detection_id","parent_detection_id","id","machine_id","schedule_id","job_id"]},{"title":"Detection Simple String Fields","type":"string","anyOf":[{"enum":["correlation_hash","threat_name","machine_name","group_name","path","md5","sha256","affected_application","process_name","schedule_etag","device_control.physical_disk_name","device_control.disk_interface","device_control.manufacturer","device_control.serial_number","device_control.file_system","device_control.volume_name","device_control.volume_serial","device_control.volume_device_path","scan_result.device.disk_model"]},{"title":"Active Directory Simple String Fields","type":"string","enum":["active_directory.user.display_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.user.ou.path","active_directory.machine.display_name","active_directory.machine.sam_account_name","active_directory.machine.ou","active_directory.machine.ou.path"]}]},{"type":"string","title":"Detection Enum String Fields","enum":["status","type","category","scan_result.scan_type","action_taken"]},{"title":"Agent Simple String Fields","type":"string","enum":["agent.nics.mac_address","agent.nics.description","agent.os_info.os_version","agent.os_info.os_release_name","agent.os_info.os_architecture","agent.plugins.asset_manager.plugin_version","agent.plugins.asset_manager.alerts.codes","agent.plugins.endpoint_protection.plugin_version","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.plugins.endpoint_protection.update_package_version","agent.plugins.endpoint_protection.alerts.codes","agent.plugins.endpoint_detection_and_response.plugin_version","agent.plugins.endpoint_detection_and_response.alerts.codes","agent.plugins.incident_response.plugin_version","agent.plugins.incident_response.update_package_version","agent.plugins.incident_response.alerts.codes","agent.plugins.siem.plugin_version","agent.plugins.siem.alerts.codes","agent.plugins.browser_phishing_protection.plugin_version","agent.plugins.browser_phishing_protection.alerts.codes","agent.engine_version","agent.source_location.city","agent.source_location.country","agent.source_location.subdivisions","agent.source_location.time_zone","agent.domain_name","agent.alias","agent.policy_etag","agent.serial_number","agent.available_software_updates.sdk_version.currentVersion","agent.available_software_updates.sdk_version.newVersion","agent.alerts.codes","agent.host_name","agent.fully_qualified_host_name","agent.object_guid","agent.last_user","agent.active_directory.user.display_name","agent.active_directory.user.ou","agent.active_directory.user.ou.path","agent.active_directory.user.sam_account_name","agent.active_directory.machine.display_name","agent.active_directory.machine.ou","agent.active_directory.machine.ou.path","agent.active_directory.machine.sam_account_name"]},{"title":"Agent Enum String Fields","type":"string","enum":["agent.os_info.os_type","agent.os_info.os_platform"]},{"title":"Agent Version fields","type":"string","enum":["agent.plugins.asset_manager.plugin_version","agent.plugins.endpoint_protection.plugin_version","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.plugins.endpoint_protection.update_package_version","agent.plugins.endpoint_detection_and_response.plugin_version","agent.plugins.incident_response.plugin_version","agent.plugins.incident_response.update_package_version","agent.available_software_updates.sdk_version.currentVersion","agent.available_software_updates.sdk_version.newVersion"]},{"type":"string","title":"Device Control UID String Fields","enum":["device_control.pnp_device_id","device_control.device_id"]},{"title":"Device Control Simple String Fields","type":"string","enum":["device_control.physical_disk_name","device_control.disk_interface","device_control.manufacturer","device_control.serial_number","device_control.file_system","device_control.volume_name","device_control.volume_serial","device_control.volume_device_path","device_control.access"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["equals","not_equals"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}}},"if":{"properties":{"field":{"type":"string","title":"Detection UID String Fields","enum":["trace_id","scan_id","group_id","account_id","detection_id","parent_detection_id","id","machine_id","schedule_id","job_id"]}}},"then":{"properties":{"value":{"type":["string","array"],"format":"uuid","items":{"type":"string","format":"uuid"}}}}},{"title":"String (Contains, Not Contains) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"title":"Detection Simple String Fields","type":"string","anyOf":[{"enum":["correlation_hash","threat_name","machine_name","group_name","path","md5","sha256","affected_application","process_name","schedule_etag","device_control.physical_disk_name","device_control.disk_interface","device_control.manufacturer","device_control.serial_number","device_control.file_system","device_control.volume_name","device_control.volume_serial","device_control.volume_device_path","scan_result.device.disk_model"]},{"title":"Active Directory Simple String Fields","type":"string","enum":["active_directory.user.display_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.user.ou.path","active_directory.machine.display_name","active_directory.machine.sam_account_name","active_directory.machine.ou","active_directory.machine.ou.path"]}]},{"title":"Agent Simple String Fields","type":"string","enum":["agent.nics.mac_address","agent.nics.description","agent.os_info.os_version","agent.os_info.os_release_name","agent.os_info.os_architecture","agent.plugins.asset_manager.plugin_version","agent.plugins.asset_manager.alerts.codes","agent.plugins.endpoint_protection.plugin_version","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.plugins.endpoint_protection.update_package_version","agent.plugins.endpoint_protection.alerts.codes","agent.plugins.endpoint_detection_and_response.plugin_version","agent.plugins.endpoint_detection_and_response.alerts.codes","agent.plugins.incident_response.plugin_version","agent.plugins.incident_response.update_package_version","agent.plugins.incident_response.alerts.codes","agent.plugins.siem.plugin_version","agent.plugins.siem.alerts.codes","agent.plugins.browser_phishing_protection.plugin_version","agent.plugins.browser_phishing_protection.alerts.codes","agent.engine_version","agent.source_location.city","agent.source_location.country","agent.source_location.subdivisions","agent.source_location.time_zone","agent.domain_name","agent.alias","agent.policy_etag","agent.serial_number","agent.available_software_updates.sdk_version.currentVersion","agent.available_software_updates.sdk_version.newVersion","agent.alerts.codes","agent.host_name","agent.fully_qualified_host_name","agent.object_guid","agent.last_user","agent.active_directory.user.display_name","agent.active_directory.user.ou","agent.active_directory.user.ou.path","agent.active_directory.user.sam_account_name","agent.active_directory.machine.display_name","agent.active_directory.machine.ou","agent.active_directory.machine.ou.path","agent.active_directory.machine.sam_account_name"]},{"title":"Device Control Simple String Fields","type":"string","enum":["device_control.physical_disk_name","device_control.disk_interface","device_control.manufacturer","device_control.serial_number","device_control.file_system","device_control.volume_name","device_control.volume_serial","device_control.volume_device_path","device_control.access"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["contains","not_contains"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}}}},{"title":"Number Constraints (gt, gte, lt, lte, equals)","properties":{"field":{"type":"string","oneOf":[{"title":"Agent Number Fields","type":"string","enum":["agent.started_at_offset","agent.plugins.asset_manager.reboot_reasons","agent.plugins.endpoint_protection.reboot_reasons","agent.plugins.endpoint_detection_and_response.reboot_reasons","agent.plugins.incident_response.reboot_reasons","agent.plugins.siem.reboot_reasons","agent.os_version_major","agent.os_version_minor"]}]}},"oneOf":[{"minProperties":1,"title":"Specify Number Range","not":{"anyOf":[{"required":["operator"]},{"required":["value"]}]},"properties":{"gt":{"type":"number","title":"Greater than"},"lt":{"type":"number","title":"Less than"},"gte":{"type":"number","title":"Greater than or equals"},"lte":{"type":"number","title":"Less than or equals"}}},{"title":"Specify Exact Number","not":{"anyOf":[{"required":["gt"]},{"required":["lt"]},{"required":["gte"]},{"required":["lte"]}]},"required":["operator","value"],"properties":{"operator":{"type":"string","enum":["equals"]},"value":{"type":["number","array"],"title":"Value to search","items":{"type":"number"}}}}]},{"title":"Boolean (Equals) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"type":"string","title":"Detection Boolean Fields","enum":["is_root_detection","is_rtp_stream_event"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["equals"]},"value":{"title":"Value to search. Must be true or false","type":"boolean"}}},{"title":"Date (start, end) Constraints","properties":{"field":{"oneOf":[{"title":"Agent Date Fields","type":"string","enum":["agent.at","agent.started_at_local"]},{"type":"string","title":"Detection Date Fields","enum":["scanned_at","reported_at","cleaned_at","resource_created_at","resource_modified_at"]},{"type":"string","title":"Device Control Date Fields","enum":["device_control.timestamp"]}]}},"oneOf":[{"minProperties":1,"title":"Specify Date Range","not":{"anyOf":[{"required":["operator"]},{"required":["value"]}]},"properties":{"start":{"type":"string","format":"date-time","title":"Start Date"},"end":{"type":"string","format":"date-time","title":"End Date"}}},{"title":"Specify Exact Date","not":{"anyOf":[{"required":["start"]},{"required":["end"]}]},"required":["operator","value"],"properties":{"operator":{"type":"string","enum":["equals"]},"value":{"type":["string","array"],"format":"date-time","title":"Value to search","items":{"format":"date-time"}}}}]},{"title":"IP Constraints","properties":{"field":{"oneOf":[{"title":"Agent IP Fields","type":"string","enum":["agent.nics.ips","agent.machine_ip"]}]},"operator":{"type":"string","enum":["ip"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}}}},{"title":"Field Exists/Not Exists Constraints","required":["operator"],"properties":{"field":{"type":"string","oneOf":[{"type":"string","title":"Detection UID String Fields","enum":["trace_id","scan_id","group_id","account_id","detection_id","parent_detection_id","id","machine_id","schedule_id","job_id"]},{"title":"Detection Simple String Fields","type":"string","anyOf":[{"enum":["correlation_hash","threat_name","machine_name","group_name","path","md5","sha256","affected_application","process_name","schedule_etag","device_control.physical_disk_name","device_control.disk_interface","device_control.manufacturer","device_control.serial_number","device_control.file_system","device_control.volume_name","device_control.volume_serial","device_control.volume_device_path","scan_result.device.disk_model"]},{"title":"Active Directory Simple String Fields","type":"string","enum":["active_directory.user.display_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.user.ou.path","active_directory.machine.display_name","active_directory.machine.sam_account_name","active_directory.machine.ou","active_directory.machine.ou.path"]}]},{"type":"string","title":"Detection Enum String Fields","enum":["status","type","category","scan_result.scan_type","action_taken"]},{"title":"Agent Simple String Fields","type":"string","enum":["agent.nics.mac_address","agent.nics.description","agent.os_info.os_version","agent.os_info.os_release_name","agent.os_info.os_architecture","agent.plugins.asset_manager.plugin_version","agent.plugins.asset_manager.alerts.codes","agent.plugins.endpoint_protection.plugin_version","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.plugins.endpoint_protection.update_package_version","agent.plugins.endpoint_protection.alerts.codes","agent.plugins.endpoint_detection_and_response.plugin_version","agent.plugins.endpoint_detection_and_response.alerts.codes","agent.plugins.incident_response.plugin_version","agent.plugins.incident_response.update_package_version","agent.plugins.incident_response.alerts.codes","agent.plugins.siem.plugin_version","agent.plugins.siem.alerts.codes","agent.plugins.browser_phishing_protection.plugin_version","agent.plugins.browser_phishing_protection.alerts.codes","agent.engine_version","agent.source_location.city","agent.source_location.country","agent.source_location.subdivisions","agent.source_location.time_zone","agent.domain_name","agent.alias","agent.policy_etag","agent.serial_number","agent.available_software_updates.sdk_version.currentVersion","agent.available_software_updates.sdk_version.newVersion","agent.alerts.codes","agent.host_name","agent.fully_qualified_host_name","agent.object_guid","agent.last_user","agent.active_directory.user.display_name","agent.active_directory.user.ou","agent.active_directory.user.ou.path","agent.active_directory.user.sam_account_name","agent.active_directory.machine.display_name","agent.active_directory.machine.ou","agent.active_directory.machine.ou.path","agent.active_directory.machine.sam_account_name"]},{"title":"Agent Enum String Fields","type":"string","enum":["agent.os_info.os_type","agent.os_info.os_platform"]},{"title":"Agent Version fields","type":"string","enum":["agent.plugins.asset_manager.plugin_version","agent.plugins.endpoint_protection.plugin_version","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.plugins.endpoint_protection.update_package_version","agent.plugins.endpoint_detection_and_response.plugin_version","agent.plugins.incident_response.plugin_version","agent.plugins.incident_response.update_package_version","agent.available_software_updates.sdk_version.currentVersion","agent.available_software_updates.sdk_version.newVersion"]},{"title":"Agent Date Fields","type":"string","enum":["agent.at","agent.started_at_local"]},{"type":"string","title":"Detection Date Fields","enum":["scanned_at","reported_at","cleaned_at","resource_created_at","resource_modified_at"]},{"type":"string","title":"Detection Boolean Fields","enum":["is_root_detection","is_rtp_stream_event"]},{"type":"string","title":"Device Control UID String Fields","enum":["device_control.pnp_device_id","device_control.device_id"]},{"title":"Device Control Simple String Fields","type":"string","enum":["device_control.physical_disk_name","device_control.disk_interface","device_control.manufacturer","device_control.serial_number","device_control.file_system","device_control.volume_name","device_control.volume_serial","device_control.volume_device_path","device_control.access"]},{"type":"string","title":"Device Control Date Fields","enum":["device_control.timestamp"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["exists","not_exists"]}}}]},"examples":[[{"field":"trace_id","value":"ccb84b33-2d8e-4dcb-94a0-922fc669ce4a","operator":"equals"}]]},"aggregations":{"items":{"type":"string","title":"Device Control aggregation fields","enum":["trace_id","scan_id","machine_id","group_id","account_id","detection_id","parent_detection_id","correlation_hash","status","threat_name","type","path","category","md5","affected_application","process_name","machine_name","daily_detections_by_category","protection_status","agent.os_info.os_release_name","agent.nics.ips","agent.nics.mac_address","agent.nics.description","agent.os_info.os_type","agent.os_info.os_version","agent.os_info.os_platform","agent.os_info.os_architecture","agent.host_name","agent.fully_qualified_host_name","agent.plugins.asset_manager.plugin_version","agent.plugins.asset_manager.reboot_reason","agent.plugins.endpoint_protection.plugin_version","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.plugins.endpoint_protection.update_package_version","agent.plugins.endpoint_protection.reboot_reason","agent.plugins.endpoint_detection_response.plugin_version","agent.plugins.endpoint_detection_response.reboot_reason","agent.plugins.endpoint_detection_and_response.plugin_version","agent.plugins.endpoint_detection_and_response.reboot_reason","agent.plugins.incident_response.plugin_version","agent.plugins.incident_response.reboot_reason","agent.plugins.siem.plugin_version","agent.plugins.browser_phishing_protection.plugin_version","agent.plugins.siem.reboot_reason","agent.engine_version","agent.domain_name","agent.policy_etag","agent.last_user","agent.object_guid","device_control.physical_disk_name","device_control.pnp_device_id","device_control.device_id","device_control.disk_interface","device_control.manufacturer","device_control.serial_number","device_control.file_system","device_control.volume_name","device_control.volume_serial","device_control.volume_device_path","device_control.block_status","device_control.drive_compressed","device_control.timestamp"]}},"sort_field":{"type":"string","title":"If the sort field is used, then sort_order is required.","enum":["trace_id","scan_id","machine_id","group_id","account_id","detection_id","parent_detection_id","correlation_hash","status","threat_name.keyword","type","path.keyword","category","md5","sha256","affected_application.keyword","process_name.keyword","machine_name.keyword","scanned_at","reported_at","cleaned_at","is_root_detection","is_rtp_stream_event","object_guid","device_control.physical_disk_name","device_control.pnp_device_id","device_control.device_id","device_control.disk_interface","device_control.manufacturer","device_control.serial_number","device_control.file_system","device_control.volume_name","device_control.volume_serial","device_control.volume_device_path","device_control.block_status","device_control.drive_compressed","device_control.timestamp"]}}},{"type":"object","title":"Base Search Schema","properties":{"aggregations":{"type":"array","title":"The fields onto which you can perform aggregations","items":{"type":"string","title":"The Items Schema"}},"page_size":{"type":"number","title":"The page size. If you just need to aggregate, set it to 0","minimum":0,"maximum":2000},"sort_field":{"title":"Sort Fields","type":"string"},"sort_order":{"type":"string","title":"Whether sorting should be ascending or descending","enum":["asc","desc"]},"aggregate_by_account":{"type":"boolean","title":"Indicates whether aggregations should be scoped by account"},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}]},{"type":"object","required":["account_ids"],"properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Search device control result","properties":{"detections":{"type":"array","title":"Detections","items":{"type":"object","title":"Detection items","additionalProperties":false,"properties":{"id":{"type":"string","title":"ID"},"type":{"type":"array","title":"Type","items":{"type":"string","title":"Type items"}},"status":{"type":"string","title":"Status"},"path":{"type":"string","title":"Path"},"group_id":{"type":"string","title":"Group ID"},"group":{"type":"object","title":"The Group Schema","additionalProperties":true},"is_root_detection":{"type":"boolean","title":"Is root detection"},"machine_id":{"type":"string","title":"Endpoint ID"},"account_id":{"type":"string","title":"Account ID"},"detection_id":{"type":"string","title":"Detection ID"},"scanned_at":{"type":"string","title":"Scanned at"},"scanned_at_offset_seconds":{"type":"integer","title":"Scanned at offset seconds"},"reported_at":{"type":"string","title":"Reported at"},"threat_name":{"type":"string","title":"Threat name"},"category":{"type":"string","title":"Category"},"is_rtp_stream_event":{"type":"boolean","title":"Is rtp stream event"},"process_name":{"type":"string","title":"Process name"},"cleaned_at":{"type":"string","title":"Cleaned at"},"machine_name":{"type":"string","title":"Endpoint name"},"trace_id":{"type":"string","title":"Trace ID"},"scan_id":{"type":"string","title":"Scan ID"},"affected_application":{"type":"string","title":"Affected application"},"last_user":{"type":"string","title":"Last user"},"md5":{"type":"string","title":"MD5"},"sha256":{"type":"string","title":"SHA256"},"machine_ip":{"type":"string","title":"Machine IP address"},"child_trace_count":{"type":"integer","title":"Child trace count"},"action_taken":{"type":"string","title":"Action taken"},"agent":{"allOf":[{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"The root schema","description":"The root schema comprises the entire JSON document.","default":{},"examples":[{"at":"2020-10-23T14:20:51.006558Z","is_software_update_available":false,"started_at_local":"2020-10-23T14:20:50.920306Z","started_at_offset":-25200,"nics":[{"ips":["10.151.110.52"],"description":"Intel(R) 82574L Gigabit Network Connection","mac_address":"005056B91173"}],"os_info":{"os_type":"Workstation","os_version":"6.3.9600","os_platform":"Windows","os_architecture":"x86","os_release_name":"Microsoft Windows 8.1 Pro"},"fully_qualified_host_name":"sahamedw8-1x86","plugins":{"windows_remote_intrusion_detection_and_prevention":{"product_name":"Windows Remote Intrusion Detection and Prevention","plugin_version":"1.2.0.21"},"endpoint_protection":{"sdk_version":"4.2.1.90","product_name":"Endpoint Protection","plugin_version":"1.2.0.844","update_package_version":"1.0.31870","component_package_version":"1.0.1085","reboot_reasons":0},"asset_manager":{"product_name":"Asset Manager","plugin_version":"1.2.0.330","reboot_reasons":0},"endpoint_detection_and_response":{"product_name":"Endpoint Detection and Response","plugin_version":"1.2.0.297","reboot_reasons":0}},"engine_version":"1.2.0.821","policy_etag":"c6ea44914b72c92cba939ac3bd369dc4","last_user":"SAHAMEDW8-1X86\\Administrator","serial_number":"c02thb32g8wn","host_name":"sahamedw8-1x86","machine_id":"f2bcafe1-cb2b-4833-b6c9-6148b9511c8f","machine_ip":"216.75.233.210"}],"properties":{"at":{"type":"string","title":"The at schema","default":"","examples":["2020-10-23T14:20:51.006558Z"]},"is_software_update_available":{"type":"boolean","title":"The is_software_update_available schema","default":false,"examples":[false]},"started_at_local":{"type":"string","title":"The started_at_local schema","default":"","examples":["2020-10-23T14:20:50.920306Z"]},"started_at_offset":{"type":"integer","title":"The started_at_offset schema","default":0,"examples":[-25200]},"nics":{"type":"array","title":"The nics schema","default":[],"examples":[[{"ips":["10.151.110.52"],"description":"Intel(R) 82574L Gigabit Network Connection","mac_address":"005056B91173"}]],"additionalItems":true,"items":{"anyOf":[{"type":"object","title":"The first anyOf schema","default":{},"examples":[{"ips":["10.151.110.52"],"description":"Intel(R) 82574L Gigabit Network Connection","mac_address":"005056B91173"}],"properties":{"ips":{"type":"array","title":"The ips schema","default":[],"examples":[["10.151.110.52"]],"additionalItems":true,"items":{"anyOf":[{"type":"string","title":"The first anyOf schema","default":"","examples":["10.151.110.52"]}]}},"description":{"type":"string","title":"The description schema","default":"","examples":["Intel(R) 82574L Gigabit Network Connection"]},"mac_address":{"type":"string","title":"The mac_address schema","default":"","examples":["005056B91173"]}},"additionalProperties":true}]}},"os_info":{"type":"object","title":"The os_info schema","default":{},"examples":[{"os_type":"Workstation","os_version":"6.3.9600","os_platform":"Windows","os_architecture":"x86","os_release_name":"Microsoft Windows 8.1 Pro"}],"properties":{"os_type":{"type":"string","title":"The os_type schema","default":"","examples":["Workstation"]},"os_version":{"type":"string","title":"The os_version schema","default":"","examples":["6.3.9600"]},"os_platform":{"type":"string","title":"The os_platform schema","default":"","examples":["Windows"]},"os_architecture":{"type":"string","title":"The os_architecture schema","default":"","examples":["x86"]},"os_release_name":{"type":"string","title":"The os_release_name schema","default":"","examples":["Microsoft Windows 8.1 Pro"]}},"additionalProperties":true},"fully_qualified_host_name":{"type":"string","title":"The fully_qualified_host_name schema","default":"","examples":["sahamedw8-1x86"]},"plugins":{"type":"object","title":"The plugins schema","default":{},"examples":[{"windows_remote_intrusion_detection_and_prevention":{"product_name":"Windows Remote Intrusion Detection and Prevention","plugin_version":"1.2.0.21"},"endpoint_protection":{"sdk_version":"4.2.1.90","product_name":"Endpoint Protection","plugin_version":"1.2.0.844","update_package_version":"1.0.31870","component_package_version":"1.0.1085","reboot_reasons":0},"asset_manager":{"product_name":"Asset Manager","plugin_version":"1.2.0.330","reboot_reasons":0},"endpoint_detection_and_response":{"product_name":"Endpoint Detection and Response","plugin_version":"1.2.0.297","reboot_reasons":0}}],"properties":{"windows_remote_intrusion_detection_and_prevention":{"type":"object","title":"The windows_remote_intrusion_detection_and_prevention schema","default":{},"examples":[{"product_name":"Windows Remote Intrusion Detection and Prevention","plugin_version":"1.2.0.21"}],"properties":{"product_name":{"type":"string","title":"The product_name schema","default":"","examples":["Windows Remote Intrusion Detection and Prevention"]},"plugin_version":{"type":"string","title":"The plugin_version schema","default":"","examples":["1.2.0.21"]}},"additionalProperties":true},"endpoint_protection":{"type":"object","title":"The endpoint_protection schema","default":{},"examples":[{"sdk_version":"4.2.1.90","product_name":"Endpoint Protection","plugin_version":"1.2.0.844","update_package_version":"1.0.31870","component_package_version":"1.0.1085","reboot_reasons":0}],"properties":{"sdk_version":{"type":"string","title":"The sdk_version schema","default":"","examples":["4.2.1.90"]},"product_name":{"type":"string","title":"The product_name schema","default":"","examples":["Endpoint Protection"]},"plugin_version":{"type":"string","title":"The plugin_version schema","default":"","examples":["1.2.0.844"]},"update_package_version":{"type":"string","title":"The update_package_version schema","default":"","examples":["1.0.31870"]},"component_package_version":{"type":"string","title":"The component_package_version schema","default":"","examples":["1.0.1085"]},"reboot_reasons":{"type":"integer","title":"The reboot_reasons schema","default":0,"examples":[0]}},"additionalProperties":true},"asset_manager":{"type":"object","title":"The asset_manager schema","default":{},"examples":[{"product_name":"Asset Manager","plugin_version":"1.2.0.330","reboot_reasons":0}],"properties":{"product_name":{"type":"string","title":"The product_name schema","default":"","examples":["Asset Manager"]},"plugin_version":{"type":"string","title":"The plugin_version schema","default":"","examples":["1.2.0.330"]},"reboot_reasons":{"type":"integer","title":"The reboot_reasons schema","default":0,"examples":[0]}},"additionalProperties":true},"endpoint_detection_and_response":{"type":"object","title":"The endpoint_detection_and_response schema","default":{},"examples":[{"product_name":"Endpoint Detection and Response","plugin_version":"1.2.0.297","reboot_reasons":0}],"properties":{"product_name":{"type":"string","title":"The product_name schema","default":"","examples":["Endpoint Detection and Response"]},"plugin_version":{"type":"string","title":"The plugin_version schema","default":"","examples":["1.2.0.297"]},"reboot_reasons":{"type":"integer","title":"The reboot_reasons schema","default":0,"examples":[0]}},"additionalProperties":true}},"additionalProperties":true},"engine_version":{"type":"string","title":"The engine_version schema","default":"","examples":["1.2.0.821"]},"policy_etag":{"type":"string","title":"The policy_etag schema","default":"","examples":["c6ea44914b72c92cba939ac3bd369dc4"]},"last_user":{"type":"string","title":"The last_user schema","default":"","examples":["SAHAMEDW8-1X86\\Administrator"]},"host_name":{"type":"string","title":"The host_name schema","default":"","examples":["sahamedw8-1x86"]},"machine_id":{"type":"string","title":"The machine_id schema","default":"","examples":["f2bcafe1-cb2b-4833-b6c9-6148b9511c8f"]},"machine_ip":{"type":"string","title":"The machine_ip schema","default":"","examples":["216.75.233.210"]},"object_guid":{"type":"string","title":"The object_guid schema","default":""}}},{"title":"Agent information. Included if the request includes populate 'endpoint'"}]},"machine_location":{"allOf":[{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"The root schema","description":"The root schema comprises the entire JSON document.","default":{},"examples":[{"city":"Santa Clara","continent":"North America","subdivisions":["California"],"country":"United States","country_iso":"US","accuracy_radius":10,"point":{"lat":37.3417,"lon":-121.9753},"postal_code":"95051","anonymous_proxy":false,"time_zone":"America/Los_Angeles"}],"properties":{"city":{"type":"string","title":"The city schema","default":"","examples":["Santa Clara"]},"continent":{"type":"string","title":"The continent schema","default":"","examples":["North America"]},"subdivisions":{"type":"array","title":"The subdivisions schema","default":[],"examples":[["California"]],"items":{"anyOf":[{"type":"string","title":"The first anyOf schema","default":"","examples":["California"]}]}},"country":{"type":"string","title":"The country schema","default":"","examples":["United States"]},"country_iso":{"type":"string","title":"The country_iso schema","default":"","examples":["United States"]},"accuracy_radius":{"type":"integer","title":"The accuracy_radius schema","default":0,"examples":[10]},"point":{"type":"object","title":"The point schema","default":{},"examples":[{"lat":37.3417,"lon":-121.9753}],"properties":{"lat":{"allOf":[{"bignumber":true},{"type":"number","title":"The latitude","default":0,"examples":[37.3417]}]},"lon":{"allOf":[{"bignumber":true},{"type":"number","title":"The longitude","default":0,"examples":[-121.9753]}]}}},"postal_code":{"type":"string","title":"The postal_code schema","default":"","examples":["95051"]},"anonymous_proxy":{"type":"boolean","title":"The anonymous_proxy schema","default":false,"examples":[false]},"time_zone":{"type":"string","title":"The time_zone schema","default":"","examples":["America/Los_Angeles"]}}},{"title":"Machine location. Included if the request includes populate 'endpoint'"}]},"source_location":{"allOf":[{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"The root schema","description":"The root schema comprises the entire JSON document.","default":{},"examples":[{"city":"Santa Clara","continent":"North America","subdivisions":["California"],"country":"United States","country_iso":"US","accuracy_radius":10,"point":{"lat":37.3417,"lon":-121.9753},"postal_code":"95051","anonymous_proxy":false,"time_zone":"America/Los_Angeles"}],"properties":{"city":{"type":"string","title":"The city schema","default":"","examples":["Santa Clara"]},"continent":{"type":"string","title":"The continent schema","default":"","examples":["North America"]},"subdivisions":{"type":"array","title":"The subdivisions schema","default":[],"examples":[["California"]],"items":{"anyOf":[{"type":"string","title":"The first anyOf schema","default":"","examples":["California"]}]}},"country":{"type":"string","title":"The country schema","default":"","examples":["United States"]},"country_iso":{"type":"string","title":"The country_iso schema","default":"","examples":["United States"]},"accuracy_radius":{"type":"integer","title":"The accuracy_radius schema","default":0,"examples":[10]},"point":{"type":"object","title":"The point schema","default":{},"examples":[{"lat":37.3417,"lon":-121.9753}],"properties":{"lat":{"allOf":[{"bignumber":true},{"type":"number","title":"The latitude","default":0,"examples":[37.3417]}]},"lon":{"allOf":[{"bignumber":true},{"type":"number","title":"The longitude","default":0,"examples":[-121.9753]}]}}},"postal_code":{"type":"string","title":"The postal_code schema","default":"","examples":["95051"]},"anonymous_proxy":{"type":"boolean","title":"The anonymous_proxy schema","default":false,"examples":[false]},"time_zone":{"type":"string","title":"The time_zone schema","default":"","examples":["America/Los_Angeles"]}}},{"title":"Source location for RID category"}]},"destination_location":{"allOf":[{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"The root schema","description":"The root schema comprises the entire JSON document.","default":{},"examples":[{"city":"Santa Clara","continent":"North America","subdivisions":["California"],"country":"United States","country_iso":"US","accuracy_radius":10,"point":{"lat":37.3417,"lon":-121.9753},"postal_code":"95051","anonymous_proxy":false,"time_zone":"America/Los_Angeles"}],"properties":{"city":{"type":"string","title":"The city schema","default":"","examples":["Santa Clara"]},"continent":{"type":"string","title":"The continent schema","default":"","examples":["North America"]},"subdivisions":{"type":"array","title":"The subdivisions schema","default":[],"examples":[["California"]],"items":{"anyOf":[{"type":"string","title":"The first anyOf schema","default":"","examples":["California"]}]}},"country":{"type":"string","title":"The country schema","default":"","examples":["United States"]},"country_iso":{"type":"string","title":"The country_iso schema","default":"","examples":["United States"]},"accuracy_radius":{"type":"integer","title":"The accuracy_radius schema","default":0,"examples":[10]},"point":{"type":"object","title":"The point schema","default":{},"examples":[{"lat":37.3417,"lon":-121.9753}],"properties":{"lat":{"allOf":[{"bignumber":true},{"type":"number","title":"The latitude","default":0,"examples":[37.3417]}]},"lon":{"allOf":[{"bignumber":true},{"type":"number","title":"The longitude","default":0,"examples":[-121.9753]}]}}},"postal_code":{"type":"string","title":"The postal_code schema","default":"","examples":["95051"]},"anonymous_proxy":{"type":"boolean","title":"The anonymous_proxy schema","default":false,"examples":[false]},"time_zone":{"type":"string","title":"The time_zone schema","default":"","examples":["America/Los_Angeles"]}}},{"title":"Destination location for RID category"}]},"account":{"parent":{"title":"Parent account ID","type":"string"},"name":{"title":"Account name","type":"string"},"deleted":{"title":"Account deleted","type":"boolean"},"options":{"type":"object","properties":{"msp":{"type":"object","properties":{"name":{"type":"string"}}}}}},"device_control":{"title":"Device Control. Included if the detection is a device control event.","type":"object","properties":{"timestamp":{"type":"string"},"physical_disk_name":{"type":"string"},"device_id":{"type":"string"},"disk_interface":{"type":"string"},"manufacturer":{"type":"string"},"serial_number":{"type":"string"},"drive_compressed":{"type":"boolean"},"file_system":{"type":"string"},"volume_name":{"type":"string"},"volume_serial":{"type":"string"},"volume_device_path":{"type":"string"},"block_status":{"type":"string"},"drive_metadata":{"type":"object","additionalProperties":true},"path":{"type":"string"},"type":{"type":"array"},"status":{"type":"string"},"exclusion_id":{"type":"string"},"access":{"type":"string"}}}}}},"aggregations":{"type":"object","title":"Aggregations","additionalProperties":true},"total_count":{"type":"integer","title":"Total count of found detections"},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}}}}},"tags":["Grid"],"operationId":"api.rmm.grid.search.device_control"}},"/oneview/v1/grid/device-control/search-groupby":{"post":{"description":"Search grouped device control events across accounts","summary":"Search grouped device control events","simple_schema":"device-control-search-groupby-grid-rmm-simple","security":[{"client_credentials":["read"]},{"user_permissions":["deviceControl.view"]}],"status":{"incident":["read_nebula_data"],"outage":["auth","search_stateful"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"title":"Device Control Search Groupby Schema","type":"object","allOf":[{"type":"object","required":["group_by","page_size"],"properties":{"group_by":{"title":"Group by the following fields","type":"array","minItems":1,"uniqueItems":true,"items":{"type":"string"}},"page_size":{"type":"number","title":"The page_size Schema","minimum":50,"maximum":2000}}},{"type":"object","allOf":[{"type":"object","allOf":[{"properties":{"constraints":{"type":"array","items":{"title":"Device Control Constraints","type":"object","required":["field"],"anyOf":[{"title":"String (Equals, Not Equals) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"type":"string","title":"Detection UID String Fields","enum":["trace_id","scan_id","group_id","account_id","detection_id","parent_detection_id","id","machine_id","schedule_id","job_id"]},{"title":"Detection Simple String Fields","type":"string","anyOf":[{"enum":["correlation_hash","threat_name","machine_name","group_name","path","md5","sha256","affected_application","process_name","schedule_etag","device_control.physical_disk_name","device_control.disk_interface","device_control.manufacturer","device_control.serial_number","device_control.file_system","device_control.volume_name","device_control.volume_serial","device_control.volume_device_path","scan_result.device.disk_model"]},{"title":"Active Directory Simple String Fields","type":"string","enum":["active_directory.user.display_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.user.ou.path","active_directory.machine.display_name","active_directory.machine.sam_account_name","active_directory.machine.ou","active_directory.machine.ou.path"]}]},{"type":"string","title":"Detection Enum String Fields","enum":["status","type","category","scan_result.scan_type","action_taken"]},{"title":"Agent Simple String Fields","type":"string","enum":["agent.nics.mac_address","agent.nics.description","agent.os_info.os_version","agent.os_info.os_release_name","agent.os_info.os_architecture","agent.plugins.asset_manager.plugin_version","agent.plugins.asset_manager.alerts.codes","agent.plugins.endpoint_protection.plugin_version","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.plugins.endpoint_protection.update_package_version","agent.plugins.endpoint_protection.alerts.codes","agent.plugins.endpoint_detection_and_response.plugin_version","agent.plugins.endpoint_detection_and_response.alerts.codes","agent.plugins.incident_response.plugin_version","agent.plugins.incident_response.update_package_version","agent.plugins.incident_response.alerts.codes","agent.plugins.siem.plugin_version","agent.plugins.siem.alerts.codes","agent.plugins.browser_phishing_protection.plugin_version","agent.plugins.browser_phishing_protection.alerts.codes","agent.engine_version","agent.source_location.city","agent.source_location.country","agent.source_location.subdivisions","agent.source_location.time_zone","agent.domain_name","agent.alias","agent.policy_etag","agent.serial_number","agent.available_software_updates.sdk_version.currentVersion","agent.available_software_updates.sdk_version.newVersion","agent.alerts.codes","agent.host_name","agent.fully_qualified_host_name","agent.object_guid","agent.last_user","agent.active_directory.user.display_name","agent.active_directory.user.ou","agent.active_directory.user.ou.path","agent.active_directory.user.sam_account_name","agent.active_directory.machine.display_name","agent.active_directory.machine.ou","agent.active_directory.machine.ou.path","agent.active_directory.machine.sam_account_name"]},{"title":"Agent Enum String Fields","type":"string","enum":["agent.os_info.os_type","agent.os_info.os_platform"]},{"title":"Agent Version fields","type":"string","enum":["agent.plugins.asset_manager.plugin_version","agent.plugins.endpoint_protection.plugin_version","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.plugins.endpoint_protection.update_package_version","agent.plugins.endpoint_detection_and_response.plugin_version","agent.plugins.incident_response.plugin_version","agent.plugins.incident_response.update_package_version","agent.available_software_updates.sdk_version.currentVersion","agent.available_software_updates.sdk_version.newVersion"]},{"type":"string","title":"Device Control UID String Fields","enum":["device_control.pnp_device_id","device_control.device_id"]},{"title":"Device Control Simple String Fields","type":"string","enum":["device_control.physical_disk_name","device_control.disk_interface","device_control.manufacturer","device_control.serial_number","device_control.file_system","device_control.volume_name","device_control.volume_serial","device_control.volume_device_path","device_control.access"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["equals","not_equals"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}}},"if":{"properties":{"field":{"type":"string","title":"Detection UID String Fields","enum":["trace_id","scan_id","group_id","account_id","detection_id","parent_detection_id","id","machine_id","schedule_id","job_id"]}}},"then":{"properties":{"value":{"type":["string","array"],"format":"uuid","items":{"type":"string","format":"uuid"}}}}},{"title":"String (Contains, Not Contains) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"title":"Detection Simple String Fields","type":"string","anyOf":[{"enum":["correlation_hash","threat_name","machine_name","group_name","path","md5","sha256","affected_application","process_name","schedule_etag","device_control.physical_disk_name","device_control.disk_interface","device_control.manufacturer","device_control.serial_number","device_control.file_system","device_control.volume_name","device_control.volume_serial","device_control.volume_device_path","scan_result.device.disk_model"]},{"title":"Active Directory Simple String Fields","type":"string","enum":["active_directory.user.display_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.user.ou.path","active_directory.machine.display_name","active_directory.machine.sam_account_name","active_directory.machine.ou","active_directory.machine.ou.path"]}]},{"title":"Agent Simple String Fields","type":"string","enum":["agent.nics.mac_address","agent.nics.description","agent.os_info.os_version","agent.os_info.os_release_name","agent.os_info.os_architecture","agent.plugins.asset_manager.plugin_version","agent.plugins.asset_manager.alerts.codes","agent.plugins.endpoint_protection.plugin_version","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.plugins.endpoint_protection.update_package_version","agent.plugins.endpoint_protection.alerts.codes","agent.plugins.endpoint_detection_and_response.plugin_version","agent.plugins.endpoint_detection_and_response.alerts.codes","agent.plugins.incident_response.plugin_version","agent.plugins.incident_response.update_package_version","agent.plugins.incident_response.alerts.codes","agent.plugins.siem.plugin_version","agent.plugins.siem.alerts.codes","agent.plugins.browser_phishing_protection.plugin_version","agent.plugins.browser_phishing_protection.alerts.codes","agent.engine_version","agent.source_location.city","agent.source_location.country","agent.source_location.subdivisions","agent.source_location.time_zone","agent.domain_name","agent.alias","agent.policy_etag","agent.serial_number","agent.available_software_updates.sdk_version.currentVersion","agent.available_software_updates.sdk_version.newVersion","agent.alerts.codes","agent.host_name","agent.fully_qualified_host_name","agent.object_guid","agent.last_user","agent.active_directory.user.display_name","agent.active_directory.user.ou","agent.active_directory.user.ou.path","agent.active_directory.user.sam_account_name","agent.active_directory.machine.display_name","agent.active_directory.machine.ou","agent.active_directory.machine.ou.path","agent.active_directory.machine.sam_account_name"]},{"title":"Device Control Simple String Fields","type":"string","enum":["device_control.physical_disk_name","device_control.disk_interface","device_control.manufacturer","device_control.serial_number","device_control.file_system","device_control.volume_name","device_control.volume_serial","device_control.volume_device_path","device_control.access"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["contains","not_contains"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}}}},{"title":"Number Constraints (gt, gte, lt, lte, equals)","properties":{"field":{"type":"string","oneOf":[{"title":"Agent Number Fields","type":"string","enum":["agent.started_at_offset","agent.plugins.asset_manager.reboot_reasons","agent.plugins.endpoint_protection.reboot_reasons","agent.plugins.endpoint_detection_and_response.reboot_reasons","agent.plugins.incident_response.reboot_reasons","agent.plugins.siem.reboot_reasons","agent.os_version_major","agent.os_version_minor"]}]}},"oneOf":[{"minProperties":1,"title":"Specify Number Range","not":{"anyOf":[{"required":["operator"]},{"required":["value"]}]},"properties":{"gt":{"type":"number","title":"Greater than"},"lt":{"type":"number","title":"Less than"},"gte":{"type":"number","title":"Greater than or equals"},"lte":{"type":"number","title":"Less than or equals"}}},{"title":"Specify Exact Number","not":{"anyOf":[{"required":["gt"]},{"required":["lt"]},{"required":["gte"]},{"required":["lte"]}]},"required":["operator","value"],"properties":{"operator":{"type":"string","enum":["equals"]},"value":{"type":["number","array"],"title":"Value to search","items":{"type":"number"}}}}]},{"title":"Boolean (Equals) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"type":"string","title":"Detection Boolean Fields","enum":["is_root_detection","is_rtp_stream_event"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["equals"]},"value":{"title":"Value to search. Must be true or false","type":"boolean"}}},{"title":"Date (start, end) Constraints","properties":{"field":{"oneOf":[{"title":"Agent Date Fields","type":"string","enum":["agent.at","agent.started_at_local"]},{"type":"string","title":"Detection Date Fields","enum":["scanned_at","reported_at","cleaned_at","resource_created_at","resource_modified_at"]},{"type":"string","title":"Device Control Date Fields","enum":["device_control.timestamp"]}]}},"oneOf":[{"minProperties":1,"title":"Specify Date Range","not":{"anyOf":[{"required":["operator"]},{"required":["value"]}]},"properties":{"start":{"type":"string","format":"date-time","title":"Start Date"},"end":{"type":"string","format":"date-time","title":"End Date"}}},{"title":"Specify Exact Date","not":{"anyOf":[{"required":["start"]},{"required":["end"]}]},"required":["operator","value"],"properties":{"operator":{"type":"string","enum":["equals"]},"value":{"type":["string","array"],"format":"date-time","title":"Value to search","items":{"format":"date-time"}}}}]},{"title":"IP Constraints","properties":{"field":{"oneOf":[{"title":"Agent IP Fields","type":"string","enum":["agent.nics.ips","agent.machine_ip"]}]},"operator":{"type":"string","enum":["ip"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}}}},{"title":"Field Exists/Not Exists Constraints","required":["operator"],"properties":{"field":{"type":"string","oneOf":[{"type":"string","title":"Detection UID String Fields","enum":["trace_id","scan_id","group_id","account_id","detection_id","parent_detection_id","id","machine_id","schedule_id","job_id"]},{"title":"Detection Simple String Fields","type":"string","anyOf":[{"enum":["correlation_hash","threat_name","machine_name","group_name","path","md5","sha256","affected_application","process_name","schedule_etag","device_control.physical_disk_name","device_control.disk_interface","device_control.manufacturer","device_control.serial_number","device_control.file_system","device_control.volume_name","device_control.volume_serial","device_control.volume_device_path","scan_result.device.disk_model"]},{"title":"Active Directory Simple String Fields","type":"string","enum":["active_directory.user.display_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.user.ou.path","active_directory.machine.display_name","active_directory.machine.sam_account_name","active_directory.machine.ou","active_directory.machine.ou.path"]}]},{"type":"string","title":"Detection Enum String Fields","enum":["status","type","category","scan_result.scan_type","action_taken"]},{"title":"Agent Simple String Fields","type":"string","enum":["agent.nics.mac_address","agent.nics.description","agent.os_info.os_version","agent.os_info.os_release_name","agent.os_info.os_architecture","agent.plugins.asset_manager.plugin_version","agent.plugins.asset_manager.alerts.codes","agent.plugins.endpoint_protection.plugin_version","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.plugins.endpoint_protection.update_package_version","agent.plugins.endpoint_protection.alerts.codes","agent.plugins.endpoint_detection_and_response.plugin_version","agent.plugins.endpoint_detection_and_response.alerts.codes","agent.plugins.incident_response.plugin_version","agent.plugins.incident_response.update_package_version","agent.plugins.incident_response.alerts.codes","agent.plugins.siem.plugin_version","agent.plugins.siem.alerts.codes","agent.plugins.browser_phishing_protection.plugin_version","agent.plugins.browser_phishing_protection.alerts.codes","agent.engine_version","agent.source_location.city","agent.source_location.country","agent.source_location.subdivisions","agent.source_location.time_zone","agent.domain_name","agent.alias","agent.policy_etag","agent.serial_number","agent.available_software_updates.sdk_version.currentVersion","agent.available_software_updates.sdk_version.newVersion","agent.alerts.codes","agent.host_name","agent.fully_qualified_host_name","agent.object_guid","agent.last_user","agent.active_directory.user.display_name","agent.active_directory.user.ou","agent.active_directory.user.ou.path","agent.active_directory.user.sam_account_name","agent.active_directory.machine.display_name","agent.active_directory.machine.ou","agent.active_directory.machine.ou.path","agent.active_directory.machine.sam_account_name"]},{"title":"Agent Enum String Fields","type":"string","enum":["agent.os_info.os_type","agent.os_info.os_platform"]},{"title":"Agent Version fields","type":"string","enum":["agent.plugins.asset_manager.plugin_version","agent.plugins.endpoint_protection.plugin_version","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.plugins.endpoint_protection.update_package_version","agent.plugins.endpoint_detection_and_response.plugin_version","agent.plugins.incident_response.plugin_version","agent.plugins.incident_response.update_package_version","agent.available_software_updates.sdk_version.currentVersion","agent.available_software_updates.sdk_version.newVersion"]},{"title":"Agent Date Fields","type":"string","enum":["agent.at","agent.started_at_local"]},{"type":"string","title":"Detection Date Fields","enum":["scanned_at","reported_at","cleaned_at","resource_created_at","resource_modified_at"]},{"type":"string","title":"Detection Boolean Fields","enum":["is_root_detection","is_rtp_stream_event"]},{"type":"string","title":"Device Control UID String Fields","enum":["device_control.pnp_device_id","device_control.device_id"]},{"title":"Device Control Simple String Fields","type":"string","enum":["device_control.physical_disk_name","device_control.disk_interface","device_control.manufacturer","device_control.serial_number","device_control.file_system","device_control.volume_name","device_control.volume_serial","device_control.volume_device_path","device_control.access"]},{"type":"string","title":"Device Control Date Fields","enum":["device_control.timestamp"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["exists","not_exists"]}}}]},"examples":[[{"field":"trace_id","value":"ccb84b33-2d8e-4dcb-94a0-922fc669ce4a","operator":"equals"}]]},"aggregations":{"items":{"type":"string","title":"Device Control aggregation fields","enum":["trace_id","scan_id","machine_id","group_id","account_id","detection_id","parent_detection_id","correlation_hash","status","threat_name","type","path","category","md5","affected_application","process_name","machine_name","daily_detections_by_category","protection_status","agent.os_info.os_release_name","agent.nics.ips","agent.nics.mac_address","agent.nics.description","agent.os_info.os_type","agent.os_info.os_version","agent.os_info.os_platform","agent.os_info.os_architecture","agent.host_name","agent.fully_qualified_host_name","agent.plugins.asset_manager.plugin_version","agent.plugins.asset_manager.reboot_reason","agent.plugins.endpoint_protection.plugin_version","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.plugins.endpoint_protection.update_package_version","agent.plugins.endpoint_protection.reboot_reason","agent.plugins.endpoint_detection_response.plugin_version","agent.plugins.endpoint_detection_response.reboot_reason","agent.plugins.endpoint_detection_and_response.plugin_version","agent.plugins.endpoint_detection_and_response.reboot_reason","agent.plugins.incident_response.plugin_version","agent.plugins.incident_response.reboot_reason","agent.plugins.siem.plugin_version","agent.plugins.browser_phishing_protection.plugin_version","agent.plugins.siem.reboot_reason","agent.engine_version","agent.domain_name","agent.policy_etag","agent.last_user","agent.object_guid","device_control.physical_disk_name","device_control.pnp_device_id","device_control.device_id","device_control.disk_interface","device_control.manufacturer","device_control.serial_number","device_control.file_system","device_control.volume_name","device_control.volume_serial","device_control.volume_device_path","device_control.block_status","device_control.drive_compressed","device_control.timestamp"]}},"sort_field":{"type":"string","title":"If the sort field is used, then sort_order is required.","enum":["trace_id","scan_id","machine_id","group_id","account_id","detection_id","parent_detection_id","correlation_hash","status","threat_name.keyword","type","path.keyword","category","md5","sha256","affected_application.keyword","process_name.keyword","machine_name.keyword","scanned_at","reported_at","cleaned_at","is_root_detection","is_rtp_stream_event","object_guid","device_control.physical_disk_name","device_control.pnp_device_id","device_control.device_id","device_control.disk_interface","device_control.manufacturer","device_control.serial_number","device_control.file_system","device_control.volume_name","device_control.volume_serial","device_control.volume_device_path","device_control.block_status","device_control.drive_compressed","device_control.timestamp"]}}},{"type":"object","title":"Base Search Schema","properties":{"aggregations":{"type":"array","title":"The fields onto which you can perform aggregations","items":{"type":"string","title":"The Items Schema"}},"page_size":{"type":"number","title":"The page size. If you just need to aggregate, set it to 0","minimum":0,"maximum":2000},"sort_field":{"title":"Sort Fields","type":"string"},"sort_order":{"type":"string","title":"Whether sorting should be ascending or descending","enum":["asc","desc"]},"aggregate_by_account":{"type":"boolean","title":"Indicates whether aggregations should be scoped by account"},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}]},{"type":"object","required":["account_ids"],"properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]},{"properties":{"group_by":{"type":"array","title":"Group results by indicated field(s)","items":{"type":"string","title":"Device Control Groupby Fields","anyOf":[{"enum":["account_id","group_id","machine_id","type","status","category","affected_application","threat_name","process_name","action_taken","os_info.os_type","os_info.os_platform","object_guid","device_control.serial_number","device_control.physical_disk_name","device_control.manufacturer","device_control.volume_serial","device_control.volume_name"]},{"type":"string","title":"Active Directory Group By Fields","enum":["active_directory.user.display_name","active_directory.user.ou","active_directory.machine.display_name","active_directory.machine.ou"]}]}}}}]}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"The Post Device Control Search GroupBy Response Schema","required":["results","next_cursor"],"properties":{"results":{"type":"array","title":"The Results Schema","default":[]},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}}}}},"tags":["Grid"],"operationId":"api.rmm.grid.search.device_control.group"}},"/oneview/v1/grid/dns/export":{"post":{"description":"Export DNS activity across accounts","summary":"Export DNS activity","simple_schema":"dns-export-grid-rmm-simple","security":[{"client_credentials":["execute"]},{"user_permissions":["dnsFiltering.view"]}],"status":{"outage":["auth","search_stateless"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"title":"DNS Export Schema","type":"object","allOf":[{"type":"object","title":"Base Export Schema","required":["groups","select","format"],"properties":{"format":{"type":"string","title":"The output file","enum":["csv","xlsx","html","ods","txt","rtf","json"]},"download":{"type":"boolean","title":"Whether to instruct the client to download the response as a file. Only clients like browsers are supported"},"type":{"type":"string","title":"The encoding of the output","enum":["string","base64","binary"],"default":"string"},"select":{"type":"array","title":"Which fields to select from the response","items":{"type":"object","title":"Field","required":["field","newField"],"properties":{"newField":{"type":"string","title":"the new value"},"field":{"type":"string","title":"The response field to map to a new value"}}}},"groups":{"type":"array","title":"List of queries","items":{"type":"object"}}}},{"properties":{"select":{"items":{"properties":{"field":{"type":"string","title":"DNS select fields","anyOf":[{"enum":["rule_id","rule_name","resolved_ips","machine_id","group_id","group_name","account_name","machine_name","policy_id","policy_name","account_id","parent_account_id","action","log.policy_id","log.policy","log.protocol","log.query_name","log.query_name_reversed","log.resolver_decision","log.user_id","log.colo_id","log.dst_port","log.query_category_ids","log.query_size","log.query_type","log.src_port","log.dst_ip","log.src_ip","timestamp","log.datetime","agent.at","agent.last_user","agent.fully_qualified_host_name","agent.started_at_local","agent.started_at_offset","agent.os_info.os_type","agent.os_info.os_version","agent.os_info.os_platform","agent.os_info.os_architecture","agent.os_info.os_release_name","agent.domain_name","agent.engine_version","agent.policy_etag","agent.host_name","agent.nics.ips","agent.nics.mac_address","agent.has_alerts","agent.machine_ip","agent.object_guid","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.source_location.city","agent.source_location.country","agent.source_location.country_iso","agent.source_location.continent","agent.source_location.time_zone","agent.source_location.postal_code","agent.source_location.subdivisions","agent.source_location.anonymous_proxy","agent.serial_number","online"]},{"type":"string","title":"Active Directory Select Fields","enum":["active_directory.user.display_name","active_directory.user.distinguished_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.machine.display_name","active_directory.machine.distinguished_name","active_directory.machine.sam_account_name","active_directory.machine.ou"]}]}}}},"groups":{"items":{"title":"List of queries to fetch dns activity","allOf":[{"type":"object","allOf":[{"type":"object","allOf":[{"properties":{"constraints":{"type":"array","items":{"title":"DNS Constraints","type":"object","required":["field"],"anyOf":[{"title":"String (Equals, Not Equals) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"title":"DNS Simple String Fields","type":"string","anyOf":[{"enum":["rule_name","group_name","policy_name","log.policy","log.protocol","log.query_name","log.query_name_reversed","log.resolver_decision"]},{"title":"Active Directory Simple String Fields","type":"string","enum":["active_directory.user.display_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.user.ou.path","active_directory.machine.display_name","active_directory.machine.sam_account_name","active_directory.machine.ou","active_directory.machine.ou.path"]}]},{"title":"DNS Enum String Fields","type":"string","enum":["log.resolver_decision","action"]},{"title":"DNS UID String Fields","type":"string","enum":["id","machine_id","rule_id","group_id","policy_id","account_id","parent_account_id","log.policy_id","log.user_id"]},{"title":"Agent Simple String Fields","type":"string","enum":["agent.nics.mac_address","agent.nics.description","agent.os_info.os_version","agent.os_info.os_release_name","agent.os_info.os_architecture","agent.plugins.asset_manager.plugin_version","agent.plugins.asset_manager.alerts.codes","agent.plugins.endpoint_protection.plugin_version","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.plugins.endpoint_protection.update_package_version","agent.plugins.endpoint_protection.alerts.codes","agent.plugins.endpoint_detection_and_response.plugin_version","agent.plugins.endpoint_detection_and_response.alerts.codes","agent.plugins.incident_response.plugin_version","agent.plugins.incident_response.update_package_version","agent.plugins.incident_response.alerts.codes","agent.plugins.siem.plugin_version","agent.plugins.siem.alerts.codes","agent.plugins.browser_phishing_protection.plugin_version","agent.plugins.browser_phishing_protection.alerts.codes","agent.engine_version","agent.source_location.city","agent.source_location.country","agent.source_location.subdivisions","agent.source_location.time_zone","agent.domain_name","agent.alias","agent.policy_etag","agent.serial_number","agent.available_software_updates.sdk_version.currentVersion","agent.available_software_updates.sdk_version.newVersion","agent.alerts.codes","agent.host_name","agent.fully_qualified_host_name","agent.object_guid","agent.last_user","agent.active_directory.user.display_name","agent.active_directory.user.ou","agent.active_directory.user.ou.path","agent.active_directory.user.sam_account_name","agent.active_directory.machine.display_name","agent.active_directory.machine.ou","agent.active_directory.machine.ou.path","agent.active_directory.machine.sam_account_name"]},{"title":"Agent Enum String Fields","type":"string","enum":["agent.os_info.os_type","agent.os_info.os_platform"]},{"title":"Agent Version fields","type":"string","enum":["agent.plugins.asset_manager.plugin_version","agent.plugins.endpoint_protection.plugin_version","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.plugins.endpoint_protection.update_package_version","agent.plugins.endpoint_detection_and_response.plugin_version","agent.plugins.incident_response.plugin_version","agent.plugins.incident_response.update_package_version","agent.available_software_updates.sdk_version.currentVersion","agent.available_software_updates.sdk_version.newVersion"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["equals","not_equals"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}}},"if":{"properties":{"field":{"title":"DNS UID String Fields","type":"string","enum":["id","machine_id","rule_id","group_id","policy_id","account_id","parent_account_id","log.policy_id","log.user_id"]}}},"then":{"properties":{"value":{"type":["string","array"],"format":"uuid","items":{"type":"string","format":"uuid"}}}}},{"title":"String (Contains, Not Contains) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"title":"DNS Simple String Fields","type":"string","anyOf":[{"enum":["rule_name","group_name","policy_name","log.policy","log.protocol","log.query_name","log.query_name_reversed","log.resolver_decision"]},{"title":"Active Directory Simple String Fields","type":"string","enum":["active_directory.user.display_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.user.ou.path","active_directory.machine.display_name","active_directory.machine.sam_account_name","active_directory.machine.ou","active_directory.machine.ou.path"]}]},{"title":"Agent Simple String Fields","type":"string","enum":["agent.nics.mac_address","agent.nics.description","agent.os_info.os_version","agent.os_info.os_release_name","agent.os_info.os_architecture","agent.plugins.asset_manager.plugin_version","agent.plugins.asset_manager.alerts.codes","agent.plugins.endpoint_protection.plugin_version","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.plugins.endpoint_protection.update_package_version","agent.plugins.endpoint_protection.alerts.codes","agent.plugins.endpoint_detection_and_response.plugin_version","agent.plugins.endpoint_detection_and_response.alerts.codes","agent.plugins.incident_response.plugin_version","agent.plugins.incident_response.update_package_version","agent.plugins.incident_response.alerts.codes","agent.plugins.siem.plugin_version","agent.plugins.siem.alerts.codes","agent.plugins.browser_phishing_protection.plugin_version","agent.plugins.browser_phishing_protection.alerts.codes","agent.engine_version","agent.source_location.city","agent.source_location.country","agent.source_location.subdivisions","agent.source_location.time_zone","agent.domain_name","agent.alias","agent.policy_etag","agent.serial_number","agent.available_software_updates.sdk_version.currentVersion","agent.available_software_updates.sdk_version.newVersion","agent.alerts.codes","agent.host_name","agent.fully_qualified_host_name","agent.object_guid","agent.last_user","agent.active_directory.user.display_name","agent.active_directory.user.ou","agent.active_directory.user.ou.path","agent.active_directory.user.sam_account_name","agent.active_directory.machine.display_name","agent.active_directory.machine.ou","agent.active_directory.machine.ou.path","agent.active_directory.machine.sam_account_name"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["contains","not_contains"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}}}},{"title":"Number Constraints (gt, gte, lt, lte, equals)","properties":{"field":{"type":"string","oneOf":[{"title":"DNS Number Fields","type":"string","enum":["log.colo_id","log.dst_port","log.query_category_ids","log.query_size","log.query_type","log.src_port"]},{"title":"Agent Number Fields","type":"string","enum":["agent.started_at_offset","agent.plugins.asset_manager.reboot_reasons","agent.plugins.endpoint_protection.reboot_reasons","agent.plugins.endpoint_detection_and_response.reboot_reasons","agent.plugins.incident_response.reboot_reasons","agent.plugins.siem.reboot_reasons","agent.os_version_major","agent.os_version_minor"]}]}},"oneOf":[{"minProperties":1,"title":"Specify Number Range","not":{"anyOf":[{"required":["operator"]},{"required":["value"]}]},"properties":{"gt":{"type":"number","title":"Greater than"},"lt":{"type":"number","title":"Less than"},"gte":{"type":"number","title":"Greater than or equals"},"lte":{"type":"number","title":"Less than or equals"}}},{"title":"Specify Exact Number","not":{"anyOf":[{"required":["gt"]},{"required":["lt"]},{"required":["gte"]},{"required":["lte"]}]},"required":["operator","value"],"properties":{"operator":{"type":"string","enum":["equals"]},"value":{"type":["number","array"],"title":"Value to search","items":{"type":"number"}}}}]},{"title":"Date (start, end) Constraints","properties":{"field":{"oneOf":[{"title":"DNS Date Fields","type":"string","enum":["timestamp","log.datetime"]},{"title":"Agent Date Fields","type":"string","enum":["agent.at","agent.started_at_local"]}]}},"oneOf":[{"minProperties":1,"title":"Specify Date Range","not":{"anyOf":[{"required":["operator"]},{"required":["value"]}]},"properties":{"start":{"type":"string","format":"date-time","title":"Start Date"},"end":{"type":"string","format":"date-time","title":"End Date"}}},{"title":"Specify Exact Date","not":{"anyOf":[{"required":["start"]},{"required":["end"]}]},"required":["operator","value"],"properties":{"operator":{"type":"string","enum":["equals"]},"value":{"type":["string","array"],"format":"date-time","title":"Value to search","items":{"format":"date-time"}}}}]},{"title":"IP Constraints","properties":{"field":{"oneOf":[{"title":"DNS IP Fields","type":"string","enum":["log.dst_ip","log.src_ip"]},{"title":"Agent IP Fields","type":"string","enum":["agent.nics.ips","agent.machine_ip"]}]},"operator":{"type":"string","enum":["ip"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}}}},{"title":"Field Exists/Not Exists Constraints","required":["operator"],"properties":{"field":{"type":"string","oneOf":[{"title":"DNS UID String Fields","type":"string","enum":["id","machine_id","rule_id","group_id","policy_id","account_id","parent_account_id","log.policy_id","log.user_id"]},{"title":"DNS Simple String Fields","type":"string","anyOf":[{"enum":["rule_name","group_name","policy_name","log.policy","log.protocol","log.query_name","log.query_name_reversed","log.resolver_decision"]},{"title":"Active Directory Simple String Fields","type":"string","enum":["active_directory.user.display_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.user.ou.path","active_directory.machine.display_name","active_directory.machine.sam_account_name","active_directory.machine.ou","active_directory.machine.ou.path"]}]},{"title":"DNS Enum String Fields","type":"string","enum":["log.resolver_decision","action"]},{"title":"Agent Simple String Fields","type":"string","enum":["agent.nics.mac_address","agent.nics.description","agent.os_info.os_version","agent.os_info.os_release_name","agent.os_info.os_architecture","agent.plugins.asset_manager.plugin_version","agent.plugins.asset_manager.alerts.codes","agent.plugins.endpoint_protection.plugin_version","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.plugins.endpoint_protection.update_package_version","agent.plugins.endpoint_protection.alerts.codes","agent.plugins.endpoint_detection_and_response.plugin_version","agent.plugins.endpoint_detection_and_response.alerts.codes","agent.plugins.incident_response.plugin_version","agent.plugins.incident_response.update_package_version","agent.plugins.incident_response.alerts.codes","agent.plugins.siem.plugin_version","agent.plugins.siem.alerts.codes","agent.plugins.browser_phishing_protection.plugin_version","agent.plugins.browser_phishing_protection.alerts.codes","agent.engine_version","agent.source_location.city","agent.source_location.country","agent.source_location.subdivisions","agent.source_location.time_zone","agent.domain_name","agent.alias","agent.policy_etag","agent.serial_number","agent.available_software_updates.sdk_version.currentVersion","agent.available_software_updates.sdk_version.newVersion","agent.alerts.codes","agent.host_name","agent.fully_qualified_host_name","agent.object_guid","agent.last_user","agent.active_directory.user.display_name","agent.active_directory.user.ou","agent.active_directory.user.ou.path","agent.active_directory.user.sam_account_name","agent.active_directory.machine.display_name","agent.active_directory.machine.ou","agent.active_directory.machine.ou.path","agent.active_directory.machine.sam_account_name"]},{"title":"Agent Enum String Fields","type":"string","enum":["agent.os_info.os_type","agent.os_info.os_platform"]},{"title":"Agent Version fields","type":"string","enum":["agent.plugins.asset_manager.plugin_version","agent.plugins.endpoint_protection.plugin_version","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.plugins.endpoint_protection.update_package_version","agent.plugins.endpoint_detection_and_response.plugin_version","agent.plugins.incident_response.plugin_version","agent.plugins.incident_response.update_package_version","agent.available_software_updates.sdk_version.currentVersion","agent.available_software_updates.sdk_version.newVersion"]},{"title":"DNS IP Fields","type":"string","enum":["log.dst_ip","log.src_ip"]},{"title":"Agent IP Fields","type":"string","enum":["agent.nics.ips","agent.machine_ip"]},{"title":"DNS Date Fields","type":"string","enum":["timestamp","log.datetime"]},{"title":"Agent Date Fields","type":"string","enum":["agent.at","agent.started_at_local"]},{"title":"DNS Number Fields","type":"string","enum":["log.colo_id","log.dst_port","log.query_category_ids","log.query_size","log.query_type","log.src_port"]},{"title":"Agent Number Fields","type":"string","enum":["agent.started_at_offset","agent.plugins.asset_manager.reboot_reasons","agent.plugins.endpoint_protection.reboot_reasons","agent.plugins.endpoint_detection_and_response.reboot_reasons","agent.plugins.incident_response.reboot_reasons","agent.plugins.siem.reboot_reasons","agent.os_version_major","agent.os_version_minor"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["exists","not_exists"]}}}]},"examples":[[{"field":"rule_name","value":"Test Rule","operator":"equals"}]]},"aggregations":{"items":{"type":"string","title":"DNS aggregation fields","enum":["machine_id","group_id","rule_id","rule_name","resolved_ips","group_name","policy_id","policy_name","account_id","parent_account_id","action","log.policy_id","log.policy","log.protocol","log.query_name","log.query_name_reversed","log.resolver_decision","log.user_id","log.colo_id","log.dst_port","log.query_category_ids","log.query_size","log.query_type","log.src_port","log.dst_ip","log.src_ip","timestamp","log.datetime","agent.at","agent.last_user","agent.fully_qualified_host_name","agent.started_at_local","agent.started_at_offset","agent.os_info.os_type","agent.os_info.os_version","agent.os_info.os_platform","agent.os_info.os_architecture","agent.os_info.os_release_name","agent.domain_name","agent.engine_version","agent.policy_etag","agent.host_name","agent.nics.ips","agent.nics.mac_address","agent.has_alerts","agent.machine_ip","agent.object_guid","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.source_location.city","agent.source_location.country","agent.source_location.country_iso","agent.source_location.continent","agent.source_location.time_zone","agent.source_location.postal_code","agent.source_location.subdivisions","agent.source_location.anonymous_proxy","agent.serial_number","daily_logs"]}},"sort_field":{"type":"string","title":"DNS sort fields","anyOf":[{"enum":["machine_id","group_id","group_name","rule_id","rule_name","resolved_ips","policy_id","policy_name","account_id","parent_account_id","action","log.policy_id","log.policy","log.protocol","log.query_name","log.query_name_reversed","log.resolver_decision","log.user_id","log.colo_id","log.dst_port","log.query_category_ids","log.query_size","log.query_type","log.src_port","log.dst_ip","log.src_ip","timestamp","log.datetime","agent.at","agent.last_user","agent.fully_qualified_host_name","agent.started_at_local","agent.started_at_offset","agent.os_info.os_type","agent.os_info.os_version","agent.os_info.os_platform","agent.os_info.os_architecture","agent.os_info.os_release_name","agent.domain_name","agent.engine_version","agent.policy_etag","agent.host_name","agent.nics.ips","agent.nics.mac_address","agent.has_alerts","agent.machine_ip","agent.object_guid","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.source_location.city","agent.source_location.country","agent.source_location.country_iso","agent.source_location.continent","agent.source_location.time_zone","agent.source_location.postal_code","agent.source_location.subdivisions","agent.source_location.anonymous_proxy","agent.serial_number"]},{"type":"string","title":"Active Directory Sort Fields","enum":["active_directory.user.display_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.machine.display_name","active_directory.machine.sam_account_name","active_directory.machine.ou"]}]}}},{"type":"object","title":"Base Search Schema","properties":{"aggregations":{"type":"array","title":"The fields onto which you can perform aggregations","items":{"type":"string","title":"The Items Schema"}},"page_size":{"type":"number","title":"The page size. If you just need to aggregate, set it to 0","minimum":0,"maximum":2000},"sort_field":{"title":"Sort Fields","type":"string"},"sort_order":{"type":"string","title":"Whether sorting should be ascending or descending","enum":["asc","desc"]},"aggregate_by_account":{"type":"boolean","title":"Indicates whether aggregations should be scoped by account"},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}]},{"type":"object","required":["account_ids"],"properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]}]}}}}]}}}},"responses":{"200":{"description":"Successful response"}},"tags":["Grid"],"operationId":"api.rmm.grid.export.dns"}},"/oneview/v1/grid/dns/export.async":{"post":{"description":"Export DNS activity across accounts","summary":"Export DNS activity asynchronously","simple_schema":"dns-export-grid-rmm-simple","security":[{"client_credentials":["execute"]},{"user_permissions":["dnsFiltering.view"]}],"status":{"outage":["auth","search_stateless"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"title":"DNS Export Schema","type":"object","allOf":[{"type":"object","title":"Base Export Schema","required":["groups","select","format"],"properties":{"format":{"type":"string","title":"The output file","enum":["csv","xlsx","html","ods","txt","rtf","json"]},"download":{"type":"boolean","title":"Whether to instruct the client to download the response as a file. Only clients like browsers are supported"},"type":{"type":"string","title":"The encoding of the output","enum":["string","base64","binary"],"default":"string"},"select":{"type":"array","title":"Which fields to select from the response","items":{"type":"object","title":"Field","required":["field","newField"],"properties":{"newField":{"type":"string","title":"the new value"},"field":{"type":"string","title":"The response field to map to a new value"}}}},"groups":{"type":"array","title":"List of queries","items":{"type":"object"}}}},{"properties":{"select":{"items":{"properties":{"field":{"type":"string","title":"DNS select fields","anyOf":[{"enum":["rule_id","rule_name","resolved_ips","machine_id","group_id","group_name","account_name","machine_name","policy_id","policy_name","account_id","parent_account_id","action","log.policy_id","log.policy","log.protocol","log.query_name","log.query_name_reversed","log.resolver_decision","log.user_id","log.colo_id","log.dst_port","log.query_category_ids","log.query_size","log.query_type","log.src_port","log.dst_ip","log.src_ip","timestamp","log.datetime","agent.at","agent.last_user","agent.fully_qualified_host_name","agent.started_at_local","agent.started_at_offset","agent.os_info.os_type","agent.os_info.os_version","agent.os_info.os_platform","agent.os_info.os_architecture","agent.os_info.os_release_name","agent.domain_name","agent.engine_version","agent.policy_etag","agent.host_name","agent.nics.ips","agent.nics.mac_address","agent.has_alerts","agent.machine_ip","agent.object_guid","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.source_location.city","agent.source_location.country","agent.source_location.country_iso","agent.source_location.continent","agent.source_location.time_zone","agent.source_location.postal_code","agent.source_location.subdivisions","agent.source_location.anonymous_proxy","agent.serial_number","online"]},{"type":"string","title":"Active Directory Select Fields","enum":["active_directory.user.display_name","active_directory.user.distinguished_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.machine.display_name","active_directory.machine.distinguished_name","active_directory.machine.sam_account_name","active_directory.machine.ou"]}]}}}},"groups":{"items":{"title":"List of queries to fetch dns activity","allOf":[{"type":"object","allOf":[{"type":"object","allOf":[{"properties":{"constraints":{"type":"array","items":{"title":"DNS Constraints","type":"object","required":["field"],"anyOf":[{"title":"String (Equals, Not Equals) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"title":"DNS Simple String Fields","type":"string","anyOf":[{"enum":["rule_name","group_name","policy_name","log.policy","log.protocol","log.query_name","log.query_name_reversed","log.resolver_decision"]},{"title":"Active Directory Simple String Fields","type":"string","enum":["active_directory.user.display_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.user.ou.path","active_directory.machine.display_name","active_directory.machine.sam_account_name","active_directory.machine.ou","active_directory.machine.ou.path"]}]},{"title":"DNS Enum String Fields","type":"string","enum":["log.resolver_decision","action"]},{"title":"DNS UID String Fields","type":"string","enum":["id","machine_id","rule_id","group_id","policy_id","account_id","parent_account_id","log.policy_id","log.user_id"]},{"title":"Agent Simple String Fields","type":"string","enum":["agent.nics.mac_address","agent.nics.description","agent.os_info.os_version","agent.os_info.os_release_name","agent.os_info.os_architecture","agent.plugins.asset_manager.plugin_version","agent.plugins.asset_manager.alerts.codes","agent.plugins.endpoint_protection.plugin_version","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.plugins.endpoint_protection.update_package_version","agent.plugins.endpoint_protection.alerts.codes","agent.plugins.endpoint_detection_and_response.plugin_version","agent.plugins.endpoint_detection_and_response.alerts.codes","agent.plugins.incident_response.plugin_version","agent.plugins.incident_response.update_package_version","agent.plugins.incident_response.alerts.codes","agent.plugins.siem.plugin_version","agent.plugins.siem.alerts.codes","agent.plugins.browser_phishing_protection.plugin_version","agent.plugins.browser_phishing_protection.alerts.codes","agent.engine_version","agent.source_location.city","agent.source_location.country","agent.source_location.subdivisions","agent.source_location.time_zone","agent.domain_name","agent.alias","agent.policy_etag","agent.serial_number","agent.available_software_updates.sdk_version.currentVersion","agent.available_software_updates.sdk_version.newVersion","agent.alerts.codes","agent.host_name","agent.fully_qualified_host_name","agent.object_guid","agent.last_user","agent.active_directory.user.display_name","agent.active_directory.user.ou","agent.active_directory.user.ou.path","agent.active_directory.user.sam_account_name","agent.active_directory.machine.display_name","agent.active_directory.machine.ou","agent.active_directory.machine.ou.path","agent.active_directory.machine.sam_account_name"]},{"title":"Agent Enum String Fields","type":"string","enum":["agent.os_info.os_type","agent.os_info.os_platform"]},{"title":"Agent Version fields","type":"string","enum":["agent.plugins.asset_manager.plugin_version","agent.plugins.endpoint_protection.plugin_version","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.plugins.endpoint_protection.update_package_version","agent.plugins.endpoint_detection_and_response.plugin_version","agent.plugins.incident_response.plugin_version","agent.plugins.incident_response.update_package_version","agent.available_software_updates.sdk_version.currentVersion","agent.available_software_updates.sdk_version.newVersion"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["equals","not_equals"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}}},"if":{"properties":{"field":{"title":"DNS UID String Fields","type":"string","enum":["id","machine_id","rule_id","group_id","policy_id","account_id","parent_account_id","log.policy_id","log.user_id"]}}},"then":{"properties":{"value":{"type":["string","array"],"format":"uuid","items":{"type":"string","format":"uuid"}}}}},{"title":"String (Contains, Not Contains) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"title":"DNS Simple String Fields","type":"string","anyOf":[{"enum":["rule_name","group_name","policy_name","log.policy","log.protocol","log.query_name","log.query_name_reversed","log.resolver_decision"]},{"title":"Active Directory Simple String Fields","type":"string","enum":["active_directory.user.display_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.user.ou.path","active_directory.machine.display_name","active_directory.machine.sam_account_name","active_directory.machine.ou","active_directory.machine.ou.path"]}]},{"title":"Agent Simple String Fields","type":"string","enum":["agent.nics.mac_address","agent.nics.description","agent.os_info.os_version","agent.os_info.os_release_name","agent.os_info.os_architecture","agent.plugins.asset_manager.plugin_version","agent.plugins.asset_manager.alerts.codes","agent.plugins.endpoint_protection.plugin_version","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.plugins.endpoint_protection.update_package_version","agent.plugins.endpoint_protection.alerts.codes","agent.plugins.endpoint_detection_and_response.plugin_version","agent.plugins.endpoint_detection_and_response.alerts.codes","agent.plugins.incident_response.plugin_version","agent.plugins.incident_response.update_package_version","agent.plugins.incident_response.alerts.codes","agent.plugins.siem.plugin_version","agent.plugins.siem.alerts.codes","agent.plugins.browser_phishing_protection.plugin_version","agent.plugins.browser_phishing_protection.alerts.codes","agent.engine_version","agent.source_location.city","agent.source_location.country","agent.source_location.subdivisions","agent.source_location.time_zone","agent.domain_name","agent.alias","agent.policy_etag","agent.serial_number","agent.available_software_updates.sdk_version.currentVersion","agent.available_software_updates.sdk_version.newVersion","agent.alerts.codes","agent.host_name","agent.fully_qualified_host_name","agent.object_guid","agent.last_user","agent.active_directory.user.display_name","agent.active_directory.user.ou","agent.active_directory.user.ou.path","agent.active_directory.user.sam_account_name","agent.active_directory.machine.display_name","agent.active_directory.machine.ou","agent.active_directory.machine.ou.path","agent.active_directory.machine.sam_account_name"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["contains","not_contains"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}}}},{"title":"Number Constraints (gt, gte, lt, lte, equals)","properties":{"field":{"type":"string","oneOf":[{"title":"DNS Number Fields","type":"string","enum":["log.colo_id","log.dst_port","log.query_category_ids","log.query_size","log.query_type","log.src_port"]},{"title":"Agent Number Fields","type":"string","enum":["agent.started_at_offset","agent.plugins.asset_manager.reboot_reasons","agent.plugins.endpoint_protection.reboot_reasons","agent.plugins.endpoint_detection_and_response.reboot_reasons","agent.plugins.incident_response.reboot_reasons","agent.plugins.siem.reboot_reasons","agent.os_version_major","agent.os_version_minor"]}]}},"oneOf":[{"minProperties":1,"title":"Specify Number Range","not":{"anyOf":[{"required":["operator"]},{"required":["value"]}]},"properties":{"gt":{"type":"number","title":"Greater than"},"lt":{"type":"number","title":"Less than"},"gte":{"type":"number","title":"Greater than or equals"},"lte":{"type":"number","title":"Less than or equals"}}},{"title":"Specify Exact Number","not":{"anyOf":[{"required":["gt"]},{"required":["lt"]},{"required":["gte"]},{"required":["lte"]}]},"required":["operator","value"],"properties":{"operator":{"type":"string","enum":["equals"]},"value":{"type":["number","array"],"title":"Value to search","items":{"type":"number"}}}}]},{"title":"Date (start, end) Constraints","properties":{"field":{"oneOf":[{"title":"DNS Date Fields","type":"string","enum":["timestamp","log.datetime"]},{"title":"Agent Date Fields","type":"string","enum":["agent.at","agent.started_at_local"]}]}},"oneOf":[{"minProperties":1,"title":"Specify Date Range","not":{"anyOf":[{"required":["operator"]},{"required":["value"]}]},"properties":{"start":{"type":"string","format":"date-time","title":"Start Date"},"end":{"type":"string","format":"date-time","title":"End Date"}}},{"title":"Specify Exact Date","not":{"anyOf":[{"required":["start"]},{"required":["end"]}]},"required":["operator","value"],"properties":{"operator":{"type":"string","enum":["equals"]},"value":{"type":["string","array"],"format":"date-time","title":"Value to search","items":{"format":"date-time"}}}}]},{"title":"IP Constraints","properties":{"field":{"oneOf":[{"title":"DNS IP Fields","type":"string","enum":["log.dst_ip","log.src_ip"]},{"title":"Agent IP Fields","type":"string","enum":["agent.nics.ips","agent.machine_ip"]}]},"operator":{"type":"string","enum":["ip"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}}}},{"title":"Field Exists/Not Exists Constraints","required":["operator"],"properties":{"field":{"type":"string","oneOf":[{"title":"DNS UID String Fields","type":"string","enum":["id","machine_id","rule_id","group_id","policy_id","account_id","parent_account_id","log.policy_id","log.user_id"]},{"title":"DNS Simple String Fields","type":"string","anyOf":[{"enum":["rule_name","group_name","policy_name","log.policy","log.protocol","log.query_name","log.query_name_reversed","log.resolver_decision"]},{"title":"Active Directory Simple String Fields","type":"string","enum":["active_directory.user.display_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.user.ou.path","active_directory.machine.display_name","active_directory.machine.sam_account_name","active_directory.machine.ou","active_directory.machine.ou.path"]}]},{"title":"DNS Enum String Fields","type":"string","enum":["log.resolver_decision","action"]},{"title":"Agent Simple String Fields","type":"string","enum":["agent.nics.mac_address","agent.nics.description","agent.os_info.os_version","agent.os_info.os_release_name","agent.os_info.os_architecture","agent.plugins.asset_manager.plugin_version","agent.plugins.asset_manager.alerts.codes","agent.plugins.endpoint_protection.plugin_version","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.plugins.endpoint_protection.update_package_version","agent.plugins.endpoint_protection.alerts.codes","agent.plugins.endpoint_detection_and_response.plugin_version","agent.plugins.endpoint_detection_and_response.alerts.codes","agent.plugins.incident_response.plugin_version","agent.plugins.incident_response.update_package_version","agent.plugins.incident_response.alerts.codes","agent.plugins.siem.plugin_version","agent.plugins.siem.alerts.codes","agent.plugins.browser_phishing_protection.plugin_version","agent.plugins.browser_phishing_protection.alerts.codes","agent.engine_version","agent.source_location.city","agent.source_location.country","agent.source_location.subdivisions","agent.source_location.time_zone","agent.domain_name","agent.alias","agent.policy_etag","agent.serial_number","agent.available_software_updates.sdk_version.currentVersion","agent.available_software_updates.sdk_version.newVersion","agent.alerts.codes","agent.host_name","agent.fully_qualified_host_name","agent.object_guid","agent.last_user","agent.active_directory.user.display_name","agent.active_directory.user.ou","agent.active_directory.user.ou.path","agent.active_directory.user.sam_account_name","agent.active_directory.machine.display_name","agent.active_directory.machine.ou","agent.active_directory.machine.ou.path","agent.active_directory.machine.sam_account_name"]},{"title":"Agent Enum String Fields","type":"string","enum":["agent.os_info.os_type","agent.os_info.os_platform"]},{"title":"Agent Version fields","type":"string","enum":["agent.plugins.asset_manager.plugin_version","agent.plugins.endpoint_protection.plugin_version","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.plugins.endpoint_protection.update_package_version","agent.plugins.endpoint_detection_and_response.plugin_version","agent.plugins.incident_response.plugin_version","agent.plugins.incident_response.update_package_version","agent.available_software_updates.sdk_version.currentVersion","agent.available_software_updates.sdk_version.newVersion"]},{"title":"DNS IP Fields","type":"string","enum":["log.dst_ip","log.src_ip"]},{"title":"Agent IP Fields","type":"string","enum":["agent.nics.ips","agent.machine_ip"]},{"title":"DNS Date Fields","type":"string","enum":["timestamp","log.datetime"]},{"title":"Agent Date Fields","type":"string","enum":["agent.at","agent.started_at_local"]},{"title":"DNS Number Fields","type":"string","enum":["log.colo_id","log.dst_port","log.query_category_ids","log.query_size","log.query_type","log.src_port"]},{"title":"Agent Number Fields","type":"string","enum":["agent.started_at_offset","agent.plugins.asset_manager.reboot_reasons","agent.plugins.endpoint_protection.reboot_reasons","agent.plugins.endpoint_detection_and_response.reboot_reasons","agent.plugins.incident_response.reboot_reasons","agent.plugins.siem.reboot_reasons","agent.os_version_major","agent.os_version_minor"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["exists","not_exists"]}}}]},"examples":[[{"field":"rule_name","value":"Test Rule","operator":"equals"}]]},"aggregations":{"items":{"type":"string","title":"DNS aggregation fields","enum":["machine_id","group_id","rule_id","rule_name","resolved_ips","group_name","policy_id","policy_name","account_id","parent_account_id","action","log.policy_id","log.policy","log.protocol","log.query_name","log.query_name_reversed","log.resolver_decision","log.user_id","log.colo_id","log.dst_port","log.query_category_ids","log.query_size","log.query_type","log.src_port","log.dst_ip","log.src_ip","timestamp","log.datetime","agent.at","agent.last_user","agent.fully_qualified_host_name","agent.started_at_local","agent.started_at_offset","agent.os_info.os_type","agent.os_info.os_version","agent.os_info.os_platform","agent.os_info.os_architecture","agent.os_info.os_release_name","agent.domain_name","agent.engine_version","agent.policy_etag","agent.host_name","agent.nics.ips","agent.nics.mac_address","agent.has_alerts","agent.machine_ip","agent.object_guid","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.source_location.city","agent.source_location.country","agent.source_location.country_iso","agent.source_location.continent","agent.source_location.time_zone","agent.source_location.postal_code","agent.source_location.subdivisions","agent.source_location.anonymous_proxy","agent.serial_number","daily_logs"]}},"sort_field":{"type":"string","title":"DNS sort fields","anyOf":[{"enum":["machine_id","group_id","group_name","rule_id","rule_name","resolved_ips","policy_id","policy_name","account_id","parent_account_id","action","log.policy_id","log.policy","log.protocol","log.query_name","log.query_name_reversed","log.resolver_decision","log.user_id","log.colo_id","log.dst_port","log.query_category_ids","log.query_size","log.query_type","log.src_port","log.dst_ip","log.src_ip","timestamp","log.datetime","agent.at","agent.last_user","agent.fully_qualified_host_name","agent.started_at_local","agent.started_at_offset","agent.os_info.os_type","agent.os_info.os_version","agent.os_info.os_platform","agent.os_info.os_architecture","agent.os_info.os_release_name","agent.domain_name","agent.engine_version","agent.policy_etag","agent.host_name","agent.nics.ips","agent.nics.mac_address","agent.has_alerts","agent.machine_ip","agent.object_guid","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.source_location.city","agent.source_location.country","agent.source_location.country_iso","agent.source_location.continent","agent.source_location.time_zone","agent.source_location.postal_code","agent.source_location.subdivisions","agent.source_location.anonymous_proxy","agent.serial_number"]},{"type":"string","title":"Active Directory Sort Fields","enum":["active_directory.user.display_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.machine.display_name","active_directory.machine.sam_account_name","active_directory.machine.ou"]}]}}},{"type":"object","title":"Base Search Schema","properties":{"aggregations":{"type":"array","title":"The fields onto which you can perform aggregations","items":{"type":"string","title":"The Items Schema"}},"page_size":{"type":"number","title":"The page size. If you just need to aggregate, set it to 0","minimum":0,"maximum":2000},"sort_field":{"title":"Sort Fields","type":"string"},"sort_order":{"type":"string","title":"Whether sorting should be ascending or descending","enum":["asc","desc"]},"aggregate_by_account":{"type":"boolean","title":"Indicates whether aggregations should be scoped by account"},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}]},{"type":"object","required":["account_ids"],"properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]}]}}}}]}}}},"responses":{"200":{"description":"Successful response"}},"tags":["Grid"],"operationId":"api.rmm.grid.export.dns.async"}},"/oneview/v1/grid/dns/search":{"post":{"description":"Search DNS activity across accounts","summary":"Search DNS activity","simple_schema":"dns-search-grid-rmm-simple","security":[{"client_credentials":["read"]},{"user_permissions":["dnsFiltering.view"]}],"status":{"outage":["auth","search_stateless"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","allOf":[{"type":"object","allOf":[{"properties":{"constraints":{"type":"array","items":{"title":"DNS Constraints","type":"object","required":["field"],"anyOf":[{"title":"String (Equals, Not Equals) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"title":"DNS Simple String Fields","type":"string","anyOf":[{"enum":["rule_name","group_name","policy_name","log.policy","log.protocol","log.query_name","log.query_name_reversed","log.resolver_decision"]},{"title":"Active Directory Simple String Fields","type":"string","enum":["active_directory.user.display_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.user.ou.path","active_directory.machine.display_name","active_directory.machine.sam_account_name","active_directory.machine.ou","active_directory.machine.ou.path"]}]},{"title":"DNS Enum String Fields","type":"string","enum":["log.resolver_decision","action"]},{"title":"DNS UID String Fields","type":"string","enum":["id","machine_id","rule_id","group_id","policy_id","account_id","parent_account_id","log.policy_id","log.user_id"]},{"title":"Agent Simple String Fields","type":"string","enum":["agent.nics.mac_address","agent.nics.description","agent.os_info.os_version","agent.os_info.os_release_name","agent.os_info.os_architecture","agent.plugins.asset_manager.plugin_version","agent.plugins.asset_manager.alerts.codes","agent.plugins.endpoint_protection.plugin_version","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.plugins.endpoint_protection.update_package_version","agent.plugins.endpoint_protection.alerts.codes","agent.plugins.endpoint_detection_and_response.plugin_version","agent.plugins.endpoint_detection_and_response.alerts.codes","agent.plugins.incident_response.plugin_version","agent.plugins.incident_response.update_package_version","agent.plugins.incident_response.alerts.codes","agent.plugins.siem.plugin_version","agent.plugins.siem.alerts.codes","agent.plugins.browser_phishing_protection.plugin_version","agent.plugins.browser_phishing_protection.alerts.codes","agent.engine_version","agent.source_location.city","agent.source_location.country","agent.source_location.subdivisions","agent.source_location.time_zone","agent.domain_name","agent.alias","agent.policy_etag","agent.serial_number","agent.available_software_updates.sdk_version.currentVersion","agent.available_software_updates.sdk_version.newVersion","agent.alerts.codes","agent.host_name","agent.fully_qualified_host_name","agent.object_guid","agent.last_user","agent.active_directory.user.display_name","agent.active_directory.user.ou","agent.active_directory.user.ou.path","agent.active_directory.user.sam_account_name","agent.active_directory.machine.display_name","agent.active_directory.machine.ou","agent.active_directory.machine.ou.path","agent.active_directory.machine.sam_account_name"]},{"title":"Agent Enum String Fields","type":"string","enum":["agent.os_info.os_type","agent.os_info.os_platform"]},{"title":"Agent Version fields","type":"string","enum":["agent.plugins.asset_manager.plugin_version","agent.plugins.endpoint_protection.plugin_version","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.plugins.endpoint_protection.update_package_version","agent.plugins.endpoint_detection_and_response.plugin_version","agent.plugins.incident_response.plugin_version","agent.plugins.incident_response.update_package_version","agent.available_software_updates.sdk_version.currentVersion","agent.available_software_updates.sdk_version.newVersion"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["equals","not_equals"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}}},"if":{"properties":{"field":{"title":"DNS UID String Fields","type":"string","enum":["id","machine_id","rule_id","group_id","policy_id","account_id","parent_account_id","log.policy_id","log.user_id"]}}},"then":{"properties":{"value":{"type":["string","array"],"format":"uuid","items":{"type":"string","format":"uuid"}}}}},{"title":"String (Contains, Not Contains) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"title":"DNS Simple String Fields","type":"string","anyOf":[{"enum":["rule_name","group_name","policy_name","log.policy","log.protocol","log.query_name","log.query_name_reversed","log.resolver_decision"]},{"title":"Active Directory Simple String Fields","type":"string","enum":["active_directory.user.display_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.user.ou.path","active_directory.machine.display_name","active_directory.machine.sam_account_name","active_directory.machine.ou","active_directory.machine.ou.path"]}]},{"title":"Agent Simple String Fields","type":"string","enum":["agent.nics.mac_address","agent.nics.description","agent.os_info.os_version","agent.os_info.os_release_name","agent.os_info.os_architecture","agent.plugins.asset_manager.plugin_version","agent.plugins.asset_manager.alerts.codes","agent.plugins.endpoint_protection.plugin_version","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.plugins.endpoint_protection.update_package_version","agent.plugins.endpoint_protection.alerts.codes","agent.plugins.endpoint_detection_and_response.plugin_version","agent.plugins.endpoint_detection_and_response.alerts.codes","agent.plugins.incident_response.plugin_version","agent.plugins.incident_response.update_package_version","agent.plugins.incident_response.alerts.codes","agent.plugins.siem.plugin_version","agent.plugins.siem.alerts.codes","agent.plugins.browser_phishing_protection.plugin_version","agent.plugins.browser_phishing_protection.alerts.codes","agent.engine_version","agent.source_location.city","agent.source_location.country","agent.source_location.subdivisions","agent.source_location.time_zone","agent.domain_name","agent.alias","agent.policy_etag","agent.serial_number","agent.available_software_updates.sdk_version.currentVersion","agent.available_software_updates.sdk_version.newVersion","agent.alerts.codes","agent.host_name","agent.fully_qualified_host_name","agent.object_guid","agent.last_user","agent.active_directory.user.display_name","agent.active_directory.user.ou","agent.active_directory.user.ou.path","agent.active_directory.user.sam_account_name","agent.active_directory.machine.display_name","agent.active_directory.machine.ou","agent.active_directory.machine.ou.path","agent.active_directory.machine.sam_account_name"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["contains","not_contains"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}}}},{"title":"Number Constraints (gt, gte, lt, lte, equals)","properties":{"field":{"type":"string","oneOf":[{"title":"DNS Number Fields","type":"string","enum":["log.colo_id","log.dst_port","log.query_category_ids","log.query_size","log.query_type","log.src_port"]},{"title":"Agent Number Fields","type":"string","enum":["agent.started_at_offset","agent.plugins.asset_manager.reboot_reasons","agent.plugins.endpoint_protection.reboot_reasons","agent.plugins.endpoint_detection_and_response.reboot_reasons","agent.plugins.incident_response.reboot_reasons","agent.plugins.siem.reboot_reasons","agent.os_version_major","agent.os_version_minor"]}]}},"oneOf":[{"minProperties":1,"title":"Specify Number Range","not":{"anyOf":[{"required":["operator"]},{"required":["value"]}]},"properties":{"gt":{"type":"number","title":"Greater than"},"lt":{"type":"number","title":"Less than"},"gte":{"type":"number","title":"Greater than or equals"},"lte":{"type":"number","title":"Less than or equals"}}},{"title":"Specify Exact Number","not":{"anyOf":[{"required":["gt"]},{"required":["lt"]},{"required":["gte"]},{"required":["lte"]}]},"required":["operator","value"],"properties":{"operator":{"type":"string","enum":["equals"]},"value":{"type":["number","array"],"title":"Value to search","items":{"type":"number"}}}}]},{"title":"Date (start, end) Constraints","properties":{"field":{"oneOf":[{"title":"DNS Date Fields","type":"string","enum":["timestamp","log.datetime"]},{"title":"Agent Date Fields","type":"string","enum":["agent.at","agent.started_at_local"]}]}},"oneOf":[{"minProperties":1,"title":"Specify Date Range","not":{"anyOf":[{"required":["operator"]},{"required":["value"]}]},"properties":{"start":{"type":"string","format":"date-time","title":"Start Date"},"end":{"type":"string","format":"date-time","title":"End Date"}}},{"title":"Specify Exact Date","not":{"anyOf":[{"required":["start"]},{"required":["end"]}]},"required":["operator","value"],"properties":{"operator":{"type":"string","enum":["equals"]},"value":{"type":["string","array"],"format":"date-time","title":"Value to search","items":{"format":"date-time"}}}}]},{"title":"IP Constraints","properties":{"field":{"oneOf":[{"title":"DNS IP Fields","type":"string","enum":["log.dst_ip","log.src_ip"]},{"title":"Agent IP Fields","type":"string","enum":["agent.nics.ips","agent.machine_ip"]}]},"operator":{"type":"string","enum":["ip"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}}}},{"title":"Field Exists/Not Exists Constraints","required":["operator"],"properties":{"field":{"type":"string","oneOf":[{"title":"DNS UID String Fields","type":"string","enum":["id","machine_id","rule_id","group_id","policy_id","account_id","parent_account_id","log.policy_id","log.user_id"]},{"title":"DNS Simple String Fields","type":"string","anyOf":[{"enum":["rule_name","group_name","policy_name","log.policy","log.protocol","log.query_name","log.query_name_reversed","log.resolver_decision"]},{"title":"Active Directory Simple String Fields","type":"string","enum":["active_directory.user.display_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.user.ou.path","active_directory.machine.display_name","active_directory.machine.sam_account_name","active_directory.machine.ou","active_directory.machine.ou.path"]}]},{"title":"DNS Enum String Fields","type":"string","enum":["log.resolver_decision","action"]},{"title":"Agent Simple String Fields","type":"string","enum":["agent.nics.mac_address","agent.nics.description","agent.os_info.os_version","agent.os_info.os_release_name","agent.os_info.os_architecture","agent.plugins.asset_manager.plugin_version","agent.plugins.asset_manager.alerts.codes","agent.plugins.endpoint_protection.plugin_version","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.plugins.endpoint_protection.update_package_version","agent.plugins.endpoint_protection.alerts.codes","agent.plugins.endpoint_detection_and_response.plugin_version","agent.plugins.endpoint_detection_and_response.alerts.codes","agent.plugins.incident_response.plugin_version","agent.plugins.incident_response.update_package_version","agent.plugins.incident_response.alerts.codes","agent.plugins.siem.plugin_version","agent.plugins.siem.alerts.codes","agent.plugins.browser_phishing_protection.plugin_version","agent.plugins.browser_phishing_protection.alerts.codes","agent.engine_version","agent.source_location.city","agent.source_location.country","agent.source_location.subdivisions","agent.source_location.time_zone","agent.domain_name","agent.alias","agent.policy_etag","agent.serial_number","agent.available_software_updates.sdk_version.currentVersion","agent.available_software_updates.sdk_version.newVersion","agent.alerts.codes","agent.host_name","agent.fully_qualified_host_name","agent.object_guid","agent.last_user","agent.active_directory.user.display_name","agent.active_directory.user.ou","agent.active_directory.user.ou.path","agent.active_directory.user.sam_account_name","agent.active_directory.machine.display_name","agent.active_directory.machine.ou","agent.active_directory.machine.ou.path","agent.active_directory.machine.sam_account_name"]},{"title":"Agent Enum String Fields","type":"string","enum":["agent.os_info.os_type","agent.os_info.os_platform"]},{"title":"Agent Version fields","type":"string","enum":["agent.plugins.asset_manager.plugin_version","agent.plugins.endpoint_protection.plugin_version","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.plugins.endpoint_protection.update_package_version","agent.plugins.endpoint_detection_and_response.plugin_version","agent.plugins.incident_response.plugin_version","agent.plugins.incident_response.update_package_version","agent.available_software_updates.sdk_version.currentVersion","agent.available_software_updates.sdk_version.newVersion"]},{"title":"DNS IP Fields","type":"string","enum":["log.dst_ip","log.src_ip"]},{"title":"Agent IP Fields","type":"string","enum":["agent.nics.ips","agent.machine_ip"]},{"title":"DNS Date Fields","type":"string","enum":["timestamp","log.datetime"]},{"title":"Agent Date Fields","type":"string","enum":["agent.at","agent.started_at_local"]},{"title":"DNS Number Fields","type":"string","enum":["log.colo_id","log.dst_port","log.query_category_ids","log.query_size","log.query_type","log.src_port"]},{"title":"Agent Number Fields","type":"string","enum":["agent.started_at_offset","agent.plugins.asset_manager.reboot_reasons","agent.plugins.endpoint_protection.reboot_reasons","agent.plugins.endpoint_detection_and_response.reboot_reasons","agent.plugins.incident_response.reboot_reasons","agent.plugins.siem.reboot_reasons","agent.os_version_major","agent.os_version_minor"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["exists","not_exists"]}}}]},"examples":[[{"field":"rule_name","value":"Test Rule","operator":"equals"}]]},"aggregations":{"items":{"type":"string","title":"DNS aggregation fields","enum":["machine_id","group_id","rule_id","rule_name","resolved_ips","group_name","policy_id","policy_name","account_id","parent_account_id","action","log.policy_id","log.policy","log.protocol","log.query_name","log.query_name_reversed","log.resolver_decision","log.user_id","log.colo_id","log.dst_port","log.query_category_ids","log.query_size","log.query_type","log.src_port","log.dst_ip","log.src_ip","timestamp","log.datetime","agent.at","agent.last_user","agent.fully_qualified_host_name","agent.started_at_local","agent.started_at_offset","agent.os_info.os_type","agent.os_info.os_version","agent.os_info.os_platform","agent.os_info.os_architecture","agent.os_info.os_release_name","agent.domain_name","agent.engine_version","agent.policy_etag","agent.host_name","agent.nics.ips","agent.nics.mac_address","agent.has_alerts","agent.machine_ip","agent.object_guid","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.source_location.city","agent.source_location.country","agent.source_location.country_iso","agent.source_location.continent","agent.source_location.time_zone","agent.source_location.postal_code","agent.source_location.subdivisions","agent.source_location.anonymous_proxy","agent.serial_number","daily_logs"]}},"sort_field":{"type":"string","title":"DNS sort fields","anyOf":[{"enum":["machine_id","group_id","group_name","rule_id","rule_name","resolved_ips","policy_id","policy_name","account_id","parent_account_id","action","log.policy_id","log.policy","log.protocol","log.query_name","log.query_name_reversed","log.resolver_decision","log.user_id","log.colo_id","log.dst_port","log.query_category_ids","log.query_size","log.query_type","log.src_port","log.dst_ip","log.src_ip","timestamp","log.datetime","agent.at","agent.last_user","agent.fully_qualified_host_name","agent.started_at_local","agent.started_at_offset","agent.os_info.os_type","agent.os_info.os_version","agent.os_info.os_platform","agent.os_info.os_architecture","agent.os_info.os_release_name","agent.domain_name","agent.engine_version","agent.policy_etag","agent.host_name","agent.nics.ips","agent.nics.mac_address","agent.has_alerts","agent.machine_ip","agent.object_guid","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.source_location.city","agent.source_location.country","agent.source_location.country_iso","agent.source_location.continent","agent.source_location.time_zone","agent.source_location.postal_code","agent.source_location.subdivisions","agent.source_location.anonymous_proxy","agent.serial_number"]},{"type":"string","title":"Active Directory Sort Fields","enum":["active_directory.user.display_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.machine.display_name","active_directory.machine.sam_account_name","active_directory.machine.ou"]}]}}},{"type":"object","title":"Base Search Schema","properties":{"aggregations":{"type":"array","title":"The fields onto which you can perform aggregations","items":{"type":"string","title":"The Items Schema"}},"page_size":{"type":"number","title":"The page size. If you just need to aggregate, set it to 0","minimum":0,"maximum":2000},"sort_field":{"title":"Sort Fields","type":"string"},"sort_order":{"type":"string","title":"Whether sorting should be ascending or descending","enum":["asc","desc"]},"aggregate_by_account":{"type":"boolean","title":"Indicates whether aggregations should be scoped by account"},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}]},{"type":"object","required":["account_ids"],"properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Search DNS Logs result","properties":{"results":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"@timestamp":{"type":"string"},"machine_id":{"type":"string"},"group_id":{"type":"string"},"group_name":{"type":"string"},"account_id":{"type":"string"},"policy_id":{"type":"string"},"policy_name":{"type":"string"},"parent_account_id":{"type":"string"},"action":{"type":"string"},"log":{"properties":{"colo_id":{"type":"number"},"datetime":{"type":"string"},"device_id":{"type":"string"},"dst_ip":{"type":"string"},"dst_port":{"type":"integer"},"email":{"type":"string"},"location":{"type":"string"},"policy":{"type":"string"},"policy_id":{"type":"string"},"protocol":{"type":"string"},"query_category_ids":{"type":"array"},"query_name":{"type":"string"},"query_name_reversed":{"type":"string"},"query_size":{"type":"number"},"query_type":{"type":"integer"},"resolver_decision":{"type":"string"},"src_ip":{"type":"string"},"src_port":{"type":"integer"},"user_id":{"type":"string"}}},"rule_id":{"type":"string","description":"Content filtering rule id"},"rule_name":{"type":"string","description":"Content filtering rule name"}}}},"aggregations":{"type":"object","title":"Aggregations","additionalProperties":true},"total_count":{"type":"integer","title":"Total count of found detections"},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}},"required":["results","total_count"]}}}}},"tags":["Grid"],"operationId":"api.rmm.grid.search.dns"}},"/oneview/v1/grid/dns/search-groupby":{"post":{"description":"Search grouped DNS activity across accounts","summary":"Search grouped DNS activity","simple_schema":"dns-search-groupby-grid-rmm-simple","security":[{"client_credentials":["read"]},{"user_permissions":["dnsFiltering.view"]}],"status":{"incident":["read_nebula_data"],"outage":["auth","search_stateful"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"title":"DNS Search Groupby Schema","type":"object","allOf":[{"type":"object","required":["group_by","page_size"],"properties":{"group_by":{"title":"Group by the following fields","type":"array","minItems":1,"uniqueItems":true,"items":{"type":"string"}},"page_size":{"type":"number","title":"The page_size Schema","minimum":50,"maximum":2000}}},{"type":"object","allOf":[{"type":"object","allOf":[{"properties":{"constraints":{"type":"array","items":{"title":"DNS Constraints","type":"object","required":["field"],"anyOf":[{"title":"String (Equals, Not Equals) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"title":"DNS Simple String Fields","type":"string","anyOf":[{"enum":["rule_name","group_name","policy_name","log.policy","log.protocol","log.query_name","log.query_name_reversed","log.resolver_decision"]},{"title":"Active Directory Simple String Fields","type":"string","enum":["active_directory.user.display_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.user.ou.path","active_directory.machine.display_name","active_directory.machine.sam_account_name","active_directory.machine.ou","active_directory.machine.ou.path"]}]},{"title":"DNS Enum String Fields","type":"string","enum":["log.resolver_decision","action"]},{"title":"DNS UID String Fields","type":"string","enum":["id","machine_id","rule_id","group_id","policy_id","account_id","parent_account_id","log.policy_id","log.user_id"]},{"title":"Agent Simple String Fields","type":"string","enum":["agent.nics.mac_address","agent.nics.description","agent.os_info.os_version","agent.os_info.os_release_name","agent.os_info.os_architecture","agent.plugins.asset_manager.plugin_version","agent.plugins.asset_manager.alerts.codes","agent.plugins.endpoint_protection.plugin_version","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.plugins.endpoint_protection.update_package_version","agent.plugins.endpoint_protection.alerts.codes","agent.plugins.endpoint_detection_and_response.plugin_version","agent.plugins.endpoint_detection_and_response.alerts.codes","agent.plugins.incident_response.plugin_version","agent.plugins.incident_response.update_package_version","agent.plugins.incident_response.alerts.codes","agent.plugins.siem.plugin_version","agent.plugins.siem.alerts.codes","agent.plugins.browser_phishing_protection.plugin_version","agent.plugins.browser_phishing_protection.alerts.codes","agent.engine_version","agent.source_location.city","agent.source_location.country","agent.source_location.subdivisions","agent.source_location.time_zone","agent.domain_name","agent.alias","agent.policy_etag","agent.serial_number","agent.available_software_updates.sdk_version.currentVersion","agent.available_software_updates.sdk_version.newVersion","agent.alerts.codes","agent.host_name","agent.fully_qualified_host_name","agent.object_guid","agent.last_user","agent.active_directory.user.display_name","agent.active_directory.user.ou","agent.active_directory.user.ou.path","agent.active_directory.user.sam_account_name","agent.active_directory.machine.display_name","agent.active_directory.machine.ou","agent.active_directory.machine.ou.path","agent.active_directory.machine.sam_account_name"]},{"title":"Agent Enum String Fields","type":"string","enum":["agent.os_info.os_type","agent.os_info.os_platform"]},{"title":"Agent Version fields","type":"string","enum":["agent.plugins.asset_manager.plugin_version","agent.plugins.endpoint_protection.plugin_version","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.plugins.endpoint_protection.update_package_version","agent.plugins.endpoint_detection_and_response.plugin_version","agent.plugins.incident_response.plugin_version","agent.plugins.incident_response.update_package_version","agent.available_software_updates.sdk_version.currentVersion","agent.available_software_updates.sdk_version.newVersion"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["equals","not_equals"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}}},"if":{"properties":{"field":{"title":"DNS UID String Fields","type":"string","enum":["id","machine_id","rule_id","group_id","policy_id","account_id","parent_account_id","log.policy_id","log.user_id"]}}},"then":{"properties":{"value":{"type":["string","array"],"format":"uuid","items":{"type":"string","format":"uuid"}}}}},{"title":"String (Contains, Not Contains) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"title":"DNS Simple String Fields","type":"string","anyOf":[{"enum":["rule_name","group_name","policy_name","log.policy","log.protocol","log.query_name","log.query_name_reversed","log.resolver_decision"]},{"title":"Active Directory Simple String Fields","type":"string","enum":["active_directory.user.display_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.user.ou.path","active_directory.machine.display_name","active_directory.machine.sam_account_name","active_directory.machine.ou","active_directory.machine.ou.path"]}]},{"title":"Agent Simple String Fields","type":"string","enum":["agent.nics.mac_address","agent.nics.description","agent.os_info.os_version","agent.os_info.os_release_name","agent.os_info.os_architecture","agent.plugins.asset_manager.plugin_version","agent.plugins.asset_manager.alerts.codes","agent.plugins.endpoint_protection.plugin_version","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.plugins.endpoint_protection.update_package_version","agent.plugins.endpoint_protection.alerts.codes","agent.plugins.endpoint_detection_and_response.plugin_version","agent.plugins.endpoint_detection_and_response.alerts.codes","agent.plugins.incident_response.plugin_version","agent.plugins.incident_response.update_package_version","agent.plugins.incident_response.alerts.codes","agent.plugins.siem.plugin_version","agent.plugins.siem.alerts.codes","agent.plugins.browser_phishing_protection.plugin_version","agent.plugins.browser_phishing_protection.alerts.codes","agent.engine_version","agent.source_location.city","agent.source_location.country","agent.source_location.subdivisions","agent.source_location.time_zone","agent.domain_name","agent.alias","agent.policy_etag","agent.serial_number","agent.available_software_updates.sdk_version.currentVersion","agent.available_software_updates.sdk_version.newVersion","agent.alerts.codes","agent.host_name","agent.fully_qualified_host_name","agent.object_guid","agent.last_user","agent.active_directory.user.display_name","agent.active_directory.user.ou","agent.active_directory.user.ou.path","agent.active_directory.user.sam_account_name","agent.active_directory.machine.display_name","agent.active_directory.machine.ou","agent.active_directory.machine.ou.path","agent.active_directory.machine.sam_account_name"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["contains","not_contains"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}}}},{"title":"Number Constraints (gt, gte, lt, lte, equals)","properties":{"field":{"type":"string","oneOf":[{"title":"DNS Number Fields","type":"string","enum":["log.colo_id","log.dst_port","log.query_category_ids","log.query_size","log.query_type","log.src_port"]},{"title":"Agent Number Fields","type":"string","enum":["agent.started_at_offset","agent.plugins.asset_manager.reboot_reasons","agent.plugins.endpoint_protection.reboot_reasons","agent.plugins.endpoint_detection_and_response.reboot_reasons","agent.plugins.incident_response.reboot_reasons","agent.plugins.siem.reboot_reasons","agent.os_version_major","agent.os_version_minor"]}]}},"oneOf":[{"minProperties":1,"title":"Specify Number Range","not":{"anyOf":[{"required":["operator"]},{"required":["value"]}]},"properties":{"gt":{"type":"number","title":"Greater than"},"lt":{"type":"number","title":"Less than"},"gte":{"type":"number","title":"Greater than or equals"},"lte":{"type":"number","title":"Less than or equals"}}},{"title":"Specify Exact Number","not":{"anyOf":[{"required":["gt"]},{"required":["lt"]},{"required":["gte"]},{"required":["lte"]}]},"required":["operator","value"],"properties":{"operator":{"type":"string","enum":["equals"]},"value":{"type":["number","array"],"title":"Value to search","items":{"type":"number"}}}}]},{"title":"Date (start, end) Constraints","properties":{"field":{"oneOf":[{"title":"DNS Date Fields","type":"string","enum":["timestamp","log.datetime"]},{"title":"Agent Date Fields","type":"string","enum":["agent.at","agent.started_at_local"]}]}},"oneOf":[{"minProperties":1,"title":"Specify Date Range","not":{"anyOf":[{"required":["operator"]},{"required":["value"]}]},"properties":{"start":{"type":"string","format":"date-time","title":"Start Date"},"end":{"type":"string","format":"date-time","title":"End Date"}}},{"title":"Specify Exact Date","not":{"anyOf":[{"required":["start"]},{"required":["end"]}]},"required":["operator","value"],"properties":{"operator":{"type":"string","enum":["equals"]},"value":{"type":["string","array"],"format":"date-time","title":"Value to search","items":{"format":"date-time"}}}}]},{"title":"IP Constraints","properties":{"field":{"oneOf":[{"title":"DNS IP Fields","type":"string","enum":["log.dst_ip","log.src_ip"]},{"title":"Agent IP Fields","type":"string","enum":["agent.nics.ips","agent.machine_ip"]}]},"operator":{"type":"string","enum":["ip"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}}}},{"title":"Field Exists/Not Exists Constraints","required":["operator"],"properties":{"field":{"type":"string","oneOf":[{"title":"DNS UID String Fields","type":"string","enum":["id","machine_id","rule_id","group_id","policy_id","account_id","parent_account_id","log.policy_id","log.user_id"]},{"title":"DNS Simple String Fields","type":"string","anyOf":[{"enum":["rule_name","group_name","policy_name","log.policy","log.protocol","log.query_name","log.query_name_reversed","log.resolver_decision"]},{"title":"Active Directory Simple String Fields","type":"string","enum":["active_directory.user.display_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.user.ou.path","active_directory.machine.display_name","active_directory.machine.sam_account_name","active_directory.machine.ou","active_directory.machine.ou.path"]}]},{"title":"DNS Enum String Fields","type":"string","enum":["log.resolver_decision","action"]},{"title":"Agent Simple String Fields","type":"string","enum":["agent.nics.mac_address","agent.nics.description","agent.os_info.os_version","agent.os_info.os_release_name","agent.os_info.os_architecture","agent.plugins.asset_manager.plugin_version","agent.plugins.asset_manager.alerts.codes","agent.plugins.endpoint_protection.plugin_version","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.plugins.endpoint_protection.update_package_version","agent.plugins.endpoint_protection.alerts.codes","agent.plugins.endpoint_detection_and_response.plugin_version","agent.plugins.endpoint_detection_and_response.alerts.codes","agent.plugins.incident_response.plugin_version","agent.plugins.incident_response.update_package_version","agent.plugins.incident_response.alerts.codes","agent.plugins.siem.plugin_version","agent.plugins.siem.alerts.codes","agent.plugins.browser_phishing_protection.plugin_version","agent.plugins.browser_phishing_protection.alerts.codes","agent.engine_version","agent.source_location.city","agent.source_location.country","agent.source_location.subdivisions","agent.source_location.time_zone","agent.domain_name","agent.alias","agent.policy_etag","agent.serial_number","agent.available_software_updates.sdk_version.currentVersion","agent.available_software_updates.sdk_version.newVersion","agent.alerts.codes","agent.host_name","agent.fully_qualified_host_name","agent.object_guid","agent.last_user","agent.active_directory.user.display_name","agent.active_directory.user.ou","agent.active_directory.user.ou.path","agent.active_directory.user.sam_account_name","agent.active_directory.machine.display_name","agent.active_directory.machine.ou","agent.active_directory.machine.ou.path","agent.active_directory.machine.sam_account_name"]},{"title":"Agent Enum String Fields","type":"string","enum":["agent.os_info.os_type","agent.os_info.os_platform"]},{"title":"Agent Version fields","type":"string","enum":["agent.plugins.asset_manager.plugin_version","agent.plugins.endpoint_protection.plugin_version","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.plugins.endpoint_protection.update_package_version","agent.plugins.endpoint_detection_and_response.plugin_version","agent.plugins.incident_response.plugin_version","agent.plugins.incident_response.update_package_version","agent.available_software_updates.sdk_version.currentVersion","agent.available_software_updates.sdk_version.newVersion"]},{"title":"DNS IP Fields","type":"string","enum":["log.dst_ip","log.src_ip"]},{"title":"Agent IP Fields","type":"string","enum":["agent.nics.ips","agent.machine_ip"]},{"title":"DNS Date Fields","type":"string","enum":["timestamp","log.datetime"]},{"title":"Agent Date Fields","type":"string","enum":["agent.at","agent.started_at_local"]},{"title":"DNS Number Fields","type":"string","enum":["log.colo_id","log.dst_port","log.query_category_ids","log.query_size","log.query_type","log.src_port"]},{"title":"Agent Number Fields","type":"string","enum":["agent.started_at_offset","agent.plugins.asset_manager.reboot_reasons","agent.plugins.endpoint_protection.reboot_reasons","agent.plugins.endpoint_detection_and_response.reboot_reasons","agent.plugins.incident_response.reboot_reasons","agent.plugins.siem.reboot_reasons","agent.os_version_major","agent.os_version_minor"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["exists","not_exists"]}}}]},"examples":[[{"field":"rule_name","value":"Test Rule","operator":"equals"}]]},"aggregations":{"items":{"type":"string","title":"DNS aggregation fields","enum":["machine_id","group_id","rule_id","rule_name","resolved_ips","group_name","policy_id","policy_name","account_id","parent_account_id","action","log.policy_id","log.policy","log.protocol","log.query_name","log.query_name_reversed","log.resolver_decision","log.user_id","log.colo_id","log.dst_port","log.query_category_ids","log.query_size","log.query_type","log.src_port","log.dst_ip","log.src_ip","timestamp","log.datetime","agent.at","agent.last_user","agent.fully_qualified_host_name","agent.started_at_local","agent.started_at_offset","agent.os_info.os_type","agent.os_info.os_version","agent.os_info.os_platform","agent.os_info.os_architecture","agent.os_info.os_release_name","agent.domain_name","agent.engine_version","agent.policy_etag","agent.host_name","agent.nics.ips","agent.nics.mac_address","agent.has_alerts","agent.machine_ip","agent.object_guid","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.source_location.city","agent.source_location.country","agent.source_location.country_iso","agent.source_location.continent","agent.source_location.time_zone","agent.source_location.postal_code","agent.source_location.subdivisions","agent.source_location.anonymous_proxy","agent.serial_number","daily_logs"]}},"sort_field":{"type":"string","title":"DNS sort fields","anyOf":[{"enum":["machine_id","group_id","group_name","rule_id","rule_name","resolved_ips","policy_id","policy_name","account_id","parent_account_id","action","log.policy_id","log.policy","log.protocol","log.query_name","log.query_name_reversed","log.resolver_decision","log.user_id","log.colo_id","log.dst_port","log.query_category_ids","log.query_size","log.query_type","log.src_port","log.dst_ip","log.src_ip","timestamp","log.datetime","agent.at","agent.last_user","agent.fully_qualified_host_name","agent.started_at_local","agent.started_at_offset","agent.os_info.os_type","agent.os_info.os_version","agent.os_info.os_platform","agent.os_info.os_architecture","agent.os_info.os_release_name","agent.domain_name","agent.engine_version","agent.policy_etag","agent.host_name","agent.nics.ips","agent.nics.mac_address","agent.has_alerts","agent.machine_ip","agent.object_guid","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.source_location.city","agent.source_location.country","agent.source_location.country_iso","agent.source_location.continent","agent.source_location.time_zone","agent.source_location.postal_code","agent.source_location.subdivisions","agent.source_location.anonymous_proxy","agent.serial_number"]},{"type":"string","title":"Active Directory Sort Fields","enum":["active_directory.user.display_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.machine.display_name","active_directory.machine.sam_account_name","active_directory.machine.ou"]}]}}},{"type":"object","title":"Base Search Schema","properties":{"aggregations":{"type":"array","title":"The fields onto which you can perform aggregations","items":{"type":"string","title":"The Items Schema"}},"page_size":{"type":"number","title":"The page size. If you just need to aggregate, set it to 0","minimum":0,"maximum":2000},"sort_field":{"title":"Sort Fields","type":"string"},"sort_order":{"type":"string","title":"Whether sorting should be ascending or descending","enum":["asc","desc"]},"aggregate_by_account":{"type":"boolean","title":"Indicates whether aggregations should be scoped by account"},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}]},{"type":"object","required":["account_ids"],"properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]},{"properties":{"group_by":{"type":"array","title":"Group results by indicated field(s)","items":{"type":"string","title":"DNS Groupby Fields","anyOf":[{"enum":["rule_id","rule_name","machine_id","group_id","group_name","policy_id","policy_name","account_id","parent_account_id","action","log.policy_id","log.policy","log.protocol","log.query_name","log.query_name_reversed","log.resolver_decision","log.user_id","log.colo_id","log.dst_port","log.query_category_ids","log.query_size","log.query_type","log.src_port","log.dst_ip","log.src_ip","timestamp","log.datetime","agent.at","agent.last_user","agent.fully_qualified_host_name","agent.started_at_local","agent.started_at_offset","agent.os_info.os_type","agent.os_info.os_version","agent.os_info.os_platform","agent.os_info.os_architecture","agent.os_info.os_release_name","agent.domain_name","agent.engine_version","agent.policy_etag","agent.host_name","agent.nics.ips","agent.nics.mac_address","agent.has_alerts","agent.machine_ip","agent.object_guid","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.source_location.city","agent.source_location.country","agent.source_location.country_iso","agent.source_location.continent","agent.source_location.time_zone","agent.source_location.postal_code","agent.source_location.subdivisions","agent.source_location.anonymous_proxy","agent.serial_number"]},{"type":"string","title":"Active Directory Group By Fields","enum":["active_directory.user.display_name","active_directory.user.ou","active_directory.machine.display_name","active_directory.machine.ou"]}]}}}}]}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"The Post DNS Logs Search GroupBy Response Schema","required":["results","next_cursor"],"properties":{"results":{"type":"array","title":"The Results Schema","default":[]},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}}}}},"tags":["Grid"],"operationId":"api.rmm.grid.search.dns.group"}},"/oneview/v1/grid/endpoints":{"delete":{"description":"Delete endpoints across accounts","summary":"Delete endpoints across accounts","simple_schema":"endpoint-search-grid-groups-rmm-simple","security":[{"client_credentials":["write"]},{"user_permissions":["endpoints.delete"]}],"status":{"outage":["auth","search_stateful"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Bulk endpoint filter request","required":["groups"],"properties":{"groups":{"items":{"title":"List of queries to fetch endpoints","allOf":[{"type":"object","allOf":[{"type":"object","allOf":[{"properties":{"constraints":{"type":"array","items":{"title":"Endpoint Constraints","type":"object","required":["field"],"anyOf":[{"title":"String (Equals, Not Equals) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"title":"Agent Simple String Fields","type":"string","enum":["agent.nics.mac_address","agent.nics.description","agent.os_info.os_version","agent.os_info.os_release_name","agent.os_info.os_architecture","agent.plugins.asset_manager.plugin_version","agent.plugins.asset_manager.alerts.codes","agent.plugins.endpoint_protection.plugin_version","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.plugins.endpoint_protection.update_package_version","agent.plugins.endpoint_protection.alerts.codes","agent.plugins.endpoint_detection_and_response.plugin_version","agent.plugins.endpoint_detection_and_response.alerts.codes","agent.plugins.incident_response.plugin_version","agent.plugins.incident_response.update_package_version","agent.plugins.incident_response.alerts.codes","agent.plugins.siem.plugin_version","agent.plugins.siem.alerts.codes","agent.plugins.browser_phishing_protection.plugin_version","agent.plugins.browser_phishing_protection.alerts.codes","agent.engine_version","agent.source_location.city","agent.source_location.country","agent.source_location.subdivisions","agent.source_location.time_zone","agent.domain_name","agent.alias","agent.policy_etag","agent.serial_number","agent.available_software_updates.sdk_version.currentVersion","agent.available_software_updates.sdk_version.newVersion","agent.alerts.codes","agent.host_name","agent.fully_qualified_host_name","agent.object_guid","agent.last_user","agent.active_directory.user.display_name","agent.active_directory.user.ou","agent.active_directory.user.ou.path","agent.active_directory.user.sam_account_name","agent.active_directory.machine.display_name","agent.active_directory.machine.ou","agent.active_directory.machine.ou.path","agent.active_directory.machine.sam_account_name"]},{"title":"Agent Enum String Fields","type":"string","enum":["agent.os_info.os_type","agent.os_info.os_platform"]},{"title":"Machine UID String Fields","type":"string","enum":["machine.id","machine.group_id","machine.root_group_id","machine.policy_id"]},{"title":"Machine Simple String Fields","type":"string","enum":["protection_status","machine.tags.alias","machine.reboot_required_reason","machine.group_name","machine.policy_name","stats.assets.encryption_status"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["equals","not_equals"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}}},"if":{"properties":{"field":{"title":"Machine UID String Fields","type":"string","enum":["machine.id","machine.group_id","machine.root_group_id","machine.policy_id"]}}},"then":{"properties":{"value":{"type":["string","array"],"format":"uuid","items":{"type":"string","format":"uuid"}}}}},{"title":"String (Contains, Not Contains) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"title":"Machine Simple String Fields","type":"string","enum":["protection_status","machine.tags.alias","machine.reboot_required_reason","machine.group_name","machine.policy_name","stats.assets.encryption_status"]},{"title":"Agent Simple String Fields","type":"string","enum":["agent.nics.mac_address","agent.nics.description","agent.os_info.os_version","agent.os_info.os_release_name","agent.os_info.os_architecture","agent.plugins.asset_manager.plugin_version","agent.plugins.asset_manager.alerts.codes","agent.plugins.endpoint_protection.plugin_version","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.plugins.endpoint_protection.update_package_version","agent.plugins.endpoint_protection.alerts.codes","agent.plugins.endpoint_detection_and_response.plugin_version","agent.plugins.endpoint_detection_and_response.alerts.codes","agent.plugins.incident_response.plugin_version","agent.plugins.incident_response.update_package_version","agent.plugins.incident_response.alerts.codes","agent.plugins.siem.plugin_version","agent.plugins.siem.alerts.codes","agent.plugins.browser_phishing_protection.plugin_version","agent.plugins.browser_phishing_protection.alerts.codes","agent.engine_version","agent.source_location.city","agent.source_location.country","agent.source_location.subdivisions","agent.source_location.time_zone","agent.domain_name","agent.alias","agent.policy_etag","agent.serial_number","agent.available_software_updates.sdk_version.currentVersion","agent.available_software_updates.sdk_version.newVersion","agent.alerts.codes","agent.host_name","agent.fully_qualified_host_name","agent.object_guid","agent.last_user","agent.active_directory.user.display_name","agent.active_directory.user.ou","agent.active_directory.user.ou.path","agent.active_directory.user.sam_account_name","agent.active_directory.machine.display_name","agent.active_directory.machine.ou","agent.active_directory.machine.ou.path","agent.active_directory.machine.sam_account_name"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["contains","not_contains"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}}}},{"title":"Boolean (Equals) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"title":"Agent Boolean Fields","type":"string","enum":["agent.is_software_update_available","agent.has_alerts"]},{"title":"Machine Boolean Fields","type":"string","enum":["machine.is_deleted","machine.isolated","connected"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["equals"]},"value":{"title":"Value to search. Must be true or false","type":"boolean"}}},{"title":"Number Constraints (gt, gte, lt, lte, equals)","properties":{"field":{"type":"string","oneOf":[{"title":"Agent Number Fields","type":"string","enum":["agent.started_at_offset","agent.plugins.asset_manager.reboot_reasons","agent.plugins.endpoint_protection.reboot_reasons","agent.plugins.endpoint_detection_and_response.reboot_reasons","agent.plugins.incident_response.reboot_reasons","agent.plugins.siem.reboot_reasons","agent.os_version_major","agent.os_version_minor"]},{"title":"Machine Number Fields","type":"string","enum":["machine.suspicious_activity_count","machine.infection_count","machine.reboot_required","stats.assets.vulnerabilities_found.total","stats.assets.os_patches_available","stats.assets.vulnerabilities_found.critical","stats.assets.vulnerabilities_found.high","stats.assets.vulnerabilities_found.medium","stats.assets.vulnerabilities_found.low"]}]}},"oneOf":[{"minProperties":1,"title":"Specify Number Range","not":{"anyOf":[{"required":["operator"]},{"required":["value"]}]},"properties":{"gt":{"type":"number","title":"Greater than"},"lt":{"type":"number","title":"Less than"},"gte":{"type":"number","title":"Greater than or equals"},"lte":{"type":"number","title":"Less than or equals"}}},{"title":"Specify Exact Number","not":{"anyOf":[{"required":["gt"]},{"required":["lt"]},{"required":["gte"]},{"required":["lte"]}]},"required":["operator","value"],"properties":{"operator":{"type":"string","enum":["equals"]},"value":{"type":["number","array"],"title":"Value to search","items":{"type":"number"}}}}]},{"title":"Date (start, end) Constraints","properties":{"field":{"oneOf":[{"title":"Agent Date Fields","type":"string","enum":["agent.at","agent.started_at_local"]},{"title":"Machine Date Fields","type":"string","enum":["machine.deleted_at","machine.last_day_seen","machine.last_scanned_at","machine.created_at","stats.assets.last_scanned_at"]}]}},"oneOf":[{"minProperties":1,"title":"Specify Date Range","not":{"anyOf":[{"required":["operator"]},{"required":["value"]}]},"properties":{"start":{"type":"string","format":"date-time","title":"Start Date"},"end":{"type":"string","format":"date-time","title":"End Date"}}},{"title":"Specify Exact Date","not":{"anyOf":[{"required":["start"]},{"required":["end"]}]},"required":["operator","value"],"properties":{"operator":{"type":"string","enum":["equals"]},"value":{"type":["string","array"],"format":"date-time","title":"Value to search","items":{"format":"date-time"}}}}]},{"title":"IP Constraints","properties":{"field":{"oneOf":[{"title":"Agent IP Fields","type":"string","enum":["agent.nics.ips","agent.machine_ip"]}]},"operator":{"type":"string","enum":["ip"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}}}},{"title":"MWB Version Constraints (gt, gte, lt, lte, equals)","required":["operator"],"properties":{"field":{"type":"string","oneOf":[{"title":"Agent MWB Version fields","type":"string","enum":["agent.engine_version"]}]},"operator":{"type":"string","enum":["mwb_version"]}},"oneOf":[{"minProperties":1,"title":"Specify Version Range","not":{"anyOf":[{"required":["value"]}]},"properties":{"gt":{"type":"string","title":"Greater than"},"lt":{"type":"string","title":"Less than"},"gte":{"type":"string","title":"Greater than or equals"},"lte":{"type":"string","title":"Less than or equals"}}},{"title":"Specify Exact Version","not":{"anyOf":[{"required":["gt"]},{"required":["lt"]},{"required":["gte"]},{"required":["lte"]}]},"required":["value"],"properties":{"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}}}}]},{"title":"Field Exists/Not Exists Constraints","required":["operator"],"properties":{"field":{"type":"string","oneOf":[{"title":"Agent Simple String Fields","type":"string","enum":["agent.nics.mac_address","agent.nics.description","agent.os_info.os_version","agent.os_info.os_release_name","agent.os_info.os_architecture","agent.plugins.asset_manager.plugin_version","agent.plugins.asset_manager.alerts.codes","agent.plugins.endpoint_protection.plugin_version","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.plugins.endpoint_protection.update_package_version","agent.plugins.endpoint_protection.alerts.codes","agent.plugins.endpoint_detection_and_response.plugin_version","agent.plugins.endpoint_detection_and_response.alerts.codes","agent.plugins.incident_response.plugin_version","agent.plugins.incident_response.update_package_version","agent.plugins.incident_response.alerts.codes","agent.plugins.siem.plugin_version","agent.plugins.siem.alerts.codes","agent.plugins.browser_phishing_protection.plugin_version","agent.plugins.browser_phishing_protection.alerts.codes","agent.engine_version","agent.source_location.city","agent.source_location.country","agent.source_location.subdivisions","agent.source_location.time_zone","agent.domain_name","agent.alias","agent.policy_etag","agent.serial_number","agent.available_software_updates.sdk_version.currentVersion","agent.available_software_updates.sdk_version.newVersion","agent.alerts.codes","agent.host_name","agent.fully_qualified_host_name","agent.object_guid","agent.last_user","agent.active_directory.user.display_name","agent.active_directory.user.ou","agent.active_directory.user.ou.path","agent.active_directory.user.sam_account_name","agent.active_directory.machine.display_name","agent.active_directory.machine.ou","agent.active_directory.machine.ou.path","agent.active_directory.machine.sam_account_name"]},{"title":"Agent Enum String Fields","type":"string","enum":["agent.os_info.os_type","agent.os_info.os_platform"]},{"title":"Machine UID String Fields","type":"string","enum":["machine.id","machine.group_id","machine.root_group_id","machine.policy_id"]},{"title":"Machine Simple String Fields","type":"string","enum":["protection_status","machine.tags.alias","machine.reboot_required_reason","machine.group_name","machine.policy_name","stats.assets.encryption_status"]},{"title":"Agent IP Fields","type":"string","enum":["agent.nics.ips","agent.machine_ip"]},{"title":"Agent Number Fields","type":"string","enum":["agent.started_at_offset","agent.plugins.asset_manager.reboot_reasons","agent.plugins.endpoint_protection.reboot_reasons","agent.plugins.endpoint_detection_and_response.reboot_reasons","agent.plugins.incident_response.reboot_reasons","agent.plugins.siem.reboot_reasons","agent.os_version_major","agent.os_version_minor"]},{"title":"Machine Number Fields","type":"string","enum":["machine.suspicious_activity_count","machine.infection_count","machine.reboot_required","stats.assets.vulnerabilities_found.total","stats.assets.os_patches_available","stats.assets.vulnerabilities_found.critical","stats.assets.vulnerabilities_found.high","stats.assets.vulnerabilities_found.medium","stats.assets.vulnerabilities_found.low"]},{"title":"Agent Boolean Fields","type":"string","enum":["agent.is_software_update_available","agent.has_alerts"]},{"title":"Machine Boolean Fields","type":"string","enum":["machine.is_deleted","machine.isolated","connected"]},{"title":"Machine Date Fields","type":"string","enum":["machine.deleted_at","machine.last_day_seen","machine.last_scanned_at","machine.created_at","stats.assets.last_scanned_at"]},{"title":"Agent Date Fields","type":"string","enum":["agent.at","agent.started_at_local"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["exists","not_exists"]}}}]},"examples":[[{"field":"host_name","value":"DESKTOP-PHASHA","operator":"equals"}]]},"aggregations":{},"sort_field":{"type":"string","title":"Endpoint sort fields","enum":["agent.at","agent.nics.ips","agent.nics.mac_address","agent.nics.description","agent.os_info.os_type","agent.os_info.os_version","agent.os_info.os_platform","agent.os_info.os_architecture","agent.os_info.os_release_name","agent.host_name","agent.fully_qualified_host_name","agent.plugins.asset_manager.plugin_version","agent.plugins.asset_manager.reboot_reason","agent.plugins.endpoint_protection.plugin_version","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.plugins.endpoint_protection.update_package_version","agent.plugins.endpoint_protection.reboot_reason","agent.plugins.endpoint_detection_and_response.plugin_version","agent.plugins.endpoint_detection_and_response.reboot_reason","agent.plugins.incident_response.plugin_version","agent.plugins.incident_response.reboot_reason","agent.plugins.siem.plugin_version","agent.plugins.siem.reboot_reason","agent.plugins.browser_phishing_protection.plugin_version","agent.engine_version","agent.domain_name","agent.policy_etag","machine.account_id","machine.account.name","machine.group_id","machine.root_group_id","machine.group_name","machine.policy_name","machine.policy_id","machine.deleted_at","machine.created_at","machine.marked_for_deletion","machine.is_deleted","machine.last_day_seen","machine.last_scanned_at","agent.last_user","machine.tags.alias","display_name","name_multi_search","agent.machine_ip","agent.serial_number","agent.object_guid","stats.assets.vulnerabilities_found.critical","stats.assets.vulnerabilities_found.high","stats.assets.vulnerabilities_found.medium","stats.assets.vulnerabilities_found.low","stats.assets.vulnerabilities_found.none","stats.assets.vulnerabilities_found.total","stats.assets.os_patches_available","stats.assets.last_scanned_at","connected","agent.active_directory.user.display_name","agent.active_directory.user.sam_account_name","agent.active_directory.user.ou","agent.active_directory.machine.display_name","agent.active_directory.machine.ou","agent.active_directory.machine.sam_account_name","stats.assets.encryption_status","machine.suspicious_activity_count","machine.infection_count"]}}},{"type":"object","title":"Base Search Schema","properties":{"aggregations":{"type":"array","title":"The fields onto which you can perform aggregations","items":{"type":"string","title":"The Items Schema"}},"page_size":{"type":"number","title":"The page size. If you just need to aggregate, set it to 0","minimum":0,"maximum":2000},"sort_field":{"title":"Sort Fields","type":"string"},"sort_order":{"type":"string","title":"Whether sorting should be ascending or descending","enum":["asc","desc"]},"aggregate_by_account":{"type":"boolean","title":"Indicates whether aggregations should be scoped by account"},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}]},{"type":"object","required":["account_ids"],"properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]}]}},"unregister_isolated":{"type":"boolean","title":"Force delete isolated endpoints"}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"The Delete Endpoints Bulk Body 200 Schema","required":["deleted"],"properties":{"deleted":{"type":"array","title":"IDs of the deleted endpoint","items":{"type":"string","title":"Endpoint ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}},"errors":{"type":"array","title":"tasks not performed","items":{"type":"object","title":"Endpoint ID","additionalProperties":true,"properties":{"id":{"type":"string","title":"Machine ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"account_id":{"type":"string","title":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"account_ids":{"type":"array","title":"Account IDs","items":{"type":"string","title":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}}}}}}}},"tags":["Grid"],"operationId":"api.rmm.grid.delete.endpoints"}},"/oneview/v1/grid/endpoints/export":{"post":{"description":"Export endpoints across accounts","summary":"Export endpoints","simple_schema":"endpoint-export-grid-rmm-simple","security":[{"client_credentials":["write"]},{"user_permissions":["endpoints.view"]}],"status":{"outage":["auth","search_stateful"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Endpoint export request","allOf":[{"type":"object","title":"Base Export Schema","required":["groups","select","format"],"properties":{"format":{"type":"string","title":"The output file","enum":["csv","xlsx","html","ods","txt","rtf","json"]},"download":{"type":"boolean","title":"Whether to instruct the client to download the response as a file. Only clients like browsers are supported"},"type":{"type":"string","title":"The encoding of the output","enum":["string","base64","binary"],"default":"string"},"select":{"type":"array","title":"Which fields to select from the response","items":{"type":"object","title":"Field","required":["field","newField"],"properties":{"newField":{"type":"string","title":"the new value"},"field":{"type":"string","title":"The response field to map to a new value"}}}},"groups":{"type":"array","title":"List of queries","items":{"type":"object"}}}},{"required":["endpoints"],"properties":{"endpoints":{"type":"array","title":"Endpoints IDs","items":{"type":"object","title":"Explicit list of endpoints","required":["id","account_id"],"properties":{"id":{"type":"string","title":"ID of the endpoint","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"account_id":{"type":"string","title":"Account to which the endpoint belongs","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}},"select":{"items":{"properties":{"field":{"type":"string","title":"Endpoint select fields","enum":["machine.is_deleted","machine.scan_age_days","machine.root_group_id","machine.last_day_seen","machine.isolated","machine.suspicious_activity_count","machine.infection_count","machine.reboot_required","machine.last_scanned_at","machine.group_name","machine.policy_id","machine.policy_name","machine.tags","machine.group_id","machine.id","machine.account_id","machine.online","machine.created_at","machine.job.status","machine.account.name","agent.at","agent.last_user","agent.fully_qualified_host_name","agent.started_at_local","agent.started_at_offset","agent.os_info.os_type","agent.os_info.os_version","agent.os_info.os_platform","agent.os_info.os_architecture","agent.os_info.os_release_name","agent.domain_name","agent.engine_version","agent.policy_etag","agent.host_name","agent.nics.ips","agent.nics.mac_address","machine.tags.alias","agent.is_software_update_available","agent.has_alerts","agent.machine_ip","agent.object_guid","agent.available_software_updates.sdk_version.new","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.plugins.endpoint_protection.update_package_version","agent.source_location.city","agent.source_location.country","agent.source_location.country_iso","agent.source_location.continent","agent.source_location.time_zone","agent.source_location.postal_code","agent.source_location.subdivisions","agent.source_location.anonymous_proxy","agent.serial_number","protection_status","stats.assets.vulnerabilities_found","stats.assets.os_patches_available","stats.assets.last_scanned_at","stats.app_block_count","stats.assets.encryption_status","connected","agent.plugins.browser_phishing_protection.plugin_version","agent.active_directory.user.display_name","agent.active_directory.user.ou","agent.active_directory.user.sam_account_name","agent.active_directory.machine.display_name","agent.active_directory.machine.ou","agent.active_directory.machine.sam_account_name"]}}}},"groups":{"items":{"title":"List of queries to fetch endpoints","allOf":[{"type":"object","allOf":[{"type":"object","allOf":[{"properties":{"constraints":{"type":"array","items":{"title":"Endpoint Constraints","type":"object","required":["field"],"anyOf":[{"title":"String (Equals, Not Equals) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"title":"Agent Simple String Fields","type":"string","enum":["agent.nics.mac_address","agent.nics.description","agent.os_info.os_version","agent.os_info.os_release_name","agent.os_info.os_architecture","agent.plugins.asset_manager.plugin_version","agent.plugins.asset_manager.alerts.codes","agent.plugins.endpoint_protection.plugin_version","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.plugins.endpoint_protection.update_package_version","agent.plugins.endpoint_protection.alerts.codes","agent.plugins.endpoint_detection_and_response.plugin_version","agent.plugins.endpoint_detection_and_response.alerts.codes","agent.plugins.incident_response.plugin_version","agent.plugins.incident_response.update_package_version","agent.plugins.incident_response.alerts.codes","agent.plugins.siem.plugin_version","agent.plugins.siem.alerts.codes","agent.plugins.browser_phishing_protection.plugin_version","agent.plugins.browser_phishing_protection.alerts.codes","agent.engine_version","agent.source_location.city","agent.source_location.country","agent.source_location.subdivisions","agent.source_location.time_zone","agent.domain_name","agent.alias","agent.policy_etag","agent.serial_number","agent.available_software_updates.sdk_version.currentVersion","agent.available_software_updates.sdk_version.newVersion","agent.alerts.codes","agent.host_name","agent.fully_qualified_host_name","agent.object_guid","agent.last_user","agent.active_directory.user.display_name","agent.active_directory.user.ou","agent.active_directory.user.ou.path","agent.active_directory.user.sam_account_name","agent.active_directory.machine.display_name","agent.active_directory.machine.ou","agent.active_directory.machine.ou.path","agent.active_directory.machine.sam_account_name"]},{"title":"Agent Enum String Fields","type":"string","enum":["agent.os_info.os_type","agent.os_info.os_platform"]},{"title":"Machine UID String Fields","type":"string","enum":["machine.id","machine.group_id","machine.root_group_id","machine.policy_id"]},{"title":"Machine Simple String Fields","type":"string","enum":["protection_status","machine.tags.alias","machine.reboot_required_reason","machine.group_name","machine.policy_name","stats.assets.encryption_status"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["equals","not_equals"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}}},"if":{"properties":{"field":{"title":"Machine UID String Fields","type":"string","enum":["machine.id","machine.group_id","machine.root_group_id","machine.policy_id"]}}},"then":{"properties":{"value":{"type":["string","array"],"format":"uuid","items":{"type":"string","format":"uuid"}}}}},{"title":"String (Contains, Not Contains) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"title":"Machine Simple String Fields","type":"string","enum":["protection_status","machine.tags.alias","machine.reboot_required_reason","machine.group_name","machine.policy_name","stats.assets.encryption_status"]},{"title":"Agent Simple String Fields","type":"string","enum":["agent.nics.mac_address","agent.nics.description","agent.os_info.os_version","agent.os_info.os_release_name","agent.os_info.os_architecture","agent.plugins.asset_manager.plugin_version","agent.plugins.asset_manager.alerts.codes","agent.plugins.endpoint_protection.plugin_version","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.plugins.endpoint_protection.update_package_version","agent.plugins.endpoint_protection.alerts.codes","agent.plugins.endpoint_detection_and_response.plugin_version","agent.plugins.endpoint_detection_and_response.alerts.codes","agent.plugins.incident_response.plugin_version","agent.plugins.incident_response.update_package_version","agent.plugins.incident_response.alerts.codes","agent.plugins.siem.plugin_version","agent.plugins.siem.alerts.codes","agent.plugins.browser_phishing_protection.plugin_version","agent.plugins.browser_phishing_protection.alerts.codes","agent.engine_version","agent.source_location.city","agent.source_location.country","agent.source_location.subdivisions","agent.source_location.time_zone","agent.domain_name","agent.alias","agent.policy_etag","agent.serial_number","agent.available_software_updates.sdk_version.currentVersion","agent.available_software_updates.sdk_version.newVersion","agent.alerts.codes","agent.host_name","agent.fully_qualified_host_name","agent.object_guid","agent.last_user","agent.active_directory.user.display_name","agent.active_directory.user.ou","agent.active_directory.user.ou.path","agent.active_directory.user.sam_account_name","agent.active_directory.machine.display_name","agent.active_directory.machine.ou","agent.active_directory.machine.ou.path","agent.active_directory.machine.sam_account_name"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["contains","not_contains"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}}}},{"title":"Boolean (Equals) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"title":"Agent Boolean Fields","type":"string","enum":["agent.is_software_update_available","agent.has_alerts"]},{"title":"Machine Boolean Fields","type":"string","enum":["machine.is_deleted","machine.isolated","connected"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["equals"]},"value":{"title":"Value to search. Must be true or false","type":"boolean"}}},{"title":"Number Constraints (gt, gte, lt, lte, equals)","properties":{"field":{"type":"string","oneOf":[{"title":"Agent Number Fields","type":"string","enum":["agent.started_at_offset","agent.plugins.asset_manager.reboot_reasons","agent.plugins.endpoint_protection.reboot_reasons","agent.plugins.endpoint_detection_and_response.reboot_reasons","agent.plugins.incident_response.reboot_reasons","agent.plugins.siem.reboot_reasons","agent.os_version_major","agent.os_version_minor"]},{"title":"Machine Number Fields","type":"string","enum":["machine.suspicious_activity_count","machine.infection_count","machine.reboot_required","stats.assets.vulnerabilities_found.total","stats.assets.os_patches_available","stats.assets.vulnerabilities_found.critical","stats.assets.vulnerabilities_found.high","stats.assets.vulnerabilities_found.medium","stats.assets.vulnerabilities_found.low"]}]}},"oneOf":[{"minProperties":1,"title":"Specify Number Range","not":{"anyOf":[{"required":["operator"]},{"required":["value"]}]},"properties":{"gt":{"type":"number","title":"Greater than"},"lt":{"type":"number","title":"Less than"},"gte":{"type":"number","title":"Greater than or equals"},"lte":{"type":"number","title":"Less than or equals"}}},{"title":"Specify Exact Number","not":{"anyOf":[{"required":["gt"]},{"required":["lt"]},{"required":["gte"]},{"required":["lte"]}]},"required":["operator","value"],"properties":{"operator":{"type":"string","enum":["equals"]},"value":{"type":["number","array"],"title":"Value to search","items":{"type":"number"}}}}]},{"title":"Date (start, end) Constraints","properties":{"field":{"oneOf":[{"title":"Agent Date Fields","type":"string","enum":["agent.at","agent.started_at_local"]},{"title":"Machine Date Fields","type":"string","enum":["machine.deleted_at","machine.last_day_seen","machine.last_scanned_at","machine.created_at","stats.assets.last_scanned_at"]}]}},"oneOf":[{"minProperties":1,"title":"Specify Date Range","not":{"anyOf":[{"required":["operator"]},{"required":["value"]}]},"properties":{"start":{"type":"string","format":"date-time","title":"Start Date"},"end":{"type":"string","format":"date-time","title":"End Date"}}},{"title":"Specify Exact Date","not":{"anyOf":[{"required":["start"]},{"required":["end"]}]},"required":["operator","value"],"properties":{"operator":{"type":"string","enum":["equals"]},"value":{"type":["string","array"],"format":"date-time","title":"Value to search","items":{"format":"date-time"}}}}]},{"title":"IP Constraints","properties":{"field":{"oneOf":[{"title":"Agent IP Fields","type":"string","enum":["agent.nics.ips","agent.machine_ip"]}]},"operator":{"type":"string","enum":["ip"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}}}},{"title":"MWB Version Constraints (gt, gte, lt, lte, equals)","required":["operator"],"properties":{"field":{"type":"string","oneOf":[{"title":"Agent MWB Version fields","type":"string","enum":["agent.engine_version"]}]},"operator":{"type":"string","enum":["mwb_version"]}},"oneOf":[{"minProperties":1,"title":"Specify Version Range","not":{"anyOf":[{"required":["value"]}]},"properties":{"gt":{"type":"string","title":"Greater than"},"lt":{"type":"string","title":"Less than"},"gte":{"type":"string","title":"Greater than or equals"},"lte":{"type":"string","title":"Less than or equals"}}},{"title":"Specify Exact Version","not":{"anyOf":[{"required":["gt"]},{"required":["lt"]},{"required":["gte"]},{"required":["lte"]}]},"required":["value"],"properties":{"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}}}}]},{"title":"Field Exists/Not Exists Constraints","required":["operator"],"properties":{"field":{"type":"string","oneOf":[{"title":"Agent Simple String Fields","type":"string","enum":["agent.nics.mac_address","agent.nics.description","agent.os_info.os_version","agent.os_info.os_release_name","agent.os_info.os_architecture","agent.plugins.asset_manager.plugin_version","agent.plugins.asset_manager.alerts.codes","agent.plugins.endpoint_protection.plugin_version","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.plugins.endpoint_protection.update_package_version","agent.plugins.endpoint_protection.alerts.codes","agent.plugins.endpoint_detection_and_response.plugin_version","agent.plugins.endpoint_detection_and_response.alerts.codes","agent.plugins.incident_response.plugin_version","agent.plugins.incident_response.update_package_version","agent.plugins.incident_response.alerts.codes","agent.plugins.siem.plugin_version","agent.plugins.siem.alerts.codes","agent.plugins.browser_phishing_protection.plugin_version","agent.plugins.browser_phishing_protection.alerts.codes","agent.engine_version","agent.source_location.city","agent.source_location.country","agent.source_location.subdivisions","agent.source_location.time_zone","agent.domain_name","agent.alias","agent.policy_etag","agent.serial_number","agent.available_software_updates.sdk_version.currentVersion","agent.available_software_updates.sdk_version.newVersion","agent.alerts.codes","agent.host_name","agent.fully_qualified_host_name","agent.object_guid","agent.last_user","agent.active_directory.user.display_name","agent.active_directory.user.ou","agent.active_directory.user.ou.path","agent.active_directory.user.sam_account_name","agent.active_directory.machine.display_name","agent.active_directory.machine.ou","agent.active_directory.machine.ou.path","agent.active_directory.machine.sam_account_name"]},{"title":"Agent Enum String Fields","type":"string","enum":["agent.os_info.os_type","agent.os_info.os_platform"]},{"title":"Machine UID String Fields","type":"string","enum":["machine.id","machine.group_id","machine.root_group_id","machine.policy_id"]},{"title":"Machine Simple String Fields","type":"string","enum":["protection_status","machine.tags.alias","machine.reboot_required_reason","machine.group_name","machine.policy_name","stats.assets.encryption_status"]},{"title":"Agent IP Fields","type":"string","enum":["agent.nics.ips","agent.machine_ip"]},{"title":"Agent Number Fields","type":"string","enum":["agent.started_at_offset","agent.plugins.asset_manager.reboot_reasons","agent.plugins.endpoint_protection.reboot_reasons","agent.plugins.endpoint_detection_and_response.reboot_reasons","agent.plugins.incident_response.reboot_reasons","agent.plugins.siem.reboot_reasons","agent.os_version_major","agent.os_version_minor"]},{"title":"Machine Number Fields","type":"string","enum":["machine.suspicious_activity_count","machine.infection_count","machine.reboot_required","stats.assets.vulnerabilities_found.total","stats.assets.os_patches_available","stats.assets.vulnerabilities_found.critical","stats.assets.vulnerabilities_found.high","stats.assets.vulnerabilities_found.medium","stats.assets.vulnerabilities_found.low"]},{"title":"Agent Boolean Fields","type":"string","enum":["agent.is_software_update_available","agent.has_alerts"]},{"title":"Machine Boolean Fields","type":"string","enum":["machine.is_deleted","machine.isolated","connected"]},{"title":"Machine Date Fields","type":"string","enum":["machine.deleted_at","machine.last_day_seen","machine.last_scanned_at","machine.created_at","stats.assets.last_scanned_at"]},{"title":"Agent Date Fields","type":"string","enum":["agent.at","agent.started_at_local"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["exists","not_exists"]}}}]},"examples":[[{"field":"host_name","value":"DESKTOP-PHASHA","operator":"equals"}]]},"aggregations":{},"sort_field":{"type":"string","title":"Endpoint sort fields","enum":["agent.at","agent.nics.ips","agent.nics.mac_address","agent.nics.description","agent.os_info.os_type","agent.os_info.os_version","agent.os_info.os_platform","agent.os_info.os_architecture","agent.os_info.os_release_name","agent.host_name","agent.fully_qualified_host_name","agent.plugins.asset_manager.plugin_version","agent.plugins.asset_manager.reboot_reason","agent.plugins.endpoint_protection.plugin_version","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.plugins.endpoint_protection.update_package_version","agent.plugins.endpoint_protection.reboot_reason","agent.plugins.endpoint_detection_and_response.plugin_version","agent.plugins.endpoint_detection_and_response.reboot_reason","agent.plugins.incident_response.plugin_version","agent.plugins.incident_response.reboot_reason","agent.plugins.siem.plugin_version","agent.plugins.siem.reboot_reason","agent.plugins.browser_phishing_protection.plugin_version","agent.engine_version","agent.domain_name","agent.policy_etag","machine.account_id","machine.account.name","machine.group_id","machine.root_group_id","machine.group_name","machine.policy_name","machine.policy_id","machine.deleted_at","machine.created_at","machine.marked_for_deletion","machine.is_deleted","machine.last_day_seen","machine.last_scanned_at","agent.last_user","machine.tags.alias","display_name","name_multi_search","agent.machine_ip","agent.serial_number","agent.object_guid","stats.assets.vulnerabilities_found.critical","stats.assets.vulnerabilities_found.high","stats.assets.vulnerabilities_found.medium","stats.assets.vulnerabilities_found.low","stats.assets.vulnerabilities_found.none","stats.assets.vulnerabilities_found.total","stats.assets.os_patches_available","stats.assets.last_scanned_at","connected","agent.active_directory.user.display_name","agent.active_directory.user.sam_account_name","agent.active_directory.user.ou","agent.active_directory.machine.display_name","agent.active_directory.machine.ou","agent.active_directory.machine.sam_account_name","stats.assets.encryption_status","machine.suspicious_activity_count","machine.infection_count"]}}},{"type":"object","title":"Base Search Schema","properties":{"aggregations":{"type":"array","title":"The fields onto which you can perform aggregations","items":{"type":"string","title":"The Items Schema"}},"page_size":{"type":"number","title":"The page size. If you just need to aggregate, set it to 0","minimum":0,"maximum":2000},"sort_field":{"title":"Sort Fields","type":"string"},"sort_order":{"type":"string","title":"Whether sorting should be ascending or descending","enum":["asc","desc"]},"aggregate_by_account":{"type":"boolean","title":"Indicates whether aggregations should be scoped by account"},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}]},{"type":"object","required":["account_ids"],"properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]}]}}}}]}}}},"responses":{"200":{"description":"Successful response"}},"tags":["Grid"],"operationId":"api.rmm.grid.export.endpoints"}},"/oneview/v1/grid/endpoints/export/async":{"post":{"description":"Export endpoints across accounts","summary":"Export endpoints asynchronously","simple_schema":"endpoint-export-grid-rmm-simple","security":[{"client_credentials":["write"]},{"user_permissions":["endpoints.view"]}],"status":{"outage":["auth","search_stateful"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Endpoint export request","allOf":[{"type":"object","title":"Base Export Schema","required":["groups","select","format"],"properties":{"format":{"type":"string","title":"The output file","enum":["csv","xlsx","html","ods","txt","rtf","json"]},"download":{"type":"boolean","title":"Whether to instruct the client to download the response as a file. Only clients like browsers are supported"},"type":{"type":"string","title":"The encoding of the output","enum":["string","base64","binary"],"default":"string"},"select":{"type":"array","title":"Which fields to select from the response","items":{"type":"object","title":"Field","required":["field","newField"],"properties":{"newField":{"type":"string","title":"the new value"},"field":{"type":"string","title":"The response field to map to a new value"}}}},"groups":{"type":"array","title":"List of queries","items":{"type":"object"}}}},{"required":["endpoints"],"properties":{"endpoints":{"type":"array","title":"Endpoints IDs","items":{"type":"object","title":"Explicit list of endpoints","required":["id","account_id"],"properties":{"id":{"type":"string","title":"ID of the endpoint","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"account_id":{"type":"string","title":"Account to which the endpoint belongs","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}},"select":{"items":{"properties":{"field":{"type":"string","title":"Endpoint select fields","enum":["machine.is_deleted","machine.scan_age_days","machine.root_group_id","machine.last_day_seen","machine.isolated","machine.suspicious_activity_count","machine.infection_count","machine.reboot_required","machine.last_scanned_at","machine.group_name","machine.policy_id","machine.policy_name","machine.tags","machine.group_id","machine.id","machine.account_id","machine.online","machine.created_at","machine.job.status","machine.account.name","agent.at","agent.last_user","agent.fully_qualified_host_name","agent.started_at_local","agent.started_at_offset","agent.os_info.os_type","agent.os_info.os_version","agent.os_info.os_platform","agent.os_info.os_architecture","agent.os_info.os_release_name","agent.domain_name","agent.engine_version","agent.policy_etag","agent.host_name","agent.nics.ips","agent.nics.mac_address","machine.tags.alias","agent.is_software_update_available","agent.has_alerts","agent.machine_ip","agent.object_guid","agent.available_software_updates.sdk_version.new","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.plugins.endpoint_protection.update_package_version","agent.source_location.city","agent.source_location.country","agent.source_location.country_iso","agent.source_location.continent","agent.source_location.time_zone","agent.source_location.postal_code","agent.source_location.subdivisions","agent.source_location.anonymous_proxy","agent.serial_number","protection_status","stats.assets.vulnerabilities_found","stats.assets.os_patches_available","stats.assets.last_scanned_at","stats.app_block_count","stats.assets.encryption_status","connected","agent.plugins.browser_phishing_protection.plugin_version","agent.active_directory.user.display_name","agent.active_directory.user.ou","agent.active_directory.user.sam_account_name","agent.active_directory.machine.display_name","agent.active_directory.machine.ou","agent.active_directory.machine.sam_account_name"]}}}},"groups":{"items":{"title":"List of queries to fetch endpoints","allOf":[{"type":"object","allOf":[{"type":"object","allOf":[{"properties":{"constraints":{"type":"array","items":{"title":"Endpoint Constraints","type":"object","required":["field"],"anyOf":[{"title":"String (Equals, Not Equals) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"title":"Agent Simple String Fields","type":"string","enum":["agent.nics.mac_address","agent.nics.description","agent.os_info.os_version","agent.os_info.os_release_name","agent.os_info.os_architecture","agent.plugins.asset_manager.plugin_version","agent.plugins.asset_manager.alerts.codes","agent.plugins.endpoint_protection.plugin_version","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.plugins.endpoint_protection.update_package_version","agent.plugins.endpoint_protection.alerts.codes","agent.plugins.endpoint_detection_and_response.plugin_version","agent.plugins.endpoint_detection_and_response.alerts.codes","agent.plugins.incident_response.plugin_version","agent.plugins.incident_response.update_package_version","agent.plugins.incident_response.alerts.codes","agent.plugins.siem.plugin_version","agent.plugins.siem.alerts.codes","agent.plugins.browser_phishing_protection.plugin_version","agent.plugins.browser_phishing_protection.alerts.codes","agent.engine_version","agent.source_location.city","agent.source_location.country","agent.source_location.subdivisions","agent.source_location.time_zone","agent.domain_name","agent.alias","agent.policy_etag","agent.serial_number","agent.available_software_updates.sdk_version.currentVersion","agent.available_software_updates.sdk_version.newVersion","agent.alerts.codes","agent.host_name","agent.fully_qualified_host_name","agent.object_guid","agent.last_user","agent.active_directory.user.display_name","agent.active_directory.user.ou","agent.active_directory.user.ou.path","agent.active_directory.user.sam_account_name","agent.active_directory.machine.display_name","agent.active_directory.machine.ou","agent.active_directory.machine.ou.path","agent.active_directory.machine.sam_account_name"]},{"title":"Agent Enum String Fields","type":"string","enum":["agent.os_info.os_type","agent.os_info.os_platform"]},{"title":"Machine UID String Fields","type":"string","enum":["machine.id","machine.group_id","machine.root_group_id","machine.policy_id"]},{"title":"Machine Simple String Fields","type":"string","enum":["protection_status","machine.tags.alias","machine.reboot_required_reason","machine.group_name","machine.policy_name","stats.assets.encryption_status"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["equals","not_equals"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}}},"if":{"properties":{"field":{"title":"Machine UID String Fields","type":"string","enum":["machine.id","machine.group_id","machine.root_group_id","machine.policy_id"]}}},"then":{"properties":{"value":{"type":["string","array"],"format":"uuid","items":{"type":"string","format":"uuid"}}}}},{"title":"String (Contains, Not Contains) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"title":"Machine Simple String Fields","type":"string","enum":["protection_status","machine.tags.alias","machine.reboot_required_reason","machine.group_name","machine.policy_name","stats.assets.encryption_status"]},{"title":"Agent Simple String Fields","type":"string","enum":["agent.nics.mac_address","agent.nics.description","agent.os_info.os_version","agent.os_info.os_release_name","agent.os_info.os_architecture","agent.plugins.asset_manager.plugin_version","agent.plugins.asset_manager.alerts.codes","agent.plugins.endpoint_protection.plugin_version","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.plugins.endpoint_protection.update_package_version","agent.plugins.endpoint_protection.alerts.codes","agent.plugins.endpoint_detection_and_response.plugin_version","agent.plugins.endpoint_detection_and_response.alerts.codes","agent.plugins.incident_response.plugin_version","agent.plugins.incident_response.update_package_version","agent.plugins.incident_response.alerts.codes","agent.plugins.siem.plugin_version","agent.plugins.siem.alerts.codes","agent.plugins.browser_phishing_protection.plugin_version","agent.plugins.browser_phishing_protection.alerts.codes","agent.engine_version","agent.source_location.city","agent.source_location.country","agent.source_location.subdivisions","agent.source_location.time_zone","agent.domain_name","agent.alias","agent.policy_etag","agent.serial_number","agent.available_software_updates.sdk_version.currentVersion","agent.available_software_updates.sdk_version.newVersion","agent.alerts.codes","agent.host_name","agent.fully_qualified_host_name","agent.object_guid","agent.last_user","agent.active_directory.user.display_name","agent.active_directory.user.ou","agent.active_directory.user.ou.path","agent.active_directory.user.sam_account_name","agent.active_directory.machine.display_name","agent.active_directory.machine.ou","agent.active_directory.machine.ou.path","agent.active_directory.machine.sam_account_name"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["contains","not_contains"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}}}},{"title":"Boolean (Equals) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"title":"Agent Boolean Fields","type":"string","enum":["agent.is_software_update_available","agent.has_alerts"]},{"title":"Machine Boolean Fields","type":"string","enum":["machine.is_deleted","machine.isolated","connected"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["equals"]},"value":{"title":"Value to search. Must be true or false","type":"boolean"}}},{"title":"Number Constraints (gt, gte, lt, lte, equals)","properties":{"field":{"type":"string","oneOf":[{"title":"Agent Number Fields","type":"string","enum":["agent.started_at_offset","agent.plugins.asset_manager.reboot_reasons","agent.plugins.endpoint_protection.reboot_reasons","agent.plugins.endpoint_detection_and_response.reboot_reasons","agent.plugins.incident_response.reboot_reasons","agent.plugins.siem.reboot_reasons","agent.os_version_major","agent.os_version_minor"]},{"title":"Machine Number Fields","type":"string","enum":["machine.suspicious_activity_count","machine.infection_count","machine.reboot_required","stats.assets.vulnerabilities_found.total","stats.assets.os_patches_available","stats.assets.vulnerabilities_found.critical","stats.assets.vulnerabilities_found.high","stats.assets.vulnerabilities_found.medium","stats.assets.vulnerabilities_found.low"]}]}},"oneOf":[{"minProperties":1,"title":"Specify Number Range","not":{"anyOf":[{"required":["operator"]},{"required":["value"]}]},"properties":{"gt":{"type":"number","title":"Greater than"},"lt":{"type":"number","title":"Less than"},"gte":{"type":"number","title":"Greater than or equals"},"lte":{"type":"number","title":"Less than or equals"}}},{"title":"Specify Exact Number","not":{"anyOf":[{"required":["gt"]},{"required":["lt"]},{"required":["gte"]},{"required":["lte"]}]},"required":["operator","value"],"properties":{"operator":{"type":"string","enum":["equals"]},"value":{"type":["number","array"],"title":"Value to search","items":{"type":"number"}}}}]},{"title":"Date (start, end) Constraints","properties":{"field":{"oneOf":[{"title":"Agent Date Fields","type":"string","enum":["agent.at","agent.started_at_local"]},{"title":"Machine Date Fields","type":"string","enum":["machine.deleted_at","machine.last_day_seen","machine.last_scanned_at","machine.created_at","stats.assets.last_scanned_at"]}]}},"oneOf":[{"minProperties":1,"title":"Specify Date Range","not":{"anyOf":[{"required":["operator"]},{"required":["value"]}]},"properties":{"start":{"type":"string","format":"date-time","title":"Start Date"},"end":{"type":"string","format":"date-time","title":"End Date"}}},{"title":"Specify Exact Date","not":{"anyOf":[{"required":["start"]},{"required":["end"]}]},"required":["operator","value"],"properties":{"operator":{"type":"string","enum":["equals"]},"value":{"type":["string","array"],"format":"date-time","title":"Value to search","items":{"format":"date-time"}}}}]},{"title":"IP Constraints","properties":{"field":{"oneOf":[{"title":"Agent IP Fields","type":"string","enum":["agent.nics.ips","agent.machine_ip"]}]},"operator":{"type":"string","enum":["ip"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}}}},{"title":"MWB Version Constraints (gt, gte, lt, lte, equals)","required":["operator"],"properties":{"field":{"type":"string","oneOf":[{"title":"Agent MWB Version fields","type":"string","enum":["agent.engine_version"]}]},"operator":{"type":"string","enum":["mwb_version"]}},"oneOf":[{"minProperties":1,"title":"Specify Version Range","not":{"anyOf":[{"required":["value"]}]},"properties":{"gt":{"type":"string","title":"Greater than"},"lt":{"type":"string","title":"Less than"},"gte":{"type":"string","title":"Greater than or equals"},"lte":{"type":"string","title":"Less than or equals"}}},{"title":"Specify Exact Version","not":{"anyOf":[{"required":["gt"]},{"required":["lt"]},{"required":["gte"]},{"required":["lte"]}]},"required":["value"],"properties":{"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}}}}]},{"title":"Field Exists/Not Exists Constraints","required":["operator"],"properties":{"field":{"type":"string","oneOf":[{"title":"Agent Simple String Fields","type":"string","enum":["agent.nics.mac_address","agent.nics.description","agent.os_info.os_version","agent.os_info.os_release_name","agent.os_info.os_architecture","agent.plugins.asset_manager.plugin_version","agent.plugins.asset_manager.alerts.codes","agent.plugins.endpoint_protection.plugin_version","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.plugins.endpoint_protection.update_package_version","agent.plugins.endpoint_protection.alerts.codes","agent.plugins.endpoint_detection_and_response.plugin_version","agent.plugins.endpoint_detection_and_response.alerts.codes","agent.plugins.incident_response.plugin_version","agent.plugins.incident_response.update_package_version","agent.plugins.incident_response.alerts.codes","agent.plugins.siem.plugin_version","agent.plugins.siem.alerts.codes","agent.plugins.browser_phishing_protection.plugin_version","agent.plugins.browser_phishing_protection.alerts.codes","agent.engine_version","agent.source_location.city","agent.source_location.country","agent.source_location.subdivisions","agent.source_location.time_zone","agent.domain_name","agent.alias","agent.policy_etag","agent.serial_number","agent.available_software_updates.sdk_version.currentVersion","agent.available_software_updates.sdk_version.newVersion","agent.alerts.codes","agent.host_name","agent.fully_qualified_host_name","agent.object_guid","agent.last_user","agent.active_directory.user.display_name","agent.active_directory.user.ou","agent.active_directory.user.ou.path","agent.active_directory.user.sam_account_name","agent.active_directory.machine.display_name","agent.active_directory.machine.ou","agent.active_directory.machine.ou.path","agent.active_directory.machine.sam_account_name"]},{"title":"Agent Enum String Fields","type":"string","enum":["agent.os_info.os_type","agent.os_info.os_platform"]},{"title":"Machine UID String Fields","type":"string","enum":["machine.id","machine.group_id","machine.root_group_id","machine.policy_id"]},{"title":"Machine Simple String Fields","type":"string","enum":["protection_status","machine.tags.alias","machine.reboot_required_reason","machine.group_name","machine.policy_name","stats.assets.encryption_status"]},{"title":"Agent IP Fields","type":"string","enum":["agent.nics.ips","agent.machine_ip"]},{"title":"Agent Number Fields","type":"string","enum":["agent.started_at_offset","agent.plugins.asset_manager.reboot_reasons","agent.plugins.endpoint_protection.reboot_reasons","agent.plugins.endpoint_detection_and_response.reboot_reasons","agent.plugins.incident_response.reboot_reasons","agent.plugins.siem.reboot_reasons","agent.os_version_major","agent.os_version_minor"]},{"title":"Machine Number Fields","type":"string","enum":["machine.suspicious_activity_count","machine.infection_count","machine.reboot_required","stats.assets.vulnerabilities_found.total","stats.assets.os_patches_available","stats.assets.vulnerabilities_found.critical","stats.assets.vulnerabilities_found.high","stats.assets.vulnerabilities_found.medium","stats.assets.vulnerabilities_found.low"]},{"title":"Agent Boolean Fields","type":"string","enum":["agent.is_software_update_available","agent.has_alerts"]},{"title":"Machine Boolean Fields","type":"string","enum":["machine.is_deleted","machine.isolated","connected"]},{"title":"Machine Date Fields","type":"string","enum":["machine.deleted_at","machine.last_day_seen","machine.last_scanned_at","machine.created_at","stats.assets.last_scanned_at"]},{"title":"Agent Date Fields","type":"string","enum":["agent.at","agent.started_at_local"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["exists","not_exists"]}}}]},"examples":[[{"field":"host_name","value":"DESKTOP-PHASHA","operator":"equals"}]]},"aggregations":{},"sort_field":{"type":"string","title":"Endpoint sort fields","enum":["agent.at","agent.nics.ips","agent.nics.mac_address","agent.nics.description","agent.os_info.os_type","agent.os_info.os_version","agent.os_info.os_platform","agent.os_info.os_architecture","agent.os_info.os_release_name","agent.host_name","agent.fully_qualified_host_name","agent.plugins.asset_manager.plugin_version","agent.plugins.asset_manager.reboot_reason","agent.plugins.endpoint_protection.plugin_version","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.plugins.endpoint_protection.update_package_version","agent.plugins.endpoint_protection.reboot_reason","agent.plugins.endpoint_detection_and_response.plugin_version","agent.plugins.endpoint_detection_and_response.reboot_reason","agent.plugins.incident_response.plugin_version","agent.plugins.incident_response.reboot_reason","agent.plugins.siem.plugin_version","agent.plugins.siem.reboot_reason","agent.plugins.browser_phishing_protection.plugin_version","agent.engine_version","agent.domain_name","agent.policy_etag","machine.account_id","machine.account.name","machine.group_id","machine.root_group_id","machine.group_name","machine.policy_name","machine.policy_id","machine.deleted_at","machine.created_at","machine.marked_for_deletion","machine.is_deleted","machine.last_day_seen","machine.last_scanned_at","agent.last_user","machine.tags.alias","display_name","name_multi_search","agent.machine_ip","agent.serial_number","agent.object_guid","stats.assets.vulnerabilities_found.critical","stats.assets.vulnerabilities_found.high","stats.assets.vulnerabilities_found.medium","stats.assets.vulnerabilities_found.low","stats.assets.vulnerabilities_found.none","stats.assets.vulnerabilities_found.total","stats.assets.os_patches_available","stats.assets.last_scanned_at","connected","agent.active_directory.user.display_name","agent.active_directory.user.sam_account_name","agent.active_directory.user.ou","agent.active_directory.machine.display_name","agent.active_directory.machine.ou","agent.active_directory.machine.sam_account_name","stats.assets.encryption_status","machine.suspicious_activity_count","machine.infection_count"]}}},{"type":"object","title":"Base Search Schema","properties":{"aggregations":{"type":"array","title":"The fields onto which you can perform aggregations","items":{"type":"string","title":"The Items Schema"}},"page_size":{"type":"number","title":"The page size. If you just need to aggregate, set it to 0","minimum":0,"maximum":2000},"sort_field":{"title":"Sort Fields","type":"string"},"sort_order":{"type":"string","title":"Whether sorting should be ascending or descending","enum":["asc","desc"]},"aggregate_by_account":{"type":"boolean","title":"Indicates whether aggregations should be scoped by account"},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}]},{"type":"object","required":["account_ids"],"properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]}]}}}}]}}}},"responses":{"200":{"description":"Successful response"}},"tags":["Grid"],"operationId":"api.rmm.grid.export.endpoints.async"}},"/oneview/v1/grid/endpoints/search":{"post":{"description":"Search endpoints across accounts","summary":"Search endpoints","simple_schema":"endpoint-search-grid-rmm-simple","security":[{"client_credentials":["read"]},{"user_permissions":["endpoints.view"]}],"status":{"outage":["auth","search_stateless"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","allOf":[{"type":"object","allOf":[{"properties":{"constraints":{"type":"array","items":{"title":"Endpoint Constraints","type":"object","required":["field"],"anyOf":[{"title":"String (Equals, Not Equals) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"title":"Agent Simple String Fields","type":"string","enum":["agent.nics.mac_address","agent.nics.description","agent.os_info.os_version","agent.os_info.os_release_name","agent.os_info.os_architecture","agent.plugins.asset_manager.plugin_version","agent.plugins.asset_manager.alerts.codes","agent.plugins.endpoint_protection.plugin_version","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.plugins.endpoint_protection.update_package_version","agent.plugins.endpoint_protection.alerts.codes","agent.plugins.endpoint_detection_and_response.plugin_version","agent.plugins.endpoint_detection_and_response.alerts.codes","agent.plugins.incident_response.plugin_version","agent.plugins.incident_response.update_package_version","agent.plugins.incident_response.alerts.codes","agent.plugins.siem.plugin_version","agent.plugins.siem.alerts.codes","agent.plugins.browser_phishing_protection.plugin_version","agent.plugins.browser_phishing_protection.alerts.codes","agent.engine_version","agent.source_location.city","agent.source_location.country","agent.source_location.subdivisions","agent.source_location.time_zone","agent.domain_name","agent.alias","agent.policy_etag","agent.serial_number","agent.available_software_updates.sdk_version.currentVersion","agent.available_software_updates.sdk_version.newVersion","agent.alerts.codes","agent.host_name","agent.fully_qualified_host_name","agent.object_guid","agent.last_user","agent.active_directory.user.display_name","agent.active_directory.user.ou","agent.active_directory.user.ou.path","agent.active_directory.user.sam_account_name","agent.active_directory.machine.display_name","agent.active_directory.machine.ou","agent.active_directory.machine.ou.path","agent.active_directory.machine.sam_account_name"]},{"title":"Agent Enum String Fields","type":"string","enum":["agent.os_info.os_type","agent.os_info.os_platform"]},{"title":"Machine UID String Fields","type":"string","enum":["machine.id","machine.group_id","machine.root_group_id","machine.policy_id"]},{"title":"Machine Simple String Fields","type":"string","enum":["protection_status","machine.tags.alias","machine.reboot_required_reason","machine.group_name","machine.policy_name","stats.assets.encryption_status"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["equals","not_equals"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}}},"if":{"properties":{"field":{"title":"Machine UID String Fields","type":"string","enum":["machine.id","machine.group_id","machine.root_group_id","machine.policy_id"]}}},"then":{"properties":{"value":{"type":["string","array"],"format":"uuid","items":{"type":"string","format":"uuid"}}}}},{"title":"String (Contains, Not Contains) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"title":"Machine Simple String Fields","type":"string","enum":["protection_status","machine.tags.alias","machine.reboot_required_reason","machine.group_name","machine.policy_name","stats.assets.encryption_status"]},{"title":"Agent Simple String Fields","type":"string","enum":["agent.nics.mac_address","agent.nics.description","agent.os_info.os_version","agent.os_info.os_release_name","agent.os_info.os_architecture","agent.plugins.asset_manager.plugin_version","agent.plugins.asset_manager.alerts.codes","agent.plugins.endpoint_protection.plugin_version","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.plugins.endpoint_protection.update_package_version","agent.plugins.endpoint_protection.alerts.codes","agent.plugins.endpoint_detection_and_response.plugin_version","agent.plugins.endpoint_detection_and_response.alerts.codes","agent.plugins.incident_response.plugin_version","agent.plugins.incident_response.update_package_version","agent.plugins.incident_response.alerts.codes","agent.plugins.siem.plugin_version","agent.plugins.siem.alerts.codes","agent.plugins.browser_phishing_protection.plugin_version","agent.plugins.browser_phishing_protection.alerts.codes","agent.engine_version","agent.source_location.city","agent.source_location.country","agent.source_location.subdivisions","agent.source_location.time_zone","agent.domain_name","agent.alias","agent.policy_etag","agent.serial_number","agent.available_software_updates.sdk_version.currentVersion","agent.available_software_updates.sdk_version.newVersion","agent.alerts.codes","agent.host_name","agent.fully_qualified_host_name","agent.object_guid","agent.last_user","agent.active_directory.user.display_name","agent.active_directory.user.ou","agent.active_directory.user.ou.path","agent.active_directory.user.sam_account_name","agent.active_directory.machine.display_name","agent.active_directory.machine.ou","agent.active_directory.machine.ou.path","agent.active_directory.machine.sam_account_name"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["contains","not_contains"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}}}},{"title":"Boolean (Equals) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"title":"Agent Boolean Fields","type":"string","enum":["agent.is_software_update_available","agent.has_alerts"]},{"title":"Machine Boolean Fields","type":"string","enum":["machine.is_deleted","machine.isolated","connected"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["equals"]},"value":{"title":"Value to search. Must be true or false","type":"boolean"}}},{"title":"Number Constraints (gt, gte, lt, lte, equals)","properties":{"field":{"type":"string","oneOf":[{"title":"Agent Number Fields","type":"string","enum":["agent.started_at_offset","agent.plugins.asset_manager.reboot_reasons","agent.plugins.endpoint_protection.reboot_reasons","agent.plugins.endpoint_detection_and_response.reboot_reasons","agent.plugins.incident_response.reboot_reasons","agent.plugins.siem.reboot_reasons","agent.os_version_major","agent.os_version_minor"]},{"title":"Machine Number Fields","type":"string","enum":["machine.suspicious_activity_count","machine.infection_count","machine.reboot_required","stats.assets.vulnerabilities_found.total","stats.assets.os_patches_available","stats.assets.vulnerabilities_found.critical","stats.assets.vulnerabilities_found.high","stats.assets.vulnerabilities_found.medium","stats.assets.vulnerabilities_found.low"]}]}},"oneOf":[{"minProperties":1,"title":"Specify Number Range","not":{"anyOf":[{"required":["operator"]},{"required":["value"]}]},"properties":{"gt":{"type":"number","title":"Greater than"},"lt":{"type":"number","title":"Less than"},"gte":{"type":"number","title":"Greater than or equals"},"lte":{"type":"number","title":"Less than or equals"}}},{"title":"Specify Exact Number","not":{"anyOf":[{"required":["gt"]},{"required":["lt"]},{"required":["gte"]},{"required":["lte"]}]},"required":["operator","value"],"properties":{"operator":{"type":"string","enum":["equals"]},"value":{"type":["number","array"],"title":"Value to search","items":{"type":"number"}}}}]},{"title":"Date (start, end) Constraints","properties":{"field":{"oneOf":[{"title":"Agent Date Fields","type":"string","enum":["agent.at","agent.started_at_local"]},{"title":"Machine Date Fields","type":"string","enum":["machine.deleted_at","machine.last_day_seen","machine.last_scanned_at","machine.created_at","stats.assets.last_scanned_at"]}]}},"oneOf":[{"minProperties":1,"title":"Specify Date Range","not":{"anyOf":[{"required":["operator"]},{"required":["value"]}]},"properties":{"start":{"type":"string","format":"date-time","title":"Start Date"},"end":{"type":"string","format":"date-time","title":"End Date"}}},{"title":"Specify Exact Date","not":{"anyOf":[{"required":["start"]},{"required":["end"]}]},"required":["operator","value"],"properties":{"operator":{"type":"string","enum":["equals"]},"value":{"type":["string","array"],"format":"date-time","title":"Value to search","items":{"format":"date-time"}}}}]},{"title":"IP Constraints","properties":{"field":{"oneOf":[{"title":"Agent IP Fields","type":"string","enum":["agent.nics.ips","agent.machine_ip"]}]},"operator":{"type":"string","enum":["ip"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}}}},{"title":"MWB Version Constraints (gt, gte, lt, lte, equals)","required":["operator"],"properties":{"field":{"type":"string","oneOf":[{"title":"Agent MWB Version fields","type":"string","enum":["agent.engine_version"]}]},"operator":{"type":"string","enum":["mwb_version"]}},"oneOf":[{"minProperties":1,"title":"Specify Version Range","not":{"anyOf":[{"required":["value"]}]},"properties":{"gt":{"type":"string","title":"Greater than"},"lt":{"type":"string","title":"Less than"},"gte":{"type":"string","title":"Greater than or equals"},"lte":{"type":"string","title":"Less than or equals"}}},{"title":"Specify Exact Version","not":{"anyOf":[{"required":["gt"]},{"required":["lt"]},{"required":["gte"]},{"required":["lte"]}]},"required":["value"],"properties":{"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}}}}]},{"title":"Field Exists/Not Exists Constraints","required":["operator"],"properties":{"field":{"type":"string","oneOf":[{"title":"Agent Simple String Fields","type":"string","enum":["agent.nics.mac_address","agent.nics.description","agent.os_info.os_version","agent.os_info.os_release_name","agent.os_info.os_architecture","agent.plugins.asset_manager.plugin_version","agent.plugins.asset_manager.alerts.codes","agent.plugins.endpoint_protection.plugin_version","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.plugins.endpoint_protection.update_package_version","agent.plugins.endpoint_protection.alerts.codes","agent.plugins.endpoint_detection_and_response.plugin_version","agent.plugins.endpoint_detection_and_response.alerts.codes","agent.plugins.incident_response.plugin_version","agent.plugins.incident_response.update_package_version","agent.plugins.incident_response.alerts.codes","agent.plugins.siem.plugin_version","agent.plugins.siem.alerts.codes","agent.plugins.browser_phishing_protection.plugin_version","agent.plugins.browser_phishing_protection.alerts.codes","agent.engine_version","agent.source_location.city","agent.source_location.country","agent.source_location.subdivisions","agent.source_location.time_zone","agent.domain_name","agent.alias","agent.policy_etag","agent.serial_number","agent.available_software_updates.sdk_version.currentVersion","agent.available_software_updates.sdk_version.newVersion","agent.alerts.codes","agent.host_name","agent.fully_qualified_host_name","agent.object_guid","agent.last_user","agent.active_directory.user.display_name","agent.active_directory.user.ou","agent.active_directory.user.ou.path","agent.active_directory.user.sam_account_name","agent.active_directory.machine.display_name","agent.active_directory.machine.ou","agent.active_directory.machine.ou.path","agent.active_directory.machine.sam_account_name"]},{"title":"Agent Enum String Fields","type":"string","enum":["agent.os_info.os_type","agent.os_info.os_platform"]},{"title":"Machine UID String Fields","type":"string","enum":["machine.id","machine.group_id","machine.root_group_id","machine.policy_id"]},{"title":"Machine Simple String Fields","type":"string","enum":["protection_status","machine.tags.alias","machine.reboot_required_reason","machine.group_name","machine.policy_name","stats.assets.encryption_status"]},{"title":"Agent IP Fields","type":"string","enum":["agent.nics.ips","agent.machine_ip"]},{"title":"Agent Number Fields","type":"string","enum":["agent.started_at_offset","agent.plugins.asset_manager.reboot_reasons","agent.plugins.endpoint_protection.reboot_reasons","agent.plugins.endpoint_detection_and_response.reboot_reasons","agent.plugins.incident_response.reboot_reasons","agent.plugins.siem.reboot_reasons","agent.os_version_major","agent.os_version_minor"]},{"title":"Machine Number Fields","type":"string","enum":["machine.suspicious_activity_count","machine.infection_count","machine.reboot_required","stats.assets.vulnerabilities_found.total","stats.assets.os_patches_available","stats.assets.vulnerabilities_found.critical","stats.assets.vulnerabilities_found.high","stats.assets.vulnerabilities_found.medium","stats.assets.vulnerabilities_found.low"]},{"title":"Agent Boolean Fields","type":"string","enum":["agent.is_software_update_available","agent.has_alerts"]},{"title":"Machine Boolean Fields","type":"string","enum":["machine.is_deleted","machine.isolated","connected"]},{"title":"Machine Date Fields","type":"string","enum":["machine.deleted_at","machine.last_day_seen","machine.last_scanned_at","machine.created_at","stats.assets.last_scanned_at"]},{"title":"Agent Date Fields","type":"string","enum":["agent.at","agent.started_at_local"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["exists","not_exists"]}}}]},"examples":[[{"field":"host_name","value":"DESKTOP-PHASHA","operator":"equals"}]]},"aggregations":{},"sort_field":{"type":"string","title":"Endpoint sort fields","enum":["agent.at","agent.nics.ips","agent.nics.mac_address","agent.nics.description","agent.os_info.os_type","agent.os_info.os_version","agent.os_info.os_platform","agent.os_info.os_architecture","agent.os_info.os_release_name","agent.host_name","agent.fully_qualified_host_name","agent.plugins.asset_manager.plugin_version","agent.plugins.asset_manager.reboot_reason","agent.plugins.endpoint_protection.plugin_version","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.plugins.endpoint_protection.update_package_version","agent.plugins.endpoint_protection.reboot_reason","agent.plugins.endpoint_detection_and_response.plugin_version","agent.plugins.endpoint_detection_and_response.reboot_reason","agent.plugins.incident_response.plugin_version","agent.plugins.incident_response.reboot_reason","agent.plugins.siem.plugin_version","agent.plugins.siem.reboot_reason","agent.plugins.browser_phishing_protection.plugin_version","agent.engine_version","agent.domain_name","agent.policy_etag","machine.account_id","machine.account.name","machine.group_id","machine.root_group_id","machine.group_name","machine.policy_name","machine.policy_id","machine.deleted_at","machine.created_at","machine.marked_for_deletion","machine.is_deleted","machine.last_day_seen","machine.last_scanned_at","agent.last_user","machine.tags.alias","display_name","name_multi_search","agent.machine_ip","agent.serial_number","agent.object_guid","stats.assets.vulnerabilities_found.critical","stats.assets.vulnerabilities_found.high","stats.assets.vulnerabilities_found.medium","stats.assets.vulnerabilities_found.low","stats.assets.vulnerabilities_found.none","stats.assets.vulnerabilities_found.total","stats.assets.os_patches_available","stats.assets.last_scanned_at","connected","agent.active_directory.user.display_name","agent.active_directory.user.sam_account_name","agent.active_directory.user.ou","agent.active_directory.machine.display_name","agent.active_directory.machine.ou","agent.active_directory.machine.sam_account_name","stats.assets.encryption_status","machine.suspicious_activity_count","machine.infection_count"]}}},{"type":"object","title":"Base Search Schema","properties":{"aggregations":{"type":"array","title":"The fields onto which you can perform aggregations","items":{"type":"string","title":"The Items Schema"}},"page_size":{"type":"number","title":"The page size. If you just need to aggregate, set it to 0","minimum":0,"maximum":2000},"sort_field":{"title":"Sort Fields","type":"string"},"sort_order":{"type":"string","title":"Whether sorting should be ascending or descending","enum":["asc","desc"]},"aggregate_by_account":{"type":"boolean","title":"Indicates whether aggregations should be scoped by account"},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}]},{"type":"object","required":["account_ids"],"properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Search endpoints","required":["endpoints","total_count","next_cursor"],"properties":{"aggregations":{"type":"object","additionalProperties":true},"endpoints":{"type":"array","title":"Endpoints","items":{"type":"object","title":"Endpoint items","additionalProperties":true,"properties":{"link":{"type":"string","title":"Link"},"protection_status":{"type":"string","title":"Protection Status"},"display_name":{"type":"string","title":"Display Name"},"agent":{"type":"object","title":"Agent","additionalProperties":true,"properties":{"is_software_update_available":{"type":"boolean","title":"Indicates whether the agent has an available update"},"has_alerts":{"type":"boolean","title":"Indicates whether the endpoint needs attention"},"last_user":{"type":"string","title":"The last user logging in"},"at":{"type":"string","title":"Reported At"},"machine_id":{"type":"string","title":"Endpoint ID"},"account_id":{"type":"string","title":"Account ID"},"group_id":{"type":"string","title":"Group ID"},"nics":{"type":"array","title":"Nics","items":{"type":"object","title":"Nics items","properties":{"ips":{"type":"array","title":"IPs","items":{"type":"string","title":"IP items"}},"description":{"type":"string","title":"Description"},"mac_address":{"type":"string","title":"Mac address"}}}},"os_info":{"type":"object","title":"Os info","properties":{"os_type":{"type":"string","title":"OS type"},"os_version":{"type":"string","title":"OS version"},"os_platform":{"type":"string","title":"OS platform"},"os_architecture":{"type":"string","title":"OS architecture"},"os_release_name":{"type":"string","title":"OS release name"}}},"domain_name":{"type":"string","title":"Domain name"},"host_name":{"type":"string","title":"Host name"},"fully_qualified_host_name":{"type":"string","title":"Fully qualified host name"},"object_guid":{"type":"string","title":"Object guid"},"plugins":{"type":"object","title":"Plugins","properties":{"incident_response":{"type":"object","title":"Incident response","properties":{"product_name":{"type":"string","title":"Product name"},"plugin_version":{"type":"string","title":"Plugin version"},"update_package_version":{"type":"string","title":"Update package version"},"component_package_version":{"type":"string","title":"Component package version"},"alerts":{"type":"object","properties":{"codes":{"type":"array","items":{"type":"string"}}}}}},"endpoint_protection":{"type":"object","title":"Endpoint protection plugin","properties":{"sdk_version":{"type":"string","title":"SDK version plugin"},"product_name":{"type":"string","title":"Name of the product"},"plugin_version":{"type":"string","title":"Version of the product"},"update_package_version":{"type":"string","title":"Update version"},"component_package_version":{"type":"string","title":"Component version"},"alerts":{"type":"object","properties":{"codes":{"type":"array","items":{"type":"string"}}}}}},"asset_manager":{"type":"object","title":"Asset manager","properties":{"product_name":{"type":"string","title":"Product name"},"plugin_version":{"type":"string","title":"Plugin version"},"alerts":{"type":"object","properties":{"codes":{"type":"array","items":{"type":"string"}}}}}},"endpoint_detection_and_response":{"type":"object","title":"Endpoint detection and response","properties":{"product_name":{"type":"string","title":"Product name"},"plugin_version":{"type":"string","title":"Plugin version"},"alerts":{"type":"object","properties":{"codes":{"type":"array","items":{"type":"string"}}}}}}}},"engine_version":{"type":"string","title":"Engine version"},"policy_etag":{"type":"string","title":"Policy etag"},"version":{"type":"integer","title":"Version"},"document_id":{"type":"string","title":"Document ID"},"machine_ip":{"type":"string","title":"Machine public IP"},"source_location":{"type":"object","properties":{"city":{"type":"string"},"country":{"type":"string"},"country_iso":{"type":"string"},"continent":{"type":"string"},"accuracy_radius":{"type":"integer"},"point":{"properties":{"lat":{"allOf":[{"bignumber":true},{"type":"number"}]},"lon":{"allOf":[{"bignumber":true},{"type":"number"}]}}},"time_zone":{"type":"string"},"postal_code":{"type":"string"},"subdivisions":{"type":"array","items":{"type":"string"}},"anonymous_proxy":{"type":"boolean"}}},"serial_number":{"type":"string","title":"Serial number of this endpoint"},"active_directory":{"type":"object","patternProperties":{"^(user|machine)$":{"type":"object","properties":{"display_name":{"type":"string"},"distinguished_name":{"type":"string"},"sam_account_name":{"type":"string"},"ou":{"type":"string"}}}}}}},"machine":{"type":"object","title":"Endpoint","additionalProperties":true,"properties":{"id":{"type":"string","title":"ID"},"job":{"type":"object","title":"The last job","additionalProperties":true},"account":{"type":"object","title":"Account","additionalProperties":true},"online":{"type":"boolean","title":"Is online"},"account_id":{"type":"string","title":"Account ID"},"group_id":{"type":"string","title":"Group ID"},"root_group_id":{"type":"string","title":"Root group ID"},"group_name":{"type":"string","title":"Group name"},"policy_id":{"type":"string","title":"Policy id"},"policy_account_id":{"type":"string","title":"Policy account ID"},"policy_name":{"type":"string","title":"Policy name"},"last_day_seen":{"type":"string","title":"Last day seen"},"last_active":{"type":"string","title":"Last time the endpoint connected to Nebula in real time"},"isolated":{"type":"boolean","title":"Is isolated"},"scan_age_days":{"type":"integer","title":"Days from last scan"},"suspicious_activity_count":{"type":"integer","title":"Count of suspicious activities"},"infection_count":{"type":"integer","title":"Count of infections found"},"reboot_required":{"type":"integer","title":"Is reboot required"},"last_scanned_at":{"type":"string","title":"Last scanned at"},"is_deleted":{"type":"boolean","title":"Is deleted"},"version":{"type":"integer","title":"Version"},"document_id":{"type":"string","title":"Document ID"},"created_at":{"type":"string","format":"date-time","title":"Created At"}}},"machineVersion":{"type":"integer","title":"Machine version"}}}},"total_count":{"type":"integer","title":"The Total_count Schema"},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]},"after":{"type":"string","title":"After cursor"}}}}}}},"tags":["Grid"],"operationId":"api.rmm.grid.search.endpoints"}},"/oneview/v1/grid/endpoints/search-groupby":{"post":{"description":"Search grouped endpoints across accounts","summary":"Search grouped endpoints","simple_schema":"endpoint-search-groupby-grid-rmm-simple","security":[{"client_credentials":["read"]},{"user_permissions":["endpoints.view"]}],"status":{"incident":["read_nebula_data"],"outage":["auth","search_stateful"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"title":"Endpoint Search Groupby Schema","type":"object","allOf":[{"type":"object","required":["group_by","page_size"],"properties":{"group_by":{"title":"Group by the following fields","type":"array","minItems":1,"uniqueItems":true,"items":{"type":"string"}},"page_size":{"type":"number","title":"The page_size Schema","minimum":50,"maximum":2000}}},{"type":"object","allOf":[{"type":"object","allOf":[{"properties":{"constraints":{"type":"array","items":{"title":"Endpoint Constraints","type":"object","required":["field"],"anyOf":[{"title":"String (Equals, Not Equals) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"title":"Agent Simple String Fields","type":"string","enum":["agent.nics.mac_address","agent.nics.description","agent.os_info.os_version","agent.os_info.os_release_name","agent.os_info.os_architecture","agent.plugins.asset_manager.plugin_version","agent.plugins.asset_manager.alerts.codes","agent.plugins.endpoint_protection.plugin_version","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.plugins.endpoint_protection.update_package_version","agent.plugins.endpoint_protection.alerts.codes","agent.plugins.endpoint_detection_and_response.plugin_version","agent.plugins.endpoint_detection_and_response.alerts.codes","agent.plugins.incident_response.plugin_version","agent.plugins.incident_response.update_package_version","agent.plugins.incident_response.alerts.codes","agent.plugins.siem.plugin_version","agent.plugins.siem.alerts.codes","agent.plugins.browser_phishing_protection.plugin_version","agent.plugins.browser_phishing_protection.alerts.codes","agent.engine_version","agent.source_location.city","agent.source_location.country","agent.source_location.subdivisions","agent.source_location.time_zone","agent.domain_name","agent.alias","agent.policy_etag","agent.serial_number","agent.available_software_updates.sdk_version.currentVersion","agent.available_software_updates.sdk_version.newVersion","agent.alerts.codes","agent.host_name","agent.fully_qualified_host_name","agent.object_guid","agent.last_user","agent.active_directory.user.display_name","agent.active_directory.user.ou","agent.active_directory.user.ou.path","agent.active_directory.user.sam_account_name","agent.active_directory.machine.display_name","agent.active_directory.machine.ou","agent.active_directory.machine.ou.path","agent.active_directory.machine.sam_account_name"]},{"title":"Agent Enum String Fields","type":"string","enum":["agent.os_info.os_type","agent.os_info.os_platform"]},{"title":"Machine UID String Fields","type":"string","enum":["machine.id","machine.group_id","machine.root_group_id","machine.policy_id"]},{"title":"Machine Simple String Fields","type":"string","enum":["protection_status","machine.tags.alias","machine.reboot_required_reason","machine.group_name","machine.policy_name","stats.assets.encryption_status"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["equals","not_equals"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}}},"if":{"properties":{"field":{"title":"Machine UID String Fields","type":"string","enum":["machine.id","machine.group_id","machine.root_group_id","machine.policy_id"]}}},"then":{"properties":{"value":{"type":["string","array"],"format":"uuid","items":{"type":"string","format":"uuid"}}}}},{"title":"String (Contains, Not Contains) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"title":"Machine Simple String Fields","type":"string","enum":["protection_status","machine.tags.alias","machine.reboot_required_reason","machine.group_name","machine.policy_name","stats.assets.encryption_status"]},{"title":"Agent Simple String Fields","type":"string","enum":["agent.nics.mac_address","agent.nics.description","agent.os_info.os_version","agent.os_info.os_release_name","agent.os_info.os_architecture","agent.plugins.asset_manager.plugin_version","agent.plugins.asset_manager.alerts.codes","agent.plugins.endpoint_protection.plugin_version","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.plugins.endpoint_protection.update_package_version","agent.plugins.endpoint_protection.alerts.codes","agent.plugins.endpoint_detection_and_response.plugin_version","agent.plugins.endpoint_detection_and_response.alerts.codes","agent.plugins.incident_response.plugin_version","agent.plugins.incident_response.update_package_version","agent.plugins.incident_response.alerts.codes","agent.plugins.siem.plugin_version","agent.plugins.siem.alerts.codes","agent.plugins.browser_phishing_protection.plugin_version","agent.plugins.browser_phishing_protection.alerts.codes","agent.engine_version","agent.source_location.city","agent.source_location.country","agent.source_location.subdivisions","agent.source_location.time_zone","agent.domain_name","agent.alias","agent.policy_etag","agent.serial_number","agent.available_software_updates.sdk_version.currentVersion","agent.available_software_updates.sdk_version.newVersion","agent.alerts.codes","agent.host_name","agent.fully_qualified_host_name","agent.object_guid","agent.last_user","agent.active_directory.user.display_name","agent.active_directory.user.ou","agent.active_directory.user.ou.path","agent.active_directory.user.sam_account_name","agent.active_directory.machine.display_name","agent.active_directory.machine.ou","agent.active_directory.machine.ou.path","agent.active_directory.machine.sam_account_name"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["contains","not_contains"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}}}},{"title":"Boolean (Equals) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"title":"Agent Boolean Fields","type":"string","enum":["agent.is_software_update_available","agent.has_alerts"]},{"title":"Machine Boolean Fields","type":"string","enum":["machine.is_deleted","machine.isolated","connected"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["equals"]},"value":{"title":"Value to search. Must be true or false","type":"boolean"}}},{"title":"Number Constraints (gt, gte, lt, lte, equals)","properties":{"field":{"type":"string","oneOf":[{"title":"Agent Number Fields","type":"string","enum":["agent.started_at_offset","agent.plugins.asset_manager.reboot_reasons","agent.plugins.endpoint_protection.reboot_reasons","agent.plugins.endpoint_detection_and_response.reboot_reasons","agent.plugins.incident_response.reboot_reasons","agent.plugins.siem.reboot_reasons","agent.os_version_major","agent.os_version_minor"]},{"title":"Machine Number Fields","type":"string","enum":["machine.suspicious_activity_count","machine.infection_count","machine.reboot_required","stats.assets.vulnerabilities_found.total","stats.assets.os_patches_available","stats.assets.vulnerabilities_found.critical","stats.assets.vulnerabilities_found.high","stats.assets.vulnerabilities_found.medium","stats.assets.vulnerabilities_found.low"]}]}},"oneOf":[{"minProperties":1,"title":"Specify Number Range","not":{"anyOf":[{"required":["operator"]},{"required":["value"]}]},"properties":{"gt":{"type":"number","title":"Greater than"},"lt":{"type":"number","title":"Less than"},"gte":{"type":"number","title":"Greater than or equals"},"lte":{"type":"number","title":"Less than or equals"}}},{"title":"Specify Exact Number","not":{"anyOf":[{"required":["gt"]},{"required":["lt"]},{"required":["gte"]},{"required":["lte"]}]},"required":["operator","value"],"properties":{"operator":{"type":"string","enum":["equals"]},"value":{"type":["number","array"],"title":"Value to search","items":{"type":"number"}}}}]},{"title":"Date (start, end) Constraints","properties":{"field":{"oneOf":[{"title":"Agent Date Fields","type":"string","enum":["agent.at","agent.started_at_local"]},{"title":"Machine Date Fields","type":"string","enum":["machine.deleted_at","machine.last_day_seen","machine.last_scanned_at","machine.created_at","stats.assets.last_scanned_at"]}]}},"oneOf":[{"minProperties":1,"title":"Specify Date Range","not":{"anyOf":[{"required":["operator"]},{"required":["value"]}]},"properties":{"start":{"type":"string","format":"date-time","title":"Start Date"},"end":{"type":"string","format":"date-time","title":"End Date"}}},{"title":"Specify Exact Date","not":{"anyOf":[{"required":["start"]},{"required":["end"]}]},"required":["operator","value"],"properties":{"operator":{"type":"string","enum":["equals"]},"value":{"type":["string","array"],"format":"date-time","title":"Value to search","items":{"format":"date-time"}}}}]},{"title":"IP Constraints","properties":{"field":{"oneOf":[{"title":"Agent IP Fields","type":"string","enum":["agent.nics.ips","agent.machine_ip"]}]},"operator":{"type":"string","enum":["ip"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}}}},{"title":"MWB Version Constraints (gt, gte, lt, lte, equals)","required":["operator"],"properties":{"field":{"type":"string","oneOf":[{"title":"Agent MWB Version fields","type":"string","enum":["agent.engine_version"]}]},"operator":{"type":"string","enum":["mwb_version"]}},"oneOf":[{"minProperties":1,"title":"Specify Version Range","not":{"anyOf":[{"required":["value"]}]},"properties":{"gt":{"type":"string","title":"Greater than"},"lt":{"type":"string","title":"Less than"},"gte":{"type":"string","title":"Greater than or equals"},"lte":{"type":"string","title":"Less than or equals"}}},{"title":"Specify Exact Version","not":{"anyOf":[{"required":["gt"]},{"required":["lt"]},{"required":["gte"]},{"required":["lte"]}]},"required":["value"],"properties":{"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}}}}]},{"title":"Field Exists/Not Exists Constraints","required":["operator"],"properties":{"field":{"type":"string","oneOf":[{"title":"Agent Simple String Fields","type":"string","enum":["agent.nics.mac_address","agent.nics.description","agent.os_info.os_version","agent.os_info.os_release_name","agent.os_info.os_architecture","agent.plugins.asset_manager.plugin_version","agent.plugins.asset_manager.alerts.codes","agent.plugins.endpoint_protection.plugin_version","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.plugins.endpoint_protection.update_package_version","agent.plugins.endpoint_protection.alerts.codes","agent.plugins.endpoint_detection_and_response.plugin_version","agent.plugins.endpoint_detection_and_response.alerts.codes","agent.plugins.incident_response.plugin_version","agent.plugins.incident_response.update_package_version","agent.plugins.incident_response.alerts.codes","agent.plugins.siem.plugin_version","agent.plugins.siem.alerts.codes","agent.plugins.browser_phishing_protection.plugin_version","agent.plugins.browser_phishing_protection.alerts.codes","agent.engine_version","agent.source_location.city","agent.source_location.country","agent.source_location.subdivisions","agent.source_location.time_zone","agent.domain_name","agent.alias","agent.policy_etag","agent.serial_number","agent.available_software_updates.sdk_version.currentVersion","agent.available_software_updates.sdk_version.newVersion","agent.alerts.codes","agent.host_name","agent.fully_qualified_host_name","agent.object_guid","agent.last_user","agent.active_directory.user.display_name","agent.active_directory.user.ou","agent.active_directory.user.ou.path","agent.active_directory.user.sam_account_name","agent.active_directory.machine.display_name","agent.active_directory.machine.ou","agent.active_directory.machine.ou.path","agent.active_directory.machine.sam_account_name"]},{"title":"Agent Enum String Fields","type":"string","enum":["agent.os_info.os_type","agent.os_info.os_platform"]},{"title":"Machine UID String Fields","type":"string","enum":["machine.id","machine.group_id","machine.root_group_id","machine.policy_id"]},{"title":"Machine Simple String Fields","type":"string","enum":["protection_status","machine.tags.alias","machine.reboot_required_reason","machine.group_name","machine.policy_name","stats.assets.encryption_status"]},{"title":"Agent IP Fields","type":"string","enum":["agent.nics.ips","agent.machine_ip"]},{"title":"Agent Number Fields","type":"string","enum":["agent.started_at_offset","agent.plugins.asset_manager.reboot_reasons","agent.plugins.endpoint_protection.reboot_reasons","agent.plugins.endpoint_detection_and_response.reboot_reasons","agent.plugins.incident_response.reboot_reasons","agent.plugins.siem.reboot_reasons","agent.os_version_major","agent.os_version_minor"]},{"title":"Machine Number Fields","type":"string","enum":["machine.suspicious_activity_count","machine.infection_count","machine.reboot_required","stats.assets.vulnerabilities_found.total","stats.assets.os_patches_available","stats.assets.vulnerabilities_found.critical","stats.assets.vulnerabilities_found.high","stats.assets.vulnerabilities_found.medium","stats.assets.vulnerabilities_found.low"]},{"title":"Agent Boolean Fields","type":"string","enum":["agent.is_software_update_available","agent.has_alerts"]},{"title":"Machine Boolean Fields","type":"string","enum":["machine.is_deleted","machine.isolated","connected"]},{"title":"Machine Date Fields","type":"string","enum":["machine.deleted_at","machine.last_day_seen","machine.last_scanned_at","machine.created_at","stats.assets.last_scanned_at"]},{"title":"Agent Date Fields","type":"string","enum":["agent.at","agent.started_at_local"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["exists","not_exists"]}}}]},"examples":[[{"field":"host_name","value":"DESKTOP-PHASHA","operator":"equals"}]]},"aggregations":{},"sort_field":{"type":"string","title":"Endpoint sort fields","enum":["agent.at","agent.nics.ips","agent.nics.mac_address","agent.nics.description","agent.os_info.os_type","agent.os_info.os_version","agent.os_info.os_platform","agent.os_info.os_architecture","agent.os_info.os_release_name","agent.host_name","agent.fully_qualified_host_name","agent.plugins.asset_manager.plugin_version","agent.plugins.asset_manager.reboot_reason","agent.plugins.endpoint_protection.plugin_version","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.plugins.endpoint_protection.update_package_version","agent.plugins.endpoint_protection.reboot_reason","agent.plugins.endpoint_detection_and_response.plugin_version","agent.plugins.endpoint_detection_and_response.reboot_reason","agent.plugins.incident_response.plugin_version","agent.plugins.incident_response.reboot_reason","agent.plugins.siem.plugin_version","agent.plugins.siem.reboot_reason","agent.plugins.browser_phishing_protection.plugin_version","agent.engine_version","agent.domain_name","agent.policy_etag","machine.account_id","machine.account.name","machine.group_id","machine.root_group_id","machine.group_name","machine.policy_name","machine.policy_id","machine.deleted_at","machine.created_at","machine.marked_for_deletion","machine.is_deleted","machine.last_day_seen","machine.last_scanned_at","agent.last_user","machine.tags.alias","display_name","name_multi_search","agent.machine_ip","agent.serial_number","agent.object_guid","stats.assets.vulnerabilities_found.critical","stats.assets.vulnerabilities_found.high","stats.assets.vulnerabilities_found.medium","stats.assets.vulnerabilities_found.low","stats.assets.vulnerabilities_found.none","stats.assets.vulnerabilities_found.total","stats.assets.os_patches_available","stats.assets.last_scanned_at","connected","agent.active_directory.user.display_name","agent.active_directory.user.sam_account_name","agent.active_directory.user.ou","agent.active_directory.machine.display_name","agent.active_directory.machine.ou","agent.active_directory.machine.sam_account_name","stats.assets.encryption_status","machine.suspicious_activity_count","machine.infection_count"]}}},{"type":"object","title":"Base Search Schema","properties":{"aggregations":{"type":"array","title":"The fields onto which you can perform aggregations","items":{"type":"string","title":"The Items Schema"}},"page_size":{"type":"number","title":"The page size. If you just need to aggregate, set it to 0","minimum":0,"maximum":2000},"sort_field":{"title":"Sort Fields","type":"string"},"sort_order":{"type":"string","title":"Whether sorting should be ascending or descending","enum":["asc","desc"]},"aggregate_by_account":{"type":"boolean","title":"Indicates whether aggregations should be scoped by account"},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}]},{"type":"object","required":["account_ids"],"properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]},{"properties":{"group_by":{"type":"array","title":"Group results by indicated field(s)","items":{"type":"string","title":"Endpoint Groupby Fields","enum":["agent.os_info.os_platform","agent.os_info.os_type","agent.os_info.os_architecture","agent.os_info.os_version","agent.os_info.os_release_name","agent.engine_version","agent.domain_name","agent.policy_etag","machine.account_id","machine.group_id","machine.root_group_id","machine.policy_id","display_name","agent.machine_ip","agent.last_user","agent.object_guid","agent.plugins.endpoint_protection.update_package_version","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.serial_number","protection_status","agent.nics.mac_address","agent.nics.ips","stats.assets.os_patches_available","agent.plugins.browser_phishing_protection.plugin_version","agent.active_directory.user.display_name","agent.active_directory.user.ou","agent.active_directory.machine.display_name","agent.active_directory.machine.ou","stats.assets.encryption_status"]}},"account_cardinality":{"type":"boolean","title":"If specified, the number of accounts associated with each result value is displayed (works only with specific groupby-s)"}}}]}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"The Post Endpoints Search GroupBy Response Schema","required":["results","next_cursor"],"properties":{"results":{"type":"array","title":"The Results Schema","default":[]},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}}}}},"tags":["Grid"],"operationId":"api.rmm.grid.search.endpoints.group"}},"/oneview/v1/grid/events/export":{"post":{"description":"Export event data","summary":"Export events","simple_schema":"event-export-grid-rmm-simple","security":[{"client_credentials":["execute"]},{"user_permissions":["events.view","activityLogs.view"]}],"status":{"outage":["auth","search_stateless"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"title":"Event Export Schema","type":"object","allOf":[{"type":"object","title":"Base Export Schema","required":["groups","select","format"],"properties":{"format":{"type":"string","title":"The output file","enum":["csv","xlsx","html","ods","txt","rtf","json"]},"download":{"type":"boolean","title":"Whether to instruct the client to download the response as a file. Only clients like browsers are supported"},"type":{"type":"string","title":"The encoding of the output","enum":["string","base64","binary"],"default":"string"},"select":{"type":"array","title":"Which fields to select from the response","items":{"type":"object","title":"Field","required":["field","newField"],"properties":{"newField":{"type":"string","title":"the new value"},"field":{"type":"string","title":"The response field to map to a new value"}}}},"groups":{"type":"array","title":"List of queries","items":{"type":"object"}}}},{"properties":{"select":{"items":{"properties":{"field":{"type":"string","title":"Event select fields","anyOf":[{"enum":["type","severity","group_id","id","details","created_at","account_name","parent_account_id","root_group_id","machine_id","account_id","policy_id","group_name","policy_name","machine_name","source","friendly_type"]},{"type":"string","title":"Active Directory Select Fields","enum":["active_directory.user.display_name","active_directory.user.distinguished_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.machine.display_name","active_directory.machine.distinguished_name","active_directory.machine.sam_account_name","active_directory.machine.ou"]}]}}}},"groups":{"items":{"title":"List of queries to fetch events","allOf":[{"type":"object","allOf":[{"type":"object","allOf":[{"properties":{"constraints":{"type":"array","items":{"title":"Event Constraints","type":"object","required":["field"],"anyOf":[{"title":"String (Equals, Not Equals) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"title":"Event UID String Fields","type":"string","enum":["id","account_id","parent_account_id","user_id","machine_id","root_group_id","group_id","policy_id"]},{"title":"Event Simple String Fields","type":"string","anyOf":[{"enum":["account_name","user_name","machine_name","group_name","policy_name"]},{"title":"Active Directory Simple String Fields","type":"string","enum":["active_directory.user.display_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.user.ou.path","active_directory.machine.display_name","active_directory.machine.sam_account_name","active_directory.machine.ou","active_directory.machine.ou.path"]}]},{"type":"string","title":"Event Enum String Fields","enum":["source","type","severity","action"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["equals","not_equals"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}}},"if":{"properties":{"field":{"title":"Event UID String Fields","type":"string","enum":["id","account_id","parent_account_id","user_id","machine_id","root_group_id","group_id","policy_id"]}}},"then":{"properties":{"value":{"type":["string","array"],"format":"uuid","items":{"type":"string","format":"uuid"}}}}},{"title":"String (Contains, Not Contains) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"title":"Event Simple String Fields","type":"string","anyOf":[{"enum":["account_name","user_name","machine_name","group_name","policy_name"]},{"title":"Active Directory Simple String Fields","type":"string","enum":["active_directory.user.display_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.user.ou.path","active_directory.machine.display_name","active_directory.machine.sam_account_name","active_directory.machine.ou","active_directory.machine.ou.path"]}]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["contains","not_contains"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}}}},{"title":"Date (start, end) Constraints","properties":{"field":{"oneOf":[{"title":"Event Date Fields","type":"string","enum":["created_at"]}]}},"oneOf":[{"minProperties":1,"title":"Specify Date Range","not":{"anyOf":[{"required":["operator"]},{"required":["value"]}]},"properties":{"start":{"type":"string","format":"date-time","title":"Start Date"},"end":{"type":"string","format":"date-time","title":"End Date"}}},{"title":"Specify Exact Date","not":{"anyOf":[{"required":["start"]},{"required":["end"]}]},"required":["operator","value"],"properties":{"operator":{"type":"string","enum":["equals"]},"value":{"type":["string","array"],"format":"date-time","title":"Value to search","items":{"format":"date-time"}}}}]},{"title":"Field Exists/Not Exists Constraints","required":["operator"],"properties":{"field":{"type":"string","oneOf":[{"title":"Event UID String Fields","type":"string","enum":["id","account_id","parent_account_id","user_id","machine_id","root_group_id","group_id","policy_id"]},{"title":"Event Simple String Fields","type":"string","anyOf":[{"enum":["account_name","user_name","machine_name","group_name","policy_name"]},{"title":"Active Directory Simple String Fields","type":"string","enum":["active_directory.user.display_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.user.ou.path","active_directory.machine.display_name","active_directory.machine.sam_account_name","active_directory.machine.ou","active_directory.machine.ou.path"]}]},{"type":"string","title":"Event Enum String Fields","enum":["source","type","severity","action"]},{"title":"Event Date Fields","type":"string","enum":["created_at"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["exists","not_exists"]}}}]},"examples":[[{"field":"rule_name","value":"Test Rule","operator":"equals"}]]},"aggregations":{"items":{"type":"string","title":"Event aggregation fields","enum":["account_id","account_name","parent_account_id","user_id","user_name","machine_id","machine_name","root_group_id","group_id","group_name","policy_id","policy_name","source","type","severity","action","created_at"]}},"sort_field":{"type":"string","title":"Event sort fields","anyOf":[{"enum":["account_id","account_name","parent_account_id","user_id","user_name","machine_id","machine_name","root_group_id","group_id","group_name","policy_id","policy_name","source","type","severity","action","created_at"]},{"type":"string","title":"Active Directory Sort Fields","enum":["active_directory.user.display_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.machine.display_name","active_directory.machine.sam_account_name","active_directory.machine.ou"]}]},"start_date":{"type":"string","title":"Get results after this date","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"end_date":{"type":"string","title":"Get results before this date","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]}}},{"type":"object","title":"Base Search Schema","properties":{"aggregations":{"type":"array","title":"The fields onto which you can perform aggregations","items":{"type":"string","title":"The Items Schema"}},"page_size":{"type":"number","title":"The page size. If you just need to aggregate, set it to 0","minimum":0,"maximum":2000},"sort_field":{"title":"Sort Fields","type":"string"},"sort_order":{"type":"string","title":"Whether sorting should be ascending or descending","enum":["asc","desc"]},"aggregate_by_account":{"type":"boolean","title":"Indicates whether aggregations should be scoped by account"},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}]},{"type":"object","required":["account_ids"],"properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]}]}}}}]}}}},"responses":{"200":{"description":"Successful response"}},"tags":["Grid"],"operationId":"api.rmm.grid.export.events"}},"/oneview/v1/grid/events/export/async":{"post":{"description":"Export event data","summary":"Export events asynchronously","simple_schema":"event-export-grid-rmm-simple","security":[{"client_credentials":["execute"]},{"user_permissions":["events.view","activityLogs.view"]}],"status":{"outage":["auth","search_stateless"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"title":"Event Export Schema","type":"object","allOf":[{"type":"object","title":"Base Export Schema","required":["groups","select","format"],"properties":{"format":{"type":"string","title":"The output file","enum":["csv","xlsx","html","ods","txt","rtf","json"]},"download":{"type":"boolean","title":"Whether to instruct the client to download the response as a file. Only clients like browsers are supported"},"type":{"type":"string","title":"The encoding of the output","enum":["string","base64","binary"],"default":"string"},"select":{"type":"array","title":"Which fields to select from the response","items":{"type":"object","title":"Field","required":["field","newField"],"properties":{"newField":{"type":"string","title":"the new value"},"field":{"type":"string","title":"The response field to map to a new value"}}}},"groups":{"type":"array","title":"List of queries","items":{"type":"object"}}}},{"properties":{"select":{"items":{"properties":{"field":{"type":"string","title":"Event select fields","anyOf":[{"enum":["type","severity","group_id","id","details","created_at","account_name","parent_account_id","root_group_id","machine_id","account_id","policy_id","group_name","policy_name","machine_name","source","friendly_type"]},{"type":"string","title":"Active Directory Select Fields","enum":["active_directory.user.display_name","active_directory.user.distinguished_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.machine.display_name","active_directory.machine.distinguished_name","active_directory.machine.sam_account_name","active_directory.machine.ou"]}]}}}},"groups":{"items":{"title":"List of queries to fetch events","allOf":[{"type":"object","allOf":[{"type":"object","allOf":[{"properties":{"constraints":{"type":"array","items":{"title":"Event Constraints","type":"object","required":["field"],"anyOf":[{"title":"String (Equals, Not Equals) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"title":"Event UID String Fields","type":"string","enum":["id","account_id","parent_account_id","user_id","machine_id","root_group_id","group_id","policy_id"]},{"title":"Event Simple String Fields","type":"string","anyOf":[{"enum":["account_name","user_name","machine_name","group_name","policy_name"]},{"title":"Active Directory Simple String Fields","type":"string","enum":["active_directory.user.display_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.user.ou.path","active_directory.machine.display_name","active_directory.machine.sam_account_name","active_directory.machine.ou","active_directory.machine.ou.path"]}]},{"type":"string","title":"Event Enum String Fields","enum":["source","type","severity","action"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["equals","not_equals"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}}},"if":{"properties":{"field":{"title":"Event UID String Fields","type":"string","enum":["id","account_id","parent_account_id","user_id","machine_id","root_group_id","group_id","policy_id"]}}},"then":{"properties":{"value":{"type":["string","array"],"format":"uuid","items":{"type":"string","format":"uuid"}}}}},{"title":"String (Contains, Not Contains) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"title":"Event Simple String Fields","type":"string","anyOf":[{"enum":["account_name","user_name","machine_name","group_name","policy_name"]},{"title":"Active Directory Simple String Fields","type":"string","enum":["active_directory.user.display_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.user.ou.path","active_directory.machine.display_name","active_directory.machine.sam_account_name","active_directory.machine.ou","active_directory.machine.ou.path"]}]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["contains","not_contains"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}}}},{"title":"Date (start, end) Constraints","properties":{"field":{"oneOf":[{"title":"Event Date Fields","type":"string","enum":["created_at"]}]}},"oneOf":[{"minProperties":1,"title":"Specify Date Range","not":{"anyOf":[{"required":["operator"]},{"required":["value"]}]},"properties":{"start":{"type":"string","format":"date-time","title":"Start Date"},"end":{"type":"string","format":"date-time","title":"End Date"}}},{"title":"Specify Exact Date","not":{"anyOf":[{"required":["start"]},{"required":["end"]}]},"required":["operator","value"],"properties":{"operator":{"type":"string","enum":["equals"]},"value":{"type":["string","array"],"format":"date-time","title":"Value to search","items":{"format":"date-time"}}}}]},{"title":"Field Exists/Not Exists Constraints","required":["operator"],"properties":{"field":{"type":"string","oneOf":[{"title":"Event UID String Fields","type":"string","enum":["id","account_id","parent_account_id","user_id","machine_id","root_group_id","group_id","policy_id"]},{"title":"Event Simple String Fields","type":"string","anyOf":[{"enum":["account_name","user_name","machine_name","group_name","policy_name"]},{"title":"Active Directory Simple String Fields","type":"string","enum":["active_directory.user.display_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.user.ou.path","active_directory.machine.display_name","active_directory.machine.sam_account_name","active_directory.machine.ou","active_directory.machine.ou.path"]}]},{"type":"string","title":"Event Enum String Fields","enum":["source","type","severity","action"]},{"title":"Event Date Fields","type":"string","enum":["created_at"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["exists","not_exists"]}}}]},"examples":[[{"field":"rule_name","value":"Test Rule","operator":"equals"}]]},"aggregations":{"items":{"type":"string","title":"Event aggregation fields","enum":["account_id","account_name","parent_account_id","user_id","user_name","machine_id","machine_name","root_group_id","group_id","group_name","policy_id","policy_name","source","type","severity","action","created_at"]}},"sort_field":{"type":"string","title":"Event sort fields","anyOf":[{"enum":["account_id","account_name","parent_account_id","user_id","user_name","machine_id","machine_name","root_group_id","group_id","group_name","policy_id","policy_name","source","type","severity","action","created_at"]},{"type":"string","title":"Active Directory Sort Fields","enum":["active_directory.user.display_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.machine.display_name","active_directory.machine.sam_account_name","active_directory.machine.ou"]}]},"start_date":{"type":"string","title":"Get results after this date","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"end_date":{"type":"string","title":"Get results before this date","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]}}},{"type":"object","title":"Base Search Schema","properties":{"aggregations":{"type":"array","title":"The fields onto which you can perform aggregations","items":{"type":"string","title":"The Items Schema"}},"page_size":{"type":"number","title":"The page size. If you just need to aggregate, set it to 0","minimum":0,"maximum":2000},"sort_field":{"title":"Sort Fields","type":"string"},"sort_order":{"type":"string","title":"Whether sorting should be ascending or descending","enum":["asc","desc"]},"aggregate_by_account":{"type":"boolean","title":"Indicates whether aggregations should be scoped by account"},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}]},{"type":"object","required":["account_ids"],"properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]}]}}}}]}}}},"responses":{"200":{"description":"Successful response"}},"tags":["Grid"],"operationId":"api.rmm.grid.export.events.async"}},"/oneview/v1/grid/events/search":{"post":{"description":"Search events","summary":"Search events","simple_schema":"event-search-grid-rmm-simple","security":[{"client_credentials":["read"]},{"user_permissions":["events.view","activityLogs.view"]}],"status":{"outage":["auth","search_stateless"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","allOf":[{"type":"object","allOf":[{"properties":{"constraints":{"type":"array","items":{"title":"Event Constraints","type":"object","required":["field"],"anyOf":[{"title":"String (Equals, Not Equals) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"title":"Event UID String Fields","type":"string","enum":["id","account_id","parent_account_id","user_id","machine_id","root_group_id","group_id","policy_id"]},{"title":"Event Simple String Fields","type":"string","anyOf":[{"enum":["account_name","user_name","machine_name","group_name","policy_name"]},{"title":"Active Directory Simple String Fields","type":"string","enum":["active_directory.user.display_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.user.ou.path","active_directory.machine.display_name","active_directory.machine.sam_account_name","active_directory.machine.ou","active_directory.machine.ou.path"]}]},{"type":"string","title":"Event Enum String Fields","enum":["source","type","severity","action"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["equals","not_equals"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}}},"if":{"properties":{"field":{"title":"Event UID String Fields","type":"string","enum":["id","account_id","parent_account_id","user_id","machine_id","root_group_id","group_id","policy_id"]}}},"then":{"properties":{"value":{"type":["string","array"],"format":"uuid","items":{"type":"string","format":"uuid"}}}}},{"title":"String (Contains, Not Contains) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"title":"Event Simple String Fields","type":"string","anyOf":[{"enum":["account_name","user_name","machine_name","group_name","policy_name"]},{"title":"Active Directory Simple String Fields","type":"string","enum":["active_directory.user.display_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.user.ou.path","active_directory.machine.display_name","active_directory.machine.sam_account_name","active_directory.machine.ou","active_directory.machine.ou.path"]}]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["contains","not_contains"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}}}},{"title":"Date (start, end) Constraints","properties":{"field":{"oneOf":[{"title":"Event Date Fields","type":"string","enum":["created_at"]}]}},"oneOf":[{"minProperties":1,"title":"Specify Date Range","not":{"anyOf":[{"required":["operator"]},{"required":["value"]}]},"properties":{"start":{"type":"string","format":"date-time","title":"Start Date"},"end":{"type":"string","format":"date-time","title":"End Date"}}},{"title":"Specify Exact Date","not":{"anyOf":[{"required":["start"]},{"required":["end"]}]},"required":["operator","value"],"properties":{"operator":{"type":"string","enum":["equals"]},"value":{"type":["string","array"],"format":"date-time","title":"Value to search","items":{"format":"date-time"}}}}]},{"title":"Field Exists/Not Exists Constraints","required":["operator"],"properties":{"field":{"type":"string","oneOf":[{"title":"Event UID String Fields","type":"string","enum":["id","account_id","parent_account_id","user_id","machine_id","root_group_id","group_id","policy_id"]},{"title":"Event Simple String Fields","type":"string","anyOf":[{"enum":["account_name","user_name","machine_name","group_name","policy_name"]},{"title":"Active Directory Simple String Fields","type":"string","enum":["active_directory.user.display_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.user.ou.path","active_directory.machine.display_name","active_directory.machine.sam_account_name","active_directory.machine.ou","active_directory.machine.ou.path"]}]},{"type":"string","title":"Event Enum String Fields","enum":["source","type","severity","action"]},{"title":"Event Date Fields","type":"string","enum":["created_at"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["exists","not_exists"]}}}]},"examples":[[{"field":"rule_name","value":"Test Rule","operator":"equals"}]]},"aggregations":{"items":{"type":"string","title":"Event aggregation fields","enum":["account_id","account_name","parent_account_id","user_id","user_name","machine_id","machine_name","root_group_id","group_id","group_name","policy_id","policy_name","source","type","severity","action","created_at"]}},"sort_field":{"type":"string","title":"Event sort fields","anyOf":[{"enum":["account_id","account_name","parent_account_id","user_id","user_name","machine_id","machine_name","root_group_id","group_id","group_name","policy_id","policy_name","source","type","severity","action","created_at"]},{"type":"string","title":"Active Directory Sort Fields","enum":["active_directory.user.display_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.machine.display_name","active_directory.machine.sam_account_name","active_directory.machine.ou"]}]},"start_date":{"type":"string","title":"Get results after this date","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"end_date":{"type":"string","title":"Get results before this date","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]}}},{"type":"object","title":"Base Search Schema","properties":{"aggregations":{"type":"array","title":"The fields onto which you can perform aggregations","items":{"type":"string","title":"The Items Schema"}},"page_size":{"type":"number","title":"The page size. If you just need to aggregate, set it to 0","minimum":0,"maximum":2000},"sort_field":{"title":"Sort Fields","type":"string"},"sort_order":{"type":"string","title":"Whether sorting should be ascending or descending","enum":["asc","desc"]},"aggregate_by_account":{"type":"boolean","title":"Indicates whether aggregations should be scoped by account"},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}]},{"type":"object","required":["account_ids"],"properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Search events result","properties":{"results":{"type":"array","items":{"required":["type"],"type":"object","additionalProperties":false,"properties":{"type":{"type":"string"},"friendly_type":{"type":"string"},"severity":{"type":"string"},"group_id":{"type":"string"},"id":{"type":"string"},"details":{"type":["object","array"]},"created_at":{"type":"string"},"account_name":{"type":"string"},"parent_account_id":{"type":"string"},"root_group_id":{"type":"string"},"machine_id":{"type":"string"},"account_id":{"type":"string"},"policy_id":{"type":"string"},"group_name":{"type":"string"},"policy_name":{"type":"string"},"machine_name":{"type":"string"},"source":{"type":"string"},"action":{"type":"string"},"online":{"type":"boolean","title":"Endpoint connection status (populated only if the populate.online is set)"},"active_directory":{"type":"object","patternProperties":{"^(user|machine)$":{"type":"object","properties":{"display_name":{"type":"string"},"distinguished_name":{"type":"string"},"sam_account_name":{"type":"string"},"ou":{"type":"string"}}}}}}}},"total_count":{"type":"integer","title":"Total count of found detections"},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}}}}},"tags":["Grid"],"operationId":"api.rmm.grid.search.events"}},"/oneview/v1/grid/events/search-groupby":{"post":{"description":"Search and group events","summary":"Search events groupby","simple_schema":"event-search-groupby-grid-rmm-simple","security":[{"client_credentials":["read"]},{"user_permissions":["events.view","activityLogs.view"]}],"status":{"incident":["read_nebula_data"],"outage":["auth","search_stateful"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"title":"Event Search Groupby Schema","type":"object","allOf":[{"type":"object","required":["group_by","page_size"],"properties":{"group_by":{"title":"Group by the following fields","type":"array","minItems":1,"uniqueItems":true,"items":{"type":"string"}},"page_size":{"type":"number","title":"The page_size Schema","minimum":50,"maximum":2000}}},{"type":"object","allOf":[{"type":"object","allOf":[{"properties":{"constraints":{"type":"array","items":{"title":"Event Constraints","type":"object","required":["field"],"anyOf":[{"title":"String (Equals, Not Equals) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"title":"Event UID String Fields","type":"string","enum":["id","account_id","parent_account_id","user_id","machine_id","root_group_id","group_id","policy_id"]},{"title":"Event Simple String Fields","type":"string","anyOf":[{"enum":["account_name","user_name","machine_name","group_name","policy_name"]},{"title":"Active Directory Simple String Fields","type":"string","enum":["active_directory.user.display_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.user.ou.path","active_directory.machine.display_name","active_directory.machine.sam_account_name","active_directory.machine.ou","active_directory.machine.ou.path"]}]},{"type":"string","title":"Event Enum String Fields","enum":["source","type","severity","action"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["equals","not_equals"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}}},"if":{"properties":{"field":{"title":"Event UID String Fields","type":"string","enum":["id","account_id","parent_account_id","user_id","machine_id","root_group_id","group_id","policy_id"]}}},"then":{"properties":{"value":{"type":["string","array"],"format":"uuid","items":{"type":"string","format":"uuid"}}}}},{"title":"String (Contains, Not Contains) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"title":"Event Simple String Fields","type":"string","anyOf":[{"enum":["account_name","user_name","machine_name","group_name","policy_name"]},{"title":"Active Directory Simple String Fields","type":"string","enum":["active_directory.user.display_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.user.ou.path","active_directory.machine.display_name","active_directory.machine.sam_account_name","active_directory.machine.ou","active_directory.machine.ou.path"]}]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["contains","not_contains"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}}}},{"title":"Date (start, end) Constraints","properties":{"field":{"oneOf":[{"title":"Event Date Fields","type":"string","enum":["created_at"]}]}},"oneOf":[{"minProperties":1,"title":"Specify Date Range","not":{"anyOf":[{"required":["operator"]},{"required":["value"]}]},"properties":{"start":{"type":"string","format":"date-time","title":"Start Date"},"end":{"type":"string","format":"date-time","title":"End Date"}}},{"title":"Specify Exact Date","not":{"anyOf":[{"required":["start"]},{"required":["end"]}]},"required":["operator","value"],"properties":{"operator":{"type":"string","enum":["equals"]},"value":{"type":["string","array"],"format":"date-time","title":"Value to search","items":{"format":"date-time"}}}}]},{"title":"Field Exists/Not Exists Constraints","required":["operator"],"properties":{"field":{"type":"string","oneOf":[{"title":"Event UID String Fields","type":"string","enum":["id","account_id","parent_account_id","user_id","machine_id","root_group_id","group_id","policy_id"]},{"title":"Event Simple String Fields","type":"string","anyOf":[{"enum":["account_name","user_name","machine_name","group_name","policy_name"]},{"title":"Active Directory Simple String Fields","type":"string","enum":["active_directory.user.display_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.user.ou.path","active_directory.machine.display_name","active_directory.machine.sam_account_name","active_directory.machine.ou","active_directory.machine.ou.path"]}]},{"type":"string","title":"Event Enum String Fields","enum":["source","type","severity","action"]},{"title":"Event Date Fields","type":"string","enum":["created_at"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["exists","not_exists"]}}}]},"examples":[[{"field":"rule_name","value":"Test Rule","operator":"equals"}]]},"aggregations":{"items":{"type":"string","title":"Event aggregation fields","enum":["account_id","account_name","parent_account_id","user_id","user_name","machine_id","machine_name","root_group_id","group_id","group_name","policy_id","policy_name","source","type","severity","action","created_at"]}},"sort_field":{"type":"string","title":"Event sort fields","anyOf":[{"enum":["account_id","account_name","parent_account_id","user_id","user_name","machine_id","machine_name","root_group_id","group_id","group_name","policy_id","policy_name","source","type","severity","action","created_at"]},{"type":"string","title":"Active Directory Sort Fields","enum":["active_directory.user.display_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.machine.display_name","active_directory.machine.sam_account_name","active_directory.machine.ou"]}]},"start_date":{"type":"string","title":"Get results after this date","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"end_date":{"type":"string","title":"Get results before this date","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]}}},{"type":"object","title":"Base Search Schema","properties":{"aggregations":{"type":"array","title":"The fields onto which you can perform aggregations","items":{"type":"string","title":"The Items Schema"}},"page_size":{"type":"number","title":"The page size. If you just need to aggregate, set it to 0","minimum":0,"maximum":2000},"sort_field":{"title":"Sort Fields","type":"string"},"sort_order":{"type":"string","title":"Whether sorting should be ascending or descending","enum":["asc","desc"]},"aggregate_by_account":{"type":"boolean","title":"Indicates whether aggregations should be scoped by account"},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}]},{"type":"object","required":["account_ids"],"properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]},{"properties":{"group_by":{"type":"array","title":"Group results by indicated field(s)","items":{"type":"string","title":"Event groupby fields","anyOf":[{"enum":["account_id","account_name","parent_account_id","user_id","user_name","machine_id","machine_name","root_group_id","group_id","group_name","policy_id","policy_name","source","type","severity","action","created_at"]},{"type":"string","title":"Active Directory Group By Fields","enum":["active_directory.user.display_name","active_directory.user.ou","active_directory.machine.display_name","active_directory.machine.ou"]}]}}}}]}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"The Events Search GroupBy Response Schema","required":["results","next_cursor"],"properties":{"results":{"type":"array","title":"The Results Schema","default":[]},"total_count":{"type":"integer","title":"Total count of found detections"},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}}}}},"tags":["Grid"],"operationId":"api.rmm.grid.search.events.group"}},"/oneview/v1/grid/firewall/export":{"post":{"description":"Export firewall activity","summary":"Export firewall activity","simple_schema":"firewall-export-grid-rmm-simple","security":[{"client_credentials":["execute"]},{"user_permissions":["firewall.view"]}],"status":{"outage":["auth","search_stateless"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"title":"Firewall Export Schema","type":"object","allOf":[{"type":"object","title":"Base Export Schema","required":["groups","select","format"],"properties":{"format":{"type":"string","title":"The output file","enum":["csv","xlsx","html","ods","txt","rtf","json"]},"download":{"type":"boolean","title":"Whether to instruct the client to download the response as a file. Only clients like browsers are supported"},"type":{"type":"string","title":"The encoding of the output","enum":["string","base64","binary"],"default":"string"},"select":{"type":"array","title":"Which fields to select from the response","items":{"type":"object","title":"Field","required":["field","newField"],"properties":{"newField":{"type":"string","title":"the new value"},"field":{"type":"string","title":"The response field to map to a new value"}}}},"groups":{"type":"array","title":"List of queries","items":{"type":"object"}}}},{"properties":{"select":{"items":{"properties":{"field":{"type":"string","title":"Firewall select fields","enum":["document_id","account_name","machine_name","rule_name","ruleset_name","program","service","protocol","hits","direction","location","action","account_id","machine_id","rule_id","start_time","end_time"]}}}},"groups":{"items":{"title":"List of queries to fetch firewall activity","allOf":[{"type":"object","allOf":[{"type":"object","allOf":[{"properties":{"constraints":{"type":"array","items":{"title":"Firewall Constraints","type":"object","required":["field"],"anyOf":[{"title":"String (Equals, Not Equals) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"title":"Firewall String Fields","type":"string","enum":["document_id","account_name","machine_name","rule_name","ruleset_name","program","service","protocol"]},{"title":"Firewall Enum String Fields","type":"string","enum":["direction","location","action"]},{"title":"Firewall UID String Fields","type":"string","enum":["account_id","machine_id","rule_id","ruleset_id"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["equals","not_equals"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}}},"if":{"properties":{"field":{"title":"Firewall UID String Fields","type":"string","enum":["account_id","machine_id","rule_id","ruleset_id"]}}},"then":{"properties":{"value":{"type":["string","array"],"format":"uuid","items":{"type":"string","format":"uuid"}}}}},{"title":"String (Contains, Not Contains) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"title":"Firewall String Fields","type":"string","enum":["document_id","account_name","machine_name","rule_name","ruleset_name","program","service","protocol"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["contains","not_contains"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}}}},{"title":"Number Constraints (gt, gte, lt, lte, equals)","properties":{"field":{"type":"string","oneOf":[{"title":"Firewall Number Fields","type":"string","enum":["hits"]}]}},"oneOf":[{"minProperties":1,"title":"Specify Number Range","not":{"anyOf":[{"required":["operator"]},{"required":["value"]}]},"properties":{"gt":{"type":"number","title":"Greater than"},"lt":{"type":"number","title":"Less than"},"gte":{"type":"number","title":"Greater than or equals"},"lte":{"type":"number","title":"Less than or equals"}}},{"title":"Specify Exact Number","not":{"anyOf":[{"required":["gt"]},{"required":["lt"]},{"required":["gte"]},{"required":["lte"]}]},"required":["operator","value"],"properties":{"operator":{"type":"string","enum":["equals"]},"value":{"type":["number","array"],"title":"Value to search","items":{"type":"number"}}}}]},{"title":"Date (start, end) Constraints","properties":{"field":{"oneOf":[{"title":"Firewall Date Fields","type":"string","enum":["@timestamp","start_time","end_time"]}]}},"oneOf":[{"minProperties":1,"title":"Specify Date Range","not":{"anyOf":[{"required":["operator"]},{"required":["value"]}]},"properties":{"start":{"type":"string","format":"date-time","title":"Start Date"},"end":{"type":"string","format":"date-time","title":"End Date"}}},{"title":"Specify Exact Date","not":{"anyOf":[{"required":["start"]},{"required":["end"]}]},"required":["operator","value"],"properties":{"operator":{"type":"string","enum":["equals"]},"value":{"type":["string","array"],"format":"date-time","title":"Value to search","items":{"format":"date-time"}}}}]},{"title":"Field Exists/Not Exists Constraints","required":["operator"],"properties":{"field":{"type":"string","oneOf":[{"title":"Firewall String Fields","type":"string","enum":["document_id","account_name","machine_name","rule_name","ruleset_name","program","service","protocol"]},{"title":"Firewall Enum String Fields","type":"string","enum":["direction","location","action"]},{"title":"Firewall UID String Fields","type":"string","enum":["account_id","machine_id","rule_id","ruleset_id"]},{"title":"Firewall Number Fields","type":"string","enum":["hits"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["exists","not_exists"]}}}]},"examples":[[{"field":"rule_name","value":"Test Rule","operator":"equals"}]]},"aggregations":{"items":{"type":"string","title":"Firewall aggregation fields","enum":["account_name","machine_name","rule_name","program","service","protocol","account_id","machine_id","ruleset_id","ruleset_name","rule_id","action","location","daily_firewall_hits_by_direction","hits_by_direction_per_endpoint"]}},"sort_field":{"type":"string","title":"Firewall sort Fields","enum":["account_name","machine_name","rule_name","ruleset_name","program","service","protocol","account_id","machine_id","rule_id","hits","start_time","end_time","action","direction"]}}},{"type":"object","title":"Base Search Schema","properties":{"aggregations":{"type":"array","title":"The fields onto which you can perform aggregations","items":{"type":"string","title":"The Items Schema"}},"page_size":{"type":"number","title":"The page size. If you just need to aggregate, set it to 0","minimum":0,"maximum":2000},"sort_field":{"title":"Sort Fields","type":"string"},"sort_order":{"type":"string","title":"Whether sorting should be ascending or descending","enum":["asc","desc"]},"aggregate_by_account":{"type":"boolean","title":"Indicates whether aggregations should be scoped by account"},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}]},{"type":"object","required":["account_ids"],"properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]}]}}}}]}}}},"responses":{"200":{"description":"Successful response"}},"tags":["Grid"],"operationId":"api.rmm.grid.export.firewall"}},"/oneview/v1/grid/firewall/search":{"post":{"description":"Search firewall activity","summary":"Search firewall activity","simple_schema":"firewall-search-grid-rmm-simple","security":[{"client_credentials":["read"]},{"user_permissions":["firewall.view"]}],"status":{"outage":["auth","search_stateless"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","allOf":[{"type":"object","allOf":[{"properties":{"constraints":{"type":"array","items":{"title":"Firewall Constraints","type":"object","required":["field"],"anyOf":[{"title":"String (Equals, Not Equals) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"title":"Firewall String Fields","type":"string","enum":["document_id","account_name","machine_name","rule_name","ruleset_name","program","service","protocol"]},{"title":"Firewall Enum String Fields","type":"string","enum":["direction","location","action"]},{"title":"Firewall UID String Fields","type":"string","enum":["account_id","machine_id","rule_id","ruleset_id"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["equals","not_equals"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}}},"if":{"properties":{"field":{"title":"Firewall UID String Fields","type":"string","enum":["account_id","machine_id","rule_id","ruleset_id"]}}},"then":{"properties":{"value":{"type":["string","array"],"format":"uuid","items":{"type":"string","format":"uuid"}}}}},{"title":"String (Contains, Not Contains) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"title":"Firewall String Fields","type":"string","enum":["document_id","account_name","machine_name","rule_name","ruleset_name","program","service","protocol"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["contains","not_contains"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}}}},{"title":"Number Constraints (gt, gte, lt, lte, equals)","properties":{"field":{"type":"string","oneOf":[{"title":"Firewall Number Fields","type":"string","enum":["hits"]}]}},"oneOf":[{"minProperties":1,"title":"Specify Number Range","not":{"anyOf":[{"required":["operator"]},{"required":["value"]}]},"properties":{"gt":{"type":"number","title":"Greater than"},"lt":{"type":"number","title":"Less than"},"gte":{"type":"number","title":"Greater than or equals"},"lte":{"type":"number","title":"Less than or equals"}}},{"title":"Specify Exact Number","not":{"anyOf":[{"required":["gt"]},{"required":["lt"]},{"required":["gte"]},{"required":["lte"]}]},"required":["operator","value"],"properties":{"operator":{"type":"string","enum":["equals"]},"value":{"type":["number","array"],"title":"Value to search","items":{"type":"number"}}}}]},{"title":"Date (start, end) Constraints","properties":{"field":{"oneOf":[{"title":"Firewall Date Fields","type":"string","enum":["@timestamp","start_time","end_time"]}]}},"oneOf":[{"minProperties":1,"title":"Specify Date Range","not":{"anyOf":[{"required":["operator"]},{"required":["value"]}]},"properties":{"start":{"type":"string","format":"date-time","title":"Start Date"},"end":{"type":"string","format":"date-time","title":"End Date"}}},{"title":"Specify Exact Date","not":{"anyOf":[{"required":["start"]},{"required":["end"]}]},"required":["operator","value"],"properties":{"operator":{"type":"string","enum":["equals"]},"value":{"type":["string","array"],"format":"date-time","title":"Value to search","items":{"format":"date-time"}}}}]},{"title":"Field Exists/Not Exists Constraints","required":["operator"],"properties":{"field":{"type":"string","oneOf":[{"title":"Firewall String Fields","type":"string","enum":["document_id","account_name","machine_name","rule_name","ruleset_name","program","service","protocol"]},{"title":"Firewall Enum String Fields","type":"string","enum":["direction","location","action"]},{"title":"Firewall UID String Fields","type":"string","enum":["account_id","machine_id","rule_id","ruleset_id"]},{"title":"Firewall Number Fields","type":"string","enum":["hits"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["exists","not_exists"]}}}]},"examples":[[{"field":"rule_name","value":"Test Rule","operator":"equals"}]]},"aggregations":{"items":{"type":"string","title":"Firewall aggregation fields","enum":["account_name","machine_name","rule_name","program","service","protocol","account_id","machine_id","ruleset_id","ruleset_name","rule_id","action","location","daily_firewall_hits_by_direction","hits_by_direction_per_endpoint"]}},"sort_field":{"type":"string","title":"Firewall sort Fields","enum":["account_name","machine_name","rule_name","ruleset_name","program","service","protocol","account_id","machine_id","rule_id","hits","start_time","end_time","action","direction"]}}},{"type":"object","title":"Base Search Schema","properties":{"aggregations":{"type":"array","title":"The fields onto which you can perform aggregations","items":{"type":"string","title":"The Items Schema"}},"page_size":{"type":"number","title":"The page size. If you just need to aggregate, set it to 0","minimum":0,"maximum":2000},"sort_field":{"title":"Sort Fields","type":"string"},"sort_order":{"type":"string","title":"Whether sorting should be ascending or descending","enum":["asc","desc"]},"aggregate_by_account":{"type":"boolean","title":"Indicates whether aggregations should be scoped by account"},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}]},{"type":"object","required":["account_ids"],"properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Search firewall activity","required":["results","total_count"],"properties":{"results":{"type":"array","items":{"type":"object","properties":{"created_at":{"type":"string","format":"date-time","title":"Created at"},"start_time":{"type":"string","title":"Start time"},"end_time":{"type":"string","title":"End time"},"account_id":{"type":"string","title":"Account ID","format":"uuid"},"account_name":{"type":"string","title":"Account name"},"machine_id":{"type":"string","title":"Machine ID","format":"uuid"},"machine_name":{"type":"string","title":"Machine name"},"group_id":{"type":"string","title":"Group ID","format":"uuid"},"root_group_id":{"type":"string","title":"Root group ID","format":"uuid"},"document_id":{"type":"string","title":"Document ID"},"rule_id":{"type":"string","title":"Rule ID","format":"uuid"},"rule_name":{"type":"string","title":"Rule name"},"ruleset_id":{"type":"string","title":"Ruleset ID"},"ruleset_name":{"type":"string","title":"Ruleset name"},"direction":{"type":"string","title":"Direction"},"action":{"type":"string","title":"Action"},"protocol":{"type":"string","title":"Protocol"},"location":{"type":"string","title":"Location"},"program":{"type":"string","title":"Program"},"service":{"type":"string","title":"Service"},"hits":{"type":"integer","title":"Hits"}}}},"aggregations":{"type":"object","title":"Aggregations","additionalProperties":true},"total_count":{"type":"integer","title":"Total count of found firewall activities"},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}}}}},"tags":["Grid"],"operationId":"api.rmm.grid.search.firewall"}},"/oneview/v1/grid/firewall/search-groupby":{"post":{"description":"Search grouped firewall activity","summary":"Search grouped firewall activity","simple_schema":"firewall-search-groupby-grid-rmm-simple","security":[{"client_credentials":["read"]},{"user_permissions":["firewall.view"]}],"status":{"outage":["auth","search_stateful"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"title":"Firewall Search Groupby Schema","type":"object","allOf":[{"type":"object","required":["group_by","page_size"],"properties":{"group_by":{"title":"Group by the following fields","type":"array","minItems":1,"uniqueItems":true,"items":{"type":"string"}},"page_size":{"type":"number","title":"The page_size Schema","minimum":50,"maximum":2000}}},{"type":"object","allOf":[{"type":"object","allOf":[{"properties":{"constraints":{"type":"array","items":{"title":"Firewall Constraints","type":"object","required":["field"],"anyOf":[{"title":"String (Equals, Not Equals) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"title":"Firewall String Fields","type":"string","enum":["document_id","account_name","machine_name","rule_name","ruleset_name","program","service","protocol"]},{"title":"Firewall Enum String Fields","type":"string","enum":["direction","location","action"]},{"title":"Firewall UID String Fields","type":"string","enum":["account_id","machine_id","rule_id","ruleset_id"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["equals","not_equals"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}}},"if":{"properties":{"field":{"title":"Firewall UID String Fields","type":"string","enum":["account_id","machine_id","rule_id","ruleset_id"]}}},"then":{"properties":{"value":{"type":["string","array"],"format":"uuid","items":{"type":"string","format":"uuid"}}}}},{"title":"String (Contains, Not Contains) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"title":"Firewall String Fields","type":"string","enum":["document_id","account_name","machine_name","rule_name","ruleset_name","program","service","protocol"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["contains","not_contains"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}}}},{"title":"Number Constraints (gt, gte, lt, lte, equals)","properties":{"field":{"type":"string","oneOf":[{"title":"Firewall Number Fields","type":"string","enum":["hits"]}]}},"oneOf":[{"minProperties":1,"title":"Specify Number Range","not":{"anyOf":[{"required":["operator"]},{"required":["value"]}]},"properties":{"gt":{"type":"number","title":"Greater than"},"lt":{"type":"number","title":"Less than"},"gte":{"type":"number","title":"Greater than or equals"},"lte":{"type":"number","title":"Less than or equals"}}},{"title":"Specify Exact Number","not":{"anyOf":[{"required":["gt"]},{"required":["lt"]},{"required":["gte"]},{"required":["lte"]}]},"required":["operator","value"],"properties":{"operator":{"type":"string","enum":["equals"]},"value":{"type":["number","array"],"title":"Value to search","items":{"type":"number"}}}}]},{"title":"Date (start, end) Constraints","properties":{"field":{"oneOf":[{"title":"Firewall Date Fields","type":"string","enum":["@timestamp","start_time","end_time"]}]}},"oneOf":[{"minProperties":1,"title":"Specify Date Range","not":{"anyOf":[{"required":["operator"]},{"required":["value"]}]},"properties":{"start":{"type":"string","format":"date-time","title":"Start Date"},"end":{"type":"string","format":"date-time","title":"End Date"}}},{"title":"Specify Exact Date","not":{"anyOf":[{"required":["start"]},{"required":["end"]}]},"required":["operator","value"],"properties":{"operator":{"type":"string","enum":["equals"]},"value":{"type":["string","array"],"format":"date-time","title":"Value to search","items":{"format":"date-time"}}}}]},{"title":"Field Exists/Not Exists Constraints","required":["operator"],"properties":{"field":{"type":"string","oneOf":[{"title":"Firewall String Fields","type":"string","enum":["document_id","account_name","machine_name","rule_name","ruleset_name","program","service","protocol"]},{"title":"Firewall Enum String Fields","type":"string","enum":["direction","location","action"]},{"title":"Firewall UID String Fields","type":"string","enum":["account_id","machine_id","rule_id","ruleset_id"]},{"title":"Firewall Number Fields","type":"string","enum":["hits"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["exists","not_exists"]}}}]},"examples":[[{"field":"rule_name","value":"Test Rule","operator":"equals"}]]},"aggregations":{"items":{"type":"string","title":"Firewall aggregation fields","enum":["account_name","machine_name","rule_name","program","service","protocol","account_id","machine_id","ruleset_id","ruleset_name","rule_id","action","location","daily_firewall_hits_by_direction","hits_by_direction_per_endpoint"]}},"sort_field":{"type":"string","title":"Firewall sort Fields","enum":["account_name","machine_name","rule_name","ruleset_name","program","service","protocol","account_id","machine_id","rule_id","hits","start_time","end_time","action","direction"]}}},{"type":"object","title":"Base Search Schema","properties":{"aggregations":{"type":"array","title":"The fields onto which you can perform aggregations","items":{"type":"string","title":"The Items Schema"}},"page_size":{"type":"number","title":"The page size. If you just need to aggregate, set it to 0","minimum":0,"maximum":2000},"sort_field":{"title":"Sort Fields","type":"string"},"sort_order":{"type":"string","title":"Whether sorting should be ascending or descending","enum":["asc","desc"]},"aggregate_by_account":{"type":"boolean","title":"Indicates whether aggregations should be scoped by account"},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}]},{"type":"object","required":["account_ids"],"properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]},{"properties":{"group_by":{"type":"array","title":"Group results by indicated field(s)","items":{"type":"string","title":"Firewall Groupby Fields","enum":["account_name","machine_name","rule_name","ruleset_id","ruleset_name","program","service","protocol","account_id","machine_id","rule_id","direction","action"]}}}}]}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Group firewall activity response","required":["results","next_cursor"],"properties":{"results":{"type":"array","title":"The Results Schema","default":[]},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}}}}},"tags":["Grid"],"operationId":"api.rmm.grid.search.firewall.group"}},"/oneview/v1/grid/groups/{id}/machines":{"post":{"description":"Move endpoints between groups across accounts","summary":"Move endpoints between groups across accounts","simple_schema":"endpoint-search-grid-groups-rmm-simple","security":[{"client_credentials":["write"]},{"user_permissions":["endpoints.performActions"]}],"status":{"outage":["auth","search_stateful"]},"parameters":[{"name":"id","required":true,"in":"path","description":"Valid UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Bulk endpoint filter request","required":["groups"],"properties":{"groups":{"items":{"title":"List of queries to fetch endpoints","allOf":[{"type":"object","allOf":[{"type":"object","allOf":[{"properties":{"constraints":{"type":"array","items":{"title":"Endpoint Constraints","type":"object","required":["field"],"anyOf":[{"title":"String (Equals, Not Equals) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"title":"Agent Simple String Fields","type":"string","enum":["agent.nics.mac_address","agent.nics.description","agent.os_info.os_version","agent.os_info.os_release_name","agent.os_info.os_architecture","agent.plugins.asset_manager.plugin_version","agent.plugins.asset_manager.alerts.codes","agent.plugins.endpoint_protection.plugin_version","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.plugins.endpoint_protection.update_package_version","agent.plugins.endpoint_protection.alerts.codes","agent.plugins.endpoint_detection_and_response.plugin_version","agent.plugins.endpoint_detection_and_response.alerts.codes","agent.plugins.incident_response.plugin_version","agent.plugins.incident_response.update_package_version","agent.plugins.incident_response.alerts.codes","agent.plugins.siem.plugin_version","agent.plugins.siem.alerts.codes","agent.plugins.browser_phishing_protection.plugin_version","agent.plugins.browser_phishing_protection.alerts.codes","agent.engine_version","agent.source_location.city","agent.source_location.country","agent.source_location.subdivisions","agent.source_location.time_zone","agent.domain_name","agent.alias","agent.policy_etag","agent.serial_number","agent.available_software_updates.sdk_version.currentVersion","agent.available_software_updates.sdk_version.newVersion","agent.alerts.codes","agent.host_name","agent.fully_qualified_host_name","agent.object_guid","agent.last_user","agent.active_directory.user.display_name","agent.active_directory.user.ou","agent.active_directory.user.ou.path","agent.active_directory.user.sam_account_name","agent.active_directory.machine.display_name","agent.active_directory.machine.ou","agent.active_directory.machine.ou.path","agent.active_directory.machine.sam_account_name"]},{"title":"Agent Enum String Fields","type":"string","enum":["agent.os_info.os_type","agent.os_info.os_platform"]},{"title":"Machine UID String Fields","type":"string","enum":["machine.id","machine.group_id","machine.root_group_id","machine.policy_id"]},{"title":"Machine Simple String Fields","type":"string","enum":["protection_status","machine.tags.alias","machine.reboot_required_reason","machine.group_name","machine.policy_name","stats.assets.encryption_status"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["equals","not_equals"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}}},"if":{"properties":{"field":{"title":"Machine UID String Fields","type":"string","enum":["machine.id","machine.group_id","machine.root_group_id","machine.policy_id"]}}},"then":{"properties":{"value":{"type":["string","array"],"format":"uuid","items":{"type":"string","format":"uuid"}}}}},{"title":"String (Contains, Not Contains) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"title":"Machine Simple String Fields","type":"string","enum":["protection_status","machine.tags.alias","machine.reboot_required_reason","machine.group_name","machine.policy_name","stats.assets.encryption_status"]},{"title":"Agent Simple String Fields","type":"string","enum":["agent.nics.mac_address","agent.nics.description","agent.os_info.os_version","agent.os_info.os_release_name","agent.os_info.os_architecture","agent.plugins.asset_manager.plugin_version","agent.plugins.asset_manager.alerts.codes","agent.plugins.endpoint_protection.plugin_version","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.plugins.endpoint_protection.update_package_version","agent.plugins.endpoint_protection.alerts.codes","agent.plugins.endpoint_detection_and_response.plugin_version","agent.plugins.endpoint_detection_and_response.alerts.codes","agent.plugins.incident_response.plugin_version","agent.plugins.incident_response.update_package_version","agent.plugins.incident_response.alerts.codes","agent.plugins.siem.plugin_version","agent.plugins.siem.alerts.codes","agent.plugins.browser_phishing_protection.plugin_version","agent.plugins.browser_phishing_protection.alerts.codes","agent.engine_version","agent.source_location.city","agent.source_location.country","agent.source_location.subdivisions","agent.source_location.time_zone","agent.domain_name","agent.alias","agent.policy_etag","agent.serial_number","agent.available_software_updates.sdk_version.currentVersion","agent.available_software_updates.sdk_version.newVersion","agent.alerts.codes","agent.host_name","agent.fully_qualified_host_name","agent.object_guid","agent.last_user","agent.active_directory.user.display_name","agent.active_directory.user.ou","agent.active_directory.user.ou.path","agent.active_directory.user.sam_account_name","agent.active_directory.machine.display_name","agent.active_directory.machine.ou","agent.active_directory.machine.ou.path","agent.active_directory.machine.sam_account_name"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["contains","not_contains"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}}}},{"title":"Boolean (Equals) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"title":"Agent Boolean Fields","type":"string","enum":["agent.is_software_update_available","agent.has_alerts"]},{"title":"Machine Boolean Fields","type":"string","enum":["machine.is_deleted","machine.isolated","connected"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["equals"]},"value":{"title":"Value to search. Must be true or false","type":"boolean"}}},{"title":"Number Constraints (gt, gte, lt, lte, equals)","properties":{"field":{"type":"string","oneOf":[{"title":"Agent Number Fields","type":"string","enum":["agent.started_at_offset","agent.plugins.asset_manager.reboot_reasons","agent.plugins.endpoint_protection.reboot_reasons","agent.plugins.endpoint_detection_and_response.reboot_reasons","agent.plugins.incident_response.reboot_reasons","agent.plugins.siem.reboot_reasons","agent.os_version_major","agent.os_version_minor"]},{"title":"Machine Number Fields","type":"string","enum":["machine.suspicious_activity_count","machine.infection_count","machine.reboot_required","stats.assets.vulnerabilities_found.total","stats.assets.os_patches_available","stats.assets.vulnerabilities_found.critical","stats.assets.vulnerabilities_found.high","stats.assets.vulnerabilities_found.medium","stats.assets.vulnerabilities_found.low"]}]}},"oneOf":[{"minProperties":1,"title":"Specify Number Range","not":{"anyOf":[{"required":["operator"]},{"required":["value"]}]},"properties":{"gt":{"type":"number","title":"Greater than"},"lt":{"type":"number","title":"Less than"},"gte":{"type":"number","title":"Greater than or equals"},"lte":{"type":"number","title":"Less than or equals"}}},{"title":"Specify Exact Number","not":{"anyOf":[{"required":["gt"]},{"required":["lt"]},{"required":["gte"]},{"required":["lte"]}]},"required":["operator","value"],"properties":{"operator":{"type":"string","enum":["equals"]},"value":{"type":["number","array"],"title":"Value to search","items":{"type":"number"}}}}]},{"title":"Date (start, end) Constraints","properties":{"field":{"oneOf":[{"title":"Agent Date Fields","type":"string","enum":["agent.at","agent.started_at_local"]},{"title":"Machine Date Fields","type":"string","enum":["machine.deleted_at","machine.last_day_seen","machine.last_scanned_at","machine.created_at","stats.assets.last_scanned_at"]}]}},"oneOf":[{"minProperties":1,"title":"Specify Date Range","not":{"anyOf":[{"required":["operator"]},{"required":["value"]}]},"properties":{"start":{"type":"string","format":"date-time","title":"Start Date"},"end":{"type":"string","format":"date-time","title":"End Date"}}},{"title":"Specify Exact Date","not":{"anyOf":[{"required":["start"]},{"required":["end"]}]},"required":["operator","value"],"properties":{"operator":{"type":"string","enum":["equals"]},"value":{"type":["string","array"],"format":"date-time","title":"Value to search","items":{"format":"date-time"}}}}]},{"title":"IP Constraints","properties":{"field":{"oneOf":[{"title":"Agent IP Fields","type":"string","enum":["agent.nics.ips","agent.machine_ip"]}]},"operator":{"type":"string","enum":["ip"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}}}},{"title":"MWB Version Constraints (gt, gte, lt, lte, equals)","required":["operator"],"properties":{"field":{"type":"string","oneOf":[{"title":"Agent MWB Version fields","type":"string","enum":["agent.engine_version"]}]},"operator":{"type":"string","enum":["mwb_version"]}},"oneOf":[{"minProperties":1,"title":"Specify Version Range","not":{"anyOf":[{"required":["value"]}]},"properties":{"gt":{"type":"string","title":"Greater than"},"lt":{"type":"string","title":"Less than"},"gte":{"type":"string","title":"Greater than or equals"},"lte":{"type":"string","title":"Less than or equals"}}},{"title":"Specify Exact Version","not":{"anyOf":[{"required":["gt"]},{"required":["lt"]},{"required":["gte"]},{"required":["lte"]}]},"required":["value"],"properties":{"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}}}}]},{"title":"Field Exists/Not Exists Constraints","required":["operator"],"properties":{"field":{"type":"string","oneOf":[{"title":"Agent Simple String Fields","type":"string","enum":["agent.nics.mac_address","agent.nics.description","agent.os_info.os_version","agent.os_info.os_release_name","agent.os_info.os_architecture","agent.plugins.asset_manager.plugin_version","agent.plugins.asset_manager.alerts.codes","agent.plugins.endpoint_protection.plugin_version","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.plugins.endpoint_protection.update_package_version","agent.plugins.endpoint_protection.alerts.codes","agent.plugins.endpoint_detection_and_response.plugin_version","agent.plugins.endpoint_detection_and_response.alerts.codes","agent.plugins.incident_response.plugin_version","agent.plugins.incident_response.update_package_version","agent.plugins.incident_response.alerts.codes","agent.plugins.siem.plugin_version","agent.plugins.siem.alerts.codes","agent.plugins.browser_phishing_protection.plugin_version","agent.plugins.browser_phishing_protection.alerts.codes","agent.engine_version","agent.source_location.city","agent.source_location.country","agent.source_location.subdivisions","agent.source_location.time_zone","agent.domain_name","agent.alias","agent.policy_etag","agent.serial_number","agent.available_software_updates.sdk_version.currentVersion","agent.available_software_updates.sdk_version.newVersion","agent.alerts.codes","agent.host_name","agent.fully_qualified_host_name","agent.object_guid","agent.last_user","agent.active_directory.user.display_name","agent.active_directory.user.ou","agent.active_directory.user.ou.path","agent.active_directory.user.sam_account_name","agent.active_directory.machine.display_name","agent.active_directory.machine.ou","agent.active_directory.machine.ou.path","agent.active_directory.machine.sam_account_name"]},{"title":"Agent Enum String Fields","type":"string","enum":["agent.os_info.os_type","agent.os_info.os_platform"]},{"title":"Machine UID String Fields","type":"string","enum":["machine.id","machine.group_id","machine.root_group_id","machine.policy_id"]},{"title":"Machine Simple String Fields","type":"string","enum":["protection_status","machine.tags.alias","machine.reboot_required_reason","machine.group_name","machine.policy_name","stats.assets.encryption_status"]},{"title":"Agent IP Fields","type":"string","enum":["agent.nics.ips","agent.machine_ip"]},{"title":"Agent Number Fields","type":"string","enum":["agent.started_at_offset","agent.plugins.asset_manager.reboot_reasons","agent.plugins.endpoint_protection.reboot_reasons","agent.plugins.endpoint_detection_and_response.reboot_reasons","agent.plugins.incident_response.reboot_reasons","agent.plugins.siem.reboot_reasons","agent.os_version_major","agent.os_version_minor"]},{"title":"Machine Number Fields","type":"string","enum":["machine.suspicious_activity_count","machine.infection_count","machine.reboot_required","stats.assets.vulnerabilities_found.total","stats.assets.os_patches_available","stats.assets.vulnerabilities_found.critical","stats.assets.vulnerabilities_found.high","stats.assets.vulnerabilities_found.medium","stats.assets.vulnerabilities_found.low"]},{"title":"Agent Boolean Fields","type":"string","enum":["agent.is_software_update_available","agent.has_alerts"]},{"title":"Machine Boolean Fields","type":"string","enum":["machine.is_deleted","machine.isolated","connected"]},{"title":"Machine Date Fields","type":"string","enum":["machine.deleted_at","machine.last_day_seen","machine.last_scanned_at","machine.created_at","stats.assets.last_scanned_at"]},{"title":"Agent Date Fields","type":"string","enum":["agent.at","agent.started_at_local"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["exists","not_exists"]}}}]},"examples":[[{"field":"host_name","value":"DESKTOP-PHASHA","operator":"equals"}]]},"aggregations":{},"sort_field":{"type":"string","title":"Endpoint sort fields","enum":["agent.at","agent.nics.ips","agent.nics.mac_address","agent.nics.description","agent.os_info.os_type","agent.os_info.os_version","agent.os_info.os_platform","agent.os_info.os_architecture","agent.os_info.os_release_name","agent.host_name","agent.fully_qualified_host_name","agent.plugins.asset_manager.plugin_version","agent.plugins.asset_manager.reboot_reason","agent.plugins.endpoint_protection.plugin_version","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.plugins.endpoint_protection.update_package_version","agent.plugins.endpoint_protection.reboot_reason","agent.plugins.endpoint_detection_and_response.plugin_version","agent.plugins.endpoint_detection_and_response.reboot_reason","agent.plugins.incident_response.plugin_version","agent.plugins.incident_response.reboot_reason","agent.plugins.siem.plugin_version","agent.plugins.siem.reboot_reason","agent.plugins.browser_phishing_protection.plugin_version","agent.engine_version","agent.domain_name","agent.policy_etag","machine.account_id","machine.account.name","machine.group_id","machine.root_group_id","machine.group_name","machine.policy_name","machine.policy_id","machine.deleted_at","machine.created_at","machine.marked_for_deletion","machine.is_deleted","machine.last_day_seen","machine.last_scanned_at","agent.last_user","machine.tags.alias","display_name","name_multi_search","agent.machine_ip","agent.serial_number","agent.object_guid","stats.assets.vulnerabilities_found.critical","stats.assets.vulnerabilities_found.high","stats.assets.vulnerabilities_found.medium","stats.assets.vulnerabilities_found.low","stats.assets.vulnerabilities_found.none","stats.assets.vulnerabilities_found.total","stats.assets.os_patches_available","stats.assets.last_scanned_at","connected","agent.active_directory.user.display_name","agent.active_directory.user.sam_account_name","agent.active_directory.user.ou","agent.active_directory.machine.display_name","agent.active_directory.machine.ou","agent.active_directory.machine.sam_account_name","stats.assets.encryption_status","machine.suspicious_activity_count","machine.infection_count"]}}},{"type":"object","title":"Base Search Schema","properties":{"aggregations":{"type":"array","title":"The fields onto which you can perform aggregations","items":{"type":"string","title":"The Items Schema"}},"page_size":{"type":"number","title":"The page size. If you just need to aggregate, set it to 0","minimum":0,"maximum":2000},"sort_field":{"title":"Sort Fields","type":"string"},"sort_order":{"type":"string","title":"Whether sorting should be ascending or descending","enum":["asc","desc"]},"aggregate_by_account":{"type":"boolean","title":"Indicates whether aggregations should be scoped by account"},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}]},{"type":"object","required":["account_ids"],"properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]}]}},"unregister_isolated":{"type":"boolean","title":"Force delete isolated endpoints"}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"The Delete Endpoints Bulk Body 200 Schema","required":["moved"],"properties":{"moved":{"type":"array","title":"IDs of the deleted endpoint","items":{"type":"string","title":"Endpoint ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}},"errors":{"type":"array","title":"tasks not performed","items":{"type":"object","title":"Endpoint ID","additionalProperties":true,"properties":{"id":{"type":"string","title":"Machine ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"account_id":{"type":"string","title":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"account_ids":{"type":"array","title":"Account IDs","items":{"type":"string","title":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}}}}}}}},"tags":["Grid"],"operationId":"api.rmm.grid.groups.bulk"}},"/oneview/v1/grid/jobs/bulk":{"post":{"description":"Issue jobs to endpoints across accounts","summary":"Issue jobs to endpoints across accounts","simple_schema":"grid-issue-jobs-rmm-simple","security":[{"client_credentials":["execute"]},{"user_permissions":["tasks.manage"]}],"status":{"outage":["auth","search_stateful"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"The Post Isolate Request Body Schema","required":["groups","command","endpoints"],"allOf":[{"type":"object","title":"The Post Isolate Request Body Schema","required":["command"],"properties":{"command":{"type":"string","title":"Command"},"requires_connected":{"type":"boolean","title":"Whether a connection needs to be initiated before issuing this jobs (i.e. active response shell)"},"data":{"type":"object","title":"Data","properties":{"scan_settings":{"type":"object","title":"Scan settings","properties":{"type":{"type":"string","title":"Type","enum":["CustomScan","ThreatScan","HyperScan"]},"remove":{"type":"boolean","title":"Remove"}}},"enable_shuriken":{"type":"boolean","title":"Enable shuriken"},"allow_postpone_reboot":{"type":"boolean","title":"Allow postpone reboot"},"type":{"type":"string","title":"Type"},"scan_path_from_list_file":{"type":"boolean","title":"Scan path from list file"},"scan_path":{"type":"string","title":"Scan path"},"add_scan_paths":{"type":"array","title":"Add scan paths","items":{"type":"string","title":"Add scan paths items"}},"no_archive":{"type":"boolean","title":"No archive"},"ark":{"type":"boolean","title":"Ark"},"remove":{"type":"boolean","title":"Remove"},"no_reboot":{"type":"boolean","title":"No reboot"},"reboot_delay":{"type":"integer","title":"Reboot delay"},"reboot_delay_rrule":{"type":"string","title":"Reboot delay rrule"},"reboot_message":{"type":"string","title":"Reboot message"},"pum_detection":{"type":"string","title":"Pum detection"},"pup_detection":{"type":"string","title":"Pup detection"},"scan_memory":{"type":"boolean","title":"Scan memory"},"scan_registry":{"type":"boolean","title":"Scan registry"},"scan_startup":{"type":"boolean","title":"Scan startup"},"scan_file_system":{"type":"boolean","title":"Scan file system"},"scan_priority":{"type":"string","title":"Scan priority"},"scan_fixed_drives":{"type":"boolean","title":"Scan fixed drives"},"exclusions":{"type":"array","title":"Exclusions","items":{"type":"object","title":"Exclusion items","additionalProperties":true,"properties":{"value":{"type":"string","title":"Value"},"type":{"type":"string","title":"Type"},"exclude_from":{"type":"object","title":"Exclude from","properties":{"exploit_protection":{"type":["boolean","null"],"title":"Exploit protection"},"malware_protection":{"type":["boolean","null"],"title":"Malware protection"},"ransomware_protection":{"type":["boolean","null"],"title":"Ransomware protection"},"suspicious_activity":{"type":["boolean","null"],"title":"Suspicious activity"},"website_protection":{"type":["boolean","null"],"title":"Website protection"}}}}}},"allow_postpone":{"type":["boolean","number"],"title":"Asset Reboot allow postpone"},"delay_in_seconds":{"type":"number","title":"Asset Reboot delay"},"message":{"type":"string","title":"Asset Reboot message"},"reasons":{"type":"number","title":"Asset Reboot reason: 0 RebootStatusClear, 1 RebootStatusDOR, 2 RebootStatusInstall, 3 RebootStatusUpgrade, 4 RebootStatusUnknown"},"restore_items":{"type":"array","title":"Detection IDs to restore from quarantine","items":{"type":"string","title":"Detection ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260653e4fa4f"]}},"delete_items":{"type":"array","title":"Detection IDs to delete from quarantine","items":{"type":"string","title":"Detection ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260653e4fa4f"]}},"application_name":{"type":"string","examples":["Chrome"]},"current_version":{"type":"string","examples":["96.0.4664.45"]},"new_version":{"type":"string","examples":["97.0.2103.01"]},"product":{"type":"number","product":[41]},"vendor":{"type":"string","examples":["Google"]},"architecture":{"type":"string","examples":["x86"]},"language":{"type":"string","examples":["tr-TR"]},"patches":{"type":"array","title":"Options for command.asset.patch","items":{"type":"object","properties":{"category":{"type":"string","examples":["feature_pack"]},"product":{"type":"string","examples":["Silverlight"]},"severity":{"type":"string","examples":["critical"]},"title":{"type":"string","examples":["Microsoft Silverlight (KB4481252)"]},"vendor":{"type":"string","examples":["Microsoft Corporation"]}}}}}},"relay_state":{"type":"string","title":"Relay state"}}},{"type":"object","properties":{"groups":{"type":"array","title":"Machine filters","items":{"type":"object","title":"List of queries to select endpoints","allOf":[{"type":"object","allOf":[{"type":"object","allOf":[{"properties":{"constraints":{"type":"array","items":{"title":"Endpoint Constraints","type":"object","required":["field"],"anyOf":[{"title":"String (Equals, Not Equals) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"title":"Agent Simple String Fields","type":"string","enum":["agent.nics.mac_address","agent.nics.description","agent.os_info.os_version","agent.os_info.os_release_name","agent.os_info.os_architecture","agent.plugins.asset_manager.plugin_version","agent.plugins.asset_manager.alerts.codes","agent.plugins.endpoint_protection.plugin_version","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.plugins.endpoint_protection.update_package_version","agent.plugins.endpoint_protection.alerts.codes","agent.plugins.endpoint_detection_and_response.plugin_version","agent.plugins.endpoint_detection_and_response.alerts.codes","agent.plugins.incident_response.plugin_version","agent.plugins.incident_response.update_package_version","agent.plugins.incident_response.alerts.codes","agent.plugins.siem.plugin_version","agent.plugins.siem.alerts.codes","agent.plugins.browser_phishing_protection.plugin_version","agent.plugins.browser_phishing_protection.alerts.codes","agent.engine_version","agent.source_location.city","agent.source_location.country","agent.source_location.subdivisions","agent.source_location.time_zone","agent.domain_name","agent.alias","agent.policy_etag","agent.serial_number","agent.available_software_updates.sdk_version.currentVersion","agent.available_software_updates.sdk_version.newVersion","agent.alerts.codes","agent.host_name","agent.fully_qualified_host_name","agent.object_guid","agent.last_user","agent.active_directory.user.display_name","agent.active_directory.user.ou","agent.active_directory.user.ou.path","agent.active_directory.user.sam_account_name","agent.active_directory.machine.display_name","agent.active_directory.machine.ou","agent.active_directory.machine.ou.path","agent.active_directory.machine.sam_account_name"]},{"title":"Agent Enum String Fields","type":"string","enum":["agent.os_info.os_type","agent.os_info.os_platform"]},{"title":"Machine UID String Fields","type":"string","enum":["machine.id","machine.group_id","machine.root_group_id","machine.policy_id"]},{"title":"Machine Simple String Fields","type":"string","enum":["protection_status","machine.tags.alias","machine.reboot_required_reason","machine.group_name","machine.policy_name","stats.assets.encryption_status"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["equals","not_equals"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}}},"if":{"properties":{"field":{"title":"Machine UID String Fields","type":"string","enum":["machine.id","machine.group_id","machine.root_group_id","machine.policy_id"]}}},"then":{"properties":{"value":{"type":["string","array"],"format":"uuid","items":{"type":"string","format":"uuid"}}}}},{"title":"String (Contains, Not Contains) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"title":"Machine Simple String Fields","type":"string","enum":["protection_status","machine.tags.alias","machine.reboot_required_reason","machine.group_name","machine.policy_name","stats.assets.encryption_status"]},{"title":"Agent Simple String Fields","type":"string","enum":["agent.nics.mac_address","agent.nics.description","agent.os_info.os_version","agent.os_info.os_release_name","agent.os_info.os_architecture","agent.plugins.asset_manager.plugin_version","agent.plugins.asset_manager.alerts.codes","agent.plugins.endpoint_protection.plugin_version","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.plugins.endpoint_protection.update_package_version","agent.plugins.endpoint_protection.alerts.codes","agent.plugins.endpoint_detection_and_response.plugin_version","agent.plugins.endpoint_detection_and_response.alerts.codes","agent.plugins.incident_response.plugin_version","agent.plugins.incident_response.update_package_version","agent.plugins.incident_response.alerts.codes","agent.plugins.siem.plugin_version","agent.plugins.siem.alerts.codes","agent.plugins.browser_phishing_protection.plugin_version","agent.plugins.browser_phishing_protection.alerts.codes","agent.engine_version","agent.source_location.city","agent.source_location.country","agent.source_location.subdivisions","agent.source_location.time_zone","agent.domain_name","agent.alias","agent.policy_etag","agent.serial_number","agent.available_software_updates.sdk_version.currentVersion","agent.available_software_updates.sdk_version.newVersion","agent.alerts.codes","agent.host_name","agent.fully_qualified_host_name","agent.object_guid","agent.last_user","agent.active_directory.user.display_name","agent.active_directory.user.ou","agent.active_directory.user.ou.path","agent.active_directory.user.sam_account_name","agent.active_directory.machine.display_name","agent.active_directory.machine.ou","agent.active_directory.machine.ou.path","agent.active_directory.machine.sam_account_name"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["contains","not_contains"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}}}},{"title":"Boolean (Equals) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"title":"Agent Boolean Fields","type":"string","enum":["agent.is_software_update_available","agent.has_alerts"]},{"title":"Machine Boolean Fields","type":"string","enum":["machine.is_deleted","machine.isolated","connected"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["equals"]},"value":{"title":"Value to search. Must be true or false","type":"boolean"}}},{"title":"Number Constraints (gt, gte, lt, lte, equals)","properties":{"field":{"type":"string","oneOf":[{"title":"Agent Number Fields","type":"string","enum":["agent.started_at_offset","agent.plugins.asset_manager.reboot_reasons","agent.plugins.endpoint_protection.reboot_reasons","agent.plugins.endpoint_detection_and_response.reboot_reasons","agent.plugins.incident_response.reboot_reasons","agent.plugins.siem.reboot_reasons","agent.os_version_major","agent.os_version_minor"]},{"title":"Machine Number Fields","type":"string","enum":["machine.suspicious_activity_count","machine.infection_count","machine.reboot_required","stats.assets.vulnerabilities_found.total","stats.assets.os_patches_available","stats.assets.vulnerabilities_found.critical","stats.assets.vulnerabilities_found.high","stats.assets.vulnerabilities_found.medium","stats.assets.vulnerabilities_found.low"]}]}},"oneOf":[{"minProperties":1,"title":"Specify Number Range","not":{"anyOf":[{"required":["operator"]},{"required":["value"]}]},"properties":{"gt":{"type":"number","title":"Greater than"},"lt":{"type":"number","title":"Less than"},"gte":{"type":"number","title":"Greater than or equals"},"lte":{"type":"number","title":"Less than or equals"}}},{"title":"Specify Exact Number","not":{"anyOf":[{"required":["gt"]},{"required":["lt"]},{"required":["gte"]},{"required":["lte"]}]},"required":["operator","value"],"properties":{"operator":{"type":"string","enum":["equals"]},"value":{"type":["number","array"],"title":"Value to search","items":{"type":"number"}}}}]},{"title":"Date (start, end) Constraints","properties":{"field":{"oneOf":[{"title":"Agent Date Fields","type":"string","enum":["agent.at","agent.started_at_local"]},{"title":"Machine Date Fields","type":"string","enum":["machine.deleted_at","machine.last_day_seen","machine.last_scanned_at","machine.created_at","stats.assets.last_scanned_at"]}]}},"oneOf":[{"minProperties":1,"title":"Specify Date Range","not":{"anyOf":[{"required":["operator"]},{"required":["value"]}]},"properties":{"start":{"type":"string","format":"date-time","title":"Start Date"},"end":{"type":"string","format":"date-time","title":"End Date"}}},{"title":"Specify Exact Date","not":{"anyOf":[{"required":["start"]},{"required":["end"]}]},"required":["operator","value"],"properties":{"operator":{"type":"string","enum":["equals"]},"value":{"type":["string","array"],"format":"date-time","title":"Value to search","items":{"format":"date-time"}}}}]},{"title":"IP Constraints","properties":{"field":{"oneOf":[{"title":"Agent IP Fields","type":"string","enum":["agent.nics.ips","agent.machine_ip"]}]},"operator":{"type":"string","enum":["ip"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}}}},{"title":"MWB Version Constraints (gt, gte, lt, lte, equals)","required":["operator"],"properties":{"field":{"type":"string","oneOf":[{"title":"Agent MWB Version fields","type":"string","enum":["agent.engine_version"]}]},"operator":{"type":"string","enum":["mwb_version"]}},"oneOf":[{"minProperties":1,"title":"Specify Version Range","not":{"anyOf":[{"required":["value"]}]},"properties":{"gt":{"type":"string","title":"Greater than"},"lt":{"type":"string","title":"Less than"},"gte":{"type":"string","title":"Greater than or equals"},"lte":{"type":"string","title":"Less than or equals"}}},{"title":"Specify Exact Version","not":{"anyOf":[{"required":["gt"]},{"required":["lt"]},{"required":["gte"]},{"required":["lte"]}]},"required":["value"],"properties":{"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}}}}]},{"title":"Field Exists/Not Exists Constraints","required":["operator"],"properties":{"field":{"type":"string","oneOf":[{"title":"Agent Simple String Fields","type":"string","enum":["agent.nics.mac_address","agent.nics.description","agent.os_info.os_version","agent.os_info.os_release_name","agent.os_info.os_architecture","agent.plugins.asset_manager.plugin_version","agent.plugins.asset_manager.alerts.codes","agent.plugins.endpoint_protection.plugin_version","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.plugins.endpoint_protection.update_package_version","agent.plugins.endpoint_protection.alerts.codes","agent.plugins.endpoint_detection_and_response.plugin_version","agent.plugins.endpoint_detection_and_response.alerts.codes","agent.plugins.incident_response.plugin_version","agent.plugins.incident_response.update_package_version","agent.plugins.incident_response.alerts.codes","agent.plugins.siem.plugin_version","agent.plugins.siem.alerts.codes","agent.plugins.browser_phishing_protection.plugin_version","agent.plugins.browser_phishing_protection.alerts.codes","agent.engine_version","agent.source_location.city","agent.source_location.country","agent.source_location.subdivisions","agent.source_location.time_zone","agent.domain_name","agent.alias","agent.policy_etag","agent.serial_number","agent.available_software_updates.sdk_version.currentVersion","agent.available_software_updates.sdk_version.newVersion","agent.alerts.codes","agent.host_name","agent.fully_qualified_host_name","agent.object_guid","agent.last_user","agent.active_directory.user.display_name","agent.active_directory.user.ou","agent.active_directory.user.ou.path","agent.active_directory.user.sam_account_name","agent.active_directory.machine.display_name","agent.active_directory.machine.ou","agent.active_directory.machine.ou.path","agent.active_directory.machine.sam_account_name"]},{"title":"Agent Enum String Fields","type":"string","enum":["agent.os_info.os_type","agent.os_info.os_platform"]},{"title":"Machine UID String Fields","type":"string","enum":["machine.id","machine.group_id","machine.root_group_id","machine.policy_id"]},{"title":"Machine Simple String Fields","type":"string","enum":["protection_status","machine.tags.alias","machine.reboot_required_reason","machine.group_name","machine.policy_name","stats.assets.encryption_status"]},{"title":"Agent IP Fields","type":"string","enum":["agent.nics.ips","agent.machine_ip"]},{"title":"Agent Number Fields","type":"string","enum":["agent.started_at_offset","agent.plugins.asset_manager.reboot_reasons","agent.plugins.endpoint_protection.reboot_reasons","agent.plugins.endpoint_detection_and_response.reboot_reasons","agent.plugins.incident_response.reboot_reasons","agent.plugins.siem.reboot_reasons","agent.os_version_major","agent.os_version_minor"]},{"title":"Machine Number Fields","type":"string","enum":["machine.suspicious_activity_count","machine.infection_count","machine.reboot_required","stats.assets.vulnerabilities_found.total","stats.assets.os_patches_available","stats.assets.vulnerabilities_found.critical","stats.assets.vulnerabilities_found.high","stats.assets.vulnerabilities_found.medium","stats.assets.vulnerabilities_found.low"]},{"title":"Agent Boolean Fields","type":"string","enum":["agent.is_software_update_available","agent.has_alerts"]},{"title":"Machine Boolean Fields","type":"string","enum":["machine.is_deleted","machine.isolated","connected"]},{"title":"Machine Date Fields","type":"string","enum":["machine.deleted_at","machine.last_day_seen","machine.last_scanned_at","machine.created_at","stats.assets.last_scanned_at"]},{"title":"Agent Date Fields","type":"string","enum":["agent.at","agent.started_at_local"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["exists","not_exists"]}}}]},"examples":[[{"field":"host_name","value":"DESKTOP-PHASHA","operator":"equals"}]]},"aggregations":{},"sort_field":{"type":"string","title":"Endpoint sort fields","enum":["agent.at","agent.nics.ips","agent.nics.mac_address","agent.nics.description","agent.os_info.os_type","agent.os_info.os_version","agent.os_info.os_platform","agent.os_info.os_architecture","agent.os_info.os_release_name","agent.host_name","agent.fully_qualified_host_name","agent.plugins.asset_manager.plugin_version","agent.plugins.asset_manager.reboot_reason","agent.plugins.endpoint_protection.plugin_version","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.plugins.endpoint_protection.update_package_version","agent.plugins.endpoint_protection.reboot_reason","agent.plugins.endpoint_detection_and_response.plugin_version","agent.plugins.endpoint_detection_and_response.reboot_reason","agent.plugins.incident_response.plugin_version","agent.plugins.incident_response.reboot_reason","agent.plugins.siem.plugin_version","agent.plugins.siem.reboot_reason","agent.plugins.browser_phishing_protection.plugin_version","agent.engine_version","agent.domain_name","agent.policy_etag","machine.account_id","machine.account.name","machine.group_id","machine.root_group_id","machine.group_name","machine.policy_name","machine.policy_id","machine.deleted_at","machine.created_at","machine.marked_for_deletion","machine.is_deleted","machine.last_day_seen","machine.last_scanned_at","agent.last_user","machine.tags.alias","display_name","name_multi_search","agent.machine_ip","agent.serial_number","agent.object_guid","stats.assets.vulnerabilities_found.critical","stats.assets.vulnerabilities_found.high","stats.assets.vulnerabilities_found.medium","stats.assets.vulnerabilities_found.low","stats.assets.vulnerabilities_found.none","stats.assets.vulnerabilities_found.total","stats.assets.os_patches_available","stats.assets.last_scanned_at","connected","agent.active_directory.user.display_name","agent.active_directory.user.sam_account_name","agent.active_directory.user.ou","agent.active_directory.machine.display_name","agent.active_directory.machine.ou","agent.active_directory.machine.sam_account_name","stats.assets.encryption_status","machine.suspicious_activity_count","machine.infection_count"]}}},{"type":"object","title":"Base Search Schema","properties":{"aggregations":{"type":"array","title":"The fields onto which you can perform aggregations","items":{"type":"string","title":"The Items Schema"}},"page_size":{"type":"number","title":"The page size. If you just need to aggregate, set it to 0","minimum":0,"maximum":2000},"sort_field":{"title":"Sort Fields","type":"string"},"sort_order":{"type":"string","title":"Whether sorting should be ascending or descending","enum":["asc","desc"]},"aggregate_by_account":{"type":"boolean","title":"Indicates whether aggregations should be scoped by account"},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}]},{"type":"object","required":["account_ids"],"properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]}]}},"endpoints":{"type":"array","title":"Machine IDs","items":{"type":"object","title":"Machine IDs items","required":["id","account_id"],"properties":{"id":{"type":"string","title":"Endpoint ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"account_id":{"type":"string","title":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}}}]}}}},"responses":{"201":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Create job response","required":["jobs","total_count"],"properties":{"jobs":{"type":"array","title":"List of jobs","items":{"type":"object","title":"Job items","required":["machine_id","job_id"],"properties":{"machine_id":{"type":"string","title":"The ID of the endpoint onto which the job was issued (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"job_id":{"type":"string","title":"The ID of the job. You can use this ID to retrieve additional informations about the job and track its progress, as well as use it as a reference to handle webhooks notifications (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}},"errors":{"type":"array","title":"tasks not performed","items":{"type":"object","title":"Endpoint ID","additionalProperties":true,"properties":{"id":{"type":"string","title":"Machine ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"account_id":{"type":"string","title":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"account_ids":{"type":"array","title":"Account IDs","items":{"type":"string","title":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}},"total_count":{"type":"integer","title":"The total number of issued jobs"},"correlation_id":{"type":"string","title":"Correlation ID of the job (Parent job ID). Could be used to find related child jobs.","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}}}},"tags":["Grid"],"operationId":"api.rmm.grid.jobs.bulk"}},"/oneview/v1/grid/os-patches/export":{"post":{"description":"Export OS Patches across accounts","summary":"Export OS Patches","simple_schema":"os-patch-export-grid-rmm-simple","security":[{"client_credentials":["execute"]},{"user_permissions":["patchManagement.view"]}],"status":{"outage":["auth","search_stateless"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"title":"OS Patches Export Schema","type":"object","allOf":[{"type":"object","title":"Base Export Schema","required":["groups","select","format"],"properties":{"format":{"type":"string","title":"The output file","enum":["csv","xlsx","html","ods","txt","rtf","json"]},"download":{"type":"boolean","title":"Whether to instruct the client to download the response as a file. Only clients like browsers are supported"},"type":{"type":"string","title":"The encoding of the output","enum":["string","base64","binary"],"default":"string"},"select":{"type":"array","title":"Which fields to select from the response","items":{"type":"object","title":"Field","required":["field","newField"],"properties":{"newField":{"type":"string","title":"the new value"},"field":{"type":"string","title":"The response field to map to a new value"}}}},"groups":{"type":"array","title":"List of queries","items":{"type":"object"}}}},{"properties":{"select":{"items":{"properties":{"field":{"type":"string","title":"OS Patch select fields","anyOf":[{"enum":["machine_id","group_id","root_group_id","object_guid","fully_qualified_host_name","display_name","vendor","product","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","severity","title","description","category","security_update_id","patch_id","kb_id","created_at","released_at","reboot_required","preview_patch","size","group.name","group.policy_id","group.policy_name","endpoint.last_day_seen","endpoint.last_user","endpoint.online","domain_name","host_name","alias","ignored_until"]},{"type":"string","title":"Active Directory Select Fields","enum":["active_directory.user.display_name","active_directory.user.distinguished_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.machine.display_name","active_directory.machine.distinguished_name","active_directory.machine.sam_account_name","active_directory.machine.ou"]}]}}}},"groups":{"items":{"title":"List of queries to fetch dns activity","allOf":[{"type":"object","allOf":[{"type":"object","allOf":[{"properties":{"constraints":{"type":"array","items":{"title":"OS Patch Constraints","type":"object","required":["field"],"anyOf":[{"title":"String (Equals, Not Equals) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"title":"Os Patch Simple String Fields","type":"string","anyOf":[{"enum":["account_name","group_name","host_name","fully_qualified_host_name","os_info.os_version","os_info.os_release_name","domain_name","alias","display_name","vendor","product","severity","title","description","category","kb_id"]},{"title":"Active Directory Simple String Fields","type":"string","enum":["active_directory.user.display_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.user.ou.path","active_directory.machine.display_name","active_directory.machine.sam_account_name","active_directory.machine.ou","active_directory.machine.ou.path"]}]},{"title":"Os Patch UID Fields","type":"string","enum":["account_id","parent_account_id","machine_id","group_id","root_group_id","object_guid","security_update_id","patch_id"]},{"title":"Os Patch Enum String Fields","type":"string","enum":["os_info.os_type","os_info.os_platform","os_info.os_architecture"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["equals","not_equals"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}}},"if":{"properties":{"field":{"title":"Os Patch UID Fields","type":"string","enum":["account_id","parent_account_id","machine_id","group_id","root_group_id","object_guid","security_update_id","patch_id"]}}},"then":{"properties":{"value":{"type":["string","array"],"format":"uuid","items":{"type":"string","format":"uuid"}}}}},{"title":"String (Contains, Not Contains) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"title":"Os Patch Simple String Fields","type":"string","anyOf":[{"enum":["account_name","group_name","host_name","fully_qualified_host_name","os_info.os_version","os_info.os_release_name","domain_name","alias","display_name","vendor","product","severity","title","description","category","kb_id"]},{"title":"Active Directory Simple String Fields","type":"string","enum":["active_directory.user.display_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.user.ou.path","active_directory.machine.display_name","active_directory.machine.sam_account_name","active_directory.machine.ou","active_directory.machine.ou.path"]}]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["contains","not_contains"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}}}},{"title":"Boolean (Equals) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"type":"string","title":"OS Patch Boolean Fields","enum":["reboot_required","preview_patch"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["equals"]},"value":{"title":"Value to search. Must be true or false","type":"boolean"}}},{"title":"Number Constraints (gt, gte, lt, lte, equals)","properties":{"field":{"type":"string","oneOf":[{"title":"Os Patch Number Fields","type":"string","enum":["size"]}]}},"oneOf":[{"minProperties":1,"title":"Specify Number Range","not":{"anyOf":[{"required":["operator"]},{"required":["value"]}]},"properties":{"gt":{"type":"number","title":"Greater than"},"lt":{"type":"number","title":"Less than"},"gte":{"type":"number","title":"Greater than or equals"},"lte":{"type":"number","title":"Less than or equals"}}},{"title":"Specify Exact Number","not":{"anyOf":[{"required":["gt"]},{"required":["lt"]},{"required":["gte"]},{"required":["lte"]}]},"required":["operator","value"],"properties":{"operator":{"type":"string","enum":["equals"]},"value":{"type":["number","array"],"title":"Value to search","items":{"type":"number"}}}}]},{"title":"Date (start, end) Constraints","properties":{"field":{"oneOf":[{"title":"Os Patch Date Fields","type":"string","enum":["created_at","released_at","ignored_until"]}]}},"oneOf":[{"minProperties":1,"title":"Specify Date Range","not":{"anyOf":[{"required":["operator"]},{"required":["value"]}]},"properties":{"start":{"type":"string","format":"date-time","title":"Start Date"},"end":{"type":"string","format":"date-time","title":"End Date"}}},{"title":"Specify Exact Date","not":{"anyOf":[{"required":["start"]},{"required":["end"]}]},"required":["operator","value"],"properties":{"operator":{"type":"string","enum":["equals"]},"value":{"type":["string","array"],"format":"date-time","title":"Value to search","items":{"format":"date-time"}}}}]},{"title":"Field Exists/Not Exists Constraints","required":["operator"],"properties":{"field":{"type":"string","oneOf":[{"title":"Os Patch Simple String Fields","type":"string","anyOf":[{"enum":["account_name","group_name","host_name","fully_qualified_host_name","os_info.os_version","os_info.os_release_name","domain_name","alias","display_name","vendor","product","severity","title","description","category","kb_id"]},{"title":"Active Directory Simple String Fields","type":"string","enum":["active_directory.user.display_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.user.ou.path","active_directory.machine.display_name","active_directory.machine.sam_account_name","active_directory.machine.ou","active_directory.machine.ou.path"]}]},{"title":"Os Patch UID Fields","type":"string","enum":["account_id","parent_account_id","machine_id","group_id","root_group_id","object_guid","security_update_id","patch_id"]},{"title":"Os Patch Enum String Fields","type":"string","enum":["os_info.os_type","os_info.os_platform","os_info.os_architecture"]},{"title":"Os Patch Date Fields","type":"string","enum":["created_at","released_at","ignored_until"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["exists","not_exists"]}}}]},"examples":[[{"field":"account_name","value":"Test Account","operator":"equals"}]]},"aggregations":{"items":{"type":"string","title":"OS Patch aggregation fields","enum":["machine_id","group_id","root_group_id","object_guid","host_name","fully_qualified_host_name","display_name","vendor","product","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","severity","title","description","category","security_update_id","patch_id","kb_id","created_at","released_at","reboot_required","preview_patch","size"]}},"sort_field":{"type":"string","title":"OS Patch sort fields","anyOf":[{"enum":["machine_id","group_id","root_group_id","object_guid","host_name","fully_qualified_host_name","display_name","vendor","product","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","severity","title","description","category","security_update_id","patch_id","kb_id","created_at","released_at","reboot_required","preview_patch","size","ignored_until"]},{"type":"string","title":"Active Directory Sort Fields","enum":["active_directory.user.display_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.machine.display_name","active_directory.machine.sam_account_name","active_directory.machine.ou"]}]}}},{"type":"object","title":"Base Search Schema","properties":{"aggregations":{"type":"array","title":"The fields onto which you can perform aggregations","items":{"type":"string","title":"The Items Schema"}},"page_size":{"type":"number","title":"The page size. If you just need to aggregate, set it to 0","minimum":0,"maximum":2000},"sort_field":{"title":"Sort Fields","type":"string"},"sort_order":{"type":"string","title":"Whether sorting should be ascending or descending","enum":["asc","desc"]},"aggregate_by_account":{"type":"boolean","title":"Indicates whether aggregations should be scoped by account"},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}]},{"type":"object","required":["account_ids"],"properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]}]}}}}]}}}},"responses":{"200":{"description":"Successful response"}},"tags":["Grid"],"operationId":"api.rmm.grid.export.os_patches"}},"/oneview/v1/grid/os-patches/export/async":{"post":{"description":"Export OS Patches across accounts","summary":"Export OS Patches asynchronously","simple_schema":"os-patch-export-grid-rmm-simple","security":[{"client_credentials":["execute"]},{"user_permissions":["patchManagement.view"]}],"status":{"outage":["auth","search_stateless"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"title":"OS Patches Export Schema","type":"object","allOf":[{"type":"object","title":"Base Export Schema","required":["groups","select","format"],"properties":{"format":{"type":"string","title":"The output file","enum":["csv","xlsx","html","ods","txt","rtf","json"]},"download":{"type":"boolean","title":"Whether to instruct the client to download the response as a file. Only clients like browsers are supported"},"type":{"type":"string","title":"The encoding of the output","enum":["string","base64","binary"],"default":"string"},"select":{"type":"array","title":"Which fields to select from the response","items":{"type":"object","title":"Field","required":["field","newField"],"properties":{"newField":{"type":"string","title":"the new value"},"field":{"type":"string","title":"The response field to map to a new value"}}}},"groups":{"type":"array","title":"List of queries","items":{"type":"object"}}}},{"properties":{"select":{"items":{"properties":{"field":{"type":"string","title":"OS Patch select fields","anyOf":[{"enum":["machine_id","group_id","root_group_id","object_guid","fully_qualified_host_name","display_name","vendor","product","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","severity","title","description","category","security_update_id","patch_id","kb_id","created_at","released_at","reboot_required","preview_patch","size","group.name","group.policy_id","group.policy_name","endpoint.last_day_seen","endpoint.last_user","endpoint.online","domain_name","host_name","alias","ignored_until"]},{"type":"string","title":"Active Directory Select Fields","enum":["active_directory.user.display_name","active_directory.user.distinguished_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.machine.display_name","active_directory.machine.distinguished_name","active_directory.machine.sam_account_name","active_directory.machine.ou"]}]}}}},"groups":{"items":{"title":"List of queries to fetch dns activity","allOf":[{"type":"object","allOf":[{"type":"object","allOf":[{"properties":{"constraints":{"type":"array","items":{"title":"OS Patch Constraints","type":"object","required":["field"],"anyOf":[{"title":"String (Equals, Not Equals) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"title":"Os Patch Simple String Fields","type":"string","anyOf":[{"enum":["account_name","group_name","host_name","fully_qualified_host_name","os_info.os_version","os_info.os_release_name","domain_name","alias","display_name","vendor","product","severity","title","description","category","kb_id"]},{"title":"Active Directory Simple String Fields","type":"string","enum":["active_directory.user.display_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.user.ou.path","active_directory.machine.display_name","active_directory.machine.sam_account_name","active_directory.machine.ou","active_directory.machine.ou.path"]}]},{"title":"Os Patch UID Fields","type":"string","enum":["account_id","parent_account_id","machine_id","group_id","root_group_id","object_guid","security_update_id","patch_id"]},{"title":"Os Patch Enum String Fields","type":"string","enum":["os_info.os_type","os_info.os_platform","os_info.os_architecture"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["equals","not_equals"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}}},"if":{"properties":{"field":{"title":"Os Patch UID Fields","type":"string","enum":["account_id","parent_account_id","machine_id","group_id","root_group_id","object_guid","security_update_id","patch_id"]}}},"then":{"properties":{"value":{"type":["string","array"],"format":"uuid","items":{"type":"string","format":"uuid"}}}}},{"title":"String (Contains, Not Contains) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"title":"Os Patch Simple String Fields","type":"string","anyOf":[{"enum":["account_name","group_name","host_name","fully_qualified_host_name","os_info.os_version","os_info.os_release_name","domain_name","alias","display_name","vendor","product","severity","title","description","category","kb_id"]},{"title":"Active Directory Simple String Fields","type":"string","enum":["active_directory.user.display_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.user.ou.path","active_directory.machine.display_name","active_directory.machine.sam_account_name","active_directory.machine.ou","active_directory.machine.ou.path"]}]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["contains","not_contains"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}}}},{"title":"Boolean (Equals) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"type":"string","title":"OS Patch Boolean Fields","enum":["reboot_required","preview_patch"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["equals"]},"value":{"title":"Value to search. Must be true or false","type":"boolean"}}},{"title":"Number Constraints (gt, gte, lt, lte, equals)","properties":{"field":{"type":"string","oneOf":[{"title":"Os Patch Number Fields","type":"string","enum":["size"]}]}},"oneOf":[{"minProperties":1,"title":"Specify Number Range","not":{"anyOf":[{"required":["operator"]},{"required":["value"]}]},"properties":{"gt":{"type":"number","title":"Greater than"},"lt":{"type":"number","title":"Less than"},"gte":{"type":"number","title":"Greater than or equals"},"lte":{"type":"number","title":"Less than or equals"}}},{"title":"Specify Exact Number","not":{"anyOf":[{"required":["gt"]},{"required":["lt"]},{"required":["gte"]},{"required":["lte"]}]},"required":["operator","value"],"properties":{"operator":{"type":"string","enum":["equals"]},"value":{"type":["number","array"],"title":"Value to search","items":{"type":"number"}}}}]},{"title":"Date (start, end) Constraints","properties":{"field":{"oneOf":[{"title":"Os Patch Date Fields","type":"string","enum":["created_at","released_at","ignored_until"]}]}},"oneOf":[{"minProperties":1,"title":"Specify Date Range","not":{"anyOf":[{"required":["operator"]},{"required":["value"]}]},"properties":{"start":{"type":"string","format":"date-time","title":"Start Date"},"end":{"type":"string","format":"date-time","title":"End Date"}}},{"title":"Specify Exact Date","not":{"anyOf":[{"required":["start"]},{"required":["end"]}]},"required":["operator","value"],"properties":{"operator":{"type":"string","enum":["equals"]},"value":{"type":["string","array"],"format":"date-time","title":"Value to search","items":{"format":"date-time"}}}}]},{"title":"Field Exists/Not Exists Constraints","required":["operator"],"properties":{"field":{"type":"string","oneOf":[{"title":"Os Patch Simple String Fields","type":"string","anyOf":[{"enum":["account_name","group_name","host_name","fully_qualified_host_name","os_info.os_version","os_info.os_release_name","domain_name","alias","display_name","vendor","product","severity","title","description","category","kb_id"]},{"title":"Active Directory Simple String Fields","type":"string","enum":["active_directory.user.display_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.user.ou.path","active_directory.machine.display_name","active_directory.machine.sam_account_name","active_directory.machine.ou","active_directory.machine.ou.path"]}]},{"title":"Os Patch UID Fields","type":"string","enum":["account_id","parent_account_id","machine_id","group_id","root_group_id","object_guid","security_update_id","patch_id"]},{"title":"Os Patch Enum String Fields","type":"string","enum":["os_info.os_type","os_info.os_platform","os_info.os_architecture"]},{"title":"Os Patch Date Fields","type":"string","enum":["created_at","released_at","ignored_until"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["exists","not_exists"]}}}]},"examples":[[{"field":"account_name","value":"Test Account","operator":"equals"}]]},"aggregations":{"items":{"type":"string","title":"OS Patch aggregation fields","enum":["machine_id","group_id","root_group_id","object_guid","host_name","fully_qualified_host_name","display_name","vendor","product","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","severity","title","description","category","security_update_id","patch_id","kb_id","created_at","released_at","reboot_required","preview_patch","size"]}},"sort_field":{"type":"string","title":"OS Patch sort fields","anyOf":[{"enum":["machine_id","group_id","root_group_id","object_guid","host_name","fully_qualified_host_name","display_name","vendor","product","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","severity","title","description","category","security_update_id","patch_id","kb_id","created_at","released_at","reboot_required","preview_patch","size","ignored_until"]},{"type":"string","title":"Active Directory Sort Fields","enum":["active_directory.user.display_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.machine.display_name","active_directory.machine.sam_account_name","active_directory.machine.ou"]}]}}},{"type":"object","title":"Base Search Schema","properties":{"aggregations":{"type":"array","title":"The fields onto which you can perform aggregations","items":{"type":"string","title":"The Items Schema"}},"page_size":{"type":"number","title":"The page size. If you just need to aggregate, set it to 0","minimum":0,"maximum":2000},"sort_field":{"title":"Sort Fields","type":"string"},"sort_order":{"type":"string","title":"Whether sorting should be ascending or descending","enum":["asc","desc"]},"aggregate_by_account":{"type":"boolean","title":"Indicates whether aggregations should be scoped by account"},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}]},{"type":"object","required":["account_ids"],"properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]}]}}}}]}}}},"responses":{"200":{"description":"Successful response"}},"tags":["Grid"],"operationId":"api.rmm.grid.export.os_patches.async"}},"/oneview/v1/grid/os-patches/search":{"post":{"description":"Search OS Patches across accounts","summary":"Search OS Patches","simple_schema":"os-patch-search-grid-rmm-simple","security":[{"client_credentials":["read"]},{"user_permissions":["patchManagement.view"]}],"status":{"outage":["auth","search_stateless"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","allOf":[{"type":"object","allOf":[{"properties":{"constraints":{"type":"array","items":{"title":"OS Patch Constraints","type":"object","required":["field"],"anyOf":[{"title":"String (Equals, Not Equals) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"title":"Os Patch Simple String Fields","type":"string","anyOf":[{"enum":["account_name","group_name","host_name","fully_qualified_host_name","os_info.os_version","os_info.os_release_name","domain_name","alias","display_name","vendor","product","severity","title","description","category","kb_id"]},{"title":"Active Directory Simple String Fields","type":"string","enum":["active_directory.user.display_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.user.ou.path","active_directory.machine.display_name","active_directory.machine.sam_account_name","active_directory.machine.ou","active_directory.machine.ou.path"]}]},{"title":"Os Patch UID Fields","type":"string","enum":["account_id","parent_account_id","machine_id","group_id","root_group_id","object_guid","security_update_id","patch_id"]},{"title":"Os Patch Enum String Fields","type":"string","enum":["os_info.os_type","os_info.os_platform","os_info.os_architecture"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["equals","not_equals"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}}},"if":{"properties":{"field":{"title":"Os Patch UID Fields","type":"string","enum":["account_id","parent_account_id","machine_id","group_id","root_group_id","object_guid","security_update_id","patch_id"]}}},"then":{"properties":{"value":{"type":["string","array"],"format":"uuid","items":{"type":"string","format":"uuid"}}}}},{"title":"String (Contains, Not Contains) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"title":"Os Patch Simple String Fields","type":"string","anyOf":[{"enum":["account_name","group_name","host_name","fully_qualified_host_name","os_info.os_version","os_info.os_release_name","domain_name","alias","display_name","vendor","product","severity","title","description","category","kb_id"]},{"title":"Active Directory Simple String Fields","type":"string","enum":["active_directory.user.display_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.user.ou.path","active_directory.machine.display_name","active_directory.machine.sam_account_name","active_directory.machine.ou","active_directory.machine.ou.path"]}]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["contains","not_contains"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}}}},{"title":"Boolean (Equals) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"type":"string","title":"OS Patch Boolean Fields","enum":["reboot_required","preview_patch"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["equals"]},"value":{"title":"Value to search. Must be true or false","type":"boolean"}}},{"title":"Number Constraints (gt, gte, lt, lte, equals)","properties":{"field":{"type":"string","oneOf":[{"title":"Os Patch Number Fields","type":"string","enum":["size"]}]}},"oneOf":[{"minProperties":1,"title":"Specify Number Range","not":{"anyOf":[{"required":["operator"]},{"required":["value"]}]},"properties":{"gt":{"type":"number","title":"Greater than"},"lt":{"type":"number","title":"Less than"},"gte":{"type":"number","title":"Greater than or equals"},"lte":{"type":"number","title":"Less than or equals"}}},{"title":"Specify Exact Number","not":{"anyOf":[{"required":["gt"]},{"required":["lt"]},{"required":["gte"]},{"required":["lte"]}]},"required":["operator","value"],"properties":{"operator":{"type":"string","enum":["equals"]},"value":{"type":["number","array"],"title":"Value to search","items":{"type":"number"}}}}]},{"title":"Date (start, end) Constraints","properties":{"field":{"oneOf":[{"title":"Os Patch Date Fields","type":"string","enum":["created_at","released_at","ignored_until"]}]}},"oneOf":[{"minProperties":1,"title":"Specify Date Range","not":{"anyOf":[{"required":["operator"]},{"required":["value"]}]},"properties":{"start":{"type":"string","format":"date-time","title":"Start Date"},"end":{"type":"string","format":"date-time","title":"End Date"}}},{"title":"Specify Exact Date","not":{"anyOf":[{"required":["start"]},{"required":["end"]}]},"required":["operator","value"],"properties":{"operator":{"type":"string","enum":["equals"]},"value":{"type":["string","array"],"format":"date-time","title":"Value to search","items":{"format":"date-time"}}}}]},{"title":"Field Exists/Not Exists Constraints","required":["operator"],"properties":{"field":{"type":"string","oneOf":[{"title":"Os Patch Simple String Fields","type":"string","anyOf":[{"enum":["account_name","group_name","host_name","fully_qualified_host_name","os_info.os_version","os_info.os_release_name","domain_name","alias","display_name","vendor","product","severity","title","description","category","kb_id"]},{"title":"Active Directory Simple String Fields","type":"string","enum":["active_directory.user.display_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.user.ou.path","active_directory.machine.display_name","active_directory.machine.sam_account_name","active_directory.machine.ou","active_directory.machine.ou.path"]}]},{"title":"Os Patch UID Fields","type":"string","enum":["account_id","parent_account_id","machine_id","group_id","root_group_id","object_guid","security_update_id","patch_id"]},{"title":"Os Patch Enum String Fields","type":"string","enum":["os_info.os_type","os_info.os_platform","os_info.os_architecture"]},{"title":"Os Patch Date Fields","type":"string","enum":["created_at","released_at","ignored_until"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["exists","not_exists"]}}}]},"examples":[[{"field":"account_name","value":"Test Account","operator":"equals"}]]},"aggregations":{"items":{"type":"string","title":"OS Patch aggregation fields","enum":["machine_id","group_id","root_group_id","object_guid","host_name","fully_qualified_host_name","display_name","vendor","product","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","severity","title","description","category","security_update_id","patch_id","kb_id","created_at","released_at","reboot_required","preview_patch","size"]}},"sort_field":{"type":"string","title":"OS Patch sort fields","anyOf":[{"enum":["machine_id","group_id","root_group_id","object_guid","host_name","fully_qualified_host_name","display_name","vendor","product","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","severity","title","description","category","security_update_id","patch_id","kb_id","created_at","released_at","reboot_required","preview_patch","size","ignored_until"]},{"type":"string","title":"Active Directory Sort Fields","enum":["active_directory.user.display_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.machine.display_name","active_directory.machine.sam_account_name","active_directory.machine.ou"]}]}}},{"type":"object","title":"Base Search Schema","properties":{"aggregations":{"type":"array","title":"The fields onto which you can perform aggregations","items":{"type":"string","title":"The Items Schema"}},"page_size":{"type":"number","title":"The page size. If you just need to aggregate, set it to 0","minimum":0,"maximum":2000},"sort_field":{"title":"Sort Fields","type":"string"},"sort_order":{"type":"string","title":"Whether sorting should be ascending or descending","enum":["asc","desc"]},"aggregate_by_account":{"type":"boolean","title":"Indicates whether aggregations should be scoped by account"},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}]},{"type":"object","required":["account_ids"],"properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Search OS Patches result","properties":{"results":{"type":"array","items":{"properties":{"account_id":{"type":"string"},"parent_account_id":{"type":"string"},"group_id":{"type":"string"},"root_group_id":{"type":"string"},"group_name":{"type":"string"},"machine_id":{"type":"string"},"vendor":{"type":"string"},"product":{"type":"string"},"host_name":{"type":"string"},"fully_qualified_host_name":{"type":"string"},"display_name":{"type":"string"},"domain_name":{"type":"string"},"created_at":{"type":"string"},"object_guid":{"type":"string"},"title":{"type":"string"},"description":{"type":"string"},"severity":{"type":"string"},"category":{"type":"string"},"security_update_id":{"type":"string"},"patch_id":{"type":"string"},"released_at":{"type":"string"},"size":{"type":"number"},"reboot_required":{"type":"boolean"},"preview_patch":{"type":"boolean"},"os_info":{"properties":{"os_type":{"type":"string"},"os_version":{"type":"string"},"os_platform":{"type":"string"},"os_architecture":{"type":"string"},"os_release_name":{"type":"string"}}},"endpoint":{"properties":{"last_user":{"type":"string"},"last_day_seen":{"type":"string","examples":["2020-06-01T09:52:10.579Z"]}}},"group":{"properties":{"name":{"type":"string"},"policy_id":{"type":"string"},"policy_name":{"type":"string"}}},"ignored_until":{"type":"string","format":"date-time"},"ignore_rule_ids":{"type":"array","items":{"type":"string","format":"uuid"}},"active_directory":{"type":"object","patternProperties":{"^(user|machine)$":{"type":"object","properties":{"display_name":{"type":"string"},"distinguished_name":{"type":"string"},"sam_account_name":{"type":"string"},"ou":{"type":"string"}}}}}}}},"aggregations":{"type":"object","title":"Aggregations","additionalProperties":true},"total_count":{"type":"integer","title":"Total count of found detections"},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}},"required":["results","total_count"]}}}}},"tags":["Grid"],"operationId":"api.rmm.grid.search.os_patches"}},"/oneview/v1/grid/os-patches/search-groupby":{"post":{"description":"Search grouped OS Patches across accounts","summary":"Search grouped OS Patches","simple_schema":"os-patch-search-groupby-grid-rmm-simple","security":[{"client_credentials":["read"]},{"user_permissions":["patchManagement.view"]}],"status":{"incident":["read_nebula_data"],"outage":["auth","search_stateful"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"title":"OS Patch Search Groupby Schema","type":"object","allOf":[{"type":"object","required":["group_by","page_size"],"properties":{"group_by":{"title":"Group by the following fields","type":"array","minItems":1,"uniqueItems":true,"items":{"type":"string"}},"page_size":{"type":"number","title":"The page_size Schema","minimum":50,"maximum":2000}}},{"type":"object","allOf":[{"type":"object","allOf":[{"properties":{"constraints":{"type":"array","items":{"title":"OS Patch Constraints","type":"object","required":["field"],"anyOf":[{"title":"String (Equals, Not Equals) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"title":"Os Patch Simple String Fields","type":"string","anyOf":[{"enum":["account_name","group_name","host_name","fully_qualified_host_name","os_info.os_version","os_info.os_release_name","domain_name","alias","display_name","vendor","product","severity","title","description","category","kb_id"]},{"title":"Active Directory Simple String Fields","type":"string","enum":["active_directory.user.display_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.user.ou.path","active_directory.machine.display_name","active_directory.machine.sam_account_name","active_directory.machine.ou","active_directory.machine.ou.path"]}]},{"title":"Os Patch UID Fields","type":"string","enum":["account_id","parent_account_id","machine_id","group_id","root_group_id","object_guid","security_update_id","patch_id"]},{"title":"Os Patch Enum String Fields","type":"string","enum":["os_info.os_type","os_info.os_platform","os_info.os_architecture"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["equals","not_equals"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}}},"if":{"properties":{"field":{"title":"Os Patch UID Fields","type":"string","enum":["account_id","parent_account_id","machine_id","group_id","root_group_id","object_guid","security_update_id","patch_id"]}}},"then":{"properties":{"value":{"type":["string","array"],"format":"uuid","items":{"type":"string","format":"uuid"}}}}},{"title":"String (Contains, Not Contains) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"title":"Os Patch Simple String Fields","type":"string","anyOf":[{"enum":["account_name","group_name","host_name","fully_qualified_host_name","os_info.os_version","os_info.os_release_name","domain_name","alias","display_name","vendor","product","severity","title","description","category","kb_id"]},{"title":"Active Directory Simple String Fields","type":"string","enum":["active_directory.user.display_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.user.ou.path","active_directory.machine.display_name","active_directory.machine.sam_account_name","active_directory.machine.ou","active_directory.machine.ou.path"]}]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["contains","not_contains"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}}}},{"title":"Boolean (Equals) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"type":"string","title":"OS Patch Boolean Fields","enum":["reboot_required","preview_patch"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["equals"]},"value":{"title":"Value to search. Must be true or false","type":"boolean"}}},{"title":"Number Constraints (gt, gte, lt, lte, equals)","properties":{"field":{"type":"string","oneOf":[{"title":"Os Patch Number Fields","type":"string","enum":["size"]}]}},"oneOf":[{"minProperties":1,"title":"Specify Number Range","not":{"anyOf":[{"required":["operator"]},{"required":["value"]}]},"properties":{"gt":{"type":"number","title":"Greater than"},"lt":{"type":"number","title":"Less than"},"gte":{"type":"number","title":"Greater than or equals"},"lte":{"type":"number","title":"Less than or equals"}}},{"title":"Specify Exact Number","not":{"anyOf":[{"required":["gt"]},{"required":["lt"]},{"required":["gte"]},{"required":["lte"]}]},"required":["operator","value"],"properties":{"operator":{"type":"string","enum":["equals"]},"value":{"type":["number","array"],"title":"Value to search","items":{"type":"number"}}}}]},{"title":"Date (start, end) Constraints","properties":{"field":{"oneOf":[{"title":"Os Patch Date Fields","type":"string","enum":["created_at","released_at","ignored_until"]}]}},"oneOf":[{"minProperties":1,"title":"Specify Date Range","not":{"anyOf":[{"required":["operator"]},{"required":["value"]}]},"properties":{"start":{"type":"string","format":"date-time","title":"Start Date"},"end":{"type":"string","format":"date-time","title":"End Date"}}},{"title":"Specify Exact Date","not":{"anyOf":[{"required":["start"]},{"required":["end"]}]},"required":["operator","value"],"properties":{"operator":{"type":"string","enum":["equals"]},"value":{"type":["string","array"],"format":"date-time","title":"Value to search","items":{"format":"date-time"}}}}]},{"title":"Field Exists/Not Exists Constraints","required":["operator"],"properties":{"field":{"type":"string","oneOf":[{"title":"Os Patch Simple String Fields","type":"string","anyOf":[{"enum":["account_name","group_name","host_name","fully_qualified_host_name","os_info.os_version","os_info.os_release_name","domain_name","alias","display_name","vendor","product","severity","title","description","category","kb_id"]},{"title":"Active Directory Simple String Fields","type":"string","enum":["active_directory.user.display_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.user.ou.path","active_directory.machine.display_name","active_directory.machine.sam_account_name","active_directory.machine.ou","active_directory.machine.ou.path"]}]},{"title":"Os Patch UID Fields","type":"string","enum":["account_id","parent_account_id","machine_id","group_id","root_group_id","object_guid","security_update_id","patch_id"]},{"title":"Os Patch Enum String Fields","type":"string","enum":["os_info.os_type","os_info.os_platform","os_info.os_architecture"]},{"title":"Os Patch Date Fields","type":"string","enum":["created_at","released_at","ignored_until"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["exists","not_exists"]}}}]},"examples":[[{"field":"account_name","value":"Test Account","operator":"equals"}]]},"aggregations":{"items":{"type":"string","title":"OS Patch aggregation fields","enum":["machine_id","group_id","root_group_id","object_guid","host_name","fully_qualified_host_name","display_name","vendor","product","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","severity","title","description","category","security_update_id","patch_id","kb_id","created_at","released_at","reboot_required","preview_patch","size"]}},"sort_field":{"type":"string","title":"OS Patch sort fields","anyOf":[{"enum":["machine_id","group_id","root_group_id","object_guid","host_name","fully_qualified_host_name","display_name","vendor","product","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","severity","title","description","category","security_update_id","patch_id","kb_id","created_at","released_at","reboot_required","preview_patch","size","ignored_until"]},{"type":"string","title":"Active Directory Sort Fields","enum":["active_directory.user.display_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.machine.display_name","active_directory.machine.sam_account_name","active_directory.machine.ou"]}]}}},{"type":"object","title":"Base Search Schema","properties":{"aggregations":{"type":"array","title":"The fields onto which you can perform aggregations","items":{"type":"string","title":"The Items Schema"}},"page_size":{"type":"number","title":"The page size. If you just need to aggregate, set it to 0","minimum":0,"maximum":2000},"sort_field":{"title":"Sort Fields","type":"string"},"sort_order":{"type":"string","title":"Whether sorting should be ascending or descending","enum":["asc","desc"]},"aggregate_by_account":{"type":"boolean","title":"Indicates whether aggregations should be scoped by account"},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}]},{"type":"object","required":["account_ids"],"properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]},{"properties":{"group_by":{"type":"array","title":"Group results by indicated field(s)","items":{"type":"string","title":"OS Patch Groupby Fields","anyOf":[{"enum":["account_id","account_name","parent_account_id","machine_id","group_id","root_group_id","object_guid","host_name","fully_qualified_host_name","display_name","vendor","product","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","severity","title","description","category","security_update_id","patch_id","kb_id","created_at","released_at","reboot_required","preview_patch","size","domain_name"]},{"type":"string","title":"Active Directory Group By Fields","enum":["active_directory.user.display_name","active_directory.user.ou","active_directory.machine.display_name","active_directory.machine.ou"]}]}}}}]}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"The Post OS Patches Search GroupBy Response Schema","required":["results","next_cursor"],"properties":{"results":{"type":"array","title":"The Results Schema","default":[]},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}}}}},"tags":["Grid"],"operationId":"api.rmm.grid.search.os_patches.group"}},"/oneview/v1/grid/rid/export":{"post":{"description":"Export RID rules across accounts","summary":"Export RID rules","simple_schema":"rid-export-grid-rmm-simple","security":[{"client_credentials":["execute"]},{"user_permissions":["bruteForce.view"]}],"status":{"outage":["auth","search_stateless"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"title":"RID Export Schema","type":"object","allOf":[{"type":"object","title":"Base Export Schema","required":["groups","select","format"],"properties":{"format":{"type":"string","title":"The output file","enum":["csv","xlsx","html","ods","txt","rtf","json"]},"download":{"type":"boolean","title":"Whether to instruct the client to download the response as a file. Only clients like browsers are supported"},"type":{"type":"string","title":"The encoding of the output","enum":["string","base64","binary"],"default":"string"},"select":{"type":"array","title":"Which fields to select from the response","items":{"type":"object","title":"Field","required":["field","newField"],"properties":{"newField":{"type":"string","title":"the new value"},"field":{"type":"string","title":"The response field to map to a new value"}}}},"groups":{"type":"array","title":"List of queries","items":{"type":"object"}}}},{"properties":{"groups":{"items":{"title":"List of queries to fetch dns activity","allOf":[{"type":"object","allOf":[{"type":"object","allOf":[{"properties":{"constraints":{"type":"array","items":{"title":"RID Constraints","type":"object","required":["field"],"anyOf":[{"title":"String (Equals, Not Equals) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"title":"RID Simple String Fields","type":"string","enum":["group_name","policy_name","account_name","protocol","attack_user","machine_name"]},{"title":"RID UID Fields","type":"string","enum":["id","rule_id","origin_id","machine_id","group_id","root_group_id","policy_id"]},{"title":"Agent Simple String Fields","type":"string","enum":["agent.nics.mac_address","agent.nics.description","agent.os_info.os_version","agent.os_info.os_release_name","agent.os_info.os_architecture","agent.plugins.asset_manager.plugin_version","agent.plugins.asset_manager.alerts.codes","agent.plugins.endpoint_protection.plugin_version","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.plugins.endpoint_protection.update_package_version","agent.plugins.endpoint_protection.alerts.codes","agent.plugins.endpoint_detection_and_response.plugin_version","agent.plugins.endpoint_detection_and_response.alerts.codes","agent.plugins.incident_response.plugin_version","agent.plugins.incident_response.update_package_version","agent.plugins.incident_response.alerts.codes","agent.plugins.siem.plugin_version","agent.plugins.siem.alerts.codes","agent.plugins.browser_phishing_protection.plugin_version","agent.plugins.browser_phishing_protection.alerts.codes","agent.engine_version","agent.source_location.city","agent.source_location.country","agent.source_location.subdivisions","agent.source_location.time_zone","agent.domain_name","agent.alias","agent.policy_etag","agent.serial_number","agent.available_software_updates.sdk_version.currentVersion","agent.available_software_updates.sdk_version.newVersion","agent.alerts.codes","agent.host_name","agent.fully_qualified_host_name","agent.object_guid","agent.last_user","agent.active_directory.user.display_name","agent.active_directory.user.ou","agent.active_directory.user.ou.path","agent.active_directory.user.sam_account_name","agent.active_directory.machine.display_name","agent.active_directory.machine.ou","agent.active_directory.machine.ou.path","agent.active_directory.machine.sam_account_name"]},{"title":"Agent Enum String Fields","type":"string","enum":["agent.os_info.os_type","agent.os_info.os_platform"]},{"title":"Agent Version fields","type":"string","enum":["agent.plugins.asset_manager.plugin_version","agent.plugins.endpoint_protection.plugin_version","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.plugins.endpoint_protection.update_package_version","agent.plugins.endpoint_detection_and_response.plugin_version","agent.plugins.incident_response.plugin_version","agent.plugins.incident_response.update_package_version","agent.available_software_updates.sdk_version.currentVersion","agent.available_software_updates.sdk_version.newVersion"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["equals","not_equals"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}}},"if":{"properties":{"field":{"title":"RID UID Fields","type":"string","enum":["id","rule_id","origin_id","machine_id","group_id","root_group_id","policy_id"]}}},"then":{"properties":{"value":{"type":["string","array"],"format":"uuid","items":{"type":"string","format":"uuid"}}}}},{"title":"String (Contains, Not Contains) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"title":"RID Simple String Fields","type":"string","enum":["group_name","policy_name","account_name","protocol","attack_user","machine_name"]},{"title":"Agent Simple String Fields","type":"string","enum":["agent.nics.mac_address","agent.nics.description","agent.os_info.os_version","agent.os_info.os_release_name","agent.os_info.os_architecture","agent.plugins.asset_manager.plugin_version","agent.plugins.asset_manager.alerts.codes","agent.plugins.endpoint_protection.plugin_version","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.plugins.endpoint_protection.update_package_version","agent.plugins.endpoint_protection.alerts.codes","agent.plugins.endpoint_detection_and_response.plugin_version","agent.plugins.endpoint_detection_and_response.alerts.codes","agent.plugins.incident_response.plugin_version","agent.plugins.incident_response.update_package_version","agent.plugins.incident_response.alerts.codes","agent.plugins.siem.plugin_version","agent.plugins.siem.alerts.codes","agent.plugins.browser_phishing_protection.plugin_version","agent.plugins.browser_phishing_protection.alerts.codes","agent.engine_version","agent.source_location.city","agent.source_location.country","agent.source_location.subdivisions","agent.source_location.time_zone","agent.domain_name","agent.alias","agent.policy_etag","agent.serial_number","agent.available_software_updates.sdk_version.currentVersion","agent.available_software_updates.sdk_version.newVersion","agent.alerts.codes","agent.host_name","agent.fully_qualified_host_name","agent.object_guid","agent.last_user","agent.active_directory.user.display_name","agent.active_directory.user.ou","agent.active_directory.user.ou.path","agent.active_directory.user.sam_account_name","agent.active_directory.machine.display_name","agent.active_directory.machine.ou","agent.active_directory.machine.ou.path","agent.active_directory.machine.sam_account_name"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["contains","not_contains"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}}}},{"title":"Number Constraints (gt, gte, lt, lte, equals)","properties":{"field":{"type":"string","oneOf":[{"title":"RID Number Fields","type":"string","enum":["port","attempts","duration"]},{"title":"Agent Number Fields","type":"string","enum":["agent.started_at_offset","agent.plugins.asset_manager.reboot_reasons","agent.plugins.endpoint_protection.reboot_reasons","agent.plugins.endpoint_detection_and_response.reboot_reasons","agent.plugins.incident_response.reboot_reasons","agent.plugins.siem.reboot_reasons","agent.os_version_major","agent.os_version_minor"]}]}},"oneOf":[{"minProperties":1,"title":"Specify Number Range","not":{"anyOf":[{"required":["operator"]},{"required":["value"]}]},"properties":{"gt":{"type":"number","title":"Greater than"},"lt":{"type":"number","title":"Less than"},"gte":{"type":"number","title":"Greater than or equals"},"lte":{"type":"number","title":"Less than or equals"}}},{"title":"Specify Exact Number","not":{"anyOf":[{"required":["gt"]},{"required":["lt"]},{"required":["gte"]},{"required":["lte"]}]},"required":["operator","value"],"properties":{"operator":{"type":"string","enum":["equals"]},"value":{"type":["number","array"],"title":"Value to search","items":{"type":"number"}}}}]},{"title":"Date (start, end) Constraints","properties":{"field":{"oneOf":[{"title":"RID Date Fields","type":"string","enum":["create_time"]},{"title":"Agent Date Fields","type":"string","enum":["agent.at","agent.started_at_local"]}]}},"oneOf":[{"minProperties":1,"title":"Specify Date Range","not":{"anyOf":[{"required":["operator"]},{"required":["value"]}]},"properties":{"start":{"type":"string","format":"date-time","title":"Start Date"},"end":{"type":"string","format":"date-time","title":"End Date"}}},{"title":"Specify Exact Date","not":{"anyOf":[{"required":["start"]},{"required":["end"]}]},"required":["operator","value"],"properties":{"operator":{"type":"string","enum":["equals"]},"value":{"type":["string","array"],"format":"date-time","title":"Value to search","items":{"format":"date-time"}}}}]},{"title":"IP Constraints","properties":{"field":{"oneOf":[{"title":"RID IP Fields","type":"string","enum":["ip"]},{"title":"Agent IP Fields","type":"string","enum":["agent.nics.ips","agent.machine_ip"]}]},"operator":{"type":"string","enum":["ip"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}}}},{"title":"Field Exists/Not Exists Constraints","required":["operator"],"properties":{"field":{"type":"string","oneOf":[{"title":"RID Simple String Fields","type":"string","enum":["group_name","policy_name","account_name","protocol","attack_user","machine_name"]},{"title":"RID UID Fields","type":"string","enum":["id","rule_id","origin_id","machine_id","group_id","root_group_id","policy_id"]},{"title":"Agent Simple String Fields","type":"string","enum":["agent.nics.mac_address","agent.nics.description","agent.os_info.os_version","agent.os_info.os_release_name","agent.os_info.os_architecture","agent.plugins.asset_manager.plugin_version","agent.plugins.asset_manager.alerts.codes","agent.plugins.endpoint_protection.plugin_version","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.plugins.endpoint_protection.update_package_version","agent.plugins.endpoint_protection.alerts.codes","agent.plugins.endpoint_detection_and_response.plugin_version","agent.plugins.endpoint_detection_and_response.alerts.codes","agent.plugins.incident_response.plugin_version","agent.plugins.incident_response.update_package_version","agent.plugins.incident_response.alerts.codes","agent.plugins.siem.plugin_version","agent.plugins.siem.alerts.codes","agent.plugins.browser_phishing_protection.plugin_version","agent.plugins.browser_phishing_protection.alerts.codes","agent.engine_version","agent.source_location.city","agent.source_location.country","agent.source_location.subdivisions","agent.source_location.time_zone","agent.domain_name","agent.alias","agent.policy_etag","agent.serial_number","agent.available_software_updates.sdk_version.currentVersion","agent.available_software_updates.sdk_version.newVersion","agent.alerts.codes","agent.host_name","agent.fully_qualified_host_name","agent.object_guid","agent.last_user","agent.active_directory.user.display_name","agent.active_directory.user.ou","agent.active_directory.user.ou.path","agent.active_directory.user.sam_account_name","agent.active_directory.machine.display_name","agent.active_directory.machine.ou","agent.active_directory.machine.ou.path","agent.active_directory.machine.sam_account_name"]},{"title":"Agent Enum String Fields","type":"string","enum":["agent.os_info.os_type","agent.os_info.os_platform"]},{"title":"Agent Version fields","type":"string","enum":["agent.plugins.asset_manager.plugin_version","agent.plugins.endpoint_protection.plugin_version","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.plugins.endpoint_protection.update_package_version","agent.plugins.endpoint_detection_and_response.plugin_version","agent.plugins.incident_response.plugin_version","agent.plugins.incident_response.update_package_version","agent.available_software_updates.sdk_version.currentVersion","agent.available_software_updates.sdk_version.newVersion"]},{"title":"RID IP Fields","type":"string","enum":["ip"]},{"title":"Agent IP Fields","type":"string","enum":["agent.nics.ips","agent.machine_ip"]},{"title":"RID Date Fields","type":"string","enum":["create_time"]},{"title":"Agent Date Fields","type":"string","enum":["agent.at","agent.started_at_local"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["exists","not_exists"]}}}]},"examples":[[{"field":"group_name","value":"Default Group","operator":"equals"}]]},"aggregations":{"items":{"type":"string","title":"RID aggregation fields","enum":["protection_status","agent.os_info.os_release_name","agent.nics.ips","agent.nics.mac_address","agent.nics.description","agent.os_info.os_type","agent.os_info.os_version","agent.os_info.os_platform","agent.os_info.os_architecture","agent.host_name","agent.fully_qualified_host_name","agent.plugins.asset_manager.plugin_version","agent.plugins.asset_manager.reboot_reasons","agent.plugins.endpoint_protection.plugin_version","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.plugins.endpoint_protection.update_package_version","agent.plugins.endpoint_protection.reboot_reasons","agent.plugins.endpoint_detection_and_response.plugin_version","agent.plugins.endpoint_detection_and_response.reboot_reasons","agent.plugins.incident_response.plugin_version","agent.plugins.incident_response.reboot_reasons","agent.plugins.siem.plugin_version","agent.plugins.siem.reboot_reasons","agent.plugins.browser_phishing_protection.plugin_version","agent.engine_version","agent.domain_name","agent.policy_etag","agent.last_user","agent.is_software_update_available","origin_id","machine_id","group_id","root_group_id","group_name","policy_id","policy_name","port","protocol","attack_user","agent.machine_ip","ip","deleted","machine_name","source_location.city","source_location.country","source_location.country_iso","source_location.continent","source_location.time_zone","source_location.postal_code","source_location.subdivisions","destination_location.city","destination_location.country","destination_location.country_iso","destination_location.continent","destination_location.time_zone","destination_location.postal_code","destination_location.subdivisions"]}},"sort_field":{"type":"string","title":"If the sort field is used, then sort_order is required.","enum":["id","rule_id","origin_id","machine_id","group_id","root_group_id","group_name","policy_id","policy_name","account_id","account_name","port","attempts","duration","protocol","attack_user","machine_ip","ip","create_time","expire_time","deleted","machine_name","at","nics.ips","nics.mac_address","nics.description.keyword","os_info.os_type","os_info.os_version.keyword","os_info.os_platform","os_info.os_architecture","os_info.os_release_name.keyword","host_name.keyword","fully_qualified_host_name.keyword","plugins.asset_manager.plugin_version.keyword","plugins.asset_manager.reboot_reasons","plugins.endpoint_protection.plugin_version.keyword","plugins.endpoint_protection.sdk_version.keyword","plugins.endpoint_protection.component_package_version.keyword","plugins.endpoint_protection.update_package_version.keyword","plugins.endpoint_protection.reboot_reasons","plugins.endpoint_detection_and_response.plugin_version.keyword","plugins.endpoint_detection_and_response.reboot_reasons","plugins.incident_response.plugin_version.keyword","plugins.incident_response.reboot_reasons","plugins.siem.plugin_version.keyword","plugins.browser_phishing_protection.plugin_version.keyword","plugins.siem.reboot_reasons","engine_version.keyword","domain_name.keyword","policy_etag","source_location.city","source_location.country","source_location.country_iso","source_location.continent","source_location.time_zone","source_location.postal_code","source_location.subdivisions","destination_location.city","destination_location.country","destination_location.country_iso","destination_location.continent","destination_location.time_zone","destination_location.postal_code","destination_location.subdivisions"]}}},{"type":"object","title":"Base Search Schema","properties":{"aggregations":{"type":"array","title":"The fields onto which you can perform aggregations","items":{"type":"string","title":"The Items Schema"}},"page_size":{"type":"number","title":"The page size. If you just need to aggregate, set it to 0","minimum":0,"maximum":2000},"sort_field":{"title":"Sort Fields","type":"string"},"sort_order":{"type":"string","title":"Whether sorting should be ascending or descending","enum":["asc","desc"]},"aggregate_by_account":{"type":"boolean","title":"Indicates whether aggregations should be scoped by account"},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}]},{"type":"object","required":["account_ids"],"properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]}]}}}}]}}}},"responses":{"200":{"description":"Successful response"}},"tags":["Grid"],"operationId":"api.rmm.grid.export.rid"}},"/oneview/v1/grid/rid/export/async":{"post":{"description":"Export RID rules across accounts","summary":"Export RID rules async","simple_schema":"rid-export-grid-rmm-simple","security":[{"client_credentials":["execute"]},{"user_permissions":["bruteForce.view"]}],"status":{"outage":["auth","search_stateless"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"title":"RID Export Schema","type":"object","allOf":[{"type":"object","title":"Base Export Schema","required":["groups","select","format"],"properties":{"format":{"type":"string","title":"The output file","enum":["csv","xlsx","html","ods","txt","rtf","json"]},"download":{"type":"boolean","title":"Whether to instruct the client to download the response as a file. Only clients like browsers are supported"},"type":{"type":"string","title":"The encoding of the output","enum":["string","base64","binary"],"default":"string"},"select":{"type":"array","title":"Which fields to select from the response","items":{"type":"object","title":"Field","required":["field","newField"],"properties":{"newField":{"type":"string","title":"the new value"},"field":{"type":"string","title":"The response field to map to a new value"}}}},"groups":{"type":"array","title":"List of queries","items":{"type":"object"}}}},{"properties":{"groups":{"items":{"title":"List of queries to fetch dns activity","allOf":[{"type":"object","allOf":[{"type":"object","allOf":[{"properties":{"constraints":{"type":"array","items":{"title":"RID Constraints","type":"object","required":["field"],"anyOf":[{"title":"String (Equals, Not Equals) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"title":"RID Simple String Fields","type":"string","enum":["group_name","policy_name","account_name","protocol","attack_user","machine_name"]},{"title":"RID UID Fields","type":"string","enum":["id","rule_id","origin_id","machine_id","group_id","root_group_id","policy_id"]},{"title":"Agent Simple String Fields","type":"string","enum":["agent.nics.mac_address","agent.nics.description","agent.os_info.os_version","agent.os_info.os_release_name","agent.os_info.os_architecture","agent.plugins.asset_manager.plugin_version","agent.plugins.asset_manager.alerts.codes","agent.plugins.endpoint_protection.plugin_version","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.plugins.endpoint_protection.update_package_version","agent.plugins.endpoint_protection.alerts.codes","agent.plugins.endpoint_detection_and_response.plugin_version","agent.plugins.endpoint_detection_and_response.alerts.codes","agent.plugins.incident_response.plugin_version","agent.plugins.incident_response.update_package_version","agent.plugins.incident_response.alerts.codes","agent.plugins.siem.plugin_version","agent.plugins.siem.alerts.codes","agent.plugins.browser_phishing_protection.plugin_version","agent.plugins.browser_phishing_protection.alerts.codes","agent.engine_version","agent.source_location.city","agent.source_location.country","agent.source_location.subdivisions","agent.source_location.time_zone","agent.domain_name","agent.alias","agent.policy_etag","agent.serial_number","agent.available_software_updates.sdk_version.currentVersion","agent.available_software_updates.sdk_version.newVersion","agent.alerts.codes","agent.host_name","agent.fully_qualified_host_name","agent.object_guid","agent.last_user","agent.active_directory.user.display_name","agent.active_directory.user.ou","agent.active_directory.user.ou.path","agent.active_directory.user.sam_account_name","agent.active_directory.machine.display_name","agent.active_directory.machine.ou","agent.active_directory.machine.ou.path","agent.active_directory.machine.sam_account_name"]},{"title":"Agent Enum String Fields","type":"string","enum":["agent.os_info.os_type","agent.os_info.os_platform"]},{"title":"Agent Version fields","type":"string","enum":["agent.plugins.asset_manager.plugin_version","agent.plugins.endpoint_protection.plugin_version","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.plugins.endpoint_protection.update_package_version","agent.plugins.endpoint_detection_and_response.plugin_version","agent.plugins.incident_response.plugin_version","agent.plugins.incident_response.update_package_version","agent.available_software_updates.sdk_version.currentVersion","agent.available_software_updates.sdk_version.newVersion"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["equals","not_equals"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}}},"if":{"properties":{"field":{"title":"RID UID Fields","type":"string","enum":["id","rule_id","origin_id","machine_id","group_id","root_group_id","policy_id"]}}},"then":{"properties":{"value":{"type":["string","array"],"format":"uuid","items":{"type":"string","format":"uuid"}}}}},{"title":"String (Contains, Not Contains) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"title":"RID Simple String Fields","type":"string","enum":["group_name","policy_name","account_name","protocol","attack_user","machine_name"]},{"title":"Agent Simple String Fields","type":"string","enum":["agent.nics.mac_address","agent.nics.description","agent.os_info.os_version","agent.os_info.os_release_name","agent.os_info.os_architecture","agent.plugins.asset_manager.plugin_version","agent.plugins.asset_manager.alerts.codes","agent.plugins.endpoint_protection.plugin_version","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.plugins.endpoint_protection.update_package_version","agent.plugins.endpoint_protection.alerts.codes","agent.plugins.endpoint_detection_and_response.plugin_version","agent.plugins.endpoint_detection_and_response.alerts.codes","agent.plugins.incident_response.plugin_version","agent.plugins.incident_response.update_package_version","agent.plugins.incident_response.alerts.codes","agent.plugins.siem.plugin_version","agent.plugins.siem.alerts.codes","agent.plugins.browser_phishing_protection.plugin_version","agent.plugins.browser_phishing_protection.alerts.codes","agent.engine_version","agent.source_location.city","agent.source_location.country","agent.source_location.subdivisions","agent.source_location.time_zone","agent.domain_name","agent.alias","agent.policy_etag","agent.serial_number","agent.available_software_updates.sdk_version.currentVersion","agent.available_software_updates.sdk_version.newVersion","agent.alerts.codes","agent.host_name","agent.fully_qualified_host_name","agent.object_guid","agent.last_user","agent.active_directory.user.display_name","agent.active_directory.user.ou","agent.active_directory.user.ou.path","agent.active_directory.user.sam_account_name","agent.active_directory.machine.display_name","agent.active_directory.machine.ou","agent.active_directory.machine.ou.path","agent.active_directory.machine.sam_account_name"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["contains","not_contains"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}}}},{"title":"Number Constraints (gt, gte, lt, lte, equals)","properties":{"field":{"type":"string","oneOf":[{"title":"RID Number Fields","type":"string","enum":["port","attempts","duration"]},{"title":"Agent Number Fields","type":"string","enum":["agent.started_at_offset","agent.plugins.asset_manager.reboot_reasons","agent.plugins.endpoint_protection.reboot_reasons","agent.plugins.endpoint_detection_and_response.reboot_reasons","agent.plugins.incident_response.reboot_reasons","agent.plugins.siem.reboot_reasons","agent.os_version_major","agent.os_version_minor"]}]}},"oneOf":[{"minProperties":1,"title":"Specify Number Range","not":{"anyOf":[{"required":["operator"]},{"required":["value"]}]},"properties":{"gt":{"type":"number","title":"Greater than"},"lt":{"type":"number","title":"Less than"},"gte":{"type":"number","title":"Greater than or equals"},"lte":{"type":"number","title":"Less than or equals"}}},{"title":"Specify Exact Number","not":{"anyOf":[{"required":["gt"]},{"required":["lt"]},{"required":["gte"]},{"required":["lte"]}]},"required":["operator","value"],"properties":{"operator":{"type":"string","enum":["equals"]},"value":{"type":["number","array"],"title":"Value to search","items":{"type":"number"}}}}]},{"title":"Date (start, end) Constraints","properties":{"field":{"oneOf":[{"title":"RID Date Fields","type":"string","enum":["create_time"]},{"title":"Agent Date Fields","type":"string","enum":["agent.at","agent.started_at_local"]}]}},"oneOf":[{"minProperties":1,"title":"Specify Date Range","not":{"anyOf":[{"required":["operator"]},{"required":["value"]}]},"properties":{"start":{"type":"string","format":"date-time","title":"Start Date"},"end":{"type":"string","format":"date-time","title":"End Date"}}},{"title":"Specify Exact Date","not":{"anyOf":[{"required":["start"]},{"required":["end"]}]},"required":["operator","value"],"properties":{"operator":{"type":"string","enum":["equals"]},"value":{"type":["string","array"],"format":"date-time","title":"Value to search","items":{"format":"date-time"}}}}]},{"title":"IP Constraints","properties":{"field":{"oneOf":[{"title":"RID IP Fields","type":"string","enum":["ip"]},{"title":"Agent IP Fields","type":"string","enum":["agent.nics.ips","agent.machine_ip"]}]},"operator":{"type":"string","enum":["ip"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}}}},{"title":"Field Exists/Not Exists Constraints","required":["operator"],"properties":{"field":{"type":"string","oneOf":[{"title":"RID Simple String Fields","type":"string","enum":["group_name","policy_name","account_name","protocol","attack_user","machine_name"]},{"title":"RID UID Fields","type":"string","enum":["id","rule_id","origin_id","machine_id","group_id","root_group_id","policy_id"]},{"title":"Agent Simple String Fields","type":"string","enum":["agent.nics.mac_address","agent.nics.description","agent.os_info.os_version","agent.os_info.os_release_name","agent.os_info.os_architecture","agent.plugins.asset_manager.plugin_version","agent.plugins.asset_manager.alerts.codes","agent.plugins.endpoint_protection.plugin_version","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.plugins.endpoint_protection.update_package_version","agent.plugins.endpoint_protection.alerts.codes","agent.plugins.endpoint_detection_and_response.plugin_version","agent.plugins.endpoint_detection_and_response.alerts.codes","agent.plugins.incident_response.plugin_version","agent.plugins.incident_response.update_package_version","agent.plugins.incident_response.alerts.codes","agent.plugins.siem.plugin_version","agent.plugins.siem.alerts.codes","agent.plugins.browser_phishing_protection.plugin_version","agent.plugins.browser_phishing_protection.alerts.codes","agent.engine_version","agent.source_location.city","agent.source_location.country","agent.source_location.subdivisions","agent.source_location.time_zone","agent.domain_name","agent.alias","agent.policy_etag","agent.serial_number","agent.available_software_updates.sdk_version.currentVersion","agent.available_software_updates.sdk_version.newVersion","agent.alerts.codes","agent.host_name","agent.fully_qualified_host_name","agent.object_guid","agent.last_user","agent.active_directory.user.display_name","agent.active_directory.user.ou","agent.active_directory.user.ou.path","agent.active_directory.user.sam_account_name","agent.active_directory.machine.display_name","agent.active_directory.machine.ou","agent.active_directory.machine.ou.path","agent.active_directory.machine.sam_account_name"]},{"title":"Agent Enum String Fields","type":"string","enum":["agent.os_info.os_type","agent.os_info.os_platform"]},{"title":"Agent Version fields","type":"string","enum":["agent.plugins.asset_manager.plugin_version","agent.plugins.endpoint_protection.plugin_version","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.plugins.endpoint_protection.update_package_version","agent.plugins.endpoint_detection_and_response.plugin_version","agent.plugins.incident_response.plugin_version","agent.plugins.incident_response.update_package_version","agent.available_software_updates.sdk_version.currentVersion","agent.available_software_updates.sdk_version.newVersion"]},{"title":"RID IP Fields","type":"string","enum":["ip"]},{"title":"Agent IP Fields","type":"string","enum":["agent.nics.ips","agent.machine_ip"]},{"title":"RID Date Fields","type":"string","enum":["create_time"]},{"title":"Agent Date Fields","type":"string","enum":["agent.at","agent.started_at_local"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["exists","not_exists"]}}}]},"examples":[[{"field":"group_name","value":"Default Group","operator":"equals"}]]},"aggregations":{"items":{"type":"string","title":"RID aggregation fields","enum":["protection_status","agent.os_info.os_release_name","agent.nics.ips","agent.nics.mac_address","agent.nics.description","agent.os_info.os_type","agent.os_info.os_version","agent.os_info.os_platform","agent.os_info.os_architecture","agent.host_name","agent.fully_qualified_host_name","agent.plugins.asset_manager.plugin_version","agent.plugins.asset_manager.reboot_reasons","agent.plugins.endpoint_protection.plugin_version","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.plugins.endpoint_protection.update_package_version","agent.plugins.endpoint_protection.reboot_reasons","agent.plugins.endpoint_detection_and_response.plugin_version","agent.plugins.endpoint_detection_and_response.reboot_reasons","agent.plugins.incident_response.plugin_version","agent.plugins.incident_response.reboot_reasons","agent.plugins.siem.plugin_version","agent.plugins.siem.reboot_reasons","agent.plugins.browser_phishing_protection.plugin_version","agent.engine_version","agent.domain_name","agent.policy_etag","agent.last_user","agent.is_software_update_available","origin_id","machine_id","group_id","root_group_id","group_name","policy_id","policy_name","port","protocol","attack_user","agent.machine_ip","ip","deleted","machine_name","source_location.city","source_location.country","source_location.country_iso","source_location.continent","source_location.time_zone","source_location.postal_code","source_location.subdivisions","destination_location.city","destination_location.country","destination_location.country_iso","destination_location.continent","destination_location.time_zone","destination_location.postal_code","destination_location.subdivisions"]}},"sort_field":{"type":"string","title":"If the sort field is used, then sort_order is required.","enum":["id","rule_id","origin_id","machine_id","group_id","root_group_id","group_name","policy_id","policy_name","account_id","account_name","port","attempts","duration","protocol","attack_user","machine_ip","ip","create_time","expire_time","deleted","machine_name","at","nics.ips","nics.mac_address","nics.description.keyword","os_info.os_type","os_info.os_version.keyword","os_info.os_platform","os_info.os_architecture","os_info.os_release_name.keyword","host_name.keyword","fully_qualified_host_name.keyword","plugins.asset_manager.plugin_version.keyword","plugins.asset_manager.reboot_reasons","plugins.endpoint_protection.plugin_version.keyword","plugins.endpoint_protection.sdk_version.keyword","plugins.endpoint_protection.component_package_version.keyword","plugins.endpoint_protection.update_package_version.keyword","plugins.endpoint_protection.reboot_reasons","plugins.endpoint_detection_and_response.plugin_version.keyword","plugins.endpoint_detection_and_response.reboot_reasons","plugins.incident_response.plugin_version.keyword","plugins.incident_response.reboot_reasons","plugins.siem.plugin_version.keyword","plugins.browser_phishing_protection.plugin_version.keyword","plugins.siem.reboot_reasons","engine_version.keyword","domain_name.keyword","policy_etag","source_location.city","source_location.country","source_location.country_iso","source_location.continent","source_location.time_zone","source_location.postal_code","source_location.subdivisions","destination_location.city","destination_location.country","destination_location.country_iso","destination_location.continent","destination_location.time_zone","destination_location.postal_code","destination_location.subdivisions"]}}},{"type":"object","title":"Base Search Schema","properties":{"aggregations":{"type":"array","title":"The fields onto which you can perform aggregations","items":{"type":"string","title":"The Items Schema"}},"page_size":{"type":"number","title":"The page size. If you just need to aggregate, set it to 0","minimum":0,"maximum":2000},"sort_field":{"title":"Sort Fields","type":"string"},"sort_order":{"type":"string","title":"Whether sorting should be ascending or descending","enum":["asc","desc"]},"aggregate_by_account":{"type":"boolean","title":"Indicates whether aggregations should be scoped by account"},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}]},{"type":"object","required":["account_ids"],"properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]}]}}}}]}}}},"responses":{"200":{"description":"Successful response"}},"tags":["Grid"],"operationId":"api.rmm.grid.export.rid.async"}},"/oneview/v1/grid/rid/search":{"post":{"description":"Search RID rules across accounts","summary":"Search RID rules","simple_schema":"rid-search-grid-rmm-simple","security":[{"client_credentials":["read"]},{"user_permissions":["bruteForce.view"]}],"status":{"outage":["auth","search_stateless"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","allOf":[{"type":"object","allOf":[{"properties":{"constraints":{"type":"array","items":{"title":"RID Constraints","type":"object","required":["field"],"anyOf":[{"title":"String (Equals, Not Equals) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"title":"RID Simple String Fields","type":"string","enum":["group_name","policy_name","account_name","protocol","attack_user","machine_name"]},{"title":"RID UID Fields","type":"string","enum":["id","rule_id","origin_id","machine_id","group_id","root_group_id","policy_id"]},{"title":"Agent Simple String Fields","type":"string","enum":["agent.nics.mac_address","agent.nics.description","agent.os_info.os_version","agent.os_info.os_release_name","agent.os_info.os_architecture","agent.plugins.asset_manager.plugin_version","agent.plugins.asset_manager.alerts.codes","agent.plugins.endpoint_protection.plugin_version","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.plugins.endpoint_protection.update_package_version","agent.plugins.endpoint_protection.alerts.codes","agent.plugins.endpoint_detection_and_response.plugin_version","agent.plugins.endpoint_detection_and_response.alerts.codes","agent.plugins.incident_response.plugin_version","agent.plugins.incident_response.update_package_version","agent.plugins.incident_response.alerts.codes","agent.plugins.siem.plugin_version","agent.plugins.siem.alerts.codes","agent.plugins.browser_phishing_protection.plugin_version","agent.plugins.browser_phishing_protection.alerts.codes","agent.engine_version","agent.source_location.city","agent.source_location.country","agent.source_location.subdivisions","agent.source_location.time_zone","agent.domain_name","agent.alias","agent.policy_etag","agent.serial_number","agent.available_software_updates.sdk_version.currentVersion","agent.available_software_updates.sdk_version.newVersion","agent.alerts.codes","agent.host_name","agent.fully_qualified_host_name","agent.object_guid","agent.last_user","agent.active_directory.user.display_name","agent.active_directory.user.ou","agent.active_directory.user.ou.path","agent.active_directory.user.sam_account_name","agent.active_directory.machine.display_name","agent.active_directory.machine.ou","agent.active_directory.machine.ou.path","agent.active_directory.machine.sam_account_name"]},{"title":"Agent Enum String Fields","type":"string","enum":["agent.os_info.os_type","agent.os_info.os_platform"]},{"title":"Agent Version fields","type":"string","enum":["agent.plugins.asset_manager.plugin_version","agent.plugins.endpoint_protection.plugin_version","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.plugins.endpoint_protection.update_package_version","agent.plugins.endpoint_detection_and_response.plugin_version","agent.plugins.incident_response.plugin_version","agent.plugins.incident_response.update_package_version","agent.available_software_updates.sdk_version.currentVersion","agent.available_software_updates.sdk_version.newVersion"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["equals","not_equals"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}}},"if":{"properties":{"field":{"title":"RID UID Fields","type":"string","enum":["id","rule_id","origin_id","machine_id","group_id","root_group_id","policy_id"]}}},"then":{"properties":{"value":{"type":["string","array"],"format":"uuid","items":{"type":"string","format":"uuid"}}}}},{"title":"String (Contains, Not Contains) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"title":"RID Simple String Fields","type":"string","enum":["group_name","policy_name","account_name","protocol","attack_user","machine_name"]},{"title":"Agent Simple String Fields","type":"string","enum":["agent.nics.mac_address","agent.nics.description","agent.os_info.os_version","agent.os_info.os_release_name","agent.os_info.os_architecture","agent.plugins.asset_manager.plugin_version","agent.plugins.asset_manager.alerts.codes","agent.plugins.endpoint_protection.plugin_version","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.plugins.endpoint_protection.update_package_version","agent.plugins.endpoint_protection.alerts.codes","agent.plugins.endpoint_detection_and_response.plugin_version","agent.plugins.endpoint_detection_and_response.alerts.codes","agent.plugins.incident_response.plugin_version","agent.plugins.incident_response.update_package_version","agent.plugins.incident_response.alerts.codes","agent.plugins.siem.plugin_version","agent.plugins.siem.alerts.codes","agent.plugins.browser_phishing_protection.plugin_version","agent.plugins.browser_phishing_protection.alerts.codes","agent.engine_version","agent.source_location.city","agent.source_location.country","agent.source_location.subdivisions","agent.source_location.time_zone","agent.domain_name","agent.alias","agent.policy_etag","agent.serial_number","agent.available_software_updates.sdk_version.currentVersion","agent.available_software_updates.sdk_version.newVersion","agent.alerts.codes","agent.host_name","agent.fully_qualified_host_name","agent.object_guid","agent.last_user","agent.active_directory.user.display_name","agent.active_directory.user.ou","agent.active_directory.user.ou.path","agent.active_directory.user.sam_account_name","agent.active_directory.machine.display_name","agent.active_directory.machine.ou","agent.active_directory.machine.ou.path","agent.active_directory.machine.sam_account_name"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["contains","not_contains"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}}}},{"title":"Number Constraints (gt, gte, lt, lte, equals)","properties":{"field":{"type":"string","oneOf":[{"title":"RID Number Fields","type":"string","enum":["port","attempts","duration"]},{"title":"Agent Number Fields","type":"string","enum":["agent.started_at_offset","agent.plugins.asset_manager.reboot_reasons","agent.plugins.endpoint_protection.reboot_reasons","agent.plugins.endpoint_detection_and_response.reboot_reasons","agent.plugins.incident_response.reboot_reasons","agent.plugins.siem.reboot_reasons","agent.os_version_major","agent.os_version_minor"]}]}},"oneOf":[{"minProperties":1,"title":"Specify Number Range","not":{"anyOf":[{"required":["operator"]},{"required":["value"]}]},"properties":{"gt":{"type":"number","title":"Greater than"},"lt":{"type":"number","title":"Less than"},"gte":{"type":"number","title":"Greater than or equals"},"lte":{"type":"number","title":"Less than or equals"}}},{"title":"Specify Exact Number","not":{"anyOf":[{"required":["gt"]},{"required":["lt"]},{"required":["gte"]},{"required":["lte"]}]},"required":["operator","value"],"properties":{"operator":{"type":"string","enum":["equals"]},"value":{"type":["number","array"],"title":"Value to search","items":{"type":"number"}}}}]},{"title":"Date (start, end) Constraints","properties":{"field":{"oneOf":[{"title":"RID Date Fields","type":"string","enum":["create_time"]},{"title":"Agent Date Fields","type":"string","enum":["agent.at","agent.started_at_local"]}]}},"oneOf":[{"minProperties":1,"title":"Specify Date Range","not":{"anyOf":[{"required":["operator"]},{"required":["value"]}]},"properties":{"start":{"type":"string","format":"date-time","title":"Start Date"},"end":{"type":"string","format":"date-time","title":"End Date"}}},{"title":"Specify Exact Date","not":{"anyOf":[{"required":["start"]},{"required":["end"]}]},"required":["operator","value"],"properties":{"operator":{"type":"string","enum":["equals"]},"value":{"type":["string","array"],"format":"date-time","title":"Value to search","items":{"format":"date-time"}}}}]},{"title":"IP Constraints","properties":{"field":{"oneOf":[{"title":"RID IP Fields","type":"string","enum":["ip"]},{"title":"Agent IP Fields","type":"string","enum":["agent.nics.ips","agent.machine_ip"]}]},"operator":{"type":"string","enum":["ip"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}}}},{"title":"Field Exists/Not Exists Constraints","required":["operator"],"properties":{"field":{"type":"string","oneOf":[{"title":"RID Simple String Fields","type":"string","enum":["group_name","policy_name","account_name","protocol","attack_user","machine_name"]},{"title":"RID UID Fields","type":"string","enum":["id","rule_id","origin_id","machine_id","group_id","root_group_id","policy_id"]},{"title":"Agent Simple String Fields","type":"string","enum":["agent.nics.mac_address","agent.nics.description","agent.os_info.os_version","agent.os_info.os_release_name","agent.os_info.os_architecture","agent.plugins.asset_manager.plugin_version","agent.plugins.asset_manager.alerts.codes","agent.plugins.endpoint_protection.plugin_version","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.plugins.endpoint_protection.update_package_version","agent.plugins.endpoint_protection.alerts.codes","agent.plugins.endpoint_detection_and_response.plugin_version","agent.plugins.endpoint_detection_and_response.alerts.codes","agent.plugins.incident_response.plugin_version","agent.plugins.incident_response.update_package_version","agent.plugins.incident_response.alerts.codes","agent.plugins.siem.plugin_version","agent.plugins.siem.alerts.codes","agent.plugins.browser_phishing_protection.plugin_version","agent.plugins.browser_phishing_protection.alerts.codes","agent.engine_version","agent.source_location.city","agent.source_location.country","agent.source_location.subdivisions","agent.source_location.time_zone","agent.domain_name","agent.alias","agent.policy_etag","agent.serial_number","agent.available_software_updates.sdk_version.currentVersion","agent.available_software_updates.sdk_version.newVersion","agent.alerts.codes","agent.host_name","agent.fully_qualified_host_name","agent.object_guid","agent.last_user","agent.active_directory.user.display_name","agent.active_directory.user.ou","agent.active_directory.user.ou.path","agent.active_directory.user.sam_account_name","agent.active_directory.machine.display_name","agent.active_directory.machine.ou","agent.active_directory.machine.ou.path","agent.active_directory.machine.sam_account_name"]},{"title":"Agent Enum String Fields","type":"string","enum":["agent.os_info.os_type","agent.os_info.os_platform"]},{"title":"Agent Version fields","type":"string","enum":["agent.plugins.asset_manager.plugin_version","agent.plugins.endpoint_protection.plugin_version","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.plugins.endpoint_protection.update_package_version","agent.plugins.endpoint_detection_and_response.plugin_version","agent.plugins.incident_response.plugin_version","agent.plugins.incident_response.update_package_version","agent.available_software_updates.sdk_version.currentVersion","agent.available_software_updates.sdk_version.newVersion"]},{"title":"RID IP Fields","type":"string","enum":["ip"]},{"title":"Agent IP Fields","type":"string","enum":["agent.nics.ips","agent.machine_ip"]},{"title":"RID Date Fields","type":"string","enum":["create_time"]},{"title":"Agent Date Fields","type":"string","enum":["agent.at","agent.started_at_local"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["exists","not_exists"]}}}]},"examples":[[{"field":"group_name","value":"Default Group","operator":"equals"}]]},"aggregations":{"items":{"type":"string","title":"RID aggregation fields","enum":["protection_status","agent.os_info.os_release_name","agent.nics.ips","agent.nics.mac_address","agent.nics.description","agent.os_info.os_type","agent.os_info.os_version","agent.os_info.os_platform","agent.os_info.os_architecture","agent.host_name","agent.fully_qualified_host_name","agent.plugins.asset_manager.plugin_version","agent.plugins.asset_manager.reboot_reasons","agent.plugins.endpoint_protection.plugin_version","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.plugins.endpoint_protection.update_package_version","agent.plugins.endpoint_protection.reboot_reasons","agent.plugins.endpoint_detection_and_response.plugin_version","agent.plugins.endpoint_detection_and_response.reboot_reasons","agent.plugins.incident_response.plugin_version","agent.plugins.incident_response.reboot_reasons","agent.plugins.siem.plugin_version","agent.plugins.siem.reboot_reasons","agent.plugins.browser_phishing_protection.plugin_version","agent.engine_version","agent.domain_name","agent.policy_etag","agent.last_user","agent.is_software_update_available","origin_id","machine_id","group_id","root_group_id","group_name","policy_id","policy_name","port","protocol","attack_user","agent.machine_ip","ip","deleted","machine_name","source_location.city","source_location.country","source_location.country_iso","source_location.continent","source_location.time_zone","source_location.postal_code","source_location.subdivisions","destination_location.city","destination_location.country","destination_location.country_iso","destination_location.continent","destination_location.time_zone","destination_location.postal_code","destination_location.subdivisions"]}},"sort_field":{"type":"string","title":"If the sort field is used, then sort_order is required.","enum":["id","rule_id","origin_id","machine_id","group_id","root_group_id","group_name","policy_id","policy_name","account_id","account_name","port","attempts","duration","protocol","attack_user","machine_ip","ip","create_time","expire_time","deleted","machine_name","at","nics.ips","nics.mac_address","nics.description.keyword","os_info.os_type","os_info.os_version.keyword","os_info.os_platform","os_info.os_architecture","os_info.os_release_name.keyword","host_name.keyword","fully_qualified_host_name.keyword","plugins.asset_manager.plugin_version.keyword","plugins.asset_manager.reboot_reasons","plugins.endpoint_protection.plugin_version.keyword","plugins.endpoint_protection.sdk_version.keyword","plugins.endpoint_protection.component_package_version.keyword","plugins.endpoint_protection.update_package_version.keyword","plugins.endpoint_protection.reboot_reasons","plugins.endpoint_detection_and_response.plugin_version.keyword","plugins.endpoint_detection_and_response.reboot_reasons","plugins.incident_response.plugin_version.keyword","plugins.incident_response.reboot_reasons","plugins.siem.plugin_version.keyword","plugins.browser_phishing_protection.plugin_version.keyword","plugins.siem.reboot_reasons","engine_version.keyword","domain_name.keyword","policy_etag","source_location.city","source_location.country","source_location.country_iso","source_location.continent","source_location.time_zone","source_location.postal_code","source_location.subdivisions","destination_location.city","destination_location.country","destination_location.country_iso","destination_location.continent","destination_location.time_zone","destination_location.postal_code","destination_location.subdivisions"]}}},{"type":"object","title":"Base Search Schema","properties":{"aggregations":{"type":"array","title":"The fields onto which you can perform aggregations","items":{"type":"string","title":"The Items Schema"}},"page_size":{"type":"number","title":"The page size. If you just need to aggregate, set it to 0","minimum":0,"maximum":2000},"sort_field":{"title":"Sort Fields","type":"string"},"sort_order":{"type":"string","title":"Whether sorting should be ascending or descending","enum":["asc","desc"]},"aggregate_by_account":{"type":"boolean","title":"Indicates whether aggregations should be scoped by account"},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}]},{"type":"object","required":["account_ids"],"properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"Search assets software result","properties":{"rules":{"type":"array","items":{"allOf":[{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"The root schema","description":"The root schema comprises the entire JSON document.","default":{},"examples":[{"parentId":"39a42ecb-bfd1-40e6-8b83-70318b7d30af","rootGroupId":"76132a40-5a9f-4197-9f38-c185f31f1d45","ruleId":"ed31c443-42fa-40ae-a4a6-a05ad8b560e4","ip":"10.153.0.162","attackUser":"Administrator","attempts":2,"expireTime":"2020-10-23T13:25:35Z","deleted":false,"protocol":"RDP","createTime":"2020-10-23T13:20:35Z","groupId":"76132a40-5a9f-4197-9f38-c185f31f1d45","port":3389,"machineId":"f2bcafe1-cb2b-4833-b6c9-6148b9511c8f","accountId":"39a42ecb-bfd1-40e6-8b83-70318b7d30af","machineName":"sahamedw8-1x86","duration":3}],"properties":{"parent_id":{"type":"string","title":"The parent_id schema","default":"","examples":["39a42ecb-bfd1-40e6-8b83-70318b7d30af"]},"root_group_id":{"type":"string","title":"The root_group_id schema","default":"","examples":["76132a40-5a9f-4197-9f38-c185f31f1d45"]},"rule_id":{"type":"string","title":"The rule_id schema","default":"","examples":["ed31c443-42fa-40ae-a4a6-a05ad8b560e4"]},"ip":{"type":"string","title":"The ip schema","default":"","examples":["10.153.0.162"]},"attack_user":{"type":"string","title":"The attack_user schema","default":"","examples":["Administrator"]},"attempts":{"type":"integer","title":"The attempts schema","default":0,"examples":[2]},"expire_time":{"type":"string","title":"The expireTime schema","default":"","examples":["2020-10-23T13:25:35Z"]},"deleted":{"type":"boolean","title":"The deleted schema","default":false,"examples":[false]},"protocol":{"type":"string","title":"The protocol schema","default":"","examples":["RDP"]},"create_time":{"type":"string","title":"The create_time schema","default":"","examples":["2020-10-23T13:20:35Z"]},"group_id":{"type":"string","title":"The group_id schema","default":"","examples":["76132a40-5a9f-4197-9f38-c185f31f1d45"]},"port":{"type":"integer","title":"The port schema","default":0,"examples":[3389]},"machine_id":{"type":"string","title":"The machine_id schema","default":"","examples":["f2bcafe1-cb2b-4833-b6c9-6148b9511c8f"]},"account_id":{"type":"string","title":"The account_id schema","default":"","examples":["39a42ecb-bfd1-40e6-8b83-70318b7d30af"]},"account_name":{"type":"string","title":"The account_name schema","default":"","examples":["my_account"]},"machine_name":{"type":"string","title":"The machine_name schema","default":"","examples":["sahamedw8-1x86"]},"duration":{"type":"integer","title":"The duration schema","default":0,"examples":[3]}}},{"properties":{"agent":{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"The root schema","description":"The root schema comprises the entire JSON document.","default":{},"examples":[{"at":"2020-10-23T14:20:51.006558Z","is_software_update_available":false,"started_at_local":"2020-10-23T14:20:50.920306Z","started_at_offset":-25200,"nics":[{"ips":["10.151.110.52"],"description":"Intel(R) 82574L Gigabit Network Connection","mac_address":"005056B91173"}],"os_info":{"os_type":"Workstation","os_version":"6.3.9600","os_platform":"Windows","os_architecture":"x86","os_release_name":"Microsoft Windows 8.1 Pro"},"fully_qualified_host_name":"sahamedw8-1x86","plugins":{"windows_remote_intrusion_detection_and_prevention":{"product_name":"Windows Remote Intrusion Detection and Prevention","plugin_version":"1.2.0.21"},"endpoint_protection":{"sdk_version":"4.2.1.90","product_name":"Endpoint Protection","plugin_version":"1.2.0.844","update_package_version":"1.0.31870","component_package_version":"1.0.1085","reboot_reasons":0},"asset_manager":{"product_name":"Asset Manager","plugin_version":"1.2.0.330","reboot_reasons":0},"endpoint_detection_and_response":{"product_name":"Endpoint Detection and Response","plugin_version":"1.2.0.297","reboot_reasons":0}},"engine_version":"1.2.0.821","policy_etag":"c6ea44914b72c92cba939ac3bd369dc4","last_user":"SAHAMEDW8-1X86\\Administrator","serial_number":"c02thb32g8wn","host_name":"sahamedw8-1x86","machine_id":"f2bcafe1-cb2b-4833-b6c9-6148b9511c8f","machine_ip":"216.75.233.210"}],"properties":{"at":{"type":"string","title":"The at schema","default":"","examples":["2020-10-23T14:20:51.006558Z"]},"is_software_update_available":{"type":"boolean","title":"The is_software_update_available schema","default":false,"examples":[false]},"started_at_local":{"type":"string","title":"The started_at_local schema","default":"","examples":["2020-10-23T14:20:50.920306Z"]},"started_at_offset":{"type":"integer","title":"The started_at_offset schema","default":0,"examples":[-25200]},"nics":{"type":"array","title":"The nics schema","default":[],"examples":[[{"ips":["10.151.110.52"],"description":"Intel(R) 82574L Gigabit Network Connection","mac_address":"005056B91173"}]],"additionalItems":true,"items":{"anyOf":[{"type":"object","title":"The first anyOf schema","default":{},"examples":[{"ips":["10.151.110.52"],"description":"Intel(R) 82574L Gigabit Network Connection","mac_address":"005056B91173"}],"properties":{"ips":{"type":"array","title":"The ips schema","default":[],"examples":[["10.151.110.52"]],"additionalItems":true,"items":{"anyOf":[{"type":"string","title":"The first anyOf schema","default":"","examples":["10.151.110.52"]}]}},"description":{"type":"string","title":"The description schema","default":"","examples":["Intel(R) 82574L Gigabit Network Connection"]},"mac_address":{"type":"string","title":"The mac_address schema","default":"","examples":["005056B91173"]}},"additionalProperties":true}]}},"os_info":{"type":"object","title":"The os_info schema","default":{},"examples":[{"os_type":"Workstation","os_version":"6.3.9600","os_platform":"Windows","os_architecture":"x86","os_release_name":"Microsoft Windows 8.1 Pro"}],"properties":{"os_type":{"type":"string","title":"The os_type schema","default":"","examples":["Workstation"]},"os_version":{"type":"string","title":"The os_version schema","default":"","examples":["6.3.9600"]},"os_platform":{"type":"string","title":"The os_platform schema","default":"","examples":["Windows"]},"os_architecture":{"type":"string","title":"The os_architecture schema","default":"","examples":["x86"]},"os_release_name":{"type":"string","title":"The os_release_name schema","default":"","examples":["Microsoft Windows 8.1 Pro"]}},"additionalProperties":true},"fully_qualified_host_name":{"type":"string","title":"The fully_qualified_host_name schema","default":"","examples":["sahamedw8-1x86"]},"plugins":{"type":"object","title":"The plugins schema","default":{},"examples":[{"windows_remote_intrusion_detection_and_prevention":{"product_name":"Windows Remote Intrusion Detection and Prevention","plugin_version":"1.2.0.21"},"endpoint_protection":{"sdk_version":"4.2.1.90","product_name":"Endpoint Protection","plugin_version":"1.2.0.844","update_package_version":"1.0.31870","component_package_version":"1.0.1085","reboot_reasons":0},"asset_manager":{"product_name":"Asset Manager","plugin_version":"1.2.0.330","reboot_reasons":0},"endpoint_detection_and_response":{"product_name":"Endpoint Detection and Response","plugin_version":"1.2.0.297","reboot_reasons":0}}],"properties":{"windows_remote_intrusion_detection_and_prevention":{"type":"object","title":"The windows_remote_intrusion_detection_and_prevention schema","default":{},"examples":[{"product_name":"Windows Remote Intrusion Detection and Prevention","plugin_version":"1.2.0.21"}],"properties":{"product_name":{"type":"string","title":"The product_name schema","default":"","examples":["Windows Remote Intrusion Detection and Prevention"]},"plugin_version":{"type":"string","title":"The plugin_version schema","default":"","examples":["1.2.0.21"]}},"additionalProperties":true},"endpoint_protection":{"type":"object","title":"The endpoint_protection schema","default":{},"examples":[{"sdk_version":"4.2.1.90","product_name":"Endpoint Protection","plugin_version":"1.2.0.844","update_package_version":"1.0.31870","component_package_version":"1.0.1085","reboot_reasons":0}],"properties":{"sdk_version":{"type":"string","title":"The sdk_version schema","default":"","examples":["4.2.1.90"]},"product_name":{"type":"string","title":"The product_name schema","default":"","examples":["Endpoint Protection"]},"plugin_version":{"type":"string","title":"The plugin_version schema","default":"","examples":["1.2.0.844"]},"update_package_version":{"type":"string","title":"The update_package_version schema","default":"","examples":["1.0.31870"]},"component_package_version":{"type":"string","title":"The component_package_version schema","default":"","examples":["1.0.1085"]},"reboot_reasons":{"type":"integer","title":"The reboot_reasons schema","default":0,"examples":[0]}},"additionalProperties":true},"asset_manager":{"type":"object","title":"The asset_manager schema","default":{},"examples":[{"product_name":"Asset Manager","plugin_version":"1.2.0.330","reboot_reasons":0}],"properties":{"product_name":{"type":"string","title":"The product_name schema","default":"","examples":["Asset Manager"]},"plugin_version":{"type":"string","title":"The plugin_version schema","default":"","examples":["1.2.0.330"]},"reboot_reasons":{"type":"integer","title":"The reboot_reasons schema","default":0,"examples":[0]}},"additionalProperties":true},"endpoint_detection_and_response":{"type":"object","title":"The endpoint_detection_and_response schema","default":{},"examples":[{"product_name":"Endpoint Detection and Response","plugin_version":"1.2.0.297","reboot_reasons":0}],"properties":{"product_name":{"type":"string","title":"The product_name schema","default":"","examples":["Endpoint Detection and Response"]},"plugin_version":{"type":"string","title":"The plugin_version schema","default":"","examples":["1.2.0.297"]},"reboot_reasons":{"type":"integer","title":"The reboot_reasons schema","default":0,"examples":[0]}},"additionalProperties":true}},"additionalProperties":true},"engine_version":{"type":"string","title":"The engine_version schema","default":"","examples":["1.2.0.821"]},"policy_etag":{"type":"string","title":"The policy_etag schema","default":"","examples":["c6ea44914b72c92cba939ac3bd369dc4"]},"last_user":{"type":"string","title":"The last_user schema","default":"","examples":["SAHAMEDW8-1X86\\Administrator"]},"host_name":{"type":"string","title":"The host_name schema","default":"","examples":["sahamedw8-1x86"]},"machine_id":{"type":"string","title":"The machine_id schema","default":"","examples":["f2bcafe1-cb2b-4833-b6c9-6148b9511c8f"]},"machine_ip":{"type":"string","title":"The machine_ip schema","default":"","examples":["216.75.233.210"]},"object_guid":{"type":"string","title":"The object_guid schema","default":""}}},"source_location":{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"The root schema","description":"The root schema comprises the entire JSON document.","default":{},"examples":[{"city":"Santa Clara","continent":"North America","subdivisions":["California"],"country":"United States","country_iso":"US","accuracy_radius":10,"point":{"lat":37.3417,"lon":-121.9753},"postal_code":"95051","anonymous_proxy":false,"time_zone":"America/Los_Angeles"}],"properties":{"city":{"type":"string","title":"The city schema","default":"","examples":["Santa Clara"]},"continent":{"type":"string","title":"The continent schema","default":"","examples":["North America"]},"subdivisions":{"type":"array","title":"The subdivisions schema","default":[],"examples":[["California"]],"items":{"anyOf":[{"type":"string","title":"The first anyOf schema","default":"","examples":["California"]}]}},"country":{"type":"string","title":"The country schema","default":"","examples":["United States"]},"country_iso":{"type":"string","title":"The country_iso schema","default":"","examples":["United States"]},"accuracy_radius":{"type":"integer","title":"The accuracy_radius schema","default":0,"examples":[10]},"point":{"type":"object","title":"The point schema","default":{},"examples":[{"lat":37.3417,"lon":-121.9753}],"properties":{"lat":{"allOf":[{"bignumber":true},{"type":"number","title":"The latitude","default":0,"examples":[37.3417]}]},"lon":{"allOf":[{"bignumber":true},{"type":"number","title":"The longitude","default":0,"examples":[-121.9753]}]}}},"postal_code":{"type":"string","title":"The postal_code schema","default":"","examples":["95051"]},"anonymous_proxy":{"type":"boolean","title":"The anonymous_proxy schema","default":false,"examples":[false]},"time_zone":{"type":"string","title":"The time_zone schema","default":"","examples":["America/Los_Angeles"]}}},"destination_location":{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"The root schema","description":"The root schema comprises the entire JSON document.","default":{},"examples":[{"city":"Santa Clara","continent":"North America","subdivisions":["California"],"country":"United States","country_iso":"US","accuracy_radius":10,"point":{"lat":37.3417,"lon":-121.9753},"postal_code":"95051","anonymous_proxy":false,"time_zone":"America/Los_Angeles"}],"properties":{"city":{"type":"string","title":"The city schema","default":"","examples":["Santa Clara"]},"continent":{"type":"string","title":"The continent schema","default":"","examples":["North America"]},"subdivisions":{"type":"array","title":"The subdivisions schema","default":[],"examples":[["California"]],"items":{"anyOf":[{"type":"string","title":"The first anyOf schema","default":"","examples":["California"]}]}},"country":{"type":"string","title":"The country schema","default":"","examples":["United States"]},"country_iso":{"type":"string","title":"The country_iso schema","default":"","examples":["United States"]},"accuracy_radius":{"type":"integer","title":"The accuracy_radius schema","default":0,"examples":[10]},"point":{"type":"object","title":"The point schema","default":{},"examples":[{"lat":37.3417,"lon":-121.9753}],"properties":{"lat":{"allOf":[{"bignumber":true},{"type":"number","title":"The latitude","default":0,"examples":[37.3417]}]},"lon":{"allOf":[{"bignumber":true},{"type":"number","title":"The longitude","default":0,"examples":[-121.9753]}]}}},"postal_code":{"type":"string","title":"The postal_code schema","default":"","examples":["95051"]},"anonymous_proxy":{"type":"boolean","title":"The anonymous_proxy schema","default":false,"examples":[false]},"time_zone":{"type":"string","title":"The time_zone schema","default":"","examples":["America/Los_Angeles"]}}}}}]}},"aggregations":{"type":"object","title":"Aggregations","additionalProperties":true},"total_count":{"type":"integer","title":"Total count of found detections"},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}},"required":["rules","total_count"]}}}}},"tags":["Grid"],"operationId":"api.rmm.grid.search.rid"}},"/oneview/v1/grid/rid/search-groupby":{"post":{"description":"Search grouped RID rules across accounts","summary":"Search grouped RID rules","simple_schema":"rid-search-groupby-grid-rmm-simple","security":[{"client_credentials":["read"]},{"user_permissions":["bruteForce.view"]}],"status":{"incident":["read_nebula_data"],"outage":["auth","search_stateful"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"title":"RID Search Groupby Schema","type":"object","allOf":[{"type":"object","required":["group_by","page_size"],"properties":{"group_by":{"title":"Group by the following fields","type":"array","minItems":1,"uniqueItems":true,"items":{"type":"string"}},"page_size":{"type":"number","title":"The page_size Schema","minimum":50,"maximum":2000}}},{"type":"object","allOf":[{"type":"object","allOf":[{"properties":{"constraints":{"type":"array","items":{"title":"RID Constraints","type":"object","required":["field"],"anyOf":[{"title":"String (Equals, Not Equals) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"title":"RID Simple String Fields","type":"string","enum":["group_name","policy_name","account_name","protocol","attack_user","machine_name"]},{"title":"RID UID Fields","type":"string","enum":["id","rule_id","origin_id","machine_id","group_id","root_group_id","policy_id"]},{"title":"Agent Simple String Fields","type":"string","enum":["agent.nics.mac_address","agent.nics.description","agent.os_info.os_version","agent.os_info.os_release_name","agent.os_info.os_architecture","agent.plugins.asset_manager.plugin_version","agent.plugins.asset_manager.alerts.codes","agent.plugins.endpoint_protection.plugin_version","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.plugins.endpoint_protection.update_package_version","agent.plugins.endpoint_protection.alerts.codes","agent.plugins.endpoint_detection_and_response.plugin_version","agent.plugins.endpoint_detection_and_response.alerts.codes","agent.plugins.incident_response.plugin_version","agent.plugins.incident_response.update_package_version","agent.plugins.incident_response.alerts.codes","agent.plugins.siem.plugin_version","agent.plugins.siem.alerts.codes","agent.plugins.browser_phishing_protection.plugin_version","agent.plugins.browser_phishing_protection.alerts.codes","agent.engine_version","agent.source_location.city","agent.source_location.country","agent.source_location.subdivisions","agent.source_location.time_zone","agent.domain_name","agent.alias","agent.policy_etag","agent.serial_number","agent.available_software_updates.sdk_version.currentVersion","agent.available_software_updates.sdk_version.newVersion","agent.alerts.codes","agent.host_name","agent.fully_qualified_host_name","agent.object_guid","agent.last_user","agent.active_directory.user.display_name","agent.active_directory.user.ou","agent.active_directory.user.ou.path","agent.active_directory.user.sam_account_name","agent.active_directory.machine.display_name","agent.active_directory.machine.ou","agent.active_directory.machine.ou.path","agent.active_directory.machine.sam_account_name"]},{"title":"Agent Enum String Fields","type":"string","enum":["agent.os_info.os_type","agent.os_info.os_platform"]},{"title":"Agent Version fields","type":"string","enum":["agent.plugins.asset_manager.plugin_version","agent.plugins.endpoint_protection.plugin_version","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.plugins.endpoint_protection.update_package_version","agent.plugins.endpoint_detection_and_response.plugin_version","agent.plugins.incident_response.plugin_version","agent.plugins.incident_response.update_package_version","agent.available_software_updates.sdk_version.currentVersion","agent.available_software_updates.sdk_version.newVersion"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["equals","not_equals"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}}},"if":{"properties":{"field":{"title":"RID UID Fields","type":"string","enum":["id","rule_id","origin_id","machine_id","group_id","root_group_id","policy_id"]}}},"then":{"properties":{"value":{"type":["string","array"],"format":"uuid","items":{"type":"string","format":"uuid"}}}}},{"title":"String (Contains, Not Contains) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"title":"RID Simple String Fields","type":"string","enum":["group_name","policy_name","account_name","protocol","attack_user","machine_name"]},{"title":"Agent Simple String Fields","type":"string","enum":["agent.nics.mac_address","agent.nics.description","agent.os_info.os_version","agent.os_info.os_release_name","agent.os_info.os_architecture","agent.plugins.asset_manager.plugin_version","agent.plugins.asset_manager.alerts.codes","agent.plugins.endpoint_protection.plugin_version","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.plugins.endpoint_protection.update_package_version","agent.plugins.endpoint_protection.alerts.codes","agent.plugins.endpoint_detection_and_response.plugin_version","agent.plugins.endpoint_detection_and_response.alerts.codes","agent.plugins.incident_response.plugin_version","agent.plugins.incident_response.update_package_version","agent.plugins.incident_response.alerts.codes","agent.plugins.siem.plugin_version","agent.plugins.siem.alerts.codes","agent.plugins.browser_phishing_protection.plugin_version","agent.plugins.browser_phishing_protection.alerts.codes","agent.engine_version","agent.source_location.city","agent.source_location.country","agent.source_location.subdivisions","agent.source_location.time_zone","agent.domain_name","agent.alias","agent.policy_etag","agent.serial_number","agent.available_software_updates.sdk_version.currentVersion","agent.available_software_updates.sdk_version.newVersion","agent.alerts.codes","agent.host_name","agent.fully_qualified_host_name","agent.object_guid","agent.last_user","agent.active_directory.user.display_name","agent.active_directory.user.ou","agent.active_directory.user.ou.path","agent.active_directory.user.sam_account_name","agent.active_directory.machine.display_name","agent.active_directory.machine.ou","agent.active_directory.machine.ou.path","agent.active_directory.machine.sam_account_name"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["contains","not_contains"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}}}},{"title":"Number Constraints (gt, gte, lt, lte, equals)","properties":{"field":{"type":"string","oneOf":[{"title":"RID Number Fields","type":"string","enum":["port","attempts","duration"]},{"title":"Agent Number Fields","type":"string","enum":["agent.started_at_offset","agent.plugins.asset_manager.reboot_reasons","agent.plugins.endpoint_protection.reboot_reasons","agent.plugins.endpoint_detection_and_response.reboot_reasons","agent.plugins.incident_response.reboot_reasons","agent.plugins.siem.reboot_reasons","agent.os_version_major","agent.os_version_minor"]}]}},"oneOf":[{"minProperties":1,"title":"Specify Number Range","not":{"anyOf":[{"required":["operator"]},{"required":["value"]}]},"properties":{"gt":{"type":"number","title":"Greater than"},"lt":{"type":"number","title":"Less than"},"gte":{"type":"number","title":"Greater than or equals"},"lte":{"type":"number","title":"Less than or equals"}}},{"title":"Specify Exact Number","not":{"anyOf":[{"required":["gt"]},{"required":["lt"]},{"required":["gte"]},{"required":["lte"]}]},"required":["operator","value"],"properties":{"operator":{"type":"string","enum":["equals"]},"value":{"type":["number","array"],"title":"Value to search","items":{"type":"number"}}}}]},{"title":"Date (start, end) Constraints","properties":{"field":{"oneOf":[{"title":"RID Date Fields","type":"string","enum":["create_time"]},{"title":"Agent Date Fields","type":"string","enum":["agent.at","agent.started_at_local"]}]}},"oneOf":[{"minProperties":1,"title":"Specify Date Range","not":{"anyOf":[{"required":["operator"]},{"required":["value"]}]},"properties":{"start":{"type":"string","format":"date-time","title":"Start Date"},"end":{"type":"string","format":"date-time","title":"End Date"}}},{"title":"Specify Exact Date","not":{"anyOf":[{"required":["start"]},{"required":["end"]}]},"required":["operator","value"],"properties":{"operator":{"type":"string","enum":["equals"]},"value":{"type":["string","array"],"format":"date-time","title":"Value to search","items":{"format":"date-time"}}}}]},{"title":"IP Constraints","properties":{"field":{"oneOf":[{"title":"RID IP Fields","type":"string","enum":["ip"]},{"title":"Agent IP Fields","type":"string","enum":["agent.nics.ips","agent.machine_ip"]}]},"operator":{"type":"string","enum":["ip"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}}}},{"title":"Field Exists/Not Exists Constraints","required":["operator"],"properties":{"field":{"type":"string","oneOf":[{"title":"RID Simple String Fields","type":"string","enum":["group_name","policy_name","account_name","protocol","attack_user","machine_name"]},{"title":"RID UID Fields","type":"string","enum":["id","rule_id","origin_id","machine_id","group_id","root_group_id","policy_id"]},{"title":"Agent Simple String Fields","type":"string","enum":["agent.nics.mac_address","agent.nics.description","agent.os_info.os_version","agent.os_info.os_release_name","agent.os_info.os_architecture","agent.plugins.asset_manager.plugin_version","agent.plugins.asset_manager.alerts.codes","agent.plugins.endpoint_protection.plugin_version","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.plugins.endpoint_protection.update_package_version","agent.plugins.endpoint_protection.alerts.codes","agent.plugins.endpoint_detection_and_response.plugin_version","agent.plugins.endpoint_detection_and_response.alerts.codes","agent.plugins.incident_response.plugin_version","agent.plugins.incident_response.update_package_version","agent.plugins.incident_response.alerts.codes","agent.plugins.siem.plugin_version","agent.plugins.siem.alerts.codes","agent.plugins.browser_phishing_protection.plugin_version","agent.plugins.browser_phishing_protection.alerts.codes","agent.engine_version","agent.source_location.city","agent.source_location.country","agent.source_location.subdivisions","agent.source_location.time_zone","agent.domain_name","agent.alias","agent.policy_etag","agent.serial_number","agent.available_software_updates.sdk_version.currentVersion","agent.available_software_updates.sdk_version.newVersion","agent.alerts.codes","agent.host_name","agent.fully_qualified_host_name","agent.object_guid","agent.last_user","agent.active_directory.user.display_name","agent.active_directory.user.ou","agent.active_directory.user.ou.path","agent.active_directory.user.sam_account_name","agent.active_directory.machine.display_name","agent.active_directory.machine.ou","agent.active_directory.machine.ou.path","agent.active_directory.machine.sam_account_name"]},{"title":"Agent Enum String Fields","type":"string","enum":["agent.os_info.os_type","agent.os_info.os_platform"]},{"title":"Agent Version fields","type":"string","enum":["agent.plugins.asset_manager.plugin_version","agent.plugins.endpoint_protection.plugin_version","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.plugins.endpoint_protection.update_package_version","agent.plugins.endpoint_detection_and_response.plugin_version","agent.plugins.incident_response.plugin_version","agent.plugins.incident_response.update_package_version","agent.available_software_updates.sdk_version.currentVersion","agent.available_software_updates.sdk_version.newVersion"]},{"title":"RID IP Fields","type":"string","enum":["ip"]},{"title":"Agent IP Fields","type":"string","enum":["agent.nics.ips","agent.machine_ip"]},{"title":"RID Date Fields","type":"string","enum":["create_time"]},{"title":"Agent Date Fields","type":"string","enum":["agent.at","agent.started_at_local"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["exists","not_exists"]}}}]},"examples":[[{"field":"group_name","value":"Default Group","operator":"equals"}]]},"aggregations":{"items":{"type":"string","title":"RID aggregation fields","enum":["protection_status","agent.os_info.os_release_name","agent.nics.ips","agent.nics.mac_address","agent.nics.description","agent.os_info.os_type","agent.os_info.os_version","agent.os_info.os_platform","agent.os_info.os_architecture","agent.host_name","agent.fully_qualified_host_name","agent.plugins.asset_manager.plugin_version","agent.plugins.asset_manager.reboot_reasons","agent.plugins.endpoint_protection.plugin_version","agent.plugins.endpoint_protection.sdk_version","agent.plugins.endpoint_protection.component_package_version","agent.plugins.endpoint_protection.update_package_version","agent.plugins.endpoint_protection.reboot_reasons","agent.plugins.endpoint_detection_and_response.plugin_version","agent.plugins.endpoint_detection_and_response.reboot_reasons","agent.plugins.incident_response.plugin_version","agent.plugins.incident_response.reboot_reasons","agent.plugins.siem.plugin_version","agent.plugins.siem.reboot_reasons","agent.plugins.browser_phishing_protection.plugin_version","agent.engine_version","agent.domain_name","agent.policy_etag","agent.last_user","agent.is_software_update_available","origin_id","machine_id","group_id","root_group_id","group_name","policy_id","policy_name","port","protocol","attack_user","agent.machine_ip","ip","deleted","machine_name","source_location.city","source_location.country","source_location.country_iso","source_location.continent","source_location.time_zone","source_location.postal_code","source_location.subdivisions","destination_location.city","destination_location.country","destination_location.country_iso","destination_location.continent","destination_location.time_zone","destination_location.postal_code","destination_location.subdivisions"]}},"sort_field":{"type":"string","title":"If the sort field is used, then sort_order is required.","enum":["id","rule_id","origin_id","machine_id","group_id","root_group_id","group_name","policy_id","policy_name","account_id","account_name","port","attempts","duration","protocol","attack_user","machine_ip","ip","create_time","expire_time","deleted","machine_name","at","nics.ips","nics.mac_address","nics.description.keyword","os_info.os_type","os_info.os_version.keyword","os_info.os_platform","os_info.os_architecture","os_info.os_release_name.keyword","host_name.keyword","fully_qualified_host_name.keyword","plugins.asset_manager.plugin_version.keyword","plugins.asset_manager.reboot_reasons","plugins.endpoint_protection.plugin_version.keyword","plugins.endpoint_protection.sdk_version.keyword","plugins.endpoint_protection.component_package_version.keyword","plugins.endpoint_protection.update_package_version.keyword","plugins.endpoint_protection.reboot_reasons","plugins.endpoint_detection_and_response.plugin_version.keyword","plugins.endpoint_detection_and_response.reboot_reasons","plugins.incident_response.plugin_version.keyword","plugins.incident_response.reboot_reasons","plugins.siem.plugin_version.keyword","plugins.browser_phishing_protection.plugin_version.keyword","plugins.siem.reboot_reasons","engine_version.keyword","domain_name.keyword","policy_etag","source_location.city","source_location.country","source_location.country_iso","source_location.continent","source_location.time_zone","source_location.postal_code","source_location.subdivisions","destination_location.city","destination_location.country","destination_location.country_iso","destination_location.continent","destination_location.time_zone","destination_location.postal_code","destination_location.subdivisions"]}}},{"type":"object","title":"Base Search Schema","properties":{"aggregations":{"type":"array","title":"The fields onto which you can perform aggregations","items":{"type":"string","title":"The Items Schema"}},"page_size":{"type":"number","title":"The page size. If you just need to aggregate, set it to 0","minimum":0,"maximum":2000},"sort_field":{"title":"Sort Fields","type":"string"},"sort_order":{"type":"string","title":"Whether sorting should be ascending or descending","enum":["asc","desc"]},"aggregate_by_account":{"type":"boolean","title":"Indicates whether aggregations should be scoped by account"},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}]},{"type":"object","required":["account_ids"],"properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]},{"properties":{"group_by":{"type":"array","title":"Group results by indicated field(s)","items":{"type":"string","title":"RID Groupby Fields","enum":["origin_id","machine_id","group_id","root_group_id","group_name","policy_id","policy_name","account_id","account_name","parent_id","port","protocol","attack_user","machine_ip","ip","machine_name","source_location.city","source_location.country","source_location.country_iso","source_location.continent","source_location.time_zone","source_location.postal_code","destination_location.city","destination_location.country","destination_location.country_iso","destination_location.continent","destination_location.time_zone","destination_location.postal_code"]}}}}]}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"The Post RID Search GroupBy Response Schema","required":["results","next_cursor"],"properties":{"results":{"type":"array","title":"The Results Schema","default":[]},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}}}}},"tags":["Grid"],"operationId":"api.rmm.grid.search.rid.group"}},"/oneview/v1/grid/xdr-alerts/export":{"post":{"description":"Export XDR Alerts across accounts","summary":"Export XDR Alerts","simple_schema":"xdr-alerts-export-grid-rmm-simple","security":[{"client_credentials":["execute"]},{"user_permissions":["xdr.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"title":"XDR Alerts Export Schema","type":"object","allOf":[{"type":"object","title":"Base Export Schema","required":["groups","select","format"],"properties":{"format":{"type":"string","title":"The output file","enum":["csv","xlsx","html","ods","txt","rtf","json"]},"download":{"type":"boolean","title":"Whether to instruct the client to download the response as a file. Only clients like browsers are supported"},"type":{"type":"string","title":"The encoding of the output","enum":["string","base64","binary"],"default":"string"},"select":{"type":"array","title":"Which fields to select from the response","items":{"type":"object","title":"Field","required":["field","newField"],"properties":{"newField":{"type":"string","title":"the new value"},"field":{"type":"string","title":"The response field to map to a new value"}}}},"groups":{"type":"array","title":"List of queries","items":{"type":"object"}}}},{"properties":{"select":{"items":{"properties":{"field":{"type":"string","title":"XDR Alerts select fields","enum":["account_id","account_name","metadata","action_outcome","action_taken","action_user_email","action_user_name","alert_name","category","created_at","id","rules_triggered","severity","source","status","tactics","tactic_technique","attack_technique","impacted_asset_hostname","technique","attack_detection_type","attack_category","updated_at","city","country","identity_primary_identifier","display_name","details","ip","domain","pid","process_path","detection_id","machine_id"]}}}},"groups":{"items":{"title":"List of queries to fetch XDR alerts","allOf":[{"type":"object","allOf":[{"type":"object","allOf":[{"properties":{"constraints":{"type":"array","items":{"title":"XDR Alerts Constraints","type":"object","required":["field"],"anyOf":[{"title":"String (Equals, Not Equals) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"title":"XDR Alerts Simple String Fields","type":"string","enum":["alert_name","tactics","tactic_technique","attack_technique","impacted_asset_hostname","technique","account_name","action_outcome","action_taken","action_user_email","action_user_name","attack_detection_type","attack_category","identity_primary_identifier","display_name","ip","domain"]},{"title":"XDR Alerts UID Fields","type":"string","enum":["account_id"]},{"title":"XDR Alerts Enum String Fields","type":"string","enum":["severity","status","source","category"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["equals","not_equals"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}}},"if":{"properties":{"field":{"title":"XDR Alerts UID Fields","type":"string","enum":["account_id"]}}},"then":{"properties":{"value":{"type":["string","array"],"format":"uuid","items":{"type":"string","format":"uuid"}}}}},{"title":"String (Contains, Not Contains) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"title":"XDR Alerts Simple String Fields","type":"string","enum":["alert_name","tactics","tactic_technique","attack_technique","impacted_asset_hostname","technique","account_name","action_outcome","action_taken","action_user_email","action_user_name","attack_detection_type","attack_category","identity_primary_identifier","display_name","ip","domain"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["contains","not_contains"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}}}},{"title":"Boolean (Equals) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"type":"string","title":"XDR Alerts Boolean Fields","enum":["has_impacted_asset_hostname"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["equals"]},"value":{"title":"Value to search. Must be true or false","type":"boolean"}}},{"title":"Number Constraints (gt, gte, lt, lte, equals)","properties":{"field":{"type":"string","oneOf":[{"title":"XDR Alerts Number Fields","type":"string","enum":["id"]}]}},"oneOf":[{"minProperties":1,"title":"Specify Number Range","not":{"anyOf":[{"required":["operator"]},{"required":["value"]}]},"properties":{"gt":{"type":"number","title":"Greater than"},"lt":{"type":"number","title":"Less than"},"gte":{"type":"number","title":"Greater than or equals"},"lte":{"type":"number","title":"Less than or equals"}}},{"title":"Specify Exact Number","not":{"anyOf":[{"required":["gt"]},{"required":["lt"]},{"required":["gte"]},{"required":["lte"]}]},"required":["operator","value"],"properties":{"operator":{"type":"string","enum":["equals"]},"value":{"type":["number","array"],"title":"Value to search","items":{"type":"number"}}}}]},{"title":"Date (start, end) Constraints","properties":{"field":{"oneOf":[{"title":"XDR Alerts Date Fields","type":"string","enum":["created_at"]}]}},"oneOf":[{"minProperties":1,"title":"Specify Date Range","not":{"anyOf":[{"required":["operator"]},{"required":["value"]}]},"properties":{"start":{"type":"string","format":"date-time","title":"Start Date"},"end":{"type":"string","format":"date-time","title":"End Date"}}},{"title":"Specify Exact Date","not":{"anyOf":[{"required":["start"]},{"required":["end"]}]},"required":["operator","value"],"properties":{"operator":{"type":"string","enum":["equals"]},"value":{"type":["string","array"],"format":"date-time","title":"Value to search","items":{"format":"date-time"}}}}]},{"title":"Field Exists/Not Exists Constraints","required":["operator"],"properties":{"field":{"type":"string","oneOf":[{"title":"XDR Alerts Simple String Fields","type":"string","enum":["alert_name","tactics","tactic_technique","attack_technique","impacted_asset_hostname","technique","account_name","action_outcome","action_taken","action_user_email","action_user_name","attack_detection_type","attack_category","identity_primary_identifier","display_name","ip","domain"]},{"title":"XDR Alerts UID Fields","type":"string","enum":["account_id"]},{"title":"XDR Alerts Enum String Fields","type":"string","enum":["severity","status","source","category"]},{"title":"XDR Alerts Date Fields","type":"string","enum":["created_at"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["exists","not_exists"]}}}]},"examples":[[{"field":"account_name","value":"Test Account","operator":"equals"}]]},"aggregations":{"items":{"type":"string","title":"XDR Alerts aggregation fields","enum":["severity","severity_accounts","account_id","status","status_accounts","tactics","tactics_accounts","tactic_technique","tactic_technique_accounts","attack_technique","attack_technique_accounts","impacted_asset_hostname","impacted_asset_hostname_accounts","technique","technique_accounts","created_at","identity_primary_identifier","identity_primary_identifier_count_and_last","display_name","display_name_count_and_last","attack_category","attack_category_accounts","ip","ip_accounts","domain","domain_accounts"]}},"sort_field":{"type":"string","title":"XDR Alerts sort fields","anyOf":[{"enum":["id","severity","alert_name","status","tactics","tactic_technique","attack_technique","impacted_asset_hostname","technique","created_at","account_id","account_name","source","action_outcome","action_taken","action_user_email","action_user_name","attack_detection_type","attack_category","identity_primary_identifier","display_name","ip","domain"]}]},"start_date":{"type":"string","title":"Get results after this date","format":"date-time"},"end_date":{"type":"string","title":"Get results before this date","format":"date-time"}}},{"type":"object","title":"Base Search Schema","properties":{"aggregations":{"type":"array","title":"The fields onto which you can perform aggregations","items":{"type":"string","title":"The Items Schema"}},"page_size":{"type":"number","title":"The page size. If you just need to aggregate, set it to 0","minimum":0,"maximum":2000},"sort_field":{"title":"Sort Fields","type":"string"},"sort_order":{"type":"string","title":"Whether sorting should be ascending or descending","enum":["asc","desc"]},"aggregate_by_account":{"type":"boolean","title":"Indicates whether aggregations should be scoped by account"},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}]},{"type":"object","required":["account_ids"],"properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]}]}}}}]}}}},"responses":{"200":{"description":"Successful response"}},"tags":["Grid"],"operationId":"api.rmm.grid.export.xdr-alerts"}},"/oneview/v1/grid/xdr-alerts/export/async":{"post":{"description":"Export XDR Alerts across accounts","summary":"Export XDR Alerts asynchronously","simple_schema":"xdr-alerts-export-grid-rmm-simple","security":[{"client_credentials":["execute"]},{"user_permissions":["xdr.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"title":"XDR Alerts Export Schema","type":"object","allOf":[{"type":"object","title":"Base Export Schema","required":["groups","select","format"],"properties":{"format":{"type":"string","title":"The output file","enum":["csv","xlsx","html","ods","txt","rtf","json"]},"download":{"type":"boolean","title":"Whether to instruct the client to download the response as a file. Only clients like browsers are supported"},"type":{"type":"string","title":"The encoding of the output","enum":["string","base64","binary"],"default":"string"},"select":{"type":"array","title":"Which fields to select from the response","items":{"type":"object","title":"Field","required":["field","newField"],"properties":{"newField":{"type":"string","title":"the new value"},"field":{"type":"string","title":"The response field to map to a new value"}}}},"groups":{"type":"array","title":"List of queries","items":{"type":"object"}}}},{"properties":{"select":{"items":{"properties":{"field":{"type":"string","title":"XDR Alerts select fields","enum":["account_id","account_name","metadata","action_outcome","action_taken","action_user_email","action_user_name","alert_name","category","created_at","id","rules_triggered","severity","source","status","tactics","tactic_technique","attack_technique","impacted_asset_hostname","technique","attack_detection_type","attack_category","updated_at","city","country","identity_primary_identifier","display_name","details","ip","domain","pid","process_path","detection_id","machine_id"]}}}},"groups":{"items":{"title":"List of queries to fetch XDR alerts","allOf":[{"type":"object","allOf":[{"type":"object","allOf":[{"properties":{"constraints":{"type":"array","items":{"title":"XDR Alerts Constraints","type":"object","required":["field"],"anyOf":[{"title":"String (Equals, Not Equals) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"title":"XDR Alerts Simple String Fields","type":"string","enum":["alert_name","tactics","tactic_technique","attack_technique","impacted_asset_hostname","technique","account_name","action_outcome","action_taken","action_user_email","action_user_name","attack_detection_type","attack_category","identity_primary_identifier","display_name","ip","domain"]},{"title":"XDR Alerts UID Fields","type":"string","enum":["account_id"]},{"title":"XDR Alerts Enum String Fields","type":"string","enum":["severity","status","source","category"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["equals","not_equals"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}}},"if":{"properties":{"field":{"title":"XDR Alerts UID Fields","type":"string","enum":["account_id"]}}},"then":{"properties":{"value":{"type":["string","array"],"format":"uuid","items":{"type":"string","format":"uuid"}}}}},{"title":"String (Contains, Not Contains) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"title":"XDR Alerts Simple String Fields","type":"string","enum":["alert_name","tactics","tactic_technique","attack_technique","impacted_asset_hostname","technique","account_name","action_outcome","action_taken","action_user_email","action_user_name","attack_detection_type","attack_category","identity_primary_identifier","display_name","ip","domain"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["contains","not_contains"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}}}},{"title":"Boolean (Equals) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"type":"string","title":"XDR Alerts Boolean Fields","enum":["has_impacted_asset_hostname"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["equals"]},"value":{"title":"Value to search. Must be true or false","type":"boolean"}}},{"title":"Number Constraints (gt, gte, lt, lte, equals)","properties":{"field":{"type":"string","oneOf":[{"title":"XDR Alerts Number Fields","type":"string","enum":["id"]}]}},"oneOf":[{"minProperties":1,"title":"Specify Number Range","not":{"anyOf":[{"required":["operator"]},{"required":["value"]}]},"properties":{"gt":{"type":"number","title":"Greater than"},"lt":{"type":"number","title":"Less than"},"gte":{"type":"number","title":"Greater than or equals"},"lte":{"type":"number","title":"Less than or equals"}}},{"title":"Specify Exact Number","not":{"anyOf":[{"required":["gt"]},{"required":["lt"]},{"required":["gte"]},{"required":["lte"]}]},"required":["operator","value"],"properties":{"operator":{"type":"string","enum":["equals"]},"value":{"type":["number","array"],"title":"Value to search","items":{"type":"number"}}}}]},{"title":"Date (start, end) Constraints","properties":{"field":{"oneOf":[{"title":"XDR Alerts Date Fields","type":"string","enum":["created_at"]}]}},"oneOf":[{"minProperties":1,"title":"Specify Date Range","not":{"anyOf":[{"required":["operator"]},{"required":["value"]}]},"properties":{"start":{"type":"string","format":"date-time","title":"Start Date"},"end":{"type":"string","format":"date-time","title":"End Date"}}},{"title":"Specify Exact Date","not":{"anyOf":[{"required":["start"]},{"required":["end"]}]},"required":["operator","value"],"properties":{"operator":{"type":"string","enum":["equals"]},"value":{"type":["string","array"],"format":"date-time","title":"Value to search","items":{"format":"date-time"}}}}]},{"title":"Field Exists/Not Exists Constraints","required":["operator"],"properties":{"field":{"type":"string","oneOf":[{"title":"XDR Alerts Simple String Fields","type":"string","enum":["alert_name","tactics","tactic_technique","attack_technique","impacted_asset_hostname","technique","account_name","action_outcome","action_taken","action_user_email","action_user_name","attack_detection_type","attack_category","identity_primary_identifier","display_name","ip","domain"]},{"title":"XDR Alerts UID Fields","type":"string","enum":["account_id"]},{"title":"XDR Alerts Enum String Fields","type":"string","enum":["severity","status","source","category"]},{"title":"XDR Alerts Date Fields","type":"string","enum":["created_at"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["exists","not_exists"]}}}]},"examples":[[{"field":"account_name","value":"Test Account","operator":"equals"}]]},"aggregations":{"items":{"type":"string","title":"XDR Alerts aggregation fields","enum":["severity","severity_accounts","account_id","status","status_accounts","tactics","tactics_accounts","tactic_technique","tactic_technique_accounts","attack_technique","attack_technique_accounts","impacted_asset_hostname","impacted_asset_hostname_accounts","technique","technique_accounts","created_at","identity_primary_identifier","identity_primary_identifier_count_and_last","display_name","display_name_count_and_last","attack_category","attack_category_accounts","ip","ip_accounts","domain","domain_accounts"]}},"sort_field":{"type":"string","title":"XDR Alerts sort fields","anyOf":[{"enum":["id","severity","alert_name","status","tactics","tactic_technique","attack_technique","impacted_asset_hostname","technique","created_at","account_id","account_name","source","action_outcome","action_taken","action_user_email","action_user_name","attack_detection_type","attack_category","identity_primary_identifier","display_name","ip","domain"]}]},"start_date":{"type":"string","title":"Get results after this date","format":"date-time"},"end_date":{"type":"string","title":"Get results before this date","format":"date-time"}}},{"type":"object","title":"Base Search Schema","properties":{"aggregations":{"type":"array","title":"The fields onto which you can perform aggregations","items":{"type":"string","title":"The Items Schema"}},"page_size":{"type":"number","title":"The page size. If you just need to aggregate, set it to 0","minimum":0,"maximum":2000},"sort_field":{"title":"Sort Fields","type":"string"},"sort_order":{"type":"string","title":"Whether sorting should be ascending or descending","enum":["asc","desc"]},"aggregate_by_account":{"type":"boolean","title":"Indicates whether aggregations should be scoped by account"},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}]},{"type":"object","required":["account_ids"],"properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]}]}}}}]}}}},"responses":{"200":{"description":"Successful response"}},"tags":["Grid"],"operationId":"api.rmm.grid.export.xdr-alerts.async"}},"/oneview/v1/grid/xdr-alerts/search":{"post":{"description":"Search XDR Alerts across accounts","summary":"Search XDR Alerts","simple_schema":"xdr-alerts-search-grid-rmm-simple","security":[{"client_credentials":["read"]},{"user_permissions":["xdr.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","allOf":[{"type":"object","allOf":[{"properties":{"constraints":{"type":"array","items":{"title":"XDR Alerts Constraints","type":"object","required":["field"],"anyOf":[{"title":"String (Equals, Not Equals) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"title":"XDR Alerts Simple String Fields","type":"string","enum":["alert_name","tactics","tactic_technique","attack_technique","impacted_asset_hostname","technique","account_name","action_outcome","action_taken","action_user_email","action_user_name","attack_detection_type","attack_category","identity_primary_identifier","display_name","ip","domain"]},{"title":"XDR Alerts UID Fields","type":"string","enum":["account_id"]},{"title":"XDR Alerts Enum String Fields","type":"string","enum":["severity","status","source","category"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["equals","not_equals"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}}},"if":{"properties":{"field":{"title":"XDR Alerts UID Fields","type":"string","enum":["account_id"]}}},"then":{"properties":{"value":{"type":["string","array"],"format":"uuid","items":{"type":"string","format":"uuid"}}}}},{"title":"String (Contains, Not Contains) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"title":"XDR Alerts Simple String Fields","type":"string","enum":["alert_name","tactics","tactic_technique","attack_technique","impacted_asset_hostname","technique","account_name","action_outcome","action_taken","action_user_email","action_user_name","attack_detection_type","attack_category","identity_primary_identifier","display_name","ip","domain"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["contains","not_contains"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}}}},{"title":"Boolean (Equals) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"type":"string","title":"XDR Alerts Boolean Fields","enum":["has_impacted_asset_hostname"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["equals"]},"value":{"title":"Value to search. Must be true or false","type":"boolean"}}},{"title":"Number Constraints (gt, gte, lt, lte, equals)","properties":{"field":{"type":"string","oneOf":[{"title":"XDR Alerts Number Fields","type":"string","enum":["id"]}]}},"oneOf":[{"minProperties":1,"title":"Specify Number Range","not":{"anyOf":[{"required":["operator"]},{"required":["value"]}]},"properties":{"gt":{"type":"number","title":"Greater than"},"lt":{"type":"number","title":"Less than"},"gte":{"type":"number","title":"Greater than or equals"},"lte":{"type":"number","title":"Less than or equals"}}},{"title":"Specify Exact Number","not":{"anyOf":[{"required":["gt"]},{"required":["lt"]},{"required":["gte"]},{"required":["lte"]}]},"required":["operator","value"],"properties":{"operator":{"type":"string","enum":["equals"]},"value":{"type":["number","array"],"title":"Value to search","items":{"type":"number"}}}}]},{"title":"Date (start, end) Constraints","properties":{"field":{"oneOf":[{"title":"XDR Alerts Date Fields","type":"string","enum":["created_at"]}]}},"oneOf":[{"minProperties":1,"title":"Specify Date Range","not":{"anyOf":[{"required":["operator"]},{"required":["value"]}]},"properties":{"start":{"type":"string","format":"date-time","title":"Start Date"},"end":{"type":"string","format":"date-time","title":"End Date"}}},{"title":"Specify Exact Date","not":{"anyOf":[{"required":["start"]},{"required":["end"]}]},"required":["operator","value"],"properties":{"operator":{"type":"string","enum":["equals"]},"value":{"type":["string","array"],"format":"date-time","title":"Value to search","items":{"format":"date-time"}}}}]},{"title":"Field Exists/Not Exists Constraints","required":["operator"],"properties":{"field":{"type":"string","oneOf":[{"title":"XDR Alerts Simple String Fields","type":"string","enum":["alert_name","tactics","tactic_technique","attack_technique","impacted_asset_hostname","technique","account_name","action_outcome","action_taken","action_user_email","action_user_name","attack_detection_type","attack_category","identity_primary_identifier","display_name","ip","domain"]},{"title":"XDR Alerts UID Fields","type":"string","enum":["account_id"]},{"title":"XDR Alerts Enum String Fields","type":"string","enum":["severity","status","source","category"]},{"title":"XDR Alerts Date Fields","type":"string","enum":["created_at"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["exists","not_exists"]}}}]},"examples":[[{"field":"account_name","value":"Test Account","operator":"equals"}]]},"aggregations":{"items":{"type":"string","title":"XDR Alerts aggregation fields","enum":["severity","severity_accounts","account_id","status","status_accounts","tactics","tactics_accounts","tactic_technique","tactic_technique_accounts","attack_technique","attack_technique_accounts","impacted_asset_hostname","impacted_asset_hostname_accounts","technique","technique_accounts","created_at","identity_primary_identifier","identity_primary_identifier_count_and_last","display_name","display_name_count_and_last","attack_category","attack_category_accounts","ip","ip_accounts","domain","domain_accounts"]}},"sort_field":{"type":"string","title":"XDR Alerts sort fields","anyOf":[{"enum":["id","severity","alert_name","status","tactics","tactic_technique","attack_technique","impacted_asset_hostname","technique","created_at","account_id","account_name","source","action_outcome","action_taken","action_user_email","action_user_name","attack_detection_type","attack_category","identity_primary_identifier","display_name","ip","domain"]}]},"start_date":{"type":"string","title":"Get results after this date","format":"date-time"},"end_date":{"type":"string","title":"Get results before this date","format":"date-time"}}},{"type":"object","title":"Base Search Schema","properties":{"aggregations":{"type":"array","title":"The fields onto which you can perform aggregations","items":{"type":"string","title":"The Items Schema"}},"page_size":{"type":"number","title":"The page size. If you just need to aggregate, set it to 0","minimum":0,"maximum":2000},"sort_field":{"title":"Sort Fields","type":"string"},"sort_order":{"type":"string","title":"Whether sorting should be ascending or descending","enum":["asc","desc"]},"aggregate_by_account":{"type":"boolean","title":"Indicates whether aggregations should be scoped by account"},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}]},{"type":"object","required":["account_ids"],"properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"The xdr-alerts Search Response Schema","required":["results","next_cursor"],"properties":{"results":{"type":"array","items":{"type":"object","properties":{"account_id":{"type":"string"},"account_name":{"type":"string"},"metadata":{"type":"object","additionalProperties":true,"properties":{"action":{"type":"object","additionalProperties":false,"properties":{"user_email":{"type":["string","null"]},"user_name":{"type":["string","null"]}}}}},"action_taken":{"type":"string","examples":["false_positive"]},"action_user_email":{"type":"string"},"action_user_name":{"type":"string"},"action_outcome":{"type":"string","examples":["allow","block","challenge"]},"has_impacted_asset_hostname":{"type":"boolean"},"alert_name":{"type":"string"},"category":{"type":"string"},"created_at":{"type":"string","format":"date-time"},"id":{"type":"integer"},"rules_triggered":{"type":"array","items":{"type":"string"}},"severity":{"type":"string"},"source":{"type":"string"},"status":{"type":"string"},"tactics":{"type":"array","items":{"type":"string"}},"tactic_technique":{"type":"array","items":{"type":"string"}},"attack_technique":{"type":"array","items":{"type":"string"}},"impacted_asset_hostname":{"type":"array","items":{"type":"string"}},"technique":{"type":"string"},"attack_detection_type":{"type":"string"},"attack_category":{"type":"string"},"updated_at":{"type":"string","format":"date-time"},"city":{"type":"string"},"country":{"type":"string"},"identity_primary_identifier":{"type":"string"},"display_name":{"type":"string"},"details":{"type":"object"},"impacted_assets":{"type":"array","items":{"type":"object","additionalProperties":true}},"dynamic_fields":{"type":"object"},"domain":{"type":"string"},"ip":{"type":"string"},"pid":{"type":"string"},"process_path":{"type":"string"},"detection_id":{"type":"integer"},"machine_id":{"type":"string","format":"uuid"},"tactics_description":{"type":"array","items":{"type":"string"}},"techniques_description":{"type":"array","items":{"type":"string"}}}}},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}}}}},"tags":["Grid"],"operationId":"api.rmm.grid.search.xdr-alerts"}},"/oneview/v1/grid/xdr-alerts/search-groupby":{"post":{"description":"Search grouped XDR Alerts across accounts","summary":"Search grouped XDR Alerts","simple_schema":"xdr-alerts-search-groupby-grid-rmm-simple","security":[{"client_credentials":["read"]},{"user_permissions":["xdr.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"title":"XDR Alerts Search Groupby Schema","type":"object","allOf":[{"type":"object","required":["group_by","page_size"],"properties":{"group_by":{"title":"Group by the following fields","type":"array","minItems":1,"uniqueItems":true,"items":{"type":"string"}},"page_size":{"type":"number","title":"The page_size Schema","minimum":50,"maximum":2000}}},{"type":"object","allOf":[{"type":"object","allOf":[{"properties":{"constraints":{"type":"array","items":{"title":"XDR Alerts Constraints","type":"object","required":["field"],"anyOf":[{"title":"String (Equals, Not Equals) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"title":"XDR Alerts Simple String Fields","type":"string","enum":["alert_name","tactics","tactic_technique","attack_technique","impacted_asset_hostname","technique","account_name","action_outcome","action_taken","action_user_email","action_user_name","attack_detection_type","attack_category","identity_primary_identifier","display_name","ip","domain"]},{"title":"XDR Alerts UID Fields","type":"string","enum":["account_id"]},{"title":"XDR Alerts Enum String Fields","type":"string","enum":["severity","status","source","category"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["equals","not_equals"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}}},"if":{"properties":{"field":{"title":"XDR Alerts UID Fields","type":"string","enum":["account_id"]}}},"then":{"properties":{"value":{"type":["string","array"],"format":"uuid","items":{"type":"string","format":"uuid"}}}}},{"title":"String (Contains, Not Contains) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"title":"XDR Alerts Simple String Fields","type":"string","enum":["alert_name","tactics","tactic_technique","attack_technique","impacted_asset_hostname","technique","account_name","action_outcome","action_taken","action_user_email","action_user_name","attack_detection_type","attack_category","identity_primary_identifier","display_name","ip","domain"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["contains","not_contains"]},"value":{"type":["string","array"],"title":"Value to search","items":{"type":"string"}}}},{"title":"Boolean (Equals) Constraints","required":["operator","value"],"properties":{"field":{"type":"string","oneOf":[{"type":"string","title":"XDR Alerts Boolean Fields","enum":["has_impacted_asset_hostname"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["equals"]},"value":{"title":"Value to search. Must be true or false","type":"boolean"}}},{"title":"Number Constraints (gt, gte, lt, lte, equals)","properties":{"field":{"type":"string","oneOf":[{"title":"XDR Alerts Number Fields","type":"string","enum":["id"]}]}},"oneOf":[{"minProperties":1,"title":"Specify Number Range","not":{"anyOf":[{"required":["operator"]},{"required":["value"]}]},"properties":{"gt":{"type":"number","title":"Greater than"},"lt":{"type":"number","title":"Less than"},"gte":{"type":"number","title":"Greater than or equals"},"lte":{"type":"number","title":"Less than or equals"}}},{"title":"Specify Exact Number","not":{"anyOf":[{"required":["gt"]},{"required":["lt"]},{"required":["gte"]},{"required":["lte"]}]},"required":["operator","value"],"properties":{"operator":{"type":"string","enum":["equals"]},"value":{"type":["number","array"],"title":"Value to search","items":{"type":"number"}}}}]},{"title":"Date (start, end) Constraints","properties":{"field":{"oneOf":[{"title":"XDR Alerts Date Fields","type":"string","enum":["created_at"]}]}},"oneOf":[{"minProperties":1,"title":"Specify Date Range","not":{"anyOf":[{"required":["operator"]},{"required":["value"]}]},"properties":{"start":{"type":"string","format":"date-time","title":"Start Date"},"end":{"type":"string","format":"date-time","title":"End Date"}}},{"title":"Specify Exact Date","not":{"anyOf":[{"required":["start"]},{"required":["end"]}]},"required":["operator","value"],"properties":{"operator":{"type":"string","enum":["equals"]},"value":{"type":["string","array"],"format":"date-time","title":"Value to search","items":{"format":"date-time"}}}}]},{"title":"Field Exists/Not Exists Constraints","required":["operator"],"properties":{"field":{"type":"string","oneOf":[{"title":"XDR Alerts Simple String Fields","type":"string","enum":["alert_name","tactics","tactic_technique","attack_technique","impacted_asset_hostname","technique","account_name","action_outcome","action_taken","action_user_email","action_user_name","attack_detection_type","attack_category","identity_primary_identifier","display_name","ip","domain"]},{"title":"XDR Alerts UID Fields","type":"string","enum":["account_id"]},{"title":"XDR Alerts Enum String Fields","type":"string","enum":["severity","status","source","category"]},{"title":"XDR Alerts Date Fields","type":"string","enum":["created_at"]}]},"operator":{"type":"string","description":"Operator to apply to the constraint","enum":["exists","not_exists"]}}}]},"examples":[[{"field":"account_name","value":"Test Account","operator":"equals"}]]},"aggregations":{"items":{"type":"string","title":"XDR Alerts aggregation fields","enum":["severity","severity_accounts","account_id","status","status_accounts","tactics","tactics_accounts","tactic_technique","tactic_technique_accounts","attack_technique","attack_technique_accounts","impacted_asset_hostname","impacted_asset_hostname_accounts","technique","technique_accounts","created_at","identity_primary_identifier","identity_primary_identifier_count_and_last","display_name","display_name_count_and_last","attack_category","attack_category_accounts","ip","ip_accounts","domain","domain_accounts"]}},"sort_field":{"type":"string","title":"XDR Alerts sort fields","anyOf":[{"enum":["id","severity","alert_name","status","tactics","tactic_technique","attack_technique","impacted_asset_hostname","technique","created_at","account_id","account_name","source","action_outcome","action_taken","action_user_email","action_user_name","attack_detection_type","attack_category","identity_primary_identifier","display_name","ip","domain"]}]},"start_date":{"type":"string","title":"Get results after this date","format":"date-time"},"end_date":{"type":"string","title":"Get results before this date","format":"date-time"}}},{"type":"object","title":"Base Search Schema","properties":{"aggregations":{"type":"array","title":"The fields onto which you can perform aggregations","items":{"type":"string","title":"The Items Schema"}},"page_size":{"type":"number","title":"The page size. If you just need to aggregate, set it to 0","minimum":0,"maximum":2000},"sort_field":{"title":"Sort Fields","type":"string"},"sort_order":{"type":"string","title":"Whether sorting should be ascending or descending","enum":["asc","desc"]},"aggregate_by_account":{"type":"boolean","title":"Indicates whether aggregations should be scoped by account"},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}]},{"type":"object","required":["account_ids"],"properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]},{"properties":{"group_by":{"type":"array","title":"Group results by indicated field(s)","items":{"type":"string","title":"XDR Alerts Groupby Fields","enum":["id","severity","alert_name","status","tactics","tactic_technique","attack_technique","technique","created_at","account_id","account_name","source","action_outcome","action_taken","action_user_email","action_user_name","attack_detection_type","attack_category","identity_primary_identifier","display_name","ip","domain"]}}}}]}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"The xdr-alerts Search GroupBy Response Schema","required":["results","next_cursor"],"properties":{"results":{"type":"array","title":"The Results Schema","default":[]},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}}}}},"tags":["Grid"],"operationId":"api.rmm.grid.search.xdr-alerts.group"}},"/oneview/v1/accounts/{account_id}/email-protection/integrations/domains":{"put":{"description":"Add email protection domains","summary":"Add domains","security":[{"client_credentials":["write"]},{"user_permissions":["emailSecurity.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"title":"Email Protection Add Domains Request","description":"Request to add domains from the email protection service.","type":"object","required":["domains"],"properties":{"domains":{"type":"array","title":"Domains","description":"A list of domain names to add","items":{"type":"string","format":"hostname","example":"example.com"},"example":["example.com","test.org"]}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"title":"Email Protection Add Domains Response","description":"Response containing the result of adding domains to the email protection service.","type":"object","required":["domains_added","current_domains"],"properties":{"domains_added":{"type":"array","title":"Added Domains","description":"List of domains that were successfully added.","items":{"type":"string","format":"hostname","example":"newdomain.com"},"example":["newdomain.com","anotherdomain.org"]},"current_domains":{"type":"array","title":"Current Domains","description":"List of all domains currently associated with the account after addition.","items":{"type":"string","format":"hostname","example":"existingdomain.com"},"example":["existingdomain.com","newdomain.com"]}}}}}}},"tags":["Email Protection"],"operationId":"api.rmm.put.email-protection.integrations.domains"},"delete":{"description":"Delete email protection domais","summary":"Delete domains","security":[{"client_credentials":["write"]},{"user_permissions":["emailSecurity.delete"]}],"status":{"outage":["auth"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"title":"Email Protection Delete Domains Request","description":"Request to delete domains from the email protection service.","type":"object","required":["domains"],"properties":{"domains":{"type":"array","title":"Domains","description":"A list of domain names to delete","items":{"type":"string","format":"hostname","example":"example.com"},"example":["example.com","test.org"]}}}}}},"responses":{"200":{"description":"Successful response"}},"tags":["Email Protection"],"operationId":"api.rmm.delete.email-protection.integrations.domains"},"get":{"description":"Get email protection domains","summary":"Get domains","security":[{"client_credentials":["read"]},{"user_permissions":["emailSecurity.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"title":"Email Protection Domains","description":"Response containing the domains for the accont's email protection service.","type":"object","required":["domains"],"properties":{"domains":{"type":"array","title":"Domains","description":"A list of domain names.","items":{"type":"string","format":"hostname","example":"example.com"},"example":["example.com","test.org"]}}}}}}},"tags":["Email Protection"],"operationId":"api.rmm.get.email-protection.integrations.domains"}},"/oneview/v1/accounts/{account_id}/email-protection/account/911-mailbox":{"delete":{"description":"Delete email protection 911 mailbox","summary":"Delete 911 mailbox","security":[{"client_credentials":["write"]},{"user_permissions":["emailSecurity.delete"]}],"status":{"outage":["auth"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"Successful response"}},"tags":["Email Protection"],"operationId":"api.rmm.delete.email-protection.account.911-mailbox"},"get":{"description":"Get email protection 911 mailbox","summary":"Get 911 mailbox","security":[{"client_credentials":["read"]},{"user_permissions":["emailSecurity.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"title":"Get 911 Mailbox Response","description":"Response to retrieve the 911 mailbox details.","type":"object","properties":{"email":{"type":"string","title":"Email","description":"The email address of the 911 mailbox.","example":"alerts@example.com"}}}}}}},"tags":["Email Protection"],"operationId":"api.rmm.get.email-protection.account.911-mailbox"},"put":{"description":"Edit email protection 911 mailbox","summary":"Edit 911 mailbox","security":[{"client_credentials":["write"]},{"user_permissions":["emailSecurity.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"title":"Edit 911 Mailbox Request","description":"Request to edit the 911 mailbox settings.","type":"object","required":["email"],"properties":{"email":{"type":"string","format":"email","title":"Email","description":"The 911 mailbox mail address.","example":"alerts@example.com"}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"title":"Edit 911 Mailbox Response","description":"Response to edit the 911 mailbox details.","type":"object","required":["email","is_enabled","message"],"properties":{"email":{"type":"string","format":"email","title":"Email","description":"The email address of the 911 mailbox.","example":"alerts@example.com"},"is_enabled":{"type":"boolean","title":"Is Enabled","description":"Indicates whether the 911 mailbox is enabled.","example":true},"message":{"type":"string","title":"Message","description":"Status or informational message related to the update operation.","example":"911 mailbox updated successfully."}}}}}}},"tags":["Email Protection"],"operationId":"api.rmm.put.email-protection.account.911-mailbox"}},"/oneview/v1/accounts/{account_id}/email-protection/disable":{"delete":{"description":"Disable an email protection account","summary":"Disable email protection account","security":[{"client_credentials":["write"]},{"user_permissions":["emailSecurity.delete"]}],"status":{"outage":["auth"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"Successful response"}},"tags":["Email Protection"],"operationId":"api.rmm.delete.email-protection.disable"}},"/oneview/v1/accounts/{account_id}/email-protection/auto-sync":{"delete":{"description":"Disable email protection account auto-sync","summary":"Disable account auto-sync","security":[{"client_credentials":["read"]},{"user_permissions":["emailSecurity.delete"]}],"status":{"outage":["auth"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"Successful response"}},"tags":["Email Protection"],"operationId":"api.rmm.delete.email-proteciton.account.auto-sync"},"get":{"description":"Get email protection account auto-sync status","summary":"Get account auto-sync status","security":[{"client_credentials":["read"]},{"user_permissions":["emailSecurity.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"title":"Auto Sync Status","description":"Status of the auto synchronization for email protection.","type":"object","required":["in_progress","mailboxes_total_count","protected_mailboxes_count","enabled_mailboxes_count","failed_mailboxes_count","last_synced_at"],"properties":{"in_progress":{"type":"boolean","title":"Sync In Progress","example":true},"mailboxes_total_count":{"type":"integer","title":"Total Mailboxes","example":150},"protected_mailboxes_count":{"type":"integer","title":"Protected Mailboxes","example":120},"enabled_mailboxes_count":{"type":"integer","title":"Enabled Mailboxes","example":130},"failed_mailboxes_count":{"type":"integer","title":"Failed Mailboxes","example":5},"last_synced_at":{"type":"string","format":"date-time","title":"Last Synced Timestamp","example":"2025-05-14T12:34:56Z"}}}}}}},"tags":["Email Protection"],"operationId":"api.rmm.get.email-protection.account.auto-sync"},"post":{"description":"Enable email protection account auto-sync","summary":"Enable account auto-sync","security":[{"client_credentials":["write"]},{"user_permissions":["emailSecurity.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"title":"Activate Auto Sync Request","description":"Request to activate auto synchronization for email protection.","type":"object","properties":{"sync_shared_mailboxes":{"type":"boolean","title":"Sync Shared Mailboxes","example":true},"trigger_now":{"type":"boolean","title":"Trigger Synchronization Immediately","example":false},"groups":{"type":"array","title":"Groups to Include in Sync","items":{"type":"object","additionalProperties":{"type":"string"},"example":{"group_id":"123","group_name":"Engineering"}},"example":[{"group_id":"123","group_name":"Engineering"},{"group_id":"456","group_name":"Marketing"}]}}}}}},"responses":{"200":{"description":"Successful response"}},"tags":["Email Protection"],"operationId":"api.rmm.post.email-protection.account.auto-sync"}},"/oneview/v1/accounts/{account_id}/email-protection/configurations/allow-list":{"delete":{"description":"Delete an email protection configurations allow list entry","summary":"Delete allow list entry","security":[{"client_credentials":["write"]},{"user_permissions":["emailSecurity.delete"]}],"status":{"outage":["auth"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"title":"Delete allow list entries request","type":"object","properties":{"ids":{"type":"array","description":"List of allow list entry IDs to delete.","minItems":1,"items":{"type":"integer"},"example":[101,102,103]}},"required":["ids"],"example":{"ids":[101,102,103]}}}}},"responses":{"200":{"description":"Successful response"}},"tags":["Email Protection"],"operationId":"api.rmm.delete.email-protection.configurations.allow-list"},"post":{"description":"Create a new email protection configurations allow list entry","summary":"Create allow list entry","security":[{"client_credentials":["write"]},{"user_permissions":["emailSecurity.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"title":"Create Allow List Entry","type":"object","properties":{"type":{"type":"integer","enum":[1,2,3,4],"description":"Type of whitelist entry: 1=IP Network (for IP addresses or CIDR notation), 2=Domain (for domain names), 3=Sender Address (for email addresses), 4=Unscanned Domain Link (for domain names in links)"},"scope":{"type":"integer","enum":[1,2,3,4,6],"description":"Scope of allow list entry (optional): 1=Skip All Inspections, 2=Bypass Impersonation Banners, 3=Bypass link clicking by IRONSCALES, 4=Spam Filter, 6=Bypass all scanning for links"},"value":{"type":"string","description":"The value to allow (required)."},"comment":{"type":"string","description":"Optional comment."},"external_campaigns":{"type":"boolean","description":"Whether entry applies to external campaigns."},"ignore_auth":{"type":"boolean","description":"Whether authentication should be ignored."}},"required":["type","value"]}}}},"responses":{"200":{"description":"Successful response"}},"tags":["Email Protection"],"operationId":"api.rmm.post.email-protection.configurations.allow-list"},"put":{"description":"Update email protection configurations allow list","summary":"Update allow list","security":[{"client_credentials":["write"]},{"user_permissions":["emailSecurity.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"title":"Update Allow List Entry","type":"object","properties":{"type":{"type":"integer","enum":[1,2,3,4],"description":"Type of whitelist entry: 1=IP Network (for IP addresses or CIDR notation), 2=Domain (for domain names), 3=Sender Address (for email addresses), 4=Unscanned Domain Link (for domain names in links).","example":2},"scope":{"type":"integer","enum":[1,2,3,4,6],"description":"Scope of allow list entry (optional): 1=Skip All Inspections, 2=Bypass Impersonation Banners, 3=Bypass link clicking by IRONSCALES, 4=Spam Filter, 6=Bypass all scanning for links.","example":1},"value":{"type":"string","description":"The value to allow (required).","example":"example.com"},"comment":{"type":"string","description":"Optional comment.","example":"Updated entry to expand scope"},"external_campaigns":{"type":"boolean","description":"Whether entry applies to external campaigns.","example":true},"ignore_auth":{"type":"boolean","description":"Whether authentication should be ignored.","example":false},"id":{"type":"integer","description":"The unique identifier for the allow list entry.","example":101}},"required":["type","value","id"],"example":{"type":2,"scope":1,"value":"example.com","comment":"Updated entry to expand scope","external_campaigns":true,"ignore_auth":false,"id":101}}}}},"responses":{"200":{"description":"Successful response"}},"tags":["Email Protection"],"operationId":"api.rmm.put.email-protection.configurations.allow-list"}},"/oneview/v1/accounts/{account_id}/email-protection/integrations/disable":{"delete":{"description":"Disable the integration with Google Workspace or O365","summary":"Disable the integration","security":[{"client_credentials":["read"]},{"user_permissions":["emailSecurity.delete"]}],"status":{"outage":["auth"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"Successful response"}},"tags":["Email Protection"],"operationId":"api.rmm.delete.email-protection.integrations.disable"}},"/oneview/v1/accounts/{account_id}/email-protection/details":{"get":{"description":"Get email protection account details","summary":"Get account details","security":[{"client_credentials":["read"]},{"user_permissions":["emailSecurity.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"title":"Get Account Details Response","type":"object","properties":{"name":{"type":"string","example":"Acme Corp"},"domain":{"type":"string","example":"acme.com"},"owner_email":{"type":"string","format":"email","example":"owner@acme.com"},"owner_name":{"type":"string","example":"Jane Doe"},"country":{"type":"string","example":"US"},"registration_date":{"type":"string","format":"date-time","example":"2025-04-11T09:04:45Z"},"test_mode":{"type":"boolean","example":false},"is_msp":{"type":"boolean","example":true},"last_mailbox_sync_date":{"type":"string","format":"date-time","example":"2025-04-11T09:04:45Z"},"license":{"type":"object","properties":{"trial_expiration":{"type":"string","format":"date-time","example":"2025-06-01T00:00:00Z"},"planExpiration":{"type":"string","format":"date-time","example":"2025-12-31T23:59:59Z"},"mailbox_limit":{"type":"integer","example":500},"active_mailboxes":{"type":"integer","example":320},"protected_mailboxes":{"type":"integer","example":290}},"required":["trial_expiration","planExpiration","mailbox_limit","active_mailboxes","protected_mailboxes"]}},"required":["name","domain","owner_email","owner_name","country","registration_date","test_mode","is_msp","last_mailbox_sync_date","license"]}}}}},"tags":["Email Protection"],"operationId":"api.rmm.get.email-protection.account.details"}},"/oneview/v1/accounts/{account_id}/email-protection/account/settings":{"get":{"description":"Get email protection account settings","summary":"Get account settings","security":[{"client_credentials":["read"]},{"user_permissions":["emailSecurity.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"title":"Email Protection Get Account Settings Response","description":"Response containing the account settings for email protection services.","type":"object","properties":{"silent_mode":{"type":"boolean"},"silent_mode_msg":{"type":"boolean"},"ato":{"type":"boolean"},"service_management":{"type":"boolean"},"awareness_training":{"type":"boolean"},"api":{"type":"boolean"},"advisor":{"type":"boolean"},"attachments_scan":{"type":"boolean"},"links_scan":{"type":"boolean"},"st_bundle":{"type":"boolean"},"st_plus_bundle":{"type":"boolean"},"ai_empower_bundle":{"type":"boolean"},"autopilot_enabled":{"type":"boolean"}},"required":["silent_mode","silent_mode_msg","ato","service_management","awareness_training","api","advisor","attachments_scan","links_scan","st_bundle","st_plus_bundle","ai_empower_bundle","autopilot_enabled"]}}}}},"tags":["Email Protection"],"operationId":"api.rmm.get.email-protection.account.settings"},"put":{"description":"Edit email protection account settings","summary":"Edit account settings","security":[{"client_credentials":["write"]},{"user_permissions":["emailSecurity.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"title":"Edit Email Protection Account Settings Request","description":"Request to edit account settings for email protection.","type":"object","required":["settings"],"properties":{"settings":{"type":"array","title":"Settings","description":"List of account settings to update.","items":{"type":"object","required":["name","state"],"properties":{"name":{"type":"string","title":"Setting Name","enum":["API","silentMode","silentModeMsg","themiscopilot","ATO","serviceManagement","awarenessTraining","attachmentsScan","linksScan","STbundle","dmarcManagement","autopilot"],"description":"The name of the account setting."},"state":{"type":"string","title":"State","enum":["enable","disable"],"description":"The desired state of the setting."}}}}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"title":"Edit Email Protection Account Settings Response","description":"Response to edit account settings for email protection.","type":"object","required":["settings"],"properties":{"settings":{"type":"array","title":"Settings","description":"List of updated account settings.","items":{"type":"object","required":["name","state"],"properties":{"name":{"type":"string","title":"Setting Name","description":"The name of the account setting."},"state":{"type":"string","title":"State","description":"The current state of the setting."}}}}}}}}}},"tags":["Email Protection"],"operationId":"api.rmm.put.email-protection.account.settings"}},"/oneview/v1/accounts/{account_id}/email-protection/stats":{"get":{"description":"Get email protection statistics for an account","summary":"Get statistics","security":[{"client_credentials":["read"]},{"user_permissions":["emailSecurity.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}},{"name":"period","required":false,"in":"query","schema":{"type":"integer"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"title":"Account Statistics Response","type":"object","properties":{"email_statistics":{"type":"object","properties":{"inspected_emails":{"type":"integer","example":15000},"detected_emails":{"type":"integer","example":120}},"required":["inspected_emails","detected_emails"]},"incident_statistics":{"type":"object","properties":{"total_incidents":{"type":"integer","example":200},"open_incidents":{"type":"integer","example":25},"resolved_incidents":{"type":"integer","example":175},"phishing_incidents":{"type":"integer","example":80},"spam_incidents":{"type":"integer","example":70},"safe_incidents":{"type":"integer","example":50}},"required":["total_incidents","open_incidents","resolved_incidents","phishing_incidents","spam_incidents","safe_incidents"]},"percentage_of_email_threat_types":{"type":"object","additionalProperties":{"type":"number","example":35.5},"example":{"phishing":45.5,"spam":30,"malware":24.5}},"most_targeted_employees":{"type":"object","additionalProperties":{"type":"integer","example":15},"example":{"john.doe@example.com":25,"jane.smith@example.com":18}},"most_targeted_departments":{"type":"object","additionalProperties":{"type":"integer","example":40},"example":{"Finance":60,"Engineering":45,"HR":30}}},"required":["email_statistics","incident_statistics","percentage_of_email_threat_types","most_targeted_employees","most_targeted_departments"]}}}}},"tags":["Email Protection"],"operationId":"api.rmm.get.email-protection.stats"}},"/oneview/v1/accounts/{account_id}/email-protection/configurations/allow-list/search":{"post":{"description":"Get email protection configurations allow list","summary":"Get allow list","security":[{"client_credentials":["read"]},{"user_permissions":["emailSecurity.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"title":"Get allow list","type":"object","properties":{"sort":{"type":"string","enum":["type","scope","date","allowed_for","noSorting"],"description":"Optional sort field.","example":"date"},"order":{"type":"string","enum":["asc","desc"],"description":"Sort order.","example":"asc"},"type":{"type":"integer","enum":[0,1,2,3,4],"description":"Filter by allow list type. Type of whitelist entry: 1=IP Network (for IP addresses or CIDR notation), 2=Domain (for domain names), 3=Sender Address (for email addresses), 4=Unscanned Domain Link (for domain names in links)","example":2},"search":{"type":"string","description":"Search string (searches allow entries that contain the specified string).","example":"example.com"},"page":{"type":"integer","minimum":1,"description":"Page number (must be >= 1).","example":1},"page_size":{"type":"integer","minimum":1,"maximum":500,"description":"Number of items per page (1–500).","example":50}},"required":[],"example":{"sort":"date","order":"asc","type":2,"search":"example.com","page":1,"page_size":50}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"title":"Get allow list response","type":"object","properties":{"allow_list":{"type":["array","null"],"items":{"type":"object","title":"Allow list entry","properties":{"id":{"type":["integer","null"],"description":"Unique ID of the entry.","example":101},"date":{"type":["string","null"],"description":"Creation date (ISO 8601 or string format).","example":"2025-08-19T12:34:56Z"},"value":{"type":["string","null"],"description":"The allow list value.","example":"example.com"},"type":{"type":["integer","null"],"description":"Allow list type.","example":2},"scope":{"type":["integer","null"],"description":"Allow list scope.","example":4},"comment":{"type":["string","null"],"description":"Optional comment.","example":"Temporary allow for partner domain"},"user_first_name":{"type":["string","null"],"description":"First name of the user who created the entry.","example":"Alice"},"user_last_name":{"type":["string","null"],"description":"Last name of the user who created the entry.","example":"Smith"},"user_email":{"type":["string","null"],"description":"Email of the user who created the entry.","example":"alice.smith@example.com"},"external_campaigns":{"type":["boolean","null"],"description":"Whether entry applies to external campaigns.","example":true},"ignore_auth":{"type":["boolean","null"],"description":"Whether authentication should be ignored.","example":false}},"additionalProperties":false},"example":[{"id":101,"date":"2025-08-19T12:34:56Z","value":"example.com","type":2,"scope":4,"comment":"Temporary allow for partner domain","user_first_name":"Alice","user_last_name":"Smith","user_email":"alice.smith@example.com","external_campaigns":true,"ignore_auth":false}]},"internal_active":{"type":["boolean","null"],"description":"Whether the internal allow list is active.","example":true},"external_active":{"type":["boolean","null"],"description":"Whether the external allow list is active.","example":false},"pages_count":{"type":["integer","null"],"description":"Total number of pages.","example":5},"page":{"type":["integer","null"],"description":"Current page number.","example":1},"items_per_page":{"type":["integer","null"],"description":"Number of items per page.","example":50}},"required":[],"example":{"allow_list":[{"id":101,"date":"2025-08-19T12:34:56Z","value":"example.com","type":2,"scope":4,"comment":"Temporary allow for partner domain","user_first_name":"Alice","user_last_name":"Smith","user_email":"alice.smith@example.com","external_campaigns":true,"ignore_auth":false}],"internal_active":true,"external_active":false,"pages_count":5,"page":1,"items_per_page":50}}}}}},"tags":["Email Protection"],"operationId":"api.rmm.post.email-protection.configurations.allow-list-search"}},"/oneview/v1/accounts/{account_id}/email-protection/stats/domains":{"get":{"description":"Get email protection domains statistics","summary":"Get email protection domains statistics","security":[{"client_credentials":["read"]},{"user_permissions":["emailSecurity.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"title":"Email Protection Domain Stats Response","description":"Response schema for email protection domain statistics and mail record checks","type":"object","properties":{"domains":{"type":"array","items":{"type":"object","properties":{"domain":{"type":"string"},"active_mailboxes":{"type":"integer"},"total_mailboxes":{"type":"integer"}},"required":["domain","active_mailboxes","total_mailboxes"]}},"domains_status":{"type":"object","description":"Results of SPF/DKIM/DMARC checks per domain","additionalProperties":{"type":"object","properties":{"spf_pass":{"type":"boolean"},"dkim_pass":{"type":"boolean"},"dmarc_pass":{"type":"boolean"},"spf":{"type":"string"},"dkim":{"type":"string"},"dmarc":{"type":"string"},"last_check_date":{"type":"string"},"error":{"type":"string"}},"required":["spf_pass","dkim_pass","dmarc_pass"]}}},"required":["domains","domains_status"]}}}}},"tags":["Email Protection"],"operationId":"api.rmm.get.email-protection.stats.domains"}},"/oneview/v1/accounts/{account_id}/email-protection/incidents/{incident_id}":{"get":{"description":"Get the details of a email protection incident for an account","summary":"Get incident details","security":[{"client_credentials":["read"]},{"user_permissions":["emailSecurity.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"incident_id","required":true,"in":"path","description":"Incident ID","schema":{"type":"integer"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Incident Details Response","properties":{"company_id":{"type":"integer","title":"Company ID","examples":[12345]},"company_name":{"type":"string","title":"Company Name","examples":["ACME Corp"]},"incident_id":{"type":"integer","title":"Incident ID","examples":[987654]},"classification":{"type":["string"],"title":"Classification","examples":["Spam","Phishing","Open Report","Safe"]},"first_reported_by":{"type":"string","title":"First Reported By","examples":["John Doe"]},"first_reported_date":{"type":"string","title":"First Reported Date","examples":["2025-02-11T19:27:00.937257Z"]},"affected_mailbox_count":{"type":"integer","title":"Affected Mailbox Count","examples":[10]},"sender_reputation":{"type":"string","title":"Sender Reputation","examples":["low"]},"banner_displayed":{"type":"string","title":"Banner Displayed","examples":["First Time Sender"]},"sender_email":{"type":"string","title":"Sender Email","examples":["attacker@example.com","noreply@company.com"]},"reply_to":{"type":["string","null"],"title":"Reply-To Email","examples":["reply@fake.com"]},"spf_result":{"type":["string","null"],"title":"SPF Result","examples":["Pass","Fail","SoftFail",null]},"sender_is_internal":{"type":"boolean","title":"Sender is Internal","examples":[true,false]},"advisor_probability":{"type":"number","title":"Advisor Probability","examples":[0.85]},"advisor_verdict":{"type":"string","title":"Advisor Verdict","examples":["Phishing"]},"mail_server":{"type":"object","title":"Mail Server","required":["host","ip"],"properties":{"host":{"type":"string","title":"Mail Server Host","examples":["smtp.mailserver.com"]},"ip":{"type":"string","title":"Mail Server IP","examples":["192.168.1.1"]}}},"federation":{"type":"object","title":"Federation Data","properties":{"companies_affected":{"type":"integer","title":"Companies Affected","examples":[15]},"companies_marked_phishing":{"type":"integer","title":"Companies Marked as Phishing","examples":[5]},"companies_marked_spam":{"type":"integer","title":"Companies Marked as Spam","examples":[3]},"companies_marked_fp":{"type":"integer","title":"Companies Marked as False Positive","examples":[2]},"companies_unclassified":{"type":"integer","title":"Companies Unclassified","examples":[5]},"phishing_ratio":{"type":"number","title":"Phishing Ratio","examples":[0.33]}}},"reports":{"type":"array","title":"Reports","items":{"type":"object","properties":{"name":{"type":"string","title":"Reporter Name","examples":["Alice Smith"]},"email":{"type":"string","title":"Reporter Email","examples":["alice@company.com"]},"subject":{"type":"string","title":"Email Subject","examples":["Urgent: Suspicious Email"]},"sender_email":{"type":"string","title":"Sender Email","examples":["fake@company.com"]},"mail_server":{"type":"object","title":"Mail Server","required":["host","ip"],"properties":{"host":{"type":"string","title":"Mail Server Host","examples":["smtp.mailserver.com"]},"ip":{"type":"string","title":"Mail Server IP","examples":["192.168.1.1"]}}},"headres":{"type":"array","title":"Headers","items":{"type":"object","properties":{"name":{"type":"string","title":"Header Name","examples":["X-Mailer"]},"value":{"type":"string","title":"Header Value","examples":["Microsoft Outlook 16.0"]}}}}}}},"links":{"type":"array","title":"Links","items":{"type":"object","properties":{"url":{"type":"string","title":"URL","examples":["http://malicious-site.com"]},"name":{"type":"string","title":"Link Name","examples":["Fake Bank Login"]},"scan_result":{"type":"string","title":"Scan Result","examples":["Malicious"]}}}},"attachments":{"type":"array","title":"Attachments","items":{"type":"object","properties":{"file_name":{"type":"string","title":"File Name","examples":["invoice.pdf"]},"file_size":{"type":"integer","title":"File Size (bytes)","examples":[102400]},"md5":{"type":"string","title":"MD5 Checksum","examples":["1a79a4d60de6718e8e5b326e338ae533"]},"scan_result":{"type":"string","title":"Scan Result","examples":["Clean"]}}}},"original_email_body":{"type":"string","title":"Original Email Body","examples":["Dear user, please reset your password at this link..."]},"email_body_text":{"type":"string","title":"Email Body Text","examples":["This is a plain-text version of the email."]},"reported_by_end_user":{"type":"boolean","title":"Reported by End User","examples":[true]},"reporter_name":{"type":["null","string"],"title":"Reporter Name","examples":["Bob Johnson"]},"emails":{"type":"array","title":"Emails","items":{"type":"object","properties":{"recipient":{"type":"string","title":"Recipient Email","examples":["fake@company.com"]},"sender":{"type":"string","title":"Sender Email","examples":["fake@malware.com"]},"subject":{"type":"string","title":"Subject","examples":["Great Offer Just for You!"]},"sender_ip":{"type":"string","title":"Sender IP","examples":["10.1.1.1"]},"reporter":{"type":"string","title":"Reporter","examples":["analyst@company.com"]},"remediated_date":{"type":"string","title":"Remediated Date","examples":["2025-04-02T09:21:16Z"]}}}},"challenged_type":{"type":"string","title":"Challenged Type","examples":["Release request"]},"first_challenged_date":{"type":"string","title":"First Challenged Date","examples":["2025-04-01T08:15:30Z"]},"challenged_by":{"type":["null","string"],"title":"Challenged By","examples":["analyst@company.com"]},"challenged_date":{"type":["null","string"],"title":"Challenged Date","examples":["2025-04-03T10:45:00Z"]},"challenge_reason":{"type":["null","string"],"title":"Challenge Reason","examples":["Known sender"]},"challenged_comment":{"type":["null","string"],"title":"Challenged Comment","examples":["Safe Email"]},"related_incidents":{"type":"array","title":"Related Incidents","items":{"type":"integer","title":"Related Incident ID","examples":[1,2]}},"affected_mailboxes":{"type":"array","title":"Affected Mailboxes","items":{"type":"object","properties":{"id":{"type":"integer","title":"Mitigation ID","examples":[55]},"recipient":{"type":"string","title":"Recipient","examples":["user@company.com"]},"recipient_id":{"type":"integer","title":"Recipient ID","examples":[22]},"employee_active":{"type":"boolean","title":"Employee Active","examples":[true]},"first_reported":{"type":"boolean","title":"First Reported","examples":[true]},"not_found":{"type":"boolean","title":"Not Found","examples":[false]},"can_recluster":{"type":"boolean","title":"Can Recluster","examples":[true]}}}},"is_reclassified":{"type":"boolean","title":"Is Reclassified","examples":[true,false]},"original_cluster_incident_id":{"type":["integer","null"],"title":"Original Cluster Incident ID","examples":[77,null]},"can_revert":{"type":"boolean","title":"Can Revert","examples":[true,false]},"revert_blocked_reason":{"type":["string","null"],"title":"Revert Blocked Reason","examples":[null,"Revert disabled due to policy"]}}}}}}},"tags":["Email Protection"],"operationId":"api.rmm.get.email-protection.incidents.details"}},"/oneview/v1/accounts/{account_id}/email-protection/integrations/status":{"get":{"description":"Get the status of the integration","summary":"Get Integration status","security":[{"client_credentials":["read"]},{"user_permissions":["emailSecurity.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"Successful response"}},"tags":["Email Protection"],"operationId":"api.rmm.get.email-proteciton.integrations.status"}},"/oneview/v1/accounts/{account_id}/email-protection/configurations/notifications/recipients":{"get":{"description":"Get email protection notification recipients","summary":"Get notification recipients","security":[{"client_credentials":["read"]},{"user_permissions":["emailSecurity.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"title":"Create Notification Recipients Response","description":"Response structure for getting the list of recipients who will receive notifications related to challenged email alerts.","type":"object","properties":{"recipients":{"type":"array","items":{"type":"string","format":"email"},"description":"A list of email addresses to receive challenged alert notifications."}},"required":["recipients"],"examples":[{"recipients":["admin@example.com","security.team@example.org"]}]}}}}},"tags":["Email Protection"],"operationId":"api.rmm.get.configurations.notifications.recipients"},"post":{"description":"Create email protection notification recipients","summary":"Create notification recipients","security":[{"client_credentials":["write"]},{"user_permissions":["emailSecurity.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"title":"Notification Recipients Request","description":"Request structure for creating or updating the list of recipients who will receive notifications related to challenged email alerts.","type":"object","properties":{"recipients":{"type":"array","items":{"type":"string","format":"email"},"description":"A list of email addresses to receive challenged alert notifications."}},"required":["recipients"],"examples":[{"recipients":["admin@example.com","security.team@example.org"]}]}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"title":"Create Notification Recipients Response","description":"Response structure for getting the list of recipients who will receive notifications related to challenged email alerts.","type":"object","properties":{"recipients":{"type":"array","items":{"type":"string","format":"email"},"description":"A list of email addresses to receive challenged alert notifications."}},"required":["recipients"],"examples":[{"recipients":["admin@example.com","security.team@example.org"]}]}}}}},"tags":["Email Protection"],"operationId":"api.rmm.post.configurations.notifications.recipients"}},"/oneview/v1/accounts/{account_id}/email-protection/integrations/o365/authorize":{"post":{"description":"Authorize access to the O365 tenant","summary":"Authorize O365","security":[{"client_credentials":["read"]},{"user_permissions":["emailSecurity.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"title":"O365IntegrationRequest","type":"object","required":["admin_consent","state","tenant"],"properties":{"admin_consent":{"type":"boolean","title":"Admin Consent Granted","example":true},"state":{"type":"string","title":"State Parameter","example":"xyz123state"},"tenant":{"type":"string","title":"Tenant Identifier","example":"72f988bf-86f1-41af-91ab-2d7cd011db47"},"error":{"type":"string","title":"Error Code","example":"access_denied"},"error_description":{"type":"string","title":"Error Description","example":"The user denied the request."}},"additionalProperties":false}}}},"responses":{"200":{"description":"Successful response"}},"tags":["Email Protection"],"operationId":"api.rmm.post.email-protection.integrations.o365.authorize"}},"/oneview/v1/accounts/{account_id}/email-protection/register":{"post":{"description":"Register an email protection account","summary":"Register email protection account","security":[{"client_credentials":["write"]},{"user_permissions":["emailSecurity.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"title":"Register Account Request","description":"Request to register a new account for email protection services.","type":"object","required":["name","owner_email","owner_first_name","owner_last_name","domain","region"],"properties":{"name":{"type":"string","title":"Account Name","example":"Acme Corporation"},"owner_email":{"type":"string","format":"email","title":"Owner Email Address","example":"owner@acme.com"},"owner_first_name":{"type":"string","title":"Owner First Name","example":"Alice"},"owner_last_name":{"type":"string","title":"Owner Last Name","example":"Smith"},"domain":{"type":"string","title":"Primary Domain","example":"acme.com"},"silent_mode":{"type":"boolean","title":"Silent Mode Enabled","example":false},"autopilot_enabled":{"type":"boolean","title":"Autopilot Feature Enabled","example":true},"partner_id":{"type":"integer","title":"Partner ID","example":101},"allowed_domains":{"type":"array","title":"Allowed Domains","items":{"type":"string","example":"acme.io"},"example":["acme.com","acme.io"]},"country":{"type":"string","title":"Country Code (ISO Alpha-2)","example":"US"},"region":{"type":"string","enum":["US","EU","UAE"],"description":"Region of the account.","example":"EU"}}}}}},"responses":{"200":{"description":"Successful response"}},"tags":["Email Protection"],"operationId":"api.rmm.post.email-protection.register"}},"/oneview/v1/accounts/{account_id}/email-protection/integrations/domains/check":{"post":{"description":"Check one or more domains for dkim, spf and dmarc records","summary":"Check Domain","security":[{"client_credentials":["read"]},{"user_permissions":["emailSecurity.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"title":"Email Protection Domain Check Request","description":"Request schema for checking multiple domains for email protection status","type":"object","properties":{"domains":{"type":"array","minItems":1,"items":{"type":"string","minLength":1}}},"required":["domains"]}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"title":"Email Protection Domain Security Check Response","description":"Response schema for SPF, DKIM, and DMARC checks on domains","type":"object","properties":{"domains_status":{"type":"object","description":"A map of domain names to their respective mail records check results","additionalProperties":{"type":"object","properties":{"spf_pass":{"type":"boolean"},"dkim_pass":{"type":"boolean"},"dmarc_pass":{"type":"boolean"},"spf":{"type":"string"},"dkim":{"type":"string"},"dmarc":{"type":"string"},"error":{"type":"string"}},"required":["spf_pass","dkim_pass","dmarc_pass"]}}},"required":["domains_status"]}}}}},"tags":["Email Protection"],"operationId":"api.rmm.post.email-protection.integrations.domains.check"}},"/oneview/v1/accounts/{account_id}/email-protection/incidents/{incident_id}/classify":{"post":{"description":"Classify a specific incident for an account","summary":"Classify an Incident","security":[{"client_credentials":["write"]},{"user_permissions":["emailSecurity.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"incident_id","required":true,"in":"path","description":"Incident ID","schema":{"type":"integer"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Classify Incident","required":["classification","email"],"properties":{"classification":{"type":"string","title":"Classification - open, phishing, spam, safe (or close if the incident was challenged)","examples":["open","phishing","spam","safe","close"]},"email":{"type":"string","format":"email","title":"Classifying User Email","examples":["user@example.com"]}}}}}},"responses":{"200":{"description":"Successful response"}},"tags":["Email Protection"],"operationId":"api.rmm.post.email-protection.incidents.classify"}},"/oneview/v1/accounts/{account_id}/email-protection/account/daily-usage":{"post":{"description":"Get email protection account daily usage","summary":"Get daily usage","security":[{"client_credentials":["read"]},{"user_permissions":["emailSecurity.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"title":"Get Daily Usage Report","description":"Request schema for retrieving the daily usage report, optionally filtered by plan or trial status.","type":"object","properties":{"page":{"type":"integer","minimum":1,"title":"Page Number","description":"Page number to retrieve, starting from 1.","example":1},"plan_active":{"type":"boolean","title":"Filter by Active Plan","description":"If true, only include accounts with an active plan. If false, only those without. If omitted, do not filter by plan status.","example":true},"trial_active":{"type":"boolean","title":"Filter by Active Trial","description":"If true, only include accounts with an active trial. If false, only those without. If omitted, do not filter by trial status.","example":false},"date":{"type":"string","title":"Date","description":"The date for which the usage report is requested, in ISO 8601 format (YYYY-MM-DD).","example":2025}},"required":["date"]}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"title":"Daily Usage Report","description":"Response schema for retrieving the daily usage report","type":"object","properties":{"total_pages":{"type":"integer","title":"Total Pages","description":"Total number of pages available in the report.","example":5},"page":{"type":"integer","title":"Current Page","description":"The current page number being returned.","example":1},"report":{"type":"array","title":"Usage Report Entries","description":"List of usage report entries for the current page.","items":{"type":"object","title":"Usage Report Entry","properties":{"sync_date":{"type":"string","title":"Sync Date","example":"2025-06-30"},"billing_date":{"type":"string","title":"Billing Date","example":"2025-06-01"},"company_id":{"type":"integer","title":"Company ID","example":12345},"account_id":{"type":"string","title":"Account ID","example":"acc-7890"},"account_name":{"type":"string","title":"Account Name","example":"Acme Corp"},"msp_name":{"type":"string","title":"MSP Name","example":"Managed Services Inc."},"high_watermark":{"type":"integer","title":"High Watermark","description":"Peak usage value for the account.","example":150},"plan_expiration_date":{"type":"string","title":"Plan Expiration Date","example":"2025-12-31"},"trial_expiration_date":{"type":"string","title":"Trial Expiration Date","example":"2025-07-15"},"registration_date":{"type":"string","title":"Registration Date","example":"2024-01-01"},"provider":{"type":"string","title":"provider","enum":["google","microsoft"],"example":"google"},"domains_count":{"type":"integer","title":"Domains Count","description":"Number of domains associated with the provider.","example":10},"term_type":{"type":"string","title":"Term Type","description":"License Term Type","example":"usage_billing"}},"required":["sync_date","company_id","account_id","account_name","high_watermark","registration_date"]}}},"required":["total_pages","page","report"]}}}}},"tags":["Email Protection"],"operationId":"api.rmm.post.email-protection.account.daily-usage"}},"/oneview/v1/accounts/{account_id}/email-protection/stats/emails":{"post":{"description":"Get email protection statistics","summary":"Get email statistics","security":[{"client_credentials":["read"]},{"user_permissions":["emailSecurity.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"title":"Get Email Protection Statistics Request","description":"Request to retrieve email protection statistics for a specified time range","type":"object","required":["start_time","end_time"],"properties":{"start_time":{"type":"string","format":"date-time","title":"Start Time","description":"Start of the time range. Must be earlier than EndTime.","example":"2025-05-01T00:00:00Z"},"end_time":{"type":"string","format":"date-time","title":"End Time","description":"End of the time range. Must be later than StartTime.","example":"2025-05-15T23:59:59Z"},"include_scan_back":{"type":"boolean","title":"Include Scan Back","description":"Whether to include historical scan results in the statistics.","example":true}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"title":"Email Protection Email Stats","description":"Response containing the statistics of emails scanned by the email protection service.","type":"object","required":["total_emails_inspected","total_emails_detected","total_phishing_emails","total_spam_emails","total_impersonation_emails","emails_by_phishing_threat_type"],"properties":{"total_emails_inspected":{"type":"integer","title":"Total Emails Inspected","description":"Total number of emails scanned during the time range.","example":1248},"total_emails_detected":{"type":"integer","title":"Total Emails Detected","description":"Number of emails flagged as potentially malicious.","example":399},"total_phishing_emails":{"type":"integer","title":"Total Phishing Emails","description":"Count of emails detected as phishing.","example":40},"total_spam_emails":{"type":"integer","title":"Total Spam Emails","description":"Count of emails detected as spam.","example":359},"total_impersonation_emails":{"type":"integer","title":"Total Impersonation Emails","description":"Count of emails involving impersonation attempts.","example":0},"emails_by_phishing_threat_type":{"type":"array","title":"Emails by Phishing Threat Type","items":{"type":"object","required":["name","emails_count"],"properties":{"name":{"type":"string","title":"Threat Type Name","example":"Credential Theft"},"emails_count":{"type":"integer","title":"Emails Count","example":11}}},"example":[{"name":"Bulk Phishing","emails_count":24},{"name":"Credential Theft","emails_count":11},{"name":"Invoice Phishing","emails_count":2},{"name":"Vishing Attack","emails_count":2},{"name":"Advance-fee Scam","emails_count":1}]}}}}}}},"tags":["Email Protection"],"operationId":"api.rmm.post.email-protection.stats.emails"}},"/oneview/v1/accounts/{account_id}/email-protection/incidents/export":{"post":{"description":"Export email protection incidents for an account","summary":"Export incidents","security":[{"client_credentials":["execute"]},{"user_permissions":["emailSecurity.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Export request","required":["groups","select","format"],"properties":{"format":{"type":"string","title":"The output file","enum":["csv","xlsx","html","ods","txt","rtf","json"]},"download":{"type":"boolean","title":"Whether to instruct the client to download the response as a file. Only clients like browsers are supported"},"type":{"type":"string","title":"The encoding of the output","enum":["string","base64","binary"],"default":"string"},"select":{"type":"array","title":"Which fields to select from the response","items":{"type":"object","title":"Field","required":["field","newField"],"properties":{"newField":{"type":"string","title":"the new value"},"field":{"type":"string","title":"The response field to map to a new value","enum":["incident_id","incident_type","status","email_subject","links_count","attachments_count","recipient_email","recipient_name","classification","assignee","sender_name","sender_email","affected_mailboxes_count","comments_count","release_request_count","created_at","last_updated_at","reported_by","resolved_by"]}}}},"groups":{"type":"array","title":"List of queries","items":{"type":"object","title":"Query to fetch incidents","allOf":[{"type":"object","title":"Incidents Search Request","properties":{"classification":{"type":"array","items":{"type":"string","enum":["all","phishing","spam","compromised","safe","open","silent"]},"title":"The classifications of the incidents to filter by."},"report_type":{"type":"array","title":"The type of report to filter incidents.","enum":["all","email","ato","teams"],"example":"all"},"state":{"type":"array","items":{"type":"string","enum":["all","classified","unclassified","challenged"]},"title":"The states of the incidents to filter by.","example":"all"},"page":{"type":"integer","title":"The page number to retrieve.","example":1},"sort":{"type":"string","title":"The field to sort the incidents by.","enum":["noSorting","created","latestEmailDate","incidentID","emailSubject","senderName","senderEmail","recipientName","recipientEmail","classification"],"example":"classification"},"order":{"type":"string","title":"The order to sort the incidents.","enum":["asc","desc"],"example":"asc"},"start_time":{"type":"string","title":"The start time to filter incidents. (ex: 2025-04-07T11:13:33.602716+01:00)","example":"2025-04-07T11:13:33.602716+01:00"},"end_time":{"type":"string","title":"The end time to filter incidents. (ex: 2025-04-07T11:13:33.602716+01:00)","example":"2025-04-07T11:13:33.602716+01:00"},"last_updated_start_time":{"type":"string","title":"The last updated start time to filter incidents. (ex: 2025-04-07T11:13:33.602716+01:00)","example":"2025-04-07T11:13:33.602716+01:00"},"last_updated_end_time":{"type":"string","title":"The last updated end time to filter incidents. (ex: 2025-04-07T11:13:33.602716+01:00)","example":"2025-04-07T11:13:33.602716+01:00"},"incident_id":{"type":"integer","title":"The incident ID to filter incidents. ","example":1234},"email_subject":{"type":"string","title":"The email subject to filter incidents.","example":"Phishing attempt"},"sender_name":{"type":"string","title":"The sender name to filter incidents.","example":"John Doe"},"sender_email":{"type":"string","title":"The sender email to filter incidents.","example":"jdoe@company.com"},"recipient_name":{"type":"string","title":"The recipient name to filter incidents.","example":"Jane Smith"},"recipient_email":{"type":"string","title":"The recipient email to filter incidents.","example":"jsmith@company.com"},"page_size":{"type":"integer","title":"The number of incidents per page.","example":50},"challenged_type":{"type":"string","title":"The challenged type to filter incidents. (release_request, end_user_report)","enum":["release_request","end_user_report"],"example":"release_request"},"challenged_start_date":{"type":"string","title":"The challenged start date to filter incidents. (ex: 2025-04-07T11:13:33.602716+01:00)","example":"2025-04-07T11:13:33.602716+01:00"},"challenged_end_date":{"type":"string","title":"The challenged end date to filter incidents. (ex: 2025-04-07T11:13:33.602716+01:00)","example":"2025-04-07T11:13:33.602716+01:00"}}}]}}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Email Protection Incident Search Response","properties":{"page":{"type":"integer","description":"The current page of the result set.","example":1},"total_pages":{"type":"integer","description":"The total number of pages available.","example":1},"total_count":{"type":"integer","description":"The total number of incidents in the response","example":10},"incidents":{"type":"array","description":"List of incidents.","items":{"type":"object","properties":{"incident_id":{"type":"integer","description":"Unique identifier for the incident.","example":1},"incident_type":{"type":"string","description":"Type of the incident.","example":"Email Report"},"email_subject":{"type":"string","description":"Subject of the email related to the incident.","example":"The right layers, the right prices"},"links_count":{"type":"integer","description":"The number of links in the incident's email.","example":105},"attachments_count":{"type":"integer","description":"The number of attachments in the incident's email.","example":0},"recipient_email":{"type":"string","description":"Email address of the recipient.","example":"xyz@threatdown.com"},"recipient_name":{"type":"string","description":"Name of the recipient.","example":"John Doe "},"classification":{"type":"string","description":"Classification of the incident.","example":"Phishing"},"assignee":{"type":["string","null"],"description":"The assignee of the incident, or null if unassigned.","example":null},"sender_name":{"type":"string","description":"Name of the sender.","example":"xfy storm"},"sender_email":{"type":"string","description":"Email address of the sender.","example":"xfy@storm.com"},"affected_mailboxes_count":{"type":"integer","description":"Number of mailboxes affected by the incident.","example":9},"comments_count":{"type":"integer","description":"Number of comments on the incident.","example":0},"release_request_count":{"type":"integer","description":"Number of release requests for the incident.","example":0},"created_at":{"type":"string","description":"Timestamp when the incident was created.","example":"2025-02-27T23:09:55.473222Z"},"last_updated_at":{"type":"string","description":"Timestamp of the latest email related to the incident.","example":"2025-03-07T19:24:51Z"},"reported_by":{"type":"string","description":"Who reported the incident.","example":"ThreatDown Community"},"resolved_by":{"type":"string","description":"Who resolved the incident.","example":"Skinny Skeleton"},"status":{"type":"string","description":"Status of the incident.","example":"Categorization needed"},"challenged_type":{"type":"string","description":"The challenged type of the incident, or empty if not applicable.","example":"Release request"},"first_challenged_date":{"type":"string","description":"The first challenged date of the incident","example":"2025-10-09T10:29:59.656628Z"}},"required":["incident_id","incident_type","email_subject","links_count","attachments_count","recipient_email","recipient_name","classification","assignee","sender_name","sender_email","affected_mailboxes_count","comments_count","release_request_count","created_at","last_updated_at","reported_by","resolved_by","status"]}}},"required":["page","total_pages","incidents","total_count"]}}}}},"tags":["Email Protection"],"operationId":"api.rmm.post.email-protection.incidents.export"}},"/oneview/v1/accounts/{account_id}/email-protection/mailboxes/export":{"post":{"description":"Export email protection mailboxes for an account","summary":"Export mailboxes","security":[{"client_credentials":["execute"]},{"user_permissions":["emailSecurity.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Export request","required":["groups","select","format"],"properties":{"format":{"type":"string","title":"The output file","enum":["csv","xlsx","html","ods","txt","rtf","json"]},"download":{"type":"boolean","title":"Whether to instruct the client to download the response as a file. Only clients like browsers are supported"},"type":{"type":"string","title":"The encoding of the output","enum":["string","base64","binary"],"default":"string"},"select":{"type":"array","title":"Which fields to select from the response","items":{"type":"object","title":"Field","required":["field","newField"],"properties":{"newField":{"type":"string","title":"the new value"},"field":{"type":"string","title":"The response field to map to a new value","enum":["id","firstName","lastName","title","department","email","phoneNumber","tags","language","enabled","protected","unprotectedReason"]}}}},"groups":{"type":"array","title":"List of queries","items":{"type":"object","title":"Query to fetch mailboxes","allOf":[{"type":"object","title":"Mailboxes Search Request Body","properties":{"ids":{"type":"array","items":{"type":"integer"},"description":"List of mailbox IDs to filter."},"search":{"type":"string","description":"Search term to filter mailboxes."},"is_enabled":{"type":"boolean","description":"Filter by enabled status."},"tags":{"type":"array","items":{"type":"string"},"description":"List of tags to filter mailboxes."},"first_name":{"type":"string","description":"Filter by first name."},"last_name":{"type":"string","description":"Filter by last name."},"department":{"type":"string","description":"Filter by department."},"email":{"type":"string","description":"Filter by email address."},"title":{"type":"string","description":"Filter by title."},"is_protected":{"type":"boolean","description":"Filter by protection status."},"language":{"type":"string","description":"Filter by language."},"awareness":{"type":"array","items":{"type":"integer"},"description":"Filter by awareness levels."},"sort":{"type":"string","enum":["id","title","department","first_name","last_name","email","awareness","is_enabled","language","is_protected"],"description":"Field to sort by."},"order":{"type":"string","enum":["asc","desc"],"description":"Sort order."},"page":{"type":"integer","description":"The page number to retrieve.","example":1},"page_size":{"type":"integer","description":"The number of mailboxes per page.","example":50}}}]}}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"title":"MailboxesResponse","type":"object","properties":{"page":{"type":"integer","example":1},"total_pages":{"type":"integer","example":1},"total_count":{"type":"integer","example":2},"mailboxes":{"type":"array","items":{"type":"object","properties":{"id":{"type":"integer","example":1},"firstName":{"type":"string","example":"John"},"lastName":{"type":"string","example":"Mayer"},"title":{"type":"string","example":""},"department":{"type":"string","example":""},"email":{"type":"string","format":"email","example":"jm@company.com"},"phoneNumber":{"type":"string","example":""},"tags":{"type":"array","items":{"type":"string"},"example":["Untrained","VIP_impersonation"]},"language":{"type":"string","example":"English"},"enabled":{"type":"boolean","example":false},"protected":{"type":"boolean","example":false},"unprotectedReason":{"type":"string","example":""}},"required":["firstName","lastName","title","department","email","phoneNumber","tags","language","enabled","protected","unprotectedReason"]}}},"required":["page","total_pages","total_count","mailboxes"]}}}}},"tags":["Email Protection"],"operationId":"api.rmm.post.email-protection.mailboxes.export"}},"/oneview/v1/accounts/{account_id}/email-protection/incidents/scanback/export":{"post":{"description":"Export Scanback email protection incidents for an account","summary":"Export Scanback incidents","security":[{"client_credentials":["execute"]},{"user_permissions":["emailSecurity.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Export request","required":["groups","select","format"],"properties":{"format":{"type":"string","title":"The output file","enum":["csv","xlsx","html","ods","txt","rtf","json"]},"download":{"type":"boolean","title":"Whether to instruct the client to download the response as a file. Only clients like browsers are supported"},"type":{"type":"string","title":"The encoding of the output","enum":["string","base64","binary"],"default":"string"},"select":{"type":"array","title":"Which fields to select from the response","items":{"type":"object","title":"Field","required":["field","newField"],"properties":{"newField":{"type":"string","title":"the new value"},"field":{"type":"string","title":"The response field to map to a new value","enum":["incident_id","incident_type","status","email_subject","links_count","attachments_count","recipient_email","recipient_name","classification","assignee","sender_name","sender_email","affected_mailboxes_count","comments_count","release_request_count","created_at","last_updated_at","reported_by","resolved_by"]}}}},"groups":{"type":"array","title":"List of queries","items":{"type":"object","title":"Query to fetch incidents","allOf":[{"type":"object","title":"Incidents Search Request","properties":{"classification":{"type":"array","items":{"type":"string","enum":["all","phishing","spam","compromised","safe","open","silent"]},"title":"The classifications of the incidents to filter by."},"report_type":{"type":"array","title":"The type of report to filter incidents.","enum":["all","email","ato","teams"],"example":"all"},"state":{"type":"array","items":{"type":"string","enum":["all","classified","unclassified","challenged"]},"title":"The states of the incidents to filter by.","example":"all"},"page":{"type":"integer","title":"The page number to retrieve.","example":1},"sort":{"type":"string","title":"The field to sort the incidents by.","enum":["noSorting","created","latestEmailDate","incidentID","emailSubject","senderName","senderEmail","recipientName","recipientEmail","classification"],"example":"classification"},"order":{"type":"string","title":"The order to sort the incidents.","enum":["asc","desc"],"example":"asc"},"start_time":{"type":"string","title":"The start time to filter incidents. (ex: 2025-04-07T11:13:33.602716+01:00)","example":"2025-04-07T11:13:33.602716+01:00"},"end_time":{"type":"string","title":"The end time to filter incidents. (ex: 2025-04-07T11:13:33.602716+01:00)","example":"2025-04-07T11:13:33.602716+01:00"},"last_updated_start_time":{"type":"string","title":"The last updated start time to filter incidents. (ex: 2025-04-07T11:13:33.602716+01:00)","example":"2025-04-07T11:13:33.602716+01:00"},"last_updated_end_time":{"type":"string","title":"The last updated end time to filter incidents. (ex: 2025-04-07T11:13:33.602716+01:00)","example":"2025-04-07T11:13:33.602716+01:00"},"incident_id":{"type":"integer","title":"The incident ID to filter incidents. ","example":1234},"email_subject":{"type":"string","title":"The email subject to filter incidents.","example":"Phishing attempt"},"sender_name":{"type":"string","title":"The sender name to filter incidents.","example":"John Doe"},"sender_email":{"type":"string","title":"The sender email to filter incidents.","example":"jdoe@company.com"},"recipient_name":{"type":"string","title":"The recipient name to filter incidents.","example":"Jane Smith"},"recipient_email":{"type":"string","title":"The recipient email to filter incidents.","example":"jsmith@company.com"},"page_size":{"type":"integer","title":"The number of incidents per page.","example":50},"challenged_type":{"type":"string","title":"The challenged type to filter incidents. (release_request, end_user_report)","enum":["release_request","end_user_report"],"example":"release_request"},"challenged_start_date":{"type":"string","title":"The challenged start date to filter incidents. (ex: 2025-04-07T11:13:33.602716+01:00)","example":"2025-04-07T11:13:33.602716+01:00"},"challenged_end_date":{"type":"string","title":"The challenged end date to filter incidents. (ex: 2025-04-07T11:13:33.602716+01:00)","example":"2025-04-07T11:13:33.602716+01:00"}}}]}}}}}}},"responses":{"200":{"description":"Successful response"}},"tags":["Email Protection"],"operationId":"api.rmm.post.email-protection.incidents.scanback.export"}},"/oneview/v1/accounts/{account_id}/email-protection/integrations/o365/phishing-button-manifest":{"post":{"description":"Get the manifest for the Phishing Button OWA XML Manifest","summary":"Get phishing button manifest","security":[{"client_credentials":["read"]},{"user_permissions":["emailSecurity.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"title":"Get Report Phishing OWA Xml Manifest","description":"Request to generate report phishing XML manifest.","type":"object","properties":{"button_name":{"type":"string","minLength":3,"maxLength":50,"example":"Report Phish"},"description":{"type":"string","minLength":3,"maxLength":200,"example":"Click to report suspected phishing emails to your security team."},"caption":{"type":"string","minLength":3,"maxLength":200,"example":"Report suspicious email"},"provider_name":{"type":"string","minLength":3,"maxLength":50,"example":"ThreatDown"},"logo":{"title":"image content converted to base64","description":"Base64 encoded image content.","type":"string"}},"required":["button_name","description","caption","provider_name"]}}}},"responses":{"200":{"description":"Successful response"}},"tags":["Email Protection"],"operationId":"api.rmm.post.email-protection.integrations.o365.phishing-button-manifest"}},"/oneview/v1/accounts/{account_id}/email-protection/integrations/gw/admin-consent-url":{"post":{"description":"Get the admin consent URL for the Google Workspace integration","summary":"Get GW Admin Consent URL","security":[{"client_credentials":["read"]},{"user_permissions":["emailSecurity.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"Successful response"}},"tags":["Email Protection"],"operationId":"api.rmm.post.email-protection.integrations.gw.admin-consent-url"}},"/oneview/v1/accounts/{account_id}/email-protection/integrations/gw/authorize":{"post":{"description":"Authorize Google Workspace integration","summary":"Authorize GW Integration","security":[{"client_credentials":["read"]},{"user_permissions":["emailSecurity.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"Successful response"}},"tags":["Email Protection"],"operationId":"api.rmm.post.email-protection.integrations.gw.authorize"}},"/oneview/v1/accounts/{account_id}/email-protection/stats/incidents":{"post":{"description":"Get email protection incident statistics","summary":"Get incident statistics","security":[{"client_credentials":["read"]},{"user_permissions":["emailSecurity.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"title":"Get Email Protection Incident Statistics Request","description":"Request to retrieve email protection incident statistics for a specified period","type":"object","required":["start_time","end_time"],"properties":{"start_time":{"type":"string","format":"date-time","title":"Start Time","description":"Start of the time range. Must be earlier than EndTime.","example":"2025-05-01T00:00:00Z"},"end_time":{"type":"string","format":"date-time","title":"End Time","description":"End of the time range. Must be later than StartTime.","example":"2025-05-15T23:59:59Z"},"include_scan_back":{"type":"boolean","title":"Include Scan Back","description":"Whether to include historical scan results in the statistics.","example":true}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"title":"Get Email Protection Incident Statistics Response","description":"Response containing email protection incident statistics for a specified period.","type":"object","required":["total_incidents_count","phishing","spam","safe","open","challenged","unclassified"],"properties":{"total_incidents_count":{"type":"integer","title":"Total Incidents Count","description":"Total number of incidents across all categories.","example":68},"phishing":{"type":"object","title":"Phishing Incidents Stats","description":"Statistics related to phishing incidents.","required":["incidents_count","emails_count"],"properties":{"incidents_count":{"type":"integer","title":"Phishing Incidents Count","example":34,"description":"Number of phishing-related incidents."},"emails_count":{"type":"integer","title":"Phishing Emails Count","example":112,"description":"Number of emails related to phishing incidents."}}},"spam":{"type":"object","title":"Spam Incidents Stats","description":"Statistics related to spam incidents.","required":["incidents_count","emails_count"],"properties":{"incidents_count":{"type":"integer","title":"Spam Incidents Count","example":10,"description":"Number of spam-related incidents."},"emails_count":{"type":"integer","title":"Spam Emails Count","example":88,"description":"Number of emails related to spam incidents."}}},"safe":{"type":"object","title":"Safe Incidents Stats","description":"Statistics related to safe (non-malicious) incidents.","required":["incidents_count","emails_count"],"properties":{"incidents_count":{"type":"integer","title":"Safe Incidents Count","example":4,"description":"Number of safe incidents."},"emails_count":{"type":"integer","title":"Safe Emails Count","example":25,"description":"Number of emails marked as safe."}}},"open":{"type":"object","title":"Open Incidents Stats","description":"Statistics related to open/unresolved incidents.","required":["incidents_count","emails_count"],"properties":{"incidents_count":{"type":"integer","title":"Open Incidents Count","example":5,"description":"Number of open/unresolved incidents."},"emails_count":{"type":"integer","title":"Open Emails Count","example":20,"description":"Number of emails in open incidents."}}},"challenged":{"type":"integer","title":"Challanged Incidents Count","description":"Number of incidents that were challanged.","example":7},"unclassified":{"type":"integer","title":"Unclassified Incidents Count","description":"Number of incidents that are unclassified.","example":8}}}}}}},"tags":["Email Protection"],"operationId":"api.rmm.post.email-protection.stats.incidents"}},"/oneview/v1/accounts/{account_id}/email-protection/migrate":{"post":{"description":"Migrate an email protection direct customer account to a new MSP parent account","summary":"Migrate Email Protection","security":[{"client_credentials":["write"]},{"user_permissions":["emailSecurity.manage"]}],"status":{"outage":["auth"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"title":"Migrate Email Protection Direct Customer Account","description":"Request to migrate an email protection direct customer account.","type":"object","properties":{"nebula_account_id":{"type":"string","title":"Child Account ID"}}}}}},"responses":{"200":{"description":"Successful response"}},"tags":["Email Protection"],"operationId":"api.rmm.post.email-protection.migrate"}},"/oneview/v1/accounts/{account_id}/email-protection/migration-eligibility":{"post":{"description":"Check if an account is eligible for migration to a new parent","summary":"Migration Eligibility","security":[{"client_credentials":["write"]},{"user_permissions":["emailSecurity.manage"]}],"status":{"outage":["auth"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"title":"Check if Account is Eligible for Migration","description":"Request to check if an account is eligible for migration.","type":"object","properties":{"nebula_account_id":{"type":"string","title":"Nebula Account ID"}}}}}},"responses":{"200":{"description":"Successful response"}},"tags":["Email Protection"],"operationId":"api.rmm.post.email-protection.migration-eligibility"}},"/oneview/v1/accounts/{account_id}/email-protection/account/monthly-usage":{"post":{"description":"Get email protection account monthly usage","summary":"Get monthly usage","security":[{"client_credentials":["read"]},{"user_permissions":["emailSecurity.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"title":"Get Monthly Usage Report","description":"Request schema for retrieving the monthly usage report, optionally filtered by plan or trial status.","type":"object","properties":{"page":{"type":"integer","minimum":1,"title":"Page Number","description":"Page number to retrieve, starting from 1.","example":1},"plan_active":{"type":"boolean","title":"Filter by Active Plan","description":"If true, only include accounts with an active plan. If false, only those without. If omitted, do not filter by plan status.","example":true},"trial_active":{"type":"boolean","title":"Filter by Active Trial","description":"If true, only include accounts with an active trial. If false, only those without. If omitted, do not filter by trial status.","example":false},"year":{"type":"integer","title":"Year","description":"The year for which the usage report is requested.","example":2025},"month":{"type":"integer","minimum":1,"maximum":12,"title":"Month","description":"The month (1 to 12) for which the usage report is requested.","example":7}},"required":["year","month"]}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"title":"Monthly Usage Report","description":"Response schema for retrieving the monthly usage report","type":"object","properties":{"total_pages":{"type":"integer","title":"Total Pages","description":"Total number of pages available in the report.","example":5},"page":{"type":"integer","title":"Current Page","description":"The current page number being returned.","example":1},"report":{"type":"array","title":"Usage Report Entries","description":"List of usage report entries for the current page.","items":{"type":"object","title":"Usage Report Entry","properties":{"sync_date":{"type":"string","title":"Sync Date","example":"2025-06-30"},"billing_date":{"type":"string","title":"Billing Date","example":"2025-06-01"},"company_id":{"type":"integer","title":"Company ID","example":12345},"account_id":{"type":"string","title":"Account ID","example":"acc-7890"},"account_name":{"type":"string","title":"Account Name","example":"Acme Corp"},"msp_name":{"type":"string","title":"MSP Name","example":"Managed Services Inc."},"high_watermark":{"type":"integer","title":"High Watermark","description":"Peak usage value for the account.","example":150},"plan_expiration_date":{"type":"string","title":"Plan Expiration Date","example":"2025-12-31"},"trial_expiration_date":{"type":"string","title":"Trial Expiration Date","example":"2025-07-15"},"registration_date":{"type":"string","title":"Registration Date","example":"2024-01-01"},"provider":{"type":"string","title":"provider","enum":["google","microsoft"],"example":"google"},"domains_count":{"type":"integer","title":"Domains Count","description":"Number of domains associated with the provider.","example":10},"term_type":{"type":"string","title":"Term Type","description":"License Term Type","example":"usage_billing"}},"required":["sync_date","billing_date","company_id","account_id","account_name","high_watermark","registration_date"]}}},"required":["total_pages","page","report"]}}}}},"tags":["Email Protection"],"operationId":"api.rmm.email-protection.post.account.monthly-usage"}},"/oneview/v1/accounts/{account_id}/email-protection/stats/most-targeted-departments":{"post":{"description":"Get email protection most targeted departments","summary":"Get most targeted departments","security":[{"client_credentials":["read"]},{"user_permissions":["emailSecurity.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"title":"Get Email Protection Most Targeted Departments Request","description":"Request to retrieve the most targeted departments for email protection incidents","type":"object","required":["start_time","end_time"],"properties":{"start_time":{"type":"string","format":"date-time","title":"Start Time","description":"Start of the time range. Must be earlier than EndTime.","example":"2025-05-01T00:00:00Z"},"end_time":{"type":"string","format":"date-time","title":"End Time","description":"End of the time range. Must be later than StartTime.","example":"2025-05-15T23:59:59Z"},"include_scan_back":{"type":"boolean","title":"Include Scan Back","description":"Whether to include historical scan results in the statistics.","example":true}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"title":"Get Email Protection Most Targeted Departments Response","description":"Response containing the most targeted departments for email protection incidents.","type":"object","required":["departments"],"properties":{"departments":{"type":"array","title":"Departments","description":"A list of departments and the number of phishing emails received by each.","items":{"type":"object","required":["emails_count","name"],"properties":{"emails_count":{"type":"integer","title":"Emails Count","description":"Number of emails received by the department.","example":42},"name":{"type":"string","title":"Department Name","description":"The name of the department.","example":"Finance"}}},"example":[{"emails_count":42,"name":"Finance"},{"emails_count":27,"name":"Human Resources"}]}}}}}}},"tags":["Email Protection"],"operationId":"api.rmm.post.email-proteciton.stats.most-targeted-departments"}},"/oneview/v1/accounts/{account_id}/email-protection/stats/most-targeted-users":{"post":{"description":"Get email protection most targeted users","summary":"Get most targeted users","security":[{"client_credentials":["read"]},{"user_permissions":["emailSecurity.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"title":"Get Email Protection Most Targeted Users Request","description":"Request to retrieve the most targeted Users for email protection incidents","type":"object","required":["start_time","end_time"],"properties":{"start_time":{"type":"string","format":"date-time","title":"Start Time","description":"Start of the time range. Must be earlier than EndTime.","example":"2025-05-01T00:00:00Z"},"end_time":{"type":"string","format":"date-time","title":"End Time","description":"End of the time range. Must be later than StartTime.","example":"2025-05-15T23:59:59Z"},"include_scan_back":{"type":"boolean","title":"Include Scan Back","description":"Whether to include historical scan results in the statistics.","example":true}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"title":"Get Email Protection Most Targeted Users Response","description":"Response to retrieve the most targeted Users for email protection incidents","type":"object","required":["users"],"properties":{"users":{"type":"array","title":"Most Targeted Users","description":"List of users with the number of phishing emails received and their mailbox details.","items":{"type":"object","required":["emails_count","mailbox"],"properties":{"emails_count":{"type":"integer","title":"Emails Count","description":"Number of emails received by the user.","example":12},"mailbox":{"type":"object","required":["id","firstName","lastName","title","department","email","phoneNumber","tags","language","enabled","protected","unprotectedReason"],"properties":{"id":{"type":"integer","title":"Mailbox ID","description":"Unique identifier for the mailbox.","example":1001234},"firstName":{"type":"string","title":"First Name","example":"John"},"lastName":{"type":"string","title":"Last Name","example":"Doe"},"title":{"type":"string","title":"Title","description":"Job title of the mailbox owner.","example":"Security Analyst"},"department":{"type":"string","title":"Department","description":"Department of the mailbox owner.","example":"IT"},"email":{"type":"string","format":"email","title":"Email","description":"Email address of the mailbox.","example":"john.doe@example-corp.com"},"phoneNumber":{"type":"string","title":"Phone Number","example":"+1-555-1234"},"tags":{"type":"array","title":"Tags","description":"Tags associated with the mailbox.","items":{"type":"string"},"example":["VIP","New Hire"]},"language":{"type":"string","title":"Language","example":"English"},"enabled":{"type":"boolean","title":"Enabled","description":"Whether the mailbox is enabled.","example":true},"protected":{"type":"boolean","title":"Protected","description":"Whether the mailbox is protected.","example":true},"unprotectedReason":{"type":"string","title":"Unprotected Reason","description":"Reason why the mailbox is unprotected, if applicable.","example":""}}}}},"example":[{"emails_count":12,"mailbox":{"id":1001234,"firstName":"John","lastName":"Doe","title":"Security Analyst","department":"IT","email":"john.doe@example-corp.com","phoneNumber":"+1-555-1234","tags":["VIP","New Hire"],"language":"English","enabled":true,"protected":true,"unprotectedReason":""}}]}}}}}}},"tags":["Email Protection"],"operationId":"api.rmm.post.email-protection.stats.most-targeted-users"}},"/oneview/v1/accounts/{account_id}/email-protection/integrations/o365/admin-consent-url":{"post":{"description":"Get the admin consent URL for the email protection integration","summary":"Get admin consent URL","security":[{"client_credentials":["read"]},{"user_permissions":["emailSecurity.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"title":"Generate O365 Admin Consent URL","description":"Request to generate O365 admin consent URL.","type":"object","properties":{"redirect_uri":{"type":"string","example":"https://example.com/redirect","description":"The URI to redirect to after the authentication process is complete."},"additional_data":{"type":"string","description":"The additional_data field is limited to a maximum of 36 characters. Only the following characters are allowed: letters (A-Z, a-z), digits (0-9), hyphen (-), and underscore (_). This is sufficient to support UUIDs and other short identifiers."}},"required":["redirect_uri"]}}}},"responses":{"200":{"description":"Successful response"}},"tags":["Email Protection"],"operationId":"api.rmm.post.email-protection.integrations.o365.admin-consent-url"}},"/oneview/v1/accounts/{account_id}/email-protection/register-msp":{"post":{"description":"Register an email protection MSP account","summary":"Register email protection MSP account","security":[{"client_credentials":["write"]},{"user_permissions":["emailSecurity.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"title":"Register MSP Account Request","type":"object","properties":{"region":{"type":"string","enum":["US","EU","UAE"],"description":"Region of the account.","example":"EU"}},"required":["region"],"example":{"region":"EU"}}}}},"responses":{"200":{"description":"Successful response"}},"tags":["Email Protection"],"operationId":"api.rmm.post.email-protection.register-msp"}},"/oneview/v1/accounts/{account_id}/email-protection/incidents/scanback":{"post":{"description":"Search Scanback email protection incidents for an account","summary":"Search Scanback incidents","security":[{"client_credentials":["read"]},{"user_permissions":["emailSecurity.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Incidents Search Request","properties":{"classification":{"type":"array","items":{"type":"string","enum":["all","phishing","spam","compromised","safe","open","silent"]},"title":"The classifications of the incidents to filter by."},"report_type":{"type":"array","title":"The type of report to filter incidents.","enum":["all","email","ato","teams"],"example":"all"},"state":{"type":"array","items":{"type":"string","enum":["all","classified","unclassified","challenged"]},"title":"The states of the incidents to filter by.","example":"all"},"page":{"type":"integer","title":"The page number to retrieve.","example":1},"sort":{"type":"string","title":"The field to sort the incidents by.","enum":["noSorting","created","latestEmailDate","incidentID","emailSubject","senderName","senderEmail","recipientName","recipientEmail","classification"],"example":"classification"},"order":{"type":"string","title":"The order to sort the incidents.","enum":["asc","desc"],"example":"asc"},"start_time":{"type":"string","title":"The start time to filter incidents. (ex: 2025-04-07T11:13:33.602716+01:00)","example":"2025-04-07T11:13:33.602716+01:00"},"end_time":{"type":"string","title":"The end time to filter incidents. (ex: 2025-04-07T11:13:33.602716+01:00)","example":"2025-04-07T11:13:33.602716+01:00"},"last_updated_start_time":{"type":"string","title":"The last updated start time to filter incidents. (ex: 2025-04-07T11:13:33.602716+01:00)","example":"2025-04-07T11:13:33.602716+01:00"},"last_updated_end_time":{"type":"string","title":"The last updated end time to filter incidents. (ex: 2025-04-07T11:13:33.602716+01:00)","example":"2025-04-07T11:13:33.602716+01:00"},"incident_id":{"type":"integer","title":"The incident ID to filter incidents. ","example":1234},"email_subject":{"type":"string","title":"The email subject to filter incidents.","example":"Phishing attempt"},"sender_name":{"type":"string","title":"The sender name to filter incidents.","example":"John Doe"},"sender_email":{"type":"string","title":"The sender email to filter incidents.","example":"jdoe@company.com"},"recipient_name":{"type":"string","title":"The recipient name to filter incidents.","example":"Jane Smith"},"recipient_email":{"type":"string","title":"The recipient email to filter incidents.","example":"jsmith@company.com"},"page_size":{"type":"integer","title":"The number of incidents per page.","example":50},"challenged_type":{"type":"string","title":"The challenged type to filter incidents. (release_request, end_user_report)","enum":["release_request","end_user_report"],"example":"release_request"},"challenged_start_date":{"type":"string","title":"The challenged start date to filter incidents. (ex: 2025-04-07T11:13:33.602716+01:00)","example":"2025-04-07T11:13:33.602716+01:00"},"challenged_end_date":{"type":"string","title":"The challenged end date to filter incidents. (ex: 2025-04-07T11:13:33.602716+01:00)","example":"2025-04-07T11:13:33.602716+01:00"}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Email Protection Incident Search Response","properties":{"page":{"type":"integer","description":"The current page of the result set.","example":1},"total_pages":{"type":"integer","description":"The total number of pages available.","example":1},"total_count":{"type":"integer","description":"The total number of incidents in the response","example":10},"incidents":{"type":"array","description":"List of incidents.","items":{"type":"object","properties":{"incident_id":{"type":"integer","description":"Unique identifier for the incident.","example":1},"incident_type":{"type":"string","description":"Type of the incident.","example":"Email Report"},"email_subject":{"type":"string","description":"Subject of the email related to the incident.","example":"The right layers, the right prices"},"links_count":{"type":"integer","description":"The number of links in the incident's email.","example":105},"attachments_count":{"type":"integer","description":"The number of attachments in the incident's email.","example":0},"recipient_email":{"type":"string","description":"Email address of the recipient.","example":"xyz@threatdown.com"},"recipient_name":{"type":"string","description":"Name of the recipient.","example":"John Doe "},"classification":{"type":"string","description":"Classification of the incident.","example":"Phishing"},"assignee":{"type":["string","null"],"description":"The assignee of the incident, or null if unassigned.","example":null},"sender_name":{"type":"string","description":"Name of the sender.","example":"xfy storm"},"sender_email":{"type":"string","description":"Email address of the sender.","example":"xfy@storm.com"},"affected_mailboxes_count":{"type":"integer","description":"Number of mailboxes affected by the incident.","example":9},"comments_count":{"type":"integer","description":"Number of comments on the incident.","example":0},"release_request_count":{"type":"integer","description":"Number of release requests for the incident.","example":0},"created_at":{"type":"string","description":"Timestamp when the incident was created.","example":"2025-02-27T23:09:55.473222Z"},"last_updated_at":{"type":"string","description":"Timestamp of the latest email related to the incident.","example":"2025-03-07T19:24:51Z"},"reported_by":{"type":"string","description":"Who reported the incident.","example":"ThreatDown Community"},"resolved_by":{"type":"string","description":"Who resolved the incident.","example":"Skinny Skeleton"},"status":{"type":"string","description":"Status of the incident.","example":"Categorization needed"},"challenged_type":{"type":"string","description":"The challenged type of the incident, or empty if not applicable.","example":"Release request"},"first_challenged_date":{"type":"string","description":"The first challenged date of the incident","example":"2025-10-09T10:29:59.656628Z"}},"required":["incident_id","incident_type","email_subject","links_count","attachments_count","recipient_email","recipient_name","classification","assignee","sender_name","sender_email","affected_mailboxes_count","comments_count","release_request_count","created_at","last_updated_at","reported_by","resolved_by","status"]}}},"required":["page","total_pages","incidents","total_count"]}}}}},"tags":["Email Protection"],"operationId":"api.rmm.post.email-proteciton.incidents.scanback"}},"/oneview/v1/accounts/{account_id}/email-protection/auto-sync/groups":{"post":{"description":"Search email protection account auto-sync groups","summary":"Search auto-sync groups","security":[{"client_credentials":["read"]},{"user_permissions":["emailSecurity.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"title":"Search Auto Sync Groups","description":"Request to search the groups included in the auto synchronization for email protection.","type":"object","properties":{"page":{"type":"integer","minimum":1,"title":"Page Number","example":1},"query":{"type":"string","title":"Search Query (Email Filter)","example":"john.doe@example.com"},"gw_admin_email":{"type":"string","format":"email","title":"Gateway Admin Email","example":"admin@example.com"}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"title":"Get Auto Sync Groups Response","description":"Response containing the groups included in the auto synchronization for email protection.","type":"object","required":["groups","page","total_pages","total_count"],"properties":{"groups":{"type":"array","title":"Groups","items":{"type":"object","additionalProperties":{"type":"string"},"example":{"group_id":"123","group_name":"Engineering"}},"example":[{"group_id":"123","group_name":"Engineering"},{"group_id":"456","group_name":"Sales"}]},"page":{"type":"integer","title":"Current Page","example":1},"total_pages":{"type":"integer","title":"Total Pages","example":5},"total_count":{"type":"integer","title":"Total Groups Count","example":100}}}}}}},"tags":["Email Protection"],"operationId":"api.rmm.post.email-protection.account.auto-sync.groups"}},"/oneview/v1/accounts/{account_id}/email-protection/emails":{"post":{"description":"Search email protection emails","summary":"Search emails","security":[{"client_credentials":["read"]},{"user_permissions":["emailSecurity.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"title":"Search Emails","description":"Request to search for emails in the email protection system based on various criteria.","type":"object","required":["start_time","end_time"],"properties":{"start_time":{"type":"string","format":"date-time","title":"Start Time","description":"Start time for the search (must be earlier than end_time).","example":"2024-01-01T00:00:00Z"},"end_time":{"type":"string","format":"date-time","title":"End Time","description":"End time for the search (must be later than start_time).","example":"2024-01-02T00:00:00Z"},"page":{"type":"integer","minimum":1,"title":"Page","description":"Page number for pagination.","example":1},"page_size":{"type":"integer","minimum":1,"title":"Page Size","description":"Number of results per page.","example":25},"recipient":{"type":"string","title":"Recipient","description":"Optional email or name of the recipient to filter results."},"threat_types":{"type":"array","title":"Threat Types","description":"Optional list of threat types to filter results.","items":{"type":"string","enum":["VIP Impersonation","Business Email Compromise","Financial Fraud","Gift Card Request","Fraudulent Request","Credential Theft","Advance-fee Scam","Lottery Scam","Extortion","Sextortion","Vishing Attack","Vendor Scam","Invoice Phishing","Vendor Email Compromise","Suspected Malicious Content","Polymorphic Phishing","Bulk Phishing","Image-Based Attack","QR Code Attack"]},"example":["Credential Theft","QR Code Attack"]},"classifications":{"type":"array","title":"Classifications","description":"Optional list of classifications to filter results.","items":{"type":"string","enum":["Phishing","Spam","Safe","Unclassified","Microsoft quarantine","Released from Microsoft"]},"example":["Phishing","Safe"]},"include_scanback":{"type":"boolean","title":"Include Scanback","description":"Whether to include historical scanback data.","example":false},"incident_id":{"type":"integer","title":"Incident ID","description":"Optional incident ID to filter by.","example":123456},"challenged_type":{"type":"string","title":"Challenged Type","description":"Optional type of challenge to filter results.","enum":["release_request","end_user_report"],"example":"release_request"}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"title":"Email Search Response","type":"object","required":["page","total_pages","total_count","emails"],"properties":{"page":{"type":"integer","title":"Page","description":"The current page number.","example":1},"total_pages":{"type":"integer","title":"Total Pages","description":"Total number of pages available.","example":5},"total_count":{"type":"integer","title":"Total Count","description":"Total number of emails found.","example":100},"emails":{"type":"array","title":"Emails","description":"List of emails returned in the current page.","items":{"type":"object","required":["arrived_at","subject","sender_email","recipient_name","recipient_email","primary_threat_type","is_scanback","classification","incident_state","resolution","sender_ip","reported_by","department"],"properties":{"arrived_at":{"type":["string","null"],"format":"date-time","title":"Arrived At","description":"Timestamp when the email arrived.","example":"2024-05-01T12:34:56Z"},"incident_id":{"type":"integer","title":"Incident ID","description":"ID of the associated incident.","example":12345},"subject":{"type":"string","title":"Subject","description":"Subject line of the email.","example":"Urgent: Update your credentials"},"sender_email":{"type":"string","format":"email","title":"Sender Email","description":"Email address of the sender.","example":"attacker@example.com"},"recipient_name":{"type":"string","title":"Recipient Name","description":"Name of the email recipient.","example":"John Doe"},"recipient_email":{"type":"string","format":"email","title":"Recipient Email","description":"Email address of the recipient.","example":"john.doe@company.com"},"primary_threat_type":{"type":"string","title":"Primary Threat Type","description":"Primary classification of the threat.","example":"Credential Theft"},"is_scanback":{"type":"boolean","title":"Is Scanback","description":"Indicates whether this email was found during a scanback.","example":false},"classification":{"type":"string","title":"Classification","description":"Classification of the email.","example":"Phishing"},"incident_state":{"type":"string","title":"Incident State","description":"Current state of the incident.","example":"Open"},"resolution":{"type":"string","title":"Resolution","description":"How the incident was resolved.","example":"Quarantined"},"sender_ip":{"type":"string","title":"Sender IP","description":"IP address of the sender.","example":"192.0.2.1"},"reported_by":{"type":"string","title":"Reported By","description":"Method or user who reported the email.","example":"user"},"mailbox_id":{"type":"integer","title":"Mailbox ID","description":"ID of the mailbox that received the email.","example":987654},"department":{"type":"string","title":"Department","description":"Department of the recipient.","example":"Finance"},"remediated_at":{"type":["string","null"],"format":"date-time","title":"Remediated At","description":"Timestamp when the email was remediated.","example":"2024-05-01T15:00:00Z"},"mitigation_id":{"type":"integer","title":"Mitigation ID","description":"Mitigation action identifier, if applicable.","example":56789},"challenged_type":{"type":"string","title":"Challenged Type","examples":["Release request"]},"first_challenged_date":{"type":"string","title":"First Challenged Date","examples":["2025-04-01T08:15:30Z"]},"challenged_by":{"type":["null","string"],"title":"Challenged By","examples":["analyst@company.com"]},"challenged_date":{"type":["null","string"],"title":"Challenged Date","examples":["2025-04-03T10:45:00Z"]},"challenge_reason":{"type":["null","string"],"title":"Challenge Reason","examples":["Known sender"]},"challenged_comment":{"type":["null","string"],"title":"Challenged Comment","examples":["Safe Email"]},"opened_on":{"type":["null","string"],"title":"Opened On","examples":["2025-04-04T14:20:00Z"]}}}}}}}}}},"tags":["Email Protection"],"operationId":"api.rmm.post.email-protection.emails.search"}},"/oneview/v1/accounts/{account_id}/email-protection/incidents":{"post":{"description":"Search email protection incidents for an account","summary":"Search incidents","security":[{"client_credentials":["read"]},{"user_permissions":["emailSecurity.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Incidents Search Request","properties":{"classification":{"type":"array","items":{"type":"string","enum":["all","phishing","spam","compromised","safe","open","silent"]},"title":"The classifications of the incidents to filter by."},"report_type":{"type":"array","title":"The type of report to filter incidents.","enum":["all","email","ato","teams"],"example":"all"},"state":{"type":"array","items":{"type":"string","enum":["all","classified","unclassified","challenged"]},"title":"The states of the incidents to filter by.","example":"all"},"page":{"type":"integer","title":"The page number to retrieve.","example":1},"sort":{"type":"string","title":"The field to sort the incidents by.","enum":["noSorting","created","latestEmailDate","incidentID","emailSubject","senderName","senderEmail","recipientName","recipientEmail","classification"],"example":"classification"},"order":{"type":"string","title":"The order to sort the incidents.","enum":["asc","desc"],"example":"asc"},"start_time":{"type":"string","title":"The start time to filter incidents. (ex: 2025-04-07T11:13:33.602716+01:00)","example":"2025-04-07T11:13:33.602716+01:00"},"end_time":{"type":"string","title":"The end time to filter incidents. (ex: 2025-04-07T11:13:33.602716+01:00)","example":"2025-04-07T11:13:33.602716+01:00"},"last_updated_start_time":{"type":"string","title":"The last updated start time to filter incidents. (ex: 2025-04-07T11:13:33.602716+01:00)","example":"2025-04-07T11:13:33.602716+01:00"},"last_updated_end_time":{"type":"string","title":"The last updated end time to filter incidents. (ex: 2025-04-07T11:13:33.602716+01:00)","example":"2025-04-07T11:13:33.602716+01:00"},"incident_id":{"type":"integer","title":"The incident ID to filter incidents. ","example":1234},"email_subject":{"type":"string","title":"The email subject to filter incidents.","example":"Phishing attempt"},"sender_name":{"type":"string","title":"The sender name to filter incidents.","example":"John Doe"},"sender_email":{"type":"string","title":"The sender email to filter incidents.","example":"jdoe@company.com"},"recipient_name":{"type":"string","title":"The recipient name to filter incidents.","example":"Jane Smith"},"recipient_email":{"type":"string","title":"The recipient email to filter incidents.","example":"jsmith@company.com"},"page_size":{"type":"integer","title":"The number of incidents per page.","example":50},"challenged_type":{"type":"string","title":"The challenged type to filter incidents. (release_request, end_user_report)","enum":["release_request","end_user_report"],"example":"release_request"},"challenged_start_date":{"type":"string","title":"The challenged start date to filter incidents. (ex: 2025-04-07T11:13:33.602716+01:00)","example":"2025-04-07T11:13:33.602716+01:00"},"challenged_end_date":{"type":"string","title":"The challenged end date to filter incidents. (ex: 2025-04-07T11:13:33.602716+01:00)","example":"2025-04-07T11:13:33.602716+01:00"}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Email Protection Incident Search Response","properties":{"page":{"type":"integer","description":"The current page of the result set.","example":1},"total_pages":{"type":"integer","description":"The total number of pages available.","example":1},"total_count":{"type":"integer","description":"The total number of incidents in the response","example":10},"incidents":{"type":"array","description":"List of incidents.","items":{"type":"object","properties":{"incident_id":{"type":"integer","description":"Unique identifier for the incident.","example":1},"incident_type":{"type":"string","description":"Type of the incident.","example":"Email Report"},"email_subject":{"type":"string","description":"Subject of the email related to the incident.","example":"The right layers, the right prices"},"links_count":{"type":"integer","description":"The number of links in the incident's email.","example":105},"attachments_count":{"type":"integer","description":"The number of attachments in the incident's email.","example":0},"recipient_email":{"type":"string","description":"Email address of the recipient.","example":"xyz@threatdown.com"},"recipient_name":{"type":"string","description":"Name of the recipient.","example":"John Doe "},"classification":{"type":"string","description":"Classification of the incident.","example":"Phishing"},"assignee":{"type":["string","null"],"description":"The assignee of the incident, or null if unassigned.","example":null},"sender_name":{"type":"string","description":"Name of the sender.","example":"xfy storm"},"sender_email":{"type":"string","description":"Email address of the sender.","example":"xfy@storm.com"},"affected_mailboxes_count":{"type":"integer","description":"Number of mailboxes affected by the incident.","example":9},"comments_count":{"type":"integer","description":"Number of comments on the incident.","example":0},"release_request_count":{"type":"integer","description":"Number of release requests for the incident.","example":0},"created_at":{"type":"string","description":"Timestamp when the incident was created.","example":"2025-02-27T23:09:55.473222Z"},"last_updated_at":{"type":"string","description":"Timestamp of the latest email related to the incident.","example":"2025-03-07T19:24:51Z"},"reported_by":{"type":"string","description":"Who reported the incident.","example":"ThreatDown Community"},"resolved_by":{"type":"string","description":"Who resolved the incident.","example":"Skinny Skeleton"},"status":{"type":"string","description":"Status of the incident.","example":"Categorization needed"},"challenged_type":{"type":"string","description":"The challenged type of the incident, or empty if not applicable.","example":"Release request"},"first_challenged_date":{"type":"string","description":"The first challenged date of the incident","example":"2025-10-09T10:29:59.656628Z"}},"required":["incident_id","incident_type","email_subject","links_count","attachments_count","recipient_email","recipient_name","classification","assignee","sender_name","sender_email","affected_mailboxes_count","comments_count","release_request_count","created_at","last_updated_at","reported_by","resolved_by","status"]}}},"required":["page","total_pages","incidents","total_count"]}}}}},"tags":["Email Protection"],"operationId":"api.rmm.post.email-protection.incidents"}},"/oneview/v1/accounts/{account_id}/email-protection/mailboxes":{"post":{"description":"Search email protection mailboxes for an account","summary":"Search Mailboxes","security":[{"client_credentials":["read"]},{"user_permissions":["emailSecurity.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Mailboxes Search Request Body","properties":{"ids":{"type":"array","items":{"type":"integer"},"description":"List of mailbox IDs to filter."},"search":{"type":"string","description":"Search term to filter mailboxes."},"is_enabled":{"type":"boolean","description":"Filter by enabled status."},"tags":{"type":"array","items":{"type":"string"},"description":"List of tags to filter mailboxes."},"first_name":{"type":"string","description":"Filter by first name."},"last_name":{"type":"string","description":"Filter by last name."},"department":{"type":"string","description":"Filter by department."},"email":{"type":"string","description":"Filter by email address."},"title":{"type":"string","description":"Filter by title."},"is_protected":{"type":"boolean","description":"Filter by protection status."},"language":{"type":"string","description":"Filter by language."},"awareness":{"type":"array","items":{"type":"integer"},"description":"Filter by awareness levels."},"sort":{"type":"string","enum":["id","title","department","first_name","last_name","email","awareness","is_enabled","language","is_protected"],"description":"Field to sort by."},"order":{"type":"string","enum":["asc","desc"],"description":"Sort order."},"page":{"type":"integer","description":"The page number to retrieve.","example":1},"page_size":{"type":"integer","description":"The number of mailboxes per page.","example":50}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"title":"MailboxesResponse","type":"object","properties":{"page":{"type":"integer","example":1},"total_pages":{"type":"integer","example":1},"total_count":{"type":"integer","example":2},"mailboxes":{"type":"array","items":{"type":"object","properties":{"id":{"type":"integer","example":1},"firstName":{"type":"string","example":"John"},"lastName":{"type":"string","example":"Mayer"},"title":{"type":"string","example":""},"department":{"type":"string","example":""},"email":{"type":"string","format":"email","example":"jm@company.com"},"phoneNumber":{"type":"string","example":""},"tags":{"type":"array","items":{"type":"string"},"example":["Untrained","VIP_impersonation"]},"language":{"type":"string","example":"English"},"enabled":{"type":"boolean","example":false},"protected":{"type":"boolean","example":false},"unprotectedReason":{"type":"string","example":""}},"required":["firstName","lastName","title","department","email","phoneNumber","tags","language","enabled","protected","unprotectedReason"]}}},"required":["page","total_pages","total_count","mailboxes"]}}}}},"tags":["Email Protection"],"operationId":"api.rmm.post.email-protection.mailboxes"},"put":{"description":"Edit email protection mailboxes","summary":"Edit mailboxes","security":[{"client_credentials":["write"]},{"user_permissions":["emailSecurity.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"title":"Edit Mailbox Request","type":"object","required":["params"],"properties":{"filters":{"type":"object","title":"Mailbox Filters","properties":{"ids":{"type":"array","title":"Mailbox IDs","items":{"type":"integer","minimum":1,"example":101},"example":[101,102,103]},"search":{"type":"string","title":"Search Filter","description":"Searches on First Name, Last Name, Email, Title, Department, Phone Number","example":"john.doe@example.com"},"is_enabled":{"type":"boolean","title":"Filter by Enabled Status","example":true},"tags":{"type":"array","title":"Filter by Tags","items":{"type":"string"},"example":["engineering","remote"]}},"additionalProperties":false},"params":{"type":"object","title":"Mailbox Parameters","properties":{"is_enabled":{"type":"boolean","title":"Set Enabled Status","example":false},"add_tags":{"type":"array","title":"Tags to Add","items":{"type":"string"},"example":["vip","secure"]},"remove_tags":{"type":"array","title":"Tags to Remove","items":{"type":"string"},"example":["temporary","inactive"]}}}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"title":"Enable/Disable Mailbox Response","type":"object","required":["edited_mailbox_ids"],"properties":{"edited_mailbox_ids":{"type":"array","title":"The mailbox ids edited","items":[{"type":"integer"}],"examples":[[1,2]]}}}}}}},"tags":["Email Protection"],"operationId":"api.rmm.put.email-protection.mailboxes.edit"}},"/oneview/v1/accounts/{account_id}/email-protection/site/integration/status":{"post":{"description":"Get email protection site integration status","summary":"Get site integration status","security":[{"client_credentials":["read"]},{"user_permissions":["emailSecurity.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"title":"Get MSP Site Status Request","type":"object","properties":{"page":{"type":"integer","minimum":1,"title":"Page number (must be greater than 0)","example":1},"page_size":{"type":"integer","minimum":1,"title":"Number of items per page (must be greater than 0)","example":1},"sites":{"type":"array","title":"List of site UUIDs to filter by","items":{"type":"string"},"example":["6b804679-d9f4-48c3-bec5-7a3e97f81854","7133ecf8-fec2-4b1a-939e-ab0a3b1d476f"]}},"required":["page"],"example":{"page":1,"page_size":50,"sites":["6b804679-d9f4-48c3-bec5-7a3e97f81854","7133ecf8-fec2-4b1a-939e-ab0a3b1d476f"]}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"title":"Site Integration Status Result","type":"object","properties":{"site_status":{"type":"array","title":"List of integration status objects for each site","items":{"type":"object","title":"Site Integration Status","properties":{"account_id":{"type":"string","title":"Unique identifier of the site account","example":"550e8400-e29b-41d4-a716-446655440000"},"has_license":{"type":"boolean","title":"Indicates if the site has a valid license","example":true},"is_registered":{"type":"boolean","title":"Indicates if the site is registered","example":true},"is_integrated":{"type":"boolean","title":"Indicates if the site is integrated","example":false},"expired_trial":{"type":"boolean","title":"Indicates if the site has an expired trial","example":false},"in_trial":{"type":"boolean","title":"Indicates if the site is in trial","example":false},"expired_license":{"type":"boolean","title":"Indicates if the site has an expired license","example":false},"trial_expiration_date":{"type":"string","title":"Timestamp of the trial expiration date"}},"required":["account_id","has_license","is_registered","is_integrated","expired_trial","in_trial","expired_license"],"example":{"account_id":"550e8400-e29b-41d4-a716-446655440000","has_license":true,"is_registered":true,"is_integrated":false,"expired_trial":false,"in_trial":false,"expired_license":false}},"example":[{"account_id":"550e8400-e29b-41d4-a716-446655440000","has_license":true,"is_registered":true,"is_integrated":false}]},"total_pages":{"type":"integer","title":"Total number of pages available","example":5},"total_count":{"type":"integer","title":"Total number of site integration status records","example":42},"current_page":{"type":"integer","title":"Current page number","example":1}},"required":["site_status","total_pages","total_count","current_page"],"example":{"site_status":[{"account_id":"550e8400-e29b-41d4-a716-446655440000","has_license":true,"is_registered":true,"is_integrated":false}],"total_pages":5,"total_count":42}}}}}},"tags":["Email Protection"],"operationId":"api.rmm.post.email-protection.site.integration.status"}},"/oneview/v1/accounts/{account_id}/email-protection/incidents/{incident_id}/uncluster":{"post":{"description":"Reclassify incident emails by moving emails from one incident to a new incident with a different classification","summary":"Uncluster incident emails","security":[{"client_credentials":["write"]},{"user_permissions":["emailSecurity.manage"]}],"status":{"outage":["auth"]},"parameters":[{"name":"incident_id","required":true,"in":"path","description":"Incident ID","schema":{"type":"integer"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Uncluster Incident Emails","required":["email_ids","classification"],"properties":{"classification":{"type":"string","title":"Classification - phishing, spam, safe","examples":["phishing","spam","safe"]},"email_ids":{"type":"array","items":{"type":"integer"},"title":"Email IDs to uncluster","examples":[12345]}}}}}},"responses":{"200":{"description":"Successful response"}},"tags":["Email Protection"],"operationId":"api.rmm.post.email-protection.incidents.uncluster"}},"/oneview/v1/accounts/{account_id}/email-protection/register-msp-site":{"post":{"description":"Register an email protection MSP site account","summary":"Register email protection MSP site account","security":[{"client_credentials":["write"]},{"user_permissions":["emailSecurity.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"title":"Register MSP Site Account Request","description":"Request to register a new MSP site account for email protection services.","type":"object","required":["name","owner_email","owner_first_name","owner_last_name","domain"],"properties":{"name":{"type":"string","title":"Account Name","example":"Acme Corporation"},"owner_email":{"type":"string","format":"email","title":"Owner Email Address","example":"owner@acme.com"},"owner_first_name":{"type":"string","title":"Owner First Name","example":"Alice"},"owner_last_name":{"type":"string","title":"Owner Last Name","example":"Smith"},"domain":{"type":"string","title":"Primary Domain","example":"acme.com"},"silent_mode":{"type":"boolean","title":"Silent Mode Enabled","example":false},"autopilot_enabled":{"type":"boolean","title":"Autopilot Feature Enabled","example":true},"partner_id":{"type":"integer","title":"Partner ID","example":101},"allowed_domains":{"type":"array","title":"Allowed Domains","items":{"type":"string","example":"acme.io"},"example":["acme.com","acme.io"]},"country":{"type":"string","title":"Country Code (ISO Alpha-2)","example":"US"}}}}}},"responses":{"200":{"description":"Successful response"}},"tags":["Email Protection"],"operationId":"api.rmm.post.email-protection.register-msp-site"}},"/oneview/v1/assets/software/export":{"post":{"description":"Export assets software data. You can export across multiple accounts. Specify your interested fields and the output format.\n\nSupported output formats: csv, xlsx, json.\n\n## Settings\n\n| Name | Description |\n|------|-------------|\n| groups | List of queries. The constraints accepted are the same accepted by the search assets software route. Refer to [Search assets software API](#operation/api.v2.rmm.search.assets.software) for more information about the constraints accepted. |\n| download | If set to true, the server will set the `Content-Disposition` header using the `filename` and `format` |\n| select | Which fields to select, and which field name to map to. See request schema for allowed values |\n| type | Output encoding (for `csv` and `json` format) |\n| filename | Name of the file to be set in `Content-Disposition` header if `download` = true |\n\n## Examples\n\n### Download HTML file\n\nA request with this body sent by a browser will download a file called `nameofthefile.html`, displaying a table with columns: `Path`, `Name`, `Machine ID`, `Machine Name` for all detections on `windows` endpoints within account id `1e14cd0a-2ef3-4db3-b8a4-c89894d9aa34`:\n\n```json\n\t{\n\t\t\"groups\": [{\n\t\t\t\"account_ids\": [\"1e14cd0a-2ef3-4db3-b8a4-c89894d9aa34\"],\n\t\t\t\"vendor\": \"Mozilla\"\n\t\t}],\n\t\t\"format\": \"html\",\n\t\t\"type\": \"string\",\n\t\t\"filename\": \"nameofthefile\",\n\t\t\"download\": true,\n\t\t\"select\": [\n {\"field\": \"accountId\", \"newField\": \"account_id\"},\n {\"field\": \"groupId\", \"newField\": \"groupId\"},\n {\"field\": \"vendor\", \"newField\": \"vendor\"},\n {\"field\": \"product\", \"newField\": \"product\"},\n {\"field\": \"installationDate\", \"newField\": \"installationDate\"},\n {\"field\": \"createdAt\", \"newField\": \"createdAt\"}\n ]\n\t}\n```\n\n### Download xlsx file\n\nA request with this body sent by a browser will download a file called `report.html`, displaying a table with columns: `Path`, `Name`, `Machine ID`, `Machine Name` for all `windows` endpoints within account id `1e14cd0a-2ef3-4db3-b8a4-c89894d9aa34` and the endpoint with id `211a4cfc-557e-4ba7-a96f-70685a07c29e`:\n\n```json\n\t{\n\t\t\"groups\": [{\n \t\"account_ids\": [\"1e14cd0a-2ef3-4db3-b8a4-c89894d9aa34\"],\n \t\"vendor\": \"Mozilla\"\n }],\n\t\t\"populate\": { \"account\": true, \"last_job\": true },\n\t\t\"format\": \"xlsx\",\n\t\t\"type\": \"base64\",\n\t\t\"filename\": \"report\",\n\t\t\"download\": true,\n\t\t\"select\": [\n {\"field\": \"accountId\", \"newField\": \"account_id\"},\n {\"field\": \"groupId\", \"newField\": \"groupId\"},\n {\"field\": \"vendor\", \"newField\": \"vendor\"},\n {\"field\": \"product\", \"newField\": \"product\"},\n {\"field\": \"installationDate\", \"newField\": \"installationDate\"},\n {\"field\": \"createdAt\", \"newField\": \"createdAt\"}\n ]\n\t}\n```\n\n\n","summary":"Export assets software","security":[{"client_credentials":["execute"]},{"user_permissions":["softwareInventory.view"]}],"status":{"outage":["auth","search_stateless"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Export request","allOf":[{"type":"object","title":"Export request","required":["groups","select","format"],"properties":{"format":{"type":"string","title":"The output file","enum":["csv","xlsx","html","ods","txt","rtf","json"]},"download":{"type":"boolean","title":"Whether to instruct the client to download the response as a file. Only clients like browsers are supported"},"type":{"type":"string","title":"The encoding of the output","enum":["string","base64","binary"],"default":"string"},"select":{"type":"array","title":"Which fields to select from the response","items":{"type":"object","title":"Field","required":["field","newField"],"properties":{"newField":{"type":"string","title":"the new value"},"field":{"type":"string","title":"The response field to map to a new value","enum":["account_id","parent_account_id","group_id","root_group_id","group_name","machine_id","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","installed_version","normalized_installed_version","display_installed_version","installation_date","account_name","host_name","fully_qualified_host_name","domain_name","alias","created_at","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","object_guid","latest_version_available","cves","cves_by_status.unknown","cves_by_status.low","cves_by_status.medium","cves_by_status.high","cves_by_status.critical","cves_score","cves_count","cves_count_by_status.unknown","cves_count_by_status.low","cves_count_by_status.medium","cves_count_by_status.high","cves_count_by_status.critical","language","architecture","product_signature","categories","supports_update","supports_uninstall","update_available","ignored_until","ignore_rule_ids","active_directory.user.display_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.machine.display_name","active_directory.machine.sam_account_name","active_directory.machine.ou"]}}}},"groups":{"type":"array","title":"List of queries","items":{"type":"object","title":"Query to fetch endpoints","allOf":[{"type":"object","title":"Search assets software request. Leading wildcards are not supported for constraint fields without '.keyword' suffix.","properties":{"parent_account_id":{"type":"string","title":"Filter the search by parent_account_id. Search for an exact match"},"not.parent_account_id":{"type":"string","title":"Filter the search by parent_account_id. Search for the matches that are not equal to the value"},"group_id":{"type":"string","title":"Filter the search by group_id. Search for an exact match"},"not.group_id":{"type":"string","title":"Filter the search by group_id. Search for the matches that are not equal to the value"},"root_group_id":{"type":"string","title":"Filter the search by root_group_id. Search for an exact match"},"not.root_group_id":{"type":"string","title":"Filter the search by root_group_id. Search for the matches that are not equal to the value"},"machine_id":{"type":"string","title":"Filter the search by machine_id. Search for an exact match"},"not.machine_id":{"type":"string","title":"Filter the search by machine_id. Search for the matches that are not equal to the value"},"account_name":{"type":"string","title":"Filter the search by account_name. Search for the matches that contain the value"},"account_name.keyword":{"type":"string","title":"Filter the search by account_name. Search for an exact match"},"not.account_name":{"type":"string","title":"Filter the search by account_name. Search for the matches that don't contain the value"},"not.account_name.keyword":{"type":"string","title":"Filter the search by account_name. Search for the matches that are not equal to the value"},"host_name":{"type":"string","title":"Filter the search by host_name. Search for the matches that contain the value"},"host_name.keyword":{"type":"string","title":"Filter the search by host_name. Search for an exact match"},"not.host_name":{"type":"string","title":"Filter the search by host_name. Search for the matches that don't contain the value"},"not.host_name.keyword":{"type":"string","title":"Filter the search by host_name. Search for the matches that are not equal to the value"},"fully_qualified_host_name":{"type":"string","title":"Filter the search by fully_qualified_host_name. Search for the matches that contain the value"},"fully_qualified_host_name.keyword":{"type":"string","title":"Filter the search by fully_qualified_host_name. Search for an exact match"},"not.fully_qualified_host_name":{"type":"string","title":"Filter the search by fully_qualified_host_name. Search for the matches that don't contain the value"},"not.fully_qualified_host_name.keyword":{"type":"string","title":"Filter the search by fully_qualified_host_name. Search for the matches that are not equal to the value"},"domain_name":{"type":"string","title":"Filter the search by domain_name. Search for an exact match"},"domain_name.keyword":{"type":"string","title":"Filter the search by domain_name. Search for the matches that contain the value"},"not.domain_name":{"type":"string","title":"Filter the search by domain_name. Search for the matches that are not equal to the value"},"not.domain_name.keyword":{"type":"string","title":"Filter the search by domain_name. Search for the matches that do not contain the value"},"alias":{"type":"string","title":"Filter the search by aliasn. Search for the matches that contain the value"},"alias.keyword":{"type":"string","title":"Filter the search by aliasn. Search for an exact match"},"not.alias":{"type":"string","title":"Filter the search by aliasn. Search for the matches that don't contain the value"},"not.alias.keyword":{"type":"string","title":"Filter the search by aliasn. Search for the matches that are not equal to the value"},"vendor":{"type":"string","title":"Filter the search by vendor. Search for the matches that contain the value"},"vendor.keyword":{"type":"string","title":"Filter the search by vendor. Search for an exact match"},"not.vendor":{"type":"string","title":"Filter the search by vendor. Search for the matches that don't contain the value"},"not.vendor.keyword":{"type":"string","title":"Filter the search by vendor. Search for the matches that are not equal to the value"},"normalized_vendor":{"type":"string","title":"Filter the search by normalized_vendor. Search for the matches that contain the value"},"normalized_vendor.keyword":{"type":"string","title":"Filter the search by normalized_vendor. Search for an exact match"},"not.normalized_vendor":{"type":"string","title":"Filter the search by normalized_vendor. Search for the matches that don't contain the value"},"not.normalized_vendor.keyword":{"type":"string","title":"Filter the search by normalized_vendor. Search for the matches that are not equal to the value"},"display_vendor":{"type":"string","title":"Filter the search by display_vendor. Search for the matches that contain the value"},"display_vendor.keyword":{"type":"string","title":"Filter the search by display_vendor. Search for an exact match"},"not.display_vendor":{"type":"string","title":"Filter the search by display_vendor. Search for the matches that don't contain the value"},"not.display_vendor.keyword":{"type":"string","title":"Filter the search by display_vendor. Search for the matches that are not equal to the value"},"product":{"type":"string","title":"Filter the search by product. Search for the matches that contain the value"},"product.keyword":{"type":"string","title":"Filter the search by product. Search for an exact match"},"not.product":{"type":"string","title":"Filter the search by product. Search for the matches that don't contain the value"},"not.product.keyword":{"type":"string","title":"Filter the search by product. Search for the matches that are not equal to the value"},"normalized_product":{"type":"string","title":"Filter the search by normalized_product. Search for the matches that contain the value"},"normalized_product.keyword":{"type":"string","title":"Filter the search by normalized_product. Search for an exact match"},"not.normalized_product":{"type":"string","title":"Filter the search by normalized_product. Search for the matches that don't contain the value"},"not.normalized_product.keyword":{"type":"string","title":"Filter the search by normalized_product. Search for the matches that are not equal to the value"},"display_product":{"type":"string","title":"Filter the search by display_product. Search for the matches that contain the value"},"display_product.keyword":{"type":"string","title":"Filter the search by display_product. Search for an exact match"},"not.display_product":{"type":"string","title":"Filter the search by display_product. Search for the matches that don't contain the value"},"not.display_product.keyword":{"type":"string","title":"Filter the search by display_product. Search for the matches that are not equal to the value"},"installed_version":{"type":"string","title":"Filter the search by installed_version. Search for the matches that contain the value"},"installed_version.keyword":{"type":"string","title":"Filter the search by installed_version. Search for an exact match"},"not.installed_version":{"type":"string","title":"Filter the search by installed_version. Search for the matches that don't contain the value"},"not.installed_version.keyword":{"type":"string","title":"Filter the search by installed_version. Search for the matches that are not equal to the value"},"normaliazed_installed_version":{"type":"string","title":"Filter the search by normalized_installed_version. Search for the matches that contain the value"},"normaliazed_installed_version.keyword":{"type":"string","title":"Filter the search by normalized_installed_version. Search for an exact match"},"not.normaliazed_installed_version":{"type":"string","title":"Filter the search by normalized_installed_version. Search for the matches that don't contain the value"},"not.normaliazed_installed_version.keyword":{"type":"string","title":"Filter the search by normalized_installed_version. Search for the matches that are not equal to the value"},"display_installed_version":{"type":"string","title":"Filter the search by display_installed_version. Search for the matches that contain the value"},"display_installed_version.keyword":{"type":"string","title":"Filter the search by display_installed_version. Search for an exact match"},"not.display_installed_version":{"type":"string","title":"Filter the search by display_installed_version. Search for the matches that don't contain the value"},"not.display_installed_version.keyword":{"type":"string","title":"Filter the search by display_installed_version. Search for the matches that are not equal to the value"},"os_info.os_type":{"type":"string","title":"Filter the search by os_info.os_type. Search for the matches that contain the value"},"os_info.os_type.keyword":{"type":"string","title":"Filter the search by os_info.os_type. Search for an exact match"},"not.os_info.os_type":{"type":"string","title":"Filter the search by os_info.os_type. Search for the matches that don't contain the value"},"not.os_info.os_type.keyword":{"type":"string","title":"Filter the search by os_info.os_type. Search for the matches that are not equal to the value"},"os_info.os_version":{"type":"string","title":"Filter the search by os_info.os_version. Search for the matches that contain the value"},"os_info.os_version.keyword":{"type":"string","title":"Filter the search by os_info.os_version. Search for an exact match"},"not.os_info.os_version":{"type":"string","title":"Filter the search by os_info.os_version. Search for the matches that don't contain the value"},"not.os_info.os_version.keyword":{"type":"string","title":"Filter the search by os_info.os_version. Search for the matches that are not equal to the value"},"os_info.os_platform":{"type":"string","title":"Filter the search by os_info.os_platform. Search for the matches that contain the value"},"os_info.os_platform.keyword":{"type":"string","title":"Filter the search by os_info.os_platform. Search for an exact match"},"not.os_info.os_platform":{"type":"string","title":"Filter the search by os_info.os_platform. Search for the matches that don't contain the value"},"not.os_info.os_platform.keyword":{"type":"string","title":"Filter the search by os_info.os_platform. Search for the matches that are not equal to the value"},"os_info.os_platforms":{"type":"array","title":"Filter the search by multiple os_info.os_platform. Search for exact matches","items":{"type":"string"}},"os_info.os_architecture":{"type":"string","title":"Filter the search by os_info.os_architecture. Search for the matches that contain the value"},"os_info.os_architecture.keyword":{"type":"string","title":"Filter the search by os_info.os_architecture. Search for an exact match"},"not.os_info.os_architecture":{"type":"string","title":"Filter the search by os_info.os_architecture. Search for the matches that don't contain the value"},"not.os_info.os_architecture.keyword":{"type":"string","title":"Filter the search by os_info.os_architecture. Search for the matches that are not equal to the value"},"os_info.os_release_name":{"type":"string","title":"Filter the search by os_info.os_release_name. Search for the matches that contain the value"},"os_info.os_release_name.keyword":{"type":"string","title":"Filter the search by os_info.os_release_name. Search for an exact match"},"not.os_info.os_release_name":{"type":"string","title":"Filter the search by os_info.os_release_name. Search for the matches that don't contain the value"},"not.os_info.os_release_name.keyword":{"type":"string","title":"Filter the search by os_info.os_release_name. Search for the matches that are not equal to the value"},"installation_date_before":{"type":"string","format":"date-time","title":"Results include assets that have been created before the specified date"},"installation_date_after":{"type":"string","format":"date-time","title":"Results include assets that have been installed after the specified date"},"created_at_before":{"type":"string","format":"date-time","title":"Results include assets that have been created before the specified date"},"created_at_after":{"type":"string","format":"date-time","title":"Results include assets that have been installed after the specified date"},"name_multi_search":{"type":"string","title":"Aliases for this machine"},"group_name":{"type":"string","title":"Filter the search by group name. Search for the matches that contain the value"},"group_name.keyword":{"type":"string","title":"Filter the search by group name. Search for an exact match"},"not.group_name":{"type":"string","title":"Filter the search by group name. Search for the matches that don't contain the value"},"not.group_name.keyword":{"type":"string","title":"Filter the search by group name. Search for the matches that are not equal to the value"},"object_guid":{"type":"string","title":"Filter the search by object_guid. Search for the matches that contain the value"},"object_guid.keyword":{"type":"string","title":"Filter the search by object_guid. Search for an exact match"},"not.object_guid":{"type":"string","title":"Filter the search by object_guid. Search for the matches that don't contain the value"},"not.object_guid.keyword":{"type":"string","title":"Filter the search by object_guid. Search for the matches that are not equal to the value"},"latest_version_available":{"type":"string","title":"Filter the search by latest_version_available. Search for an exact match"},"latest_version_available.keyword":{"type":"string","title":"Filter the search by latest_version_available.keyword. Search for the matches that contain the value"},"not.latest_version_available":{"type":"string","title":"Filter the search by not.latest_version_available. Search for the matches that are not equal to the value"},"not.latest_version_available.keyword":{"type":"string","title":"Filter the search by not.latest_version_available.keyword. Search for the matches that doesnt contain the value"},"cves":{"type":"array","items":{"type":"string"},"title":"Filter the search by cves. Search for an exact match"},"cves.keyword":{"type":"array","items":{"type":"string"},"title":"Filter the search by cves.keyword. Search for the matches that contain the value"},"not.cves":{"type":"array","items":{"type":"string"},"title":"Filter the search by not.cves. Search for the matches that are not equal to the value"},"not.cves.keyword":{"type":"array","items":{"type":"string"},"title":"Filter the search by not.cves.keyword. Search for the matches that doesnt contain the value"},"cves_by_status.unknown":{"type":"string","title":"Filter the search by cves_by_status.unknown. Search for an exact match"},"cves_by_status.unknown.keyword":{"type":"string","title":"Filter the search by cves_by_status.unknown.keyword. Search for the matches that contain the value"},"not.cves_by_status.unknown":{"type":"string","title":"Filter the search by not.cves_by_status.unknown. Search for the matches that are not equal to the value"},"not.cves_by_status.unknown.keyword":{"type":"string","title":"Filter the search by not.cves_by_status.unknown.keyword. Search for the matches that doesnt contain the value"},"cves_by_status.low":{"type":"string","title":"Filter the search by cves_by_status.low. Search for an exact match"},"cves_by_status.low.keyword":{"type":"string","title":"Filter the search by cves_by_status.low.keyword. Search for the matches that contain the value"},"not.cves_by_status.low":{"type":"string","title":"Filter the search by not.cves_by_status.low. Search for the matches that are not equal to the value"},"not.cves_by_status.low.keyword":{"type":"string","title":"Filter the search by not.cves_by_status.low.keyword. Search for the matches that doesnt contain the value"},"cves_by_status.medium":{"type":"string","title":"Filter the search by cves_by_status.medium. Search for an exact match"},"cves_by_status.medium.keyword":{"type":"string","title":"Filter the search by cves_by_status.medium.keyword. Search for the matches that contain the value"},"not.cves_by_status.medium":{"type":"string","title":"Filter the search by not.cves_by_status.medium. Search for the matches that are not equal to the value"},"not.cves_by_status.medium.keyword":{"type":"string","title":"Filter the search by not.cves_by_status.medium.keyword. Search for the matches that doesnt contain the value"},"cves_by_status.high":{"type":"string","title":"Filter the search by cves_by_status.high. Search for an exact match"},"cves_by_status.high.keyword":{"type":"string","title":"Filter the search by cves_by_status.high.keyword. Search for the matches that contain the value"},"not.cves_by_status.high":{"type":"string","title":"Filter the search by not.cves_by_status.high. Search for the matches that are not equal to the value"},"not.cves_by_status.high.keyword":{"type":"string","title":"Filter the search by not.cves_by_status.high.keyword. Search for the matches that doesnt contain the value"},"cves_by_status.critical":{"type":"string","title":"Filter the search by cves_by_status.critical. Search for an exact match"},"cves_by_status.critical.keyword":{"type":"string","title":"Filter the search by cves_by_status.critical.keyword. Search for the matches that contain the value"},"not.cves_by_status.critical":{"type":"string","title":"Filter the search by not.cves_by_status.critical. Search for the matches that are not equal to the value"},"not.cves_by_status.critical.keyword":{"type":"string","title":"Filter the search by not.cves_by_status.critical.keyword. Search for the matches that doesnt contain the value"},"cves_score":{"type":"string","title":"Filter the search by cves_score. Search for an exact match"},"cves_count":{"type":"string","title":"Filter the search by cves_count. Search for an exact match"},"product_signature":{"type":"number","title":"Filter the search by product_signature. Search for an exact match"},"categories":{"type":"number","title":"Filter the search by category. Search for an exact match"},"cves_count_by_status.unknown":{"type":"string","title":"Filter the search by cves_count_by_status.unknown. Search for an exact match"},"cves_count_by_status.low":{"type":"string","title":"Filter the search by cves_count_by_status.low. Search for an exact match"},"cves_count_by_status.medium":{"type":"string","title":"Filter the search by cves_count_by_status.medium. Search for an exact match"},"cves_count_by_status.high":{"type":"string","title":"Filter the search by cves_count_by_status.high. Search for an exact match"},"cves_count_by_status.critical":{"type":"string","title":"Filter the search by cves_count_by_status.critical. Search for an exact match"},"language":{"type":"string","title":"Filter the search by language. Search for an exact match"},"language.keyword":{"type":"string","title":"Filter the search by language.keyword. Search for the matches that contain the value"},"not.language":{"type":"string","title":"Filter the search by not.language. Search for the matches that are not equal to the value"},"not.language.keyword":{"type":"string","title":"Filter the search by not.language.keyword. Search for the matches that doesnt contain the value"},"architecture":{"type":"string","title":"Filter the search by architecture. Search for an exact match"},"architecture.keyword":{"type":"string","title":"Filter the search by architecture.keyword. Search for the matches that contain the value"},"not.architecture":{"type":"string","title":"Filter the search by not.architecture. Search for the matches that are not equal to the value"},"not.architecture.keyword":{"type":"string","title":"Filter the search by not.architecture.keyword. Search for the matches that doesnt contain the value"},"supports_update":{"type":"boolean","title":"Filter the search by supports_update. Search for an exact match"},"not.supports_update":{"type":"boolean","title":"Filter the search by not.supports_update. Search for the matches that are not equal to the value"},"supports_uninstall":{"type":"boolean","title":"Filter the search by supports_uninstall. Search for an exact match"},"not.supports_uninstall":{"type":"boolean","title":"Filter the search by not.supports_uninstall. Search for the matches that are not equal to the value"},"update_available":{"type":"boolean","title":"Filter the search by update_available. Search for an exact match"},"update_ignored":{"type":"boolean","title":"Filter the search to only include ignored software updates"},"exists":{"type":"array","title":"Filter the results for records that have these fields","items":{"type":"string","enum":["account_id","parent_account_id","group_id","root_group_id","machine_id","account_name","host_name","fully_qualified_host_name","alias","name_multi_search","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","installed_version","normalized_installed_version","display_installed_version","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","installation_date","created_at","object_guid","latest_version_available","cves","cves_by_status.unknown","cves_by_status.low","cves_by_status.medium","cves_by_status.high","cves_by_status.critical","cves_score","cves_count","cves_count_by_status.unknown","cves_count_by_status.low","cves_count_by_status.medium","cves_count_by_status.high","cves_count_by_status.critical","language","architecture","product_signature","categories","supports_update","supports_uninstall","update_available"]}},"not.exists":{"type":"array","title":"Filter out the results for records that doesn't have these fields","items":{"type":"string","enum":["account_id","parent_account_id","group_id","root_group_id","machine_id","account_name","host_name","fully_qualified_host_name","alias","name_multi_search","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","installed_version","normalized_installed_version","display_installed_version","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","installation_date","created_at","object_guid","latest_version_available","cves","cves_by_status.unknown","cves_by_status.low","cves_by_status.medium","cves_by_status.high","cves_by_status.critical","cves_score","cves_count","cves_count_by_status.unknown","cves_count_by_status.low","cves_count_by_status.medium","cves_count_by_status.high","cves_count_by_status.critical","language","architecture","product_signature","categories","supports_update","supports_uninstall","update_available"]}},"sort_field":{"type":"string","title":"Sort field","enum":["account_id","parent_account_id","group_id","root_group_id","machine_id","account_name","host_name","fully_qualified_host_name","alias","name_multi_search","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","installed_version","normalized_installed_version","display_installed_version","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","installation_date","created_at","object_guid","latest_version_available","cves","cves_by_status.unknown","cves_by_status.low","cves_by_status.medium","cves_by_status.high","cves_by_status.critical","cves_score","cves_count","cves_count_by_status.unknown","cves_count_by_status.low","cves_count_by_status.medium","cves_count_by_status.high","cves_count_by_status.critical","language","architecture","product_signature","categories","supports_update","supports_uninstall","update_available","domain_name","active_directory.user.display_name","active_directory.machine.display_name","active_directory.user.ou","active_directory.machine.ou","active_directory.user.sam_account_name","active_directory.machine.sam_account_name","ignored_until"]},"sort_order":{"type":"string","title":"Sorting direction","default":"asc","enum":["asc","desc"]},"page_size":{"type":"number","title":"The size of the page. If you only need aggregations, set it to 0","minimum":0,"default":50,"maximum":2000},"aggregations":{"type":"array","title":"The Aggregations Schema","items":{"type":"string","title":"Aggregations","default":[],"enum":["account_id","parent_account_id","group_id","root_group_id","machine_id","host_name","fully_qualified_host_name","alias","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","installed_version","normalized_installed_version","display_installed_version","object_guid","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","latest_version_available","cves","cves_by_status.unknown","cves_by_status.low","cves_by_status.medium","cves_by_status.high","cves_by_status.critical","supports_update","supports_uninstall","update_available","language","architecture"]}},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}},"allOf":[{"type":"object","title":"Active Directory Search Filters","properties":{"active_directory.user.display_name":{"type":"string","title":"Filter the search by active_directory.user.display_name. Search for the matches that are equal to the value"},"active_directory.user.display_name.keyword":{"type":"string","title":"Filter the search by active_directory.user.display_name.keyword. Search for the matches that contain the value"},"active_directory.user.ou":{"type":"string","title":"Filter the search by active_directory.user.ou. Search for the matches that are equal to the value"},"active_directory.user.ou.keyword":{"type":"string","title":"Filter the search by active_directory.user.ou.keyword. Search for the matches that contain the value"},"active_directory.user.ou.path":{"type":"string","title":"Filter the search by active_directory.user.ou.path. Search for the matches that are equal to the value"},"active_directory.user.ou.path.keyword":{"type":"string","title":"Filter the search by active_directory.user.ou.path.keyword. Search for the matches that contain the value"},"active_directory.user.sam_account_name":{"type":"string","title":"Filter the search by active_directory.user.sam_account_name. Search for the matches that are equal to the value"},"active_directory.user.sam_account_name.keyword":{"type":"string","title":"Filter the search by active_directory.user.sam_account_name.keyword. Search for the matches that contain the value"},"active_directory.machine.display_name":{"type":"string","title":"Filter the search by active_directory.machine.display_name. Search for the matches that are equal to the value"},"active_directory.machine.display_name.keyword":{"type":"string","title":"Filter the search by active_directory.machine.display_name.keyword. Search for the matches that contain the value"},"active_directory.machine.ou":{"type":"string","title":"Filter the search by active_directory.machine.ou. Search for the matches that are equal to the value"},"active_directory.machine.ou.keyword":{"type":"string","title":"Filter the search by active_directory.machine.ou.keyword. Search for the matches that contain the value"},"active_directory.machine.ou.path":{"type":"string","title":"Filter the search by active_directory.machine.ou.path. Search for the matches that are equal to the value"},"active_directory.machine.ou.path.keyword":{"type":"string","title":"Filter the search by active_directory.machine.ou.path.keyword. Search for the matches that contain the value"},"active_directory.machine.sam_account_name":{"type":"string","title":"Filter the search by active_directory.machine.sam_account_name. Search for the matches that are equal to the value"},"active_directory.machine.sam_account_name.keyword":{"type":"string","title":"Filter the search by active_directory.machine.sam_account_name.keyword. Search for the matches that contain the value"}}}]}]}}}},{"properties":{"groups":{"type":"array","title":"List of search queries","items":{"allOf":[{"type":"object","title":"Search assets software request. Leading wildcards are not supported for constraint fields without '.keyword' suffix.","properties":{"parent_account_id":{"type":"string","title":"Filter the search by parent_account_id. Search for an exact match"},"not.parent_account_id":{"type":"string","title":"Filter the search by parent_account_id. Search for the matches that are not equal to the value"},"group_id":{"type":"string","title":"Filter the search by group_id. Search for an exact match"},"not.group_id":{"type":"string","title":"Filter the search by group_id. Search for the matches that are not equal to the value"},"root_group_id":{"type":"string","title":"Filter the search by root_group_id. Search for an exact match"},"not.root_group_id":{"type":"string","title":"Filter the search by root_group_id. Search for the matches that are not equal to the value"},"machine_id":{"type":"string","title":"Filter the search by machine_id. Search for an exact match"},"not.machine_id":{"type":"string","title":"Filter the search by machine_id. Search for the matches that are not equal to the value"},"account_name":{"type":"string","title":"Filter the search by account_name. Search for the matches that contain the value"},"account_name.keyword":{"type":"string","title":"Filter the search by account_name. Search for an exact match"},"not.account_name":{"type":"string","title":"Filter the search by account_name. Search for the matches that don't contain the value"},"not.account_name.keyword":{"type":"string","title":"Filter the search by account_name. Search for the matches that are not equal to the value"},"host_name":{"type":"string","title":"Filter the search by host_name. Search for the matches that contain the value"},"host_name.keyword":{"type":"string","title":"Filter the search by host_name. Search for an exact match"},"not.host_name":{"type":"string","title":"Filter the search by host_name. Search for the matches that don't contain the value"},"not.host_name.keyword":{"type":"string","title":"Filter the search by host_name. Search for the matches that are not equal to the value"},"fully_qualified_host_name":{"type":"string","title":"Filter the search by fully_qualified_host_name. Search for the matches that contain the value"},"fully_qualified_host_name.keyword":{"type":"string","title":"Filter the search by fully_qualified_host_name. Search for an exact match"},"not.fully_qualified_host_name":{"type":"string","title":"Filter the search by fully_qualified_host_name. Search for the matches that don't contain the value"},"not.fully_qualified_host_name.keyword":{"type":"string","title":"Filter the search by fully_qualified_host_name. Search for the matches that are not equal to the value"},"domain_name":{"type":"string","title":"Filter the search by domain_name. Search for an exact match"},"domain_name.keyword":{"type":"string","title":"Filter the search by domain_name. Search for the matches that contain the value"},"not.domain_name":{"type":"string","title":"Filter the search by domain_name. Search for the matches that are not equal to the value"},"not.domain_name.keyword":{"type":"string","title":"Filter the search by domain_name. Search for the matches that do not contain the value"},"alias":{"type":"string","title":"Filter the search by aliasn. Search for the matches that contain the value"},"alias.keyword":{"type":"string","title":"Filter the search by aliasn. Search for an exact match"},"not.alias":{"type":"string","title":"Filter the search by aliasn. Search for the matches that don't contain the value"},"not.alias.keyword":{"type":"string","title":"Filter the search by aliasn. Search for the matches that are not equal to the value"},"vendor":{"type":"string","title":"Filter the search by vendor. Search for the matches that contain the value"},"vendor.keyword":{"type":"string","title":"Filter the search by vendor. Search for an exact match"},"not.vendor":{"type":"string","title":"Filter the search by vendor. Search for the matches that don't contain the value"},"not.vendor.keyword":{"type":"string","title":"Filter the search by vendor. Search for the matches that are not equal to the value"},"normalized_vendor":{"type":"string","title":"Filter the search by normalized_vendor. Search for the matches that contain the value"},"normalized_vendor.keyword":{"type":"string","title":"Filter the search by normalized_vendor. Search for an exact match"},"not.normalized_vendor":{"type":"string","title":"Filter the search by normalized_vendor. Search for the matches that don't contain the value"},"not.normalized_vendor.keyword":{"type":"string","title":"Filter the search by normalized_vendor. Search for the matches that are not equal to the value"},"display_vendor":{"type":"string","title":"Filter the search by display_vendor. Search for the matches that contain the value"},"display_vendor.keyword":{"type":"string","title":"Filter the search by display_vendor. Search for an exact match"},"not.display_vendor":{"type":"string","title":"Filter the search by display_vendor. Search for the matches that don't contain the value"},"not.display_vendor.keyword":{"type":"string","title":"Filter the search by display_vendor. Search for the matches that are not equal to the value"},"product":{"type":"string","title":"Filter the search by product. Search for the matches that contain the value"},"product.keyword":{"type":"string","title":"Filter the search by product. Search for an exact match"},"not.product":{"type":"string","title":"Filter the search by product. Search for the matches that don't contain the value"},"not.product.keyword":{"type":"string","title":"Filter the search by product. Search for the matches that are not equal to the value"},"normalized_product":{"type":"string","title":"Filter the search by normalized_product. Search for the matches that contain the value"},"normalized_product.keyword":{"type":"string","title":"Filter the search by normalized_product. Search for an exact match"},"not.normalized_product":{"type":"string","title":"Filter the search by normalized_product. Search for the matches that don't contain the value"},"not.normalized_product.keyword":{"type":"string","title":"Filter the search by normalized_product. Search for the matches that are not equal to the value"},"display_product":{"type":"string","title":"Filter the search by display_product. Search for the matches that contain the value"},"display_product.keyword":{"type":"string","title":"Filter the search by display_product. Search for an exact match"},"not.display_product":{"type":"string","title":"Filter the search by display_product. Search for the matches that don't contain the value"},"not.display_product.keyword":{"type":"string","title":"Filter the search by display_product. Search for the matches that are not equal to the value"},"installed_version":{"type":"string","title":"Filter the search by installed_version. Search for the matches that contain the value"},"installed_version.keyword":{"type":"string","title":"Filter the search by installed_version. Search for an exact match"},"not.installed_version":{"type":"string","title":"Filter the search by installed_version. Search for the matches that don't contain the value"},"not.installed_version.keyword":{"type":"string","title":"Filter the search by installed_version. Search for the matches that are not equal to the value"},"normaliazed_installed_version":{"type":"string","title":"Filter the search by normalized_installed_version. Search for the matches that contain the value"},"normaliazed_installed_version.keyword":{"type":"string","title":"Filter the search by normalized_installed_version. Search for an exact match"},"not.normaliazed_installed_version":{"type":"string","title":"Filter the search by normalized_installed_version. Search for the matches that don't contain the value"},"not.normaliazed_installed_version.keyword":{"type":"string","title":"Filter the search by normalized_installed_version. Search for the matches that are not equal to the value"},"display_installed_version":{"type":"string","title":"Filter the search by display_installed_version. Search for the matches that contain the value"},"display_installed_version.keyword":{"type":"string","title":"Filter the search by display_installed_version. Search for an exact match"},"not.display_installed_version":{"type":"string","title":"Filter the search by display_installed_version. Search for the matches that don't contain the value"},"not.display_installed_version.keyword":{"type":"string","title":"Filter the search by display_installed_version. Search for the matches that are not equal to the value"},"os_info.os_type":{"type":"string","title":"Filter the search by os_info.os_type. Search for the matches that contain the value"},"os_info.os_type.keyword":{"type":"string","title":"Filter the search by os_info.os_type. Search for an exact match"},"not.os_info.os_type":{"type":"string","title":"Filter the search by os_info.os_type. Search for the matches that don't contain the value"},"not.os_info.os_type.keyword":{"type":"string","title":"Filter the search by os_info.os_type. Search for the matches that are not equal to the value"},"os_info.os_version":{"type":"string","title":"Filter the search by os_info.os_version. Search for the matches that contain the value"},"os_info.os_version.keyword":{"type":"string","title":"Filter the search by os_info.os_version. Search for an exact match"},"not.os_info.os_version":{"type":"string","title":"Filter the search by os_info.os_version. Search for the matches that don't contain the value"},"not.os_info.os_version.keyword":{"type":"string","title":"Filter the search by os_info.os_version. Search for the matches that are not equal to the value"},"os_info.os_platform":{"type":"string","title":"Filter the search by os_info.os_platform. Search for the matches that contain the value"},"os_info.os_platform.keyword":{"type":"string","title":"Filter the search by os_info.os_platform. Search for an exact match"},"not.os_info.os_platform":{"type":"string","title":"Filter the search by os_info.os_platform. Search for the matches that don't contain the value"},"not.os_info.os_platform.keyword":{"type":"string","title":"Filter the search by os_info.os_platform. Search for the matches that are not equal to the value"},"os_info.os_platforms":{"type":"array","title":"Filter the search by multiple os_info.os_platform. Search for exact matches","items":{"type":"string"}},"os_info.os_architecture":{"type":"string","title":"Filter the search by os_info.os_architecture. Search for the matches that contain the value"},"os_info.os_architecture.keyword":{"type":"string","title":"Filter the search by os_info.os_architecture. Search for an exact match"},"not.os_info.os_architecture":{"type":"string","title":"Filter the search by os_info.os_architecture. Search for the matches that don't contain the value"},"not.os_info.os_architecture.keyword":{"type":"string","title":"Filter the search by os_info.os_architecture. Search for the matches that are not equal to the value"},"os_info.os_release_name":{"type":"string","title":"Filter the search by os_info.os_release_name. Search for the matches that contain the value"},"os_info.os_release_name.keyword":{"type":"string","title":"Filter the search by os_info.os_release_name. Search for an exact match"},"not.os_info.os_release_name":{"type":"string","title":"Filter the search by os_info.os_release_name. Search for the matches that don't contain the value"},"not.os_info.os_release_name.keyword":{"type":"string","title":"Filter the search by os_info.os_release_name. Search for the matches that are not equal to the value"},"installation_date_before":{"type":"string","format":"date-time","title":"Results include assets that have been created before the specified date"},"installation_date_after":{"type":"string","format":"date-time","title":"Results include assets that have been installed after the specified date"},"created_at_before":{"type":"string","format":"date-time","title":"Results include assets that have been created before the specified date"},"created_at_after":{"type":"string","format":"date-time","title":"Results include assets that have been installed after the specified date"},"name_multi_search":{"type":"string","title":"Aliases for this machine"},"group_name":{"type":"string","title":"Filter the search by group name. Search for the matches that contain the value"},"group_name.keyword":{"type":"string","title":"Filter the search by group name. Search for an exact match"},"not.group_name":{"type":"string","title":"Filter the search by group name. Search for the matches that don't contain the value"},"not.group_name.keyword":{"type":"string","title":"Filter the search by group name. Search for the matches that are not equal to the value"},"object_guid":{"type":"string","title":"Filter the search by object_guid. Search for the matches that contain the value"},"object_guid.keyword":{"type":"string","title":"Filter the search by object_guid. Search for an exact match"},"not.object_guid":{"type":"string","title":"Filter the search by object_guid. Search for the matches that don't contain the value"},"not.object_guid.keyword":{"type":"string","title":"Filter the search by object_guid. Search for the matches that are not equal to the value"},"latest_version_available":{"type":"string","title":"Filter the search by latest_version_available. Search for an exact match"},"latest_version_available.keyword":{"type":"string","title":"Filter the search by latest_version_available.keyword. Search for the matches that contain the value"},"not.latest_version_available":{"type":"string","title":"Filter the search by not.latest_version_available. Search for the matches that are not equal to the value"},"not.latest_version_available.keyword":{"type":"string","title":"Filter the search by not.latest_version_available.keyword. Search for the matches that doesnt contain the value"},"cves":{"type":"array","items":{"type":"string"},"title":"Filter the search by cves. Search for an exact match"},"cves.keyword":{"type":"array","items":{"type":"string"},"title":"Filter the search by cves.keyword. Search for the matches that contain the value"},"not.cves":{"type":"array","items":{"type":"string"},"title":"Filter the search by not.cves. Search for the matches that are not equal to the value"},"not.cves.keyword":{"type":"array","items":{"type":"string"},"title":"Filter the search by not.cves.keyword. Search for the matches that doesnt contain the value"},"cves_by_status.unknown":{"type":"string","title":"Filter the search by cves_by_status.unknown. Search for an exact match"},"cves_by_status.unknown.keyword":{"type":"string","title":"Filter the search by cves_by_status.unknown.keyword. Search for the matches that contain the value"},"not.cves_by_status.unknown":{"type":"string","title":"Filter the search by not.cves_by_status.unknown. Search for the matches that are not equal to the value"},"not.cves_by_status.unknown.keyword":{"type":"string","title":"Filter the search by not.cves_by_status.unknown.keyword. Search for the matches that doesnt contain the value"},"cves_by_status.low":{"type":"string","title":"Filter the search by cves_by_status.low. Search for an exact match"},"cves_by_status.low.keyword":{"type":"string","title":"Filter the search by cves_by_status.low.keyword. Search for the matches that contain the value"},"not.cves_by_status.low":{"type":"string","title":"Filter the search by not.cves_by_status.low. Search for the matches that are not equal to the value"},"not.cves_by_status.low.keyword":{"type":"string","title":"Filter the search by not.cves_by_status.low.keyword. Search for the matches that doesnt contain the value"},"cves_by_status.medium":{"type":"string","title":"Filter the search by cves_by_status.medium. Search for an exact match"},"cves_by_status.medium.keyword":{"type":"string","title":"Filter the search by cves_by_status.medium.keyword. Search for the matches that contain the value"},"not.cves_by_status.medium":{"type":"string","title":"Filter the search by not.cves_by_status.medium. Search for the matches that are not equal to the value"},"not.cves_by_status.medium.keyword":{"type":"string","title":"Filter the search by not.cves_by_status.medium.keyword. Search for the matches that doesnt contain the value"},"cves_by_status.high":{"type":"string","title":"Filter the search by cves_by_status.high. Search for an exact match"},"cves_by_status.high.keyword":{"type":"string","title":"Filter the search by cves_by_status.high.keyword. Search for the matches that contain the value"},"not.cves_by_status.high":{"type":"string","title":"Filter the search by not.cves_by_status.high. Search for the matches that are not equal to the value"},"not.cves_by_status.high.keyword":{"type":"string","title":"Filter the search by not.cves_by_status.high.keyword. Search for the matches that doesnt contain the value"},"cves_by_status.critical":{"type":"string","title":"Filter the search by cves_by_status.critical. Search for an exact match"},"cves_by_status.critical.keyword":{"type":"string","title":"Filter the search by cves_by_status.critical.keyword. Search for the matches that contain the value"},"not.cves_by_status.critical":{"type":"string","title":"Filter the search by not.cves_by_status.critical. Search for the matches that are not equal to the value"},"not.cves_by_status.critical.keyword":{"type":"string","title":"Filter the search by not.cves_by_status.critical.keyword. Search for the matches that doesnt contain the value"},"cves_score":{"type":"string","title":"Filter the search by cves_score. Search for an exact match"},"cves_count":{"type":"string","title":"Filter the search by cves_count. Search for an exact match"},"product_signature":{"type":"number","title":"Filter the search by product_signature. Search for an exact match"},"categories":{"type":"number","title":"Filter the search by category. Search for an exact match"},"cves_count_by_status.unknown":{"type":"string","title":"Filter the search by cves_count_by_status.unknown. Search for an exact match"},"cves_count_by_status.low":{"type":"string","title":"Filter the search by cves_count_by_status.low. Search for an exact match"},"cves_count_by_status.medium":{"type":"string","title":"Filter the search by cves_count_by_status.medium. Search for an exact match"},"cves_count_by_status.high":{"type":"string","title":"Filter the search by cves_count_by_status.high. Search for an exact match"},"cves_count_by_status.critical":{"type":"string","title":"Filter the search by cves_count_by_status.critical. Search for an exact match"},"language":{"type":"string","title":"Filter the search by language. Search for an exact match"},"language.keyword":{"type":"string","title":"Filter the search by language.keyword. Search for the matches that contain the value"},"not.language":{"type":"string","title":"Filter the search by not.language. Search for the matches that are not equal to the value"},"not.language.keyword":{"type":"string","title":"Filter the search by not.language.keyword. Search for the matches that doesnt contain the value"},"architecture":{"type":"string","title":"Filter the search by architecture. Search for an exact match"},"architecture.keyword":{"type":"string","title":"Filter the search by architecture.keyword. Search for the matches that contain the value"},"not.architecture":{"type":"string","title":"Filter the search by not.architecture. Search for the matches that are not equal to the value"},"not.architecture.keyword":{"type":"string","title":"Filter the search by not.architecture.keyword. Search for the matches that doesnt contain the value"},"supports_update":{"type":"boolean","title":"Filter the search by supports_update. Search for an exact match"},"not.supports_update":{"type":"boolean","title":"Filter the search by not.supports_update. Search for the matches that are not equal to the value"},"supports_uninstall":{"type":"boolean","title":"Filter the search by supports_uninstall. Search for an exact match"},"not.supports_uninstall":{"type":"boolean","title":"Filter the search by not.supports_uninstall. Search for the matches that are not equal to the value"},"update_available":{"type":"boolean","title":"Filter the search by update_available. Search for an exact match"},"update_ignored":{"type":"boolean","title":"Filter the search to only include ignored software updates"},"exists":{"type":"array","title":"Filter the results for records that have these fields","items":{"type":"string","enum":["account_id","parent_account_id","group_id","root_group_id","machine_id","account_name","host_name","fully_qualified_host_name","alias","name_multi_search","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","installed_version","normalized_installed_version","display_installed_version","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","installation_date","created_at","object_guid","latest_version_available","cves","cves_by_status.unknown","cves_by_status.low","cves_by_status.medium","cves_by_status.high","cves_by_status.critical","cves_score","cves_count","cves_count_by_status.unknown","cves_count_by_status.low","cves_count_by_status.medium","cves_count_by_status.high","cves_count_by_status.critical","language","architecture","product_signature","categories","supports_update","supports_uninstall","update_available"]}},"not.exists":{"type":"array","title":"Filter out the results for records that doesn't have these fields","items":{"type":"string","enum":["account_id","parent_account_id","group_id","root_group_id","machine_id","account_name","host_name","fully_qualified_host_name","alias","name_multi_search","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","installed_version","normalized_installed_version","display_installed_version","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","installation_date","created_at","object_guid","latest_version_available","cves","cves_by_status.unknown","cves_by_status.low","cves_by_status.medium","cves_by_status.high","cves_by_status.critical","cves_score","cves_count","cves_count_by_status.unknown","cves_count_by_status.low","cves_count_by_status.medium","cves_count_by_status.high","cves_count_by_status.critical","language","architecture","product_signature","categories","supports_update","supports_uninstall","update_available"]}},"sort_field":{"type":"string","title":"Sort field","enum":["account_id","parent_account_id","group_id","root_group_id","machine_id","account_name","host_name","fully_qualified_host_name","alias","name_multi_search","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","installed_version","normalized_installed_version","display_installed_version","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","installation_date","created_at","object_guid","latest_version_available","cves","cves_by_status.unknown","cves_by_status.low","cves_by_status.medium","cves_by_status.high","cves_by_status.critical","cves_score","cves_count","cves_count_by_status.unknown","cves_count_by_status.low","cves_count_by_status.medium","cves_count_by_status.high","cves_count_by_status.critical","language","architecture","product_signature","categories","supports_update","supports_uninstall","update_available","domain_name","active_directory.user.display_name","active_directory.machine.display_name","active_directory.user.ou","active_directory.machine.ou","active_directory.user.sam_account_name","active_directory.machine.sam_account_name","ignored_until"]},"sort_order":{"type":"string","title":"Sorting direction","default":"asc","enum":["asc","desc"]},"page_size":{"type":"number","title":"The size of the page. If you only need aggregations, set it to 0","minimum":0,"default":50,"maximum":2000},"aggregations":{"type":"array","title":"The Aggregations Schema","items":{"type":"string","title":"Aggregations","default":[],"enum":["account_id","parent_account_id","group_id","root_group_id","machine_id","host_name","fully_qualified_host_name","alias","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","installed_version","normalized_installed_version","display_installed_version","object_guid","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","latest_version_available","cves","cves_by_status.unknown","cves_by_status.low","cves_by_status.medium","cves_by_status.high","cves_by_status.critical","supports_update","supports_uninstall","update_available","language","architecture"]}},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}},"allOf":[{"type":"object","title":"Active Directory Search Filters","properties":{"active_directory.user.display_name":{"type":"string","title":"Filter the search by active_directory.user.display_name. Search for the matches that are equal to the value"},"active_directory.user.display_name.keyword":{"type":"string","title":"Filter the search by active_directory.user.display_name.keyword. Search for the matches that contain the value"},"active_directory.user.ou":{"type":"string","title":"Filter the search by active_directory.user.ou. Search for the matches that are equal to the value"},"active_directory.user.ou.keyword":{"type":"string","title":"Filter the search by active_directory.user.ou.keyword. Search for the matches that contain the value"},"active_directory.user.ou.path":{"type":"string","title":"Filter the search by active_directory.user.ou.path. Search for the matches that are equal to the value"},"active_directory.user.ou.path.keyword":{"type":"string","title":"Filter the search by active_directory.user.ou.path.keyword. Search for the matches that contain the value"},"active_directory.user.sam_account_name":{"type":"string","title":"Filter the search by active_directory.user.sam_account_name. Search for the matches that are equal to the value"},"active_directory.user.sam_account_name.keyword":{"type":"string","title":"Filter the search by active_directory.user.sam_account_name.keyword. Search for the matches that contain the value"},"active_directory.machine.display_name":{"type":"string","title":"Filter the search by active_directory.machine.display_name. Search for the matches that are equal to the value"},"active_directory.machine.display_name.keyword":{"type":"string","title":"Filter the search by active_directory.machine.display_name.keyword. Search for the matches that contain the value"},"active_directory.machine.ou":{"type":"string","title":"Filter the search by active_directory.machine.ou. Search for the matches that are equal to the value"},"active_directory.machine.ou.keyword":{"type":"string","title":"Filter the search by active_directory.machine.ou.keyword. Search for the matches that contain the value"},"active_directory.machine.ou.path":{"type":"string","title":"Filter the search by active_directory.machine.ou.path. Search for the matches that are equal to the value"},"active_directory.machine.ou.path.keyword":{"type":"string","title":"Filter the search by active_directory.machine.ou.path.keyword. Search for the matches that contain the value"},"active_directory.machine.sam_account_name":{"type":"string","title":"Filter the search by active_directory.machine.sam_account_name. Search for the matches that are equal to the value"},"active_directory.machine.sam_account_name.keyword":{"type":"string","title":"Filter the search by active_directory.machine.sam_account_name.keyword. Search for the matches that contain the value"}}}]},{"type":"object","required":["account_ids"],"properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]}}}}]}}}},"responses":{"200":{"description":"Successful response"}},"tags":["Assets"],"operationId":"api.v2.rmm.post.export.assets.software"}},"/oneview/v1/assets/software/export/async":{"post":{"description":"Export assets software asynchronously","summary":"Export assets software asynchronously","security":[{"client_credentials":["execute"]},{"user_permissions":["softwareInventory.view"]}],"status":{"outage":["auth","search_stateless"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Export request","allOf":[{"type":"object","title":"Export request","required":["groups","select","format"],"properties":{"format":{"type":"string","title":"The output file","enum":["csv","xlsx","html","ods","txt","rtf","json"]},"download":{"type":"boolean","title":"Whether to instruct the client to download the response as a file. Only clients like browsers are supported"},"type":{"type":"string","title":"The encoding of the output","enum":["string","base64","binary"],"default":"string"},"select":{"type":"array","title":"Which fields to select from the response","items":{"type":"object","title":"Field","required":["field","newField"],"properties":{"newField":{"type":"string","title":"the new value"},"field":{"type":"string","title":"The response field to map to a new value","enum":["account_id","parent_account_id","group_id","root_group_id","group_name","machine_id","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","installed_version","normalized_installed_version","display_installed_version","installation_date","account_name","host_name","fully_qualified_host_name","domain_name","alias","created_at","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","object_guid","latest_version_available","cves","cves_by_status.unknown","cves_by_status.low","cves_by_status.medium","cves_by_status.high","cves_by_status.critical","cves_score","cves_count","cves_count_by_status.unknown","cves_count_by_status.low","cves_count_by_status.medium","cves_count_by_status.high","cves_count_by_status.critical","language","architecture","product_signature","categories","supports_update","supports_uninstall","update_available","ignored_until","ignore_rule_ids","active_directory.user.display_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.machine.display_name","active_directory.machine.sam_account_name","active_directory.machine.ou"]}}}},"groups":{"type":"array","title":"List of queries","items":{"type":"object","title":"Query to fetch endpoints","allOf":[{"type":"object","title":"Search assets software request. Leading wildcards are not supported for constraint fields without '.keyword' suffix.","properties":{"parent_account_id":{"type":"string","title":"Filter the search by parent_account_id. Search for an exact match"},"not.parent_account_id":{"type":"string","title":"Filter the search by parent_account_id. Search for the matches that are not equal to the value"},"group_id":{"type":"string","title":"Filter the search by group_id. Search for an exact match"},"not.group_id":{"type":"string","title":"Filter the search by group_id. Search for the matches that are not equal to the value"},"root_group_id":{"type":"string","title":"Filter the search by root_group_id. Search for an exact match"},"not.root_group_id":{"type":"string","title":"Filter the search by root_group_id. Search for the matches that are not equal to the value"},"machine_id":{"type":"string","title":"Filter the search by machine_id. Search for an exact match"},"not.machine_id":{"type":"string","title":"Filter the search by machine_id. Search for the matches that are not equal to the value"},"account_name":{"type":"string","title":"Filter the search by account_name. Search for the matches that contain the value"},"account_name.keyword":{"type":"string","title":"Filter the search by account_name. Search for an exact match"},"not.account_name":{"type":"string","title":"Filter the search by account_name. Search for the matches that don't contain the value"},"not.account_name.keyword":{"type":"string","title":"Filter the search by account_name. Search for the matches that are not equal to the value"},"host_name":{"type":"string","title":"Filter the search by host_name. Search for the matches that contain the value"},"host_name.keyword":{"type":"string","title":"Filter the search by host_name. Search for an exact match"},"not.host_name":{"type":"string","title":"Filter the search by host_name. Search for the matches that don't contain the value"},"not.host_name.keyword":{"type":"string","title":"Filter the search by host_name. Search for the matches that are not equal to the value"},"fully_qualified_host_name":{"type":"string","title":"Filter the search by fully_qualified_host_name. Search for the matches that contain the value"},"fully_qualified_host_name.keyword":{"type":"string","title":"Filter the search by fully_qualified_host_name. Search for an exact match"},"not.fully_qualified_host_name":{"type":"string","title":"Filter the search by fully_qualified_host_name. Search for the matches that don't contain the value"},"not.fully_qualified_host_name.keyword":{"type":"string","title":"Filter the search by fully_qualified_host_name. Search for the matches that are not equal to the value"},"domain_name":{"type":"string","title":"Filter the search by domain_name. Search for an exact match"},"domain_name.keyword":{"type":"string","title":"Filter the search by domain_name. Search for the matches that contain the value"},"not.domain_name":{"type":"string","title":"Filter the search by domain_name. Search for the matches that are not equal to the value"},"not.domain_name.keyword":{"type":"string","title":"Filter the search by domain_name. Search for the matches that do not contain the value"},"alias":{"type":"string","title":"Filter the search by aliasn. Search for the matches that contain the value"},"alias.keyword":{"type":"string","title":"Filter the search by aliasn. Search for an exact match"},"not.alias":{"type":"string","title":"Filter the search by aliasn. Search for the matches that don't contain the value"},"not.alias.keyword":{"type":"string","title":"Filter the search by aliasn. Search for the matches that are not equal to the value"},"vendor":{"type":"string","title":"Filter the search by vendor. Search for the matches that contain the value"},"vendor.keyword":{"type":"string","title":"Filter the search by vendor. Search for an exact match"},"not.vendor":{"type":"string","title":"Filter the search by vendor. Search for the matches that don't contain the value"},"not.vendor.keyword":{"type":"string","title":"Filter the search by vendor. Search for the matches that are not equal to the value"},"normalized_vendor":{"type":"string","title":"Filter the search by normalized_vendor. Search for the matches that contain the value"},"normalized_vendor.keyword":{"type":"string","title":"Filter the search by normalized_vendor. Search for an exact match"},"not.normalized_vendor":{"type":"string","title":"Filter the search by normalized_vendor. Search for the matches that don't contain the value"},"not.normalized_vendor.keyword":{"type":"string","title":"Filter the search by normalized_vendor. Search for the matches that are not equal to the value"},"display_vendor":{"type":"string","title":"Filter the search by display_vendor. Search for the matches that contain the value"},"display_vendor.keyword":{"type":"string","title":"Filter the search by display_vendor. Search for an exact match"},"not.display_vendor":{"type":"string","title":"Filter the search by display_vendor. Search for the matches that don't contain the value"},"not.display_vendor.keyword":{"type":"string","title":"Filter the search by display_vendor. Search for the matches that are not equal to the value"},"product":{"type":"string","title":"Filter the search by product. Search for the matches that contain the value"},"product.keyword":{"type":"string","title":"Filter the search by product. Search for an exact match"},"not.product":{"type":"string","title":"Filter the search by product. Search for the matches that don't contain the value"},"not.product.keyword":{"type":"string","title":"Filter the search by product. Search for the matches that are not equal to the value"},"normalized_product":{"type":"string","title":"Filter the search by normalized_product. Search for the matches that contain the value"},"normalized_product.keyword":{"type":"string","title":"Filter the search by normalized_product. Search for an exact match"},"not.normalized_product":{"type":"string","title":"Filter the search by normalized_product. Search for the matches that don't contain the value"},"not.normalized_product.keyword":{"type":"string","title":"Filter the search by normalized_product. Search for the matches that are not equal to the value"},"display_product":{"type":"string","title":"Filter the search by display_product. Search for the matches that contain the value"},"display_product.keyword":{"type":"string","title":"Filter the search by display_product. Search for an exact match"},"not.display_product":{"type":"string","title":"Filter the search by display_product. Search for the matches that don't contain the value"},"not.display_product.keyword":{"type":"string","title":"Filter the search by display_product. Search for the matches that are not equal to the value"},"installed_version":{"type":"string","title":"Filter the search by installed_version. Search for the matches that contain the value"},"installed_version.keyword":{"type":"string","title":"Filter the search by installed_version. Search for an exact match"},"not.installed_version":{"type":"string","title":"Filter the search by installed_version. Search for the matches that don't contain the value"},"not.installed_version.keyword":{"type":"string","title":"Filter the search by installed_version. Search for the matches that are not equal to the value"},"normaliazed_installed_version":{"type":"string","title":"Filter the search by normalized_installed_version. Search for the matches that contain the value"},"normaliazed_installed_version.keyword":{"type":"string","title":"Filter the search by normalized_installed_version. Search for an exact match"},"not.normaliazed_installed_version":{"type":"string","title":"Filter the search by normalized_installed_version. Search for the matches that don't contain the value"},"not.normaliazed_installed_version.keyword":{"type":"string","title":"Filter the search by normalized_installed_version. Search for the matches that are not equal to the value"},"display_installed_version":{"type":"string","title":"Filter the search by display_installed_version. Search for the matches that contain the value"},"display_installed_version.keyword":{"type":"string","title":"Filter the search by display_installed_version. Search for an exact match"},"not.display_installed_version":{"type":"string","title":"Filter the search by display_installed_version. Search for the matches that don't contain the value"},"not.display_installed_version.keyword":{"type":"string","title":"Filter the search by display_installed_version. Search for the matches that are not equal to the value"},"os_info.os_type":{"type":"string","title":"Filter the search by os_info.os_type. Search for the matches that contain the value"},"os_info.os_type.keyword":{"type":"string","title":"Filter the search by os_info.os_type. Search for an exact match"},"not.os_info.os_type":{"type":"string","title":"Filter the search by os_info.os_type. Search for the matches that don't contain the value"},"not.os_info.os_type.keyword":{"type":"string","title":"Filter the search by os_info.os_type. Search for the matches that are not equal to the value"},"os_info.os_version":{"type":"string","title":"Filter the search by os_info.os_version. Search for the matches that contain the value"},"os_info.os_version.keyword":{"type":"string","title":"Filter the search by os_info.os_version. Search for an exact match"},"not.os_info.os_version":{"type":"string","title":"Filter the search by os_info.os_version. Search for the matches that don't contain the value"},"not.os_info.os_version.keyword":{"type":"string","title":"Filter the search by os_info.os_version. Search for the matches that are not equal to the value"},"os_info.os_platform":{"type":"string","title":"Filter the search by os_info.os_platform. Search for the matches that contain the value"},"os_info.os_platform.keyword":{"type":"string","title":"Filter the search by os_info.os_platform. Search for an exact match"},"not.os_info.os_platform":{"type":"string","title":"Filter the search by os_info.os_platform. Search for the matches that don't contain the value"},"not.os_info.os_platform.keyword":{"type":"string","title":"Filter the search by os_info.os_platform. Search for the matches that are not equal to the value"},"os_info.os_platforms":{"type":"array","title":"Filter the search by multiple os_info.os_platform. Search for exact matches","items":{"type":"string"}},"os_info.os_architecture":{"type":"string","title":"Filter the search by os_info.os_architecture. Search for the matches that contain the value"},"os_info.os_architecture.keyword":{"type":"string","title":"Filter the search by os_info.os_architecture. Search for an exact match"},"not.os_info.os_architecture":{"type":"string","title":"Filter the search by os_info.os_architecture. Search for the matches that don't contain the value"},"not.os_info.os_architecture.keyword":{"type":"string","title":"Filter the search by os_info.os_architecture. Search for the matches that are not equal to the value"},"os_info.os_release_name":{"type":"string","title":"Filter the search by os_info.os_release_name. Search for the matches that contain the value"},"os_info.os_release_name.keyword":{"type":"string","title":"Filter the search by os_info.os_release_name. Search for an exact match"},"not.os_info.os_release_name":{"type":"string","title":"Filter the search by os_info.os_release_name. Search for the matches that don't contain the value"},"not.os_info.os_release_name.keyword":{"type":"string","title":"Filter the search by os_info.os_release_name. Search for the matches that are not equal to the value"},"installation_date_before":{"type":"string","format":"date-time","title":"Results include assets that have been created before the specified date"},"installation_date_after":{"type":"string","format":"date-time","title":"Results include assets that have been installed after the specified date"},"created_at_before":{"type":"string","format":"date-time","title":"Results include assets that have been created before the specified date"},"created_at_after":{"type":"string","format":"date-time","title":"Results include assets that have been installed after the specified date"},"name_multi_search":{"type":"string","title":"Aliases for this machine"},"group_name":{"type":"string","title":"Filter the search by group name. Search for the matches that contain the value"},"group_name.keyword":{"type":"string","title":"Filter the search by group name. Search for an exact match"},"not.group_name":{"type":"string","title":"Filter the search by group name. Search for the matches that don't contain the value"},"not.group_name.keyword":{"type":"string","title":"Filter the search by group name. Search for the matches that are not equal to the value"},"object_guid":{"type":"string","title":"Filter the search by object_guid. Search for the matches that contain the value"},"object_guid.keyword":{"type":"string","title":"Filter the search by object_guid. Search for an exact match"},"not.object_guid":{"type":"string","title":"Filter the search by object_guid. Search for the matches that don't contain the value"},"not.object_guid.keyword":{"type":"string","title":"Filter the search by object_guid. Search for the matches that are not equal to the value"},"latest_version_available":{"type":"string","title":"Filter the search by latest_version_available. Search for an exact match"},"latest_version_available.keyword":{"type":"string","title":"Filter the search by latest_version_available.keyword. Search for the matches that contain the value"},"not.latest_version_available":{"type":"string","title":"Filter the search by not.latest_version_available. Search for the matches that are not equal to the value"},"not.latest_version_available.keyword":{"type":"string","title":"Filter the search by not.latest_version_available.keyword. Search for the matches that doesnt contain the value"},"cves":{"type":"array","items":{"type":"string"},"title":"Filter the search by cves. Search for an exact match"},"cves.keyword":{"type":"array","items":{"type":"string"},"title":"Filter the search by cves.keyword. Search for the matches that contain the value"},"not.cves":{"type":"array","items":{"type":"string"},"title":"Filter the search by not.cves. Search for the matches that are not equal to the value"},"not.cves.keyword":{"type":"array","items":{"type":"string"},"title":"Filter the search by not.cves.keyword. Search for the matches that doesnt contain the value"},"cves_by_status.unknown":{"type":"string","title":"Filter the search by cves_by_status.unknown. Search for an exact match"},"cves_by_status.unknown.keyword":{"type":"string","title":"Filter the search by cves_by_status.unknown.keyword. Search for the matches that contain the value"},"not.cves_by_status.unknown":{"type":"string","title":"Filter the search by not.cves_by_status.unknown. Search for the matches that are not equal to the value"},"not.cves_by_status.unknown.keyword":{"type":"string","title":"Filter the search by not.cves_by_status.unknown.keyword. Search for the matches that doesnt contain the value"},"cves_by_status.low":{"type":"string","title":"Filter the search by cves_by_status.low. Search for an exact match"},"cves_by_status.low.keyword":{"type":"string","title":"Filter the search by cves_by_status.low.keyword. Search for the matches that contain the value"},"not.cves_by_status.low":{"type":"string","title":"Filter the search by not.cves_by_status.low. Search for the matches that are not equal to the value"},"not.cves_by_status.low.keyword":{"type":"string","title":"Filter the search by not.cves_by_status.low.keyword. Search for the matches that doesnt contain the value"},"cves_by_status.medium":{"type":"string","title":"Filter the search by cves_by_status.medium. Search for an exact match"},"cves_by_status.medium.keyword":{"type":"string","title":"Filter the search by cves_by_status.medium.keyword. Search for the matches that contain the value"},"not.cves_by_status.medium":{"type":"string","title":"Filter the search by not.cves_by_status.medium. Search for the matches that are not equal to the value"},"not.cves_by_status.medium.keyword":{"type":"string","title":"Filter the search by not.cves_by_status.medium.keyword. Search for the matches that doesnt contain the value"},"cves_by_status.high":{"type":"string","title":"Filter the search by cves_by_status.high. Search for an exact match"},"cves_by_status.high.keyword":{"type":"string","title":"Filter the search by cves_by_status.high.keyword. Search for the matches that contain the value"},"not.cves_by_status.high":{"type":"string","title":"Filter the search by not.cves_by_status.high. Search for the matches that are not equal to the value"},"not.cves_by_status.high.keyword":{"type":"string","title":"Filter the search by not.cves_by_status.high.keyword. Search for the matches that doesnt contain the value"},"cves_by_status.critical":{"type":"string","title":"Filter the search by cves_by_status.critical. Search for an exact match"},"cves_by_status.critical.keyword":{"type":"string","title":"Filter the search by cves_by_status.critical.keyword. Search for the matches that contain the value"},"not.cves_by_status.critical":{"type":"string","title":"Filter the search by not.cves_by_status.critical. Search for the matches that are not equal to the value"},"not.cves_by_status.critical.keyword":{"type":"string","title":"Filter the search by not.cves_by_status.critical.keyword. Search for the matches that doesnt contain the value"},"cves_score":{"type":"string","title":"Filter the search by cves_score. Search for an exact match"},"cves_count":{"type":"string","title":"Filter the search by cves_count. Search for an exact match"},"product_signature":{"type":"number","title":"Filter the search by product_signature. Search for an exact match"},"categories":{"type":"number","title":"Filter the search by category. Search for an exact match"},"cves_count_by_status.unknown":{"type":"string","title":"Filter the search by cves_count_by_status.unknown. Search for an exact match"},"cves_count_by_status.low":{"type":"string","title":"Filter the search by cves_count_by_status.low. Search for an exact match"},"cves_count_by_status.medium":{"type":"string","title":"Filter the search by cves_count_by_status.medium. Search for an exact match"},"cves_count_by_status.high":{"type":"string","title":"Filter the search by cves_count_by_status.high. Search for an exact match"},"cves_count_by_status.critical":{"type":"string","title":"Filter the search by cves_count_by_status.critical. Search for an exact match"},"language":{"type":"string","title":"Filter the search by language. Search for an exact match"},"language.keyword":{"type":"string","title":"Filter the search by language.keyword. Search for the matches that contain the value"},"not.language":{"type":"string","title":"Filter the search by not.language. Search for the matches that are not equal to the value"},"not.language.keyword":{"type":"string","title":"Filter the search by not.language.keyword. Search for the matches that doesnt contain the value"},"architecture":{"type":"string","title":"Filter the search by architecture. Search for an exact match"},"architecture.keyword":{"type":"string","title":"Filter the search by architecture.keyword. Search for the matches that contain the value"},"not.architecture":{"type":"string","title":"Filter the search by not.architecture. Search for the matches that are not equal to the value"},"not.architecture.keyword":{"type":"string","title":"Filter the search by not.architecture.keyword. Search for the matches that doesnt contain the value"},"supports_update":{"type":"boolean","title":"Filter the search by supports_update. Search for an exact match"},"not.supports_update":{"type":"boolean","title":"Filter the search by not.supports_update. Search for the matches that are not equal to the value"},"supports_uninstall":{"type":"boolean","title":"Filter the search by supports_uninstall. Search for an exact match"},"not.supports_uninstall":{"type":"boolean","title":"Filter the search by not.supports_uninstall. Search for the matches that are not equal to the value"},"update_available":{"type":"boolean","title":"Filter the search by update_available. Search for an exact match"},"update_ignored":{"type":"boolean","title":"Filter the search to only include ignored software updates"},"exists":{"type":"array","title":"Filter the results for records that have these fields","items":{"type":"string","enum":["account_id","parent_account_id","group_id","root_group_id","machine_id","account_name","host_name","fully_qualified_host_name","alias","name_multi_search","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","installed_version","normalized_installed_version","display_installed_version","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","installation_date","created_at","object_guid","latest_version_available","cves","cves_by_status.unknown","cves_by_status.low","cves_by_status.medium","cves_by_status.high","cves_by_status.critical","cves_score","cves_count","cves_count_by_status.unknown","cves_count_by_status.low","cves_count_by_status.medium","cves_count_by_status.high","cves_count_by_status.critical","language","architecture","product_signature","categories","supports_update","supports_uninstall","update_available"]}},"not.exists":{"type":"array","title":"Filter out the results for records that doesn't have these fields","items":{"type":"string","enum":["account_id","parent_account_id","group_id","root_group_id","machine_id","account_name","host_name","fully_qualified_host_name","alias","name_multi_search","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","installed_version","normalized_installed_version","display_installed_version","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","installation_date","created_at","object_guid","latest_version_available","cves","cves_by_status.unknown","cves_by_status.low","cves_by_status.medium","cves_by_status.high","cves_by_status.critical","cves_score","cves_count","cves_count_by_status.unknown","cves_count_by_status.low","cves_count_by_status.medium","cves_count_by_status.high","cves_count_by_status.critical","language","architecture","product_signature","categories","supports_update","supports_uninstall","update_available"]}},"sort_field":{"type":"string","title":"Sort field","enum":["account_id","parent_account_id","group_id","root_group_id","machine_id","account_name","host_name","fully_qualified_host_name","alias","name_multi_search","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","installed_version","normalized_installed_version","display_installed_version","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","installation_date","created_at","object_guid","latest_version_available","cves","cves_by_status.unknown","cves_by_status.low","cves_by_status.medium","cves_by_status.high","cves_by_status.critical","cves_score","cves_count","cves_count_by_status.unknown","cves_count_by_status.low","cves_count_by_status.medium","cves_count_by_status.high","cves_count_by_status.critical","language","architecture","product_signature","categories","supports_update","supports_uninstall","update_available","domain_name","active_directory.user.display_name","active_directory.machine.display_name","active_directory.user.ou","active_directory.machine.ou","active_directory.user.sam_account_name","active_directory.machine.sam_account_name","ignored_until"]},"sort_order":{"type":"string","title":"Sorting direction","default":"asc","enum":["asc","desc"]},"page_size":{"type":"number","title":"The size of the page. If you only need aggregations, set it to 0","minimum":0,"default":50,"maximum":2000},"aggregations":{"type":"array","title":"The Aggregations Schema","items":{"type":"string","title":"Aggregations","default":[],"enum":["account_id","parent_account_id","group_id","root_group_id","machine_id","host_name","fully_qualified_host_name","alias","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","installed_version","normalized_installed_version","display_installed_version","object_guid","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","latest_version_available","cves","cves_by_status.unknown","cves_by_status.low","cves_by_status.medium","cves_by_status.high","cves_by_status.critical","supports_update","supports_uninstall","update_available","language","architecture"]}},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}},"allOf":[{"type":"object","title":"Active Directory Search Filters","properties":{"active_directory.user.display_name":{"type":"string","title":"Filter the search by active_directory.user.display_name. Search for the matches that are equal to the value"},"active_directory.user.display_name.keyword":{"type":"string","title":"Filter the search by active_directory.user.display_name.keyword. Search for the matches that contain the value"},"active_directory.user.ou":{"type":"string","title":"Filter the search by active_directory.user.ou. Search for the matches that are equal to the value"},"active_directory.user.ou.keyword":{"type":"string","title":"Filter the search by active_directory.user.ou.keyword. Search for the matches that contain the value"},"active_directory.user.ou.path":{"type":"string","title":"Filter the search by active_directory.user.ou.path. Search for the matches that are equal to the value"},"active_directory.user.ou.path.keyword":{"type":"string","title":"Filter the search by active_directory.user.ou.path.keyword. Search for the matches that contain the value"},"active_directory.user.sam_account_name":{"type":"string","title":"Filter the search by active_directory.user.sam_account_name. Search for the matches that are equal to the value"},"active_directory.user.sam_account_name.keyword":{"type":"string","title":"Filter the search by active_directory.user.sam_account_name.keyword. Search for the matches that contain the value"},"active_directory.machine.display_name":{"type":"string","title":"Filter the search by active_directory.machine.display_name. Search for the matches that are equal to the value"},"active_directory.machine.display_name.keyword":{"type":"string","title":"Filter the search by active_directory.machine.display_name.keyword. Search for the matches that contain the value"},"active_directory.machine.ou":{"type":"string","title":"Filter the search by active_directory.machine.ou. Search for the matches that are equal to the value"},"active_directory.machine.ou.keyword":{"type":"string","title":"Filter the search by active_directory.machine.ou.keyword. Search for the matches that contain the value"},"active_directory.machine.ou.path":{"type":"string","title":"Filter the search by active_directory.machine.ou.path. Search for the matches that are equal to the value"},"active_directory.machine.ou.path.keyword":{"type":"string","title":"Filter the search by active_directory.machine.ou.path.keyword. Search for the matches that contain the value"},"active_directory.machine.sam_account_name":{"type":"string","title":"Filter the search by active_directory.machine.sam_account_name. Search for the matches that are equal to the value"},"active_directory.machine.sam_account_name.keyword":{"type":"string","title":"Filter the search by active_directory.machine.sam_account_name.keyword. Search for the matches that contain the value"}}}]}]}}}},{"properties":{"groups":{"type":"array","title":"List of search queries","items":{"allOf":[{"type":"object","title":"Search assets software request. Leading wildcards are not supported for constraint fields without '.keyword' suffix.","properties":{"parent_account_id":{"type":"string","title":"Filter the search by parent_account_id. Search for an exact match"},"not.parent_account_id":{"type":"string","title":"Filter the search by parent_account_id. Search for the matches that are not equal to the value"},"group_id":{"type":"string","title":"Filter the search by group_id. Search for an exact match"},"not.group_id":{"type":"string","title":"Filter the search by group_id. Search for the matches that are not equal to the value"},"root_group_id":{"type":"string","title":"Filter the search by root_group_id. Search for an exact match"},"not.root_group_id":{"type":"string","title":"Filter the search by root_group_id. Search for the matches that are not equal to the value"},"machine_id":{"type":"string","title":"Filter the search by machine_id. Search for an exact match"},"not.machine_id":{"type":"string","title":"Filter the search by machine_id. Search for the matches that are not equal to the value"},"account_name":{"type":"string","title":"Filter the search by account_name. Search for the matches that contain the value"},"account_name.keyword":{"type":"string","title":"Filter the search by account_name. Search for an exact match"},"not.account_name":{"type":"string","title":"Filter the search by account_name. Search for the matches that don't contain the value"},"not.account_name.keyword":{"type":"string","title":"Filter the search by account_name. Search for the matches that are not equal to the value"},"host_name":{"type":"string","title":"Filter the search by host_name. Search for the matches that contain the value"},"host_name.keyword":{"type":"string","title":"Filter the search by host_name. Search for an exact match"},"not.host_name":{"type":"string","title":"Filter the search by host_name. Search for the matches that don't contain the value"},"not.host_name.keyword":{"type":"string","title":"Filter the search by host_name. Search for the matches that are not equal to the value"},"fully_qualified_host_name":{"type":"string","title":"Filter the search by fully_qualified_host_name. Search for the matches that contain the value"},"fully_qualified_host_name.keyword":{"type":"string","title":"Filter the search by fully_qualified_host_name. Search for an exact match"},"not.fully_qualified_host_name":{"type":"string","title":"Filter the search by fully_qualified_host_name. Search for the matches that don't contain the value"},"not.fully_qualified_host_name.keyword":{"type":"string","title":"Filter the search by fully_qualified_host_name. Search for the matches that are not equal to the value"},"domain_name":{"type":"string","title":"Filter the search by domain_name. Search for an exact match"},"domain_name.keyword":{"type":"string","title":"Filter the search by domain_name. Search for the matches that contain the value"},"not.domain_name":{"type":"string","title":"Filter the search by domain_name. Search for the matches that are not equal to the value"},"not.domain_name.keyword":{"type":"string","title":"Filter the search by domain_name. Search for the matches that do not contain the value"},"alias":{"type":"string","title":"Filter the search by aliasn. Search for the matches that contain the value"},"alias.keyword":{"type":"string","title":"Filter the search by aliasn. Search for an exact match"},"not.alias":{"type":"string","title":"Filter the search by aliasn. Search for the matches that don't contain the value"},"not.alias.keyword":{"type":"string","title":"Filter the search by aliasn. Search for the matches that are not equal to the value"},"vendor":{"type":"string","title":"Filter the search by vendor. Search for the matches that contain the value"},"vendor.keyword":{"type":"string","title":"Filter the search by vendor. Search for an exact match"},"not.vendor":{"type":"string","title":"Filter the search by vendor. Search for the matches that don't contain the value"},"not.vendor.keyword":{"type":"string","title":"Filter the search by vendor. Search for the matches that are not equal to the value"},"normalized_vendor":{"type":"string","title":"Filter the search by normalized_vendor. Search for the matches that contain the value"},"normalized_vendor.keyword":{"type":"string","title":"Filter the search by normalized_vendor. Search for an exact match"},"not.normalized_vendor":{"type":"string","title":"Filter the search by normalized_vendor. Search for the matches that don't contain the value"},"not.normalized_vendor.keyword":{"type":"string","title":"Filter the search by normalized_vendor. Search for the matches that are not equal to the value"},"display_vendor":{"type":"string","title":"Filter the search by display_vendor. Search for the matches that contain the value"},"display_vendor.keyword":{"type":"string","title":"Filter the search by display_vendor. Search for an exact match"},"not.display_vendor":{"type":"string","title":"Filter the search by display_vendor. Search for the matches that don't contain the value"},"not.display_vendor.keyword":{"type":"string","title":"Filter the search by display_vendor. Search for the matches that are not equal to the value"},"product":{"type":"string","title":"Filter the search by product. Search for the matches that contain the value"},"product.keyword":{"type":"string","title":"Filter the search by product. Search for an exact match"},"not.product":{"type":"string","title":"Filter the search by product. Search for the matches that don't contain the value"},"not.product.keyword":{"type":"string","title":"Filter the search by product. Search for the matches that are not equal to the value"},"normalized_product":{"type":"string","title":"Filter the search by normalized_product. Search for the matches that contain the value"},"normalized_product.keyword":{"type":"string","title":"Filter the search by normalized_product. Search for an exact match"},"not.normalized_product":{"type":"string","title":"Filter the search by normalized_product. Search for the matches that don't contain the value"},"not.normalized_product.keyword":{"type":"string","title":"Filter the search by normalized_product. Search for the matches that are not equal to the value"},"display_product":{"type":"string","title":"Filter the search by display_product. Search for the matches that contain the value"},"display_product.keyword":{"type":"string","title":"Filter the search by display_product. Search for an exact match"},"not.display_product":{"type":"string","title":"Filter the search by display_product. Search for the matches that don't contain the value"},"not.display_product.keyword":{"type":"string","title":"Filter the search by display_product. Search for the matches that are not equal to the value"},"installed_version":{"type":"string","title":"Filter the search by installed_version. Search for the matches that contain the value"},"installed_version.keyword":{"type":"string","title":"Filter the search by installed_version. Search for an exact match"},"not.installed_version":{"type":"string","title":"Filter the search by installed_version. Search for the matches that don't contain the value"},"not.installed_version.keyword":{"type":"string","title":"Filter the search by installed_version. Search for the matches that are not equal to the value"},"normaliazed_installed_version":{"type":"string","title":"Filter the search by normalized_installed_version. Search for the matches that contain the value"},"normaliazed_installed_version.keyword":{"type":"string","title":"Filter the search by normalized_installed_version. Search for an exact match"},"not.normaliazed_installed_version":{"type":"string","title":"Filter the search by normalized_installed_version. Search for the matches that don't contain the value"},"not.normaliazed_installed_version.keyword":{"type":"string","title":"Filter the search by normalized_installed_version. Search for the matches that are not equal to the value"},"display_installed_version":{"type":"string","title":"Filter the search by display_installed_version. Search for the matches that contain the value"},"display_installed_version.keyword":{"type":"string","title":"Filter the search by display_installed_version. Search for an exact match"},"not.display_installed_version":{"type":"string","title":"Filter the search by display_installed_version. Search for the matches that don't contain the value"},"not.display_installed_version.keyword":{"type":"string","title":"Filter the search by display_installed_version. Search for the matches that are not equal to the value"},"os_info.os_type":{"type":"string","title":"Filter the search by os_info.os_type. Search for the matches that contain the value"},"os_info.os_type.keyword":{"type":"string","title":"Filter the search by os_info.os_type. Search for an exact match"},"not.os_info.os_type":{"type":"string","title":"Filter the search by os_info.os_type. Search for the matches that don't contain the value"},"not.os_info.os_type.keyword":{"type":"string","title":"Filter the search by os_info.os_type. Search for the matches that are not equal to the value"},"os_info.os_version":{"type":"string","title":"Filter the search by os_info.os_version. Search for the matches that contain the value"},"os_info.os_version.keyword":{"type":"string","title":"Filter the search by os_info.os_version. Search for an exact match"},"not.os_info.os_version":{"type":"string","title":"Filter the search by os_info.os_version. Search for the matches that don't contain the value"},"not.os_info.os_version.keyword":{"type":"string","title":"Filter the search by os_info.os_version. Search for the matches that are not equal to the value"},"os_info.os_platform":{"type":"string","title":"Filter the search by os_info.os_platform. Search for the matches that contain the value"},"os_info.os_platform.keyword":{"type":"string","title":"Filter the search by os_info.os_platform. Search for an exact match"},"not.os_info.os_platform":{"type":"string","title":"Filter the search by os_info.os_platform. Search for the matches that don't contain the value"},"not.os_info.os_platform.keyword":{"type":"string","title":"Filter the search by os_info.os_platform. Search for the matches that are not equal to the value"},"os_info.os_platforms":{"type":"array","title":"Filter the search by multiple os_info.os_platform. Search for exact matches","items":{"type":"string"}},"os_info.os_architecture":{"type":"string","title":"Filter the search by os_info.os_architecture. Search for the matches that contain the value"},"os_info.os_architecture.keyword":{"type":"string","title":"Filter the search by os_info.os_architecture. Search for an exact match"},"not.os_info.os_architecture":{"type":"string","title":"Filter the search by os_info.os_architecture. Search for the matches that don't contain the value"},"not.os_info.os_architecture.keyword":{"type":"string","title":"Filter the search by os_info.os_architecture. Search for the matches that are not equal to the value"},"os_info.os_release_name":{"type":"string","title":"Filter the search by os_info.os_release_name. Search for the matches that contain the value"},"os_info.os_release_name.keyword":{"type":"string","title":"Filter the search by os_info.os_release_name. Search for an exact match"},"not.os_info.os_release_name":{"type":"string","title":"Filter the search by os_info.os_release_name. Search for the matches that don't contain the value"},"not.os_info.os_release_name.keyword":{"type":"string","title":"Filter the search by os_info.os_release_name. Search for the matches that are not equal to the value"},"installation_date_before":{"type":"string","format":"date-time","title":"Results include assets that have been created before the specified date"},"installation_date_after":{"type":"string","format":"date-time","title":"Results include assets that have been installed after the specified date"},"created_at_before":{"type":"string","format":"date-time","title":"Results include assets that have been created before the specified date"},"created_at_after":{"type":"string","format":"date-time","title":"Results include assets that have been installed after the specified date"},"name_multi_search":{"type":"string","title":"Aliases for this machine"},"group_name":{"type":"string","title":"Filter the search by group name. Search for the matches that contain the value"},"group_name.keyword":{"type":"string","title":"Filter the search by group name. Search for an exact match"},"not.group_name":{"type":"string","title":"Filter the search by group name. Search for the matches that don't contain the value"},"not.group_name.keyword":{"type":"string","title":"Filter the search by group name. Search for the matches that are not equal to the value"},"object_guid":{"type":"string","title":"Filter the search by object_guid. Search for the matches that contain the value"},"object_guid.keyword":{"type":"string","title":"Filter the search by object_guid. Search for an exact match"},"not.object_guid":{"type":"string","title":"Filter the search by object_guid. Search for the matches that don't contain the value"},"not.object_guid.keyword":{"type":"string","title":"Filter the search by object_guid. Search for the matches that are not equal to the value"},"latest_version_available":{"type":"string","title":"Filter the search by latest_version_available. Search for an exact match"},"latest_version_available.keyword":{"type":"string","title":"Filter the search by latest_version_available.keyword. Search for the matches that contain the value"},"not.latest_version_available":{"type":"string","title":"Filter the search by not.latest_version_available. Search for the matches that are not equal to the value"},"not.latest_version_available.keyword":{"type":"string","title":"Filter the search by not.latest_version_available.keyword. Search for the matches that doesnt contain the value"},"cves":{"type":"array","items":{"type":"string"},"title":"Filter the search by cves. Search for an exact match"},"cves.keyword":{"type":"array","items":{"type":"string"},"title":"Filter the search by cves.keyword. Search for the matches that contain the value"},"not.cves":{"type":"array","items":{"type":"string"},"title":"Filter the search by not.cves. Search for the matches that are not equal to the value"},"not.cves.keyword":{"type":"array","items":{"type":"string"},"title":"Filter the search by not.cves.keyword. Search for the matches that doesnt contain the value"},"cves_by_status.unknown":{"type":"string","title":"Filter the search by cves_by_status.unknown. Search for an exact match"},"cves_by_status.unknown.keyword":{"type":"string","title":"Filter the search by cves_by_status.unknown.keyword. Search for the matches that contain the value"},"not.cves_by_status.unknown":{"type":"string","title":"Filter the search by not.cves_by_status.unknown. Search for the matches that are not equal to the value"},"not.cves_by_status.unknown.keyword":{"type":"string","title":"Filter the search by not.cves_by_status.unknown.keyword. Search for the matches that doesnt contain the value"},"cves_by_status.low":{"type":"string","title":"Filter the search by cves_by_status.low. Search for an exact match"},"cves_by_status.low.keyword":{"type":"string","title":"Filter the search by cves_by_status.low.keyword. Search for the matches that contain the value"},"not.cves_by_status.low":{"type":"string","title":"Filter the search by not.cves_by_status.low. Search for the matches that are not equal to the value"},"not.cves_by_status.low.keyword":{"type":"string","title":"Filter the search by not.cves_by_status.low.keyword. Search for the matches that doesnt contain the value"},"cves_by_status.medium":{"type":"string","title":"Filter the search by cves_by_status.medium. Search for an exact match"},"cves_by_status.medium.keyword":{"type":"string","title":"Filter the search by cves_by_status.medium.keyword. Search for the matches that contain the value"},"not.cves_by_status.medium":{"type":"string","title":"Filter the search by not.cves_by_status.medium. Search for the matches that are not equal to the value"},"not.cves_by_status.medium.keyword":{"type":"string","title":"Filter the search by not.cves_by_status.medium.keyword. Search for the matches that doesnt contain the value"},"cves_by_status.high":{"type":"string","title":"Filter the search by cves_by_status.high. Search for an exact match"},"cves_by_status.high.keyword":{"type":"string","title":"Filter the search by cves_by_status.high.keyword. Search for the matches that contain the value"},"not.cves_by_status.high":{"type":"string","title":"Filter the search by not.cves_by_status.high. Search for the matches that are not equal to the value"},"not.cves_by_status.high.keyword":{"type":"string","title":"Filter the search by not.cves_by_status.high.keyword. Search for the matches that doesnt contain the value"},"cves_by_status.critical":{"type":"string","title":"Filter the search by cves_by_status.critical. Search for an exact match"},"cves_by_status.critical.keyword":{"type":"string","title":"Filter the search by cves_by_status.critical.keyword. Search for the matches that contain the value"},"not.cves_by_status.critical":{"type":"string","title":"Filter the search by not.cves_by_status.critical. Search for the matches that are not equal to the value"},"not.cves_by_status.critical.keyword":{"type":"string","title":"Filter the search by not.cves_by_status.critical.keyword. Search for the matches that doesnt contain the value"},"cves_score":{"type":"string","title":"Filter the search by cves_score. Search for an exact match"},"cves_count":{"type":"string","title":"Filter the search by cves_count. Search for an exact match"},"product_signature":{"type":"number","title":"Filter the search by product_signature. Search for an exact match"},"categories":{"type":"number","title":"Filter the search by category. Search for an exact match"},"cves_count_by_status.unknown":{"type":"string","title":"Filter the search by cves_count_by_status.unknown. Search for an exact match"},"cves_count_by_status.low":{"type":"string","title":"Filter the search by cves_count_by_status.low. Search for an exact match"},"cves_count_by_status.medium":{"type":"string","title":"Filter the search by cves_count_by_status.medium. Search for an exact match"},"cves_count_by_status.high":{"type":"string","title":"Filter the search by cves_count_by_status.high. Search for an exact match"},"cves_count_by_status.critical":{"type":"string","title":"Filter the search by cves_count_by_status.critical. Search for an exact match"},"language":{"type":"string","title":"Filter the search by language. Search for an exact match"},"language.keyword":{"type":"string","title":"Filter the search by language.keyword. Search for the matches that contain the value"},"not.language":{"type":"string","title":"Filter the search by not.language. Search for the matches that are not equal to the value"},"not.language.keyword":{"type":"string","title":"Filter the search by not.language.keyword. Search for the matches that doesnt contain the value"},"architecture":{"type":"string","title":"Filter the search by architecture. Search for an exact match"},"architecture.keyword":{"type":"string","title":"Filter the search by architecture.keyword. Search for the matches that contain the value"},"not.architecture":{"type":"string","title":"Filter the search by not.architecture. Search for the matches that are not equal to the value"},"not.architecture.keyword":{"type":"string","title":"Filter the search by not.architecture.keyword. Search for the matches that doesnt contain the value"},"supports_update":{"type":"boolean","title":"Filter the search by supports_update. Search for an exact match"},"not.supports_update":{"type":"boolean","title":"Filter the search by not.supports_update. Search for the matches that are not equal to the value"},"supports_uninstall":{"type":"boolean","title":"Filter the search by supports_uninstall. Search for an exact match"},"not.supports_uninstall":{"type":"boolean","title":"Filter the search by not.supports_uninstall. Search for the matches that are not equal to the value"},"update_available":{"type":"boolean","title":"Filter the search by update_available. Search for an exact match"},"update_ignored":{"type":"boolean","title":"Filter the search to only include ignored software updates"},"exists":{"type":"array","title":"Filter the results for records that have these fields","items":{"type":"string","enum":["account_id","parent_account_id","group_id","root_group_id","machine_id","account_name","host_name","fully_qualified_host_name","alias","name_multi_search","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","installed_version","normalized_installed_version","display_installed_version","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","installation_date","created_at","object_guid","latest_version_available","cves","cves_by_status.unknown","cves_by_status.low","cves_by_status.medium","cves_by_status.high","cves_by_status.critical","cves_score","cves_count","cves_count_by_status.unknown","cves_count_by_status.low","cves_count_by_status.medium","cves_count_by_status.high","cves_count_by_status.critical","language","architecture","product_signature","categories","supports_update","supports_uninstall","update_available"]}},"not.exists":{"type":"array","title":"Filter out the results for records that doesn't have these fields","items":{"type":"string","enum":["account_id","parent_account_id","group_id","root_group_id","machine_id","account_name","host_name","fully_qualified_host_name","alias","name_multi_search","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","installed_version","normalized_installed_version","display_installed_version","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","installation_date","created_at","object_guid","latest_version_available","cves","cves_by_status.unknown","cves_by_status.low","cves_by_status.medium","cves_by_status.high","cves_by_status.critical","cves_score","cves_count","cves_count_by_status.unknown","cves_count_by_status.low","cves_count_by_status.medium","cves_count_by_status.high","cves_count_by_status.critical","language","architecture","product_signature","categories","supports_update","supports_uninstall","update_available"]}},"sort_field":{"type":"string","title":"Sort field","enum":["account_id","parent_account_id","group_id","root_group_id","machine_id","account_name","host_name","fully_qualified_host_name","alias","name_multi_search","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","installed_version","normalized_installed_version","display_installed_version","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","installation_date","created_at","object_guid","latest_version_available","cves","cves_by_status.unknown","cves_by_status.low","cves_by_status.medium","cves_by_status.high","cves_by_status.critical","cves_score","cves_count","cves_count_by_status.unknown","cves_count_by_status.low","cves_count_by_status.medium","cves_count_by_status.high","cves_count_by_status.critical","language","architecture","product_signature","categories","supports_update","supports_uninstall","update_available","domain_name","active_directory.user.display_name","active_directory.machine.display_name","active_directory.user.ou","active_directory.machine.ou","active_directory.user.sam_account_name","active_directory.machine.sam_account_name","ignored_until"]},"sort_order":{"type":"string","title":"Sorting direction","default":"asc","enum":["asc","desc"]},"page_size":{"type":"number","title":"The size of the page. If you only need aggregations, set it to 0","minimum":0,"default":50,"maximum":2000},"aggregations":{"type":"array","title":"The Aggregations Schema","items":{"type":"string","title":"Aggregations","default":[],"enum":["account_id","parent_account_id","group_id","root_group_id","machine_id","host_name","fully_qualified_host_name","alias","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","installed_version","normalized_installed_version","display_installed_version","object_guid","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","latest_version_available","cves","cves_by_status.unknown","cves_by_status.low","cves_by_status.medium","cves_by_status.high","cves_by_status.critical","supports_update","supports_uninstall","update_available","language","architecture"]}},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}},"allOf":[{"type":"object","title":"Active Directory Search Filters","properties":{"active_directory.user.display_name":{"type":"string","title":"Filter the search by active_directory.user.display_name. Search for the matches that are equal to the value"},"active_directory.user.display_name.keyword":{"type":"string","title":"Filter the search by active_directory.user.display_name.keyword. Search for the matches that contain the value"},"active_directory.user.ou":{"type":"string","title":"Filter the search by active_directory.user.ou. Search for the matches that are equal to the value"},"active_directory.user.ou.keyword":{"type":"string","title":"Filter the search by active_directory.user.ou.keyword. Search for the matches that contain the value"},"active_directory.user.ou.path":{"type":"string","title":"Filter the search by active_directory.user.ou.path. Search for the matches that are equal to the value"},"active_directory.user.ou.path.keyword":{"type":"string","title":"Filter the search by active_directory.user.ou.path.keyword. Search for the matches that contain the value"},"active_directory.user.sam_account_name":{"type":"string","title":"Filter the search by active_directory.user.sam_account_name. Search for the matches that are equal to the value"},"active_directory.user.sam_account_name.keyword":{"type":"string","title":"Filter the search by active_directory.user.sam_account_name.keyword. Search for the matches that contain the value"},"active_directory.machine.display_name":{"type":"string","title":"Filter the search by active_directory.machine.display_name. Search for the matches that are equal to the value"},"active_directory.machine.display_name.keyword":{"type":"string","title":"Filter the search by active_directory.machine.display_name.keyword. Search for the matches that contain the value"},"active_directory.machine.ou":{"type":"string","title":"Filter the search by active_directory.machine.ou. Search for the matches that are equal to the value"},"active_directory.machine.ou.keyword":{"type":"string","title":"Filter the search by active_directory.machine.ou.keyword. Search for the matches that contain the value"},"active_directory.machine.ou.path":{"type":"string","title":"Filter the search by active_directory.machine.ou.path. Search for the matches that are equal to the value"},"active_directory.machine.ou.path.keyword":{"type":"string","title":"Filter the search by active_directory.machine.ou.path.keyword. Search for the matches that contain the value"},"active_directory.machine.sam_account_name":{"type":"string","title":"Filter the search by active_directory.machine.sam_account_name. Search for the matches that are equal to the value"},"active_directory.machine.sam_account_name.keyword":{"type":"string","title":"Filter the search by active_directory.machine.sam_account_name.keyword. Search for the matches that contain the value"}}}]},{"type":"object","required":["account_ids"],"properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]}}}}]}}}},"responses":{"200":{"description":"Successful response"}},"tags":["Assets"],"operationId":"api.v2.rmm.post.export.assets.software.async"}},"/oneview/v1/assets/software":{"post":{"description":"Search assets software across all your managed account. The search will be scoped to the account_ids you specify in the request body.","summary":"Search assets software","security":[{"client_credentials":["read"]},{"user_permissions":["softwareInventory.view"]}],"status":{"outage":["auth","search_stateless"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"allOf":[{"type":"object","title":"Search assets software request. Leading wildcards are not supported for constraint fields without '.keyword' suffix.","properties":{"parent_account_id":{"type":"string","title":"Filter the search by parent_account_id. Search for an exact match"},"not.parent_account_id":{"type":"string","title":"Filter the search by parent_account_id. Search for the matches that are not equal to the value"},"group_id":{"type":"string","title":"Filter the search by group_id. Search for an exact match"},"not.group_id":{"type":"string","title":"Filter the search by group_id. Search for the matches that are not equal to the value"},"root_group_id":{"type":"string","title":"Filter the search by root_group_id. Search for an exact match"},"not.root_group_id":{"type":"string","title":"Filter the search by root_group_id. Search for the matches that are not equal to the value"},"machine_id":{"type":"string","title":"Filter the search by machine_id. Search for an exact match"},"not.machine_id":{"type":"string","title":"Filter the search by machine_id. Search for the matches that are not equal to the value"},"account_name":{"type":"string","title":"Filter the search by account_name. Search for the matches that contain the value"},"account_name.keyword":{"type":"string","title":"Filter the search by account_name. Search for an exact match"},"not.account_name":{"type":"string","title":"Filter the search by account_name. Search for the matches that don't contain the value"},"not.account_name.keyword":{"type":"string","title":"Filter the search by account_name. Search for the matches that are not equal to the value"},"host_name":{"type":"string","title":"Filter the search by host_name. Search for the matches that contain the value"},"host_name.keyword":{"type":"string","title":"Filter the search by host_name. Search for an exact match"},"not.host_name":{"type":"string","title":"Filter the search by host_name. Search for the matches that don't contain the value"},"not.host_name.keyword":{"type":"string","title":"Filter the search by host_name. Search for the matches that are not equal to the value"},"fully_qualified_host_name":{"type":"string","title":"Filter the search by fully_qualified_host_name. Search for the matches that contain the value"},"fully_qualified_host_name.keyword":{"type":"string","title":"Filter the search by fully_qualified_host_name. Search for an exact match"},"not.fully_qualified_host_name":{"type":"string","title":"Filter the search by fully_qualified_host_name. Search for the matches that don't contain the value"},"not.fully_qualified_host_name.keyword":{"type":"string","title":"Filter the search by fully_qualified_host_name. Search for the matches that are not equal to the value"},"domain_name":{"type":"string","title":"Filter the search by domain_name. Search for an exact match"},"domain_name.keyword":{"type":"string","title":"Filter the search by domain_name. Search for the matches that contain the value"},"not.domain_name":{"type":"string","title":"Filter the search by domain_name. Search for the matches that are not equal to the value"},"not.domain_name.keyword":{"type":"string","title":"Filter the search by domain_name. Search for the matches that do not contain the value"},"alias":{"type":"string","title":"Filter the search by aliasn. Search for the matches that contain the value"},"alias.keyword":{"type":"string","title":"Filter the search by aliasn. Search for an exact match"},"not.alias":{"type":"string","title":"Filter the search by aliasn. Search for the matches that don't contain the value"},"not.alias.keyword":{"type":"string","title":"Filter the search by aliasn. Search for the matches that are not equal to the value"},"vendor":{"type":"string","title":"Filter the search by vendor. Search for the matches that contain the value"},"vendor.keyword":{"type":"string","title":"Filter the search by vendor. Search for an exact match"},"not.vendor":{"type":"string","title":"Filter the search by vendor. Search for the matches that don't contain the value"},"not.vendor.keyword":{"type":"string","title":"Filter the search by vendor. Search for the matches that are not equal to the value"},"normalized_vendor":{"type":"string","title":"Filter the search by normalized_vendor. Search for the matches that contain the value"},"normalized_vendor.keyword":{"type":"string","title":"Filter the search by normalized_vendor. Search for an exact match"},"not.normalized_vendor":{"type":"string","title":"Filter the search by normalized_vendor. Search for the matches that don't contain the value"},"not.normalized_vendor.keyword":{"type":"string","title":"Filter the search by normalized_vendor. Search for the matches that are not equal to the value"},"display_vendor":{"type":"string","title":"Filter the search by display_vendor. Search for the matches that contain the value"},"display_vendor.keyword":{"type":"string","title":"Filter the search by display_vendor. Search for an exact match"},"not.display_vendor":{"type":"string","title":"Filter the search by display_vendor. Search for the matches that don't contain the value"},"not.display_vendor.keyword":{"type":"string","title":"Filter the search by display_vendor. Search for the matches that are not equal to the value"},"product":{"type":"string","title":"Filter the search by product. Search for the matches that contain the value"},"product.keyword":{"type":"string","title":"Filter the search by product. Search for an exact match"},"not.product":{"type":"string","title":"Filter the search by product. Search for the matches that don't contain the value"},"not.product.keyword":{"type":"string","title":"Filter the search by product. Search for the matches that are not equal to the value"},"normalized_product":{"type":"string","title":"Filter the search by normalized_product. Search for the matches that contain the value"},"normalized_product.keyword":{"type":"string","title":"Filter the search by normalized_product. Search for an exact match"},"not.normalized_product":{"type":"string","title":"Filter the search by normalized_product. Search for the matches that don't contain the value"},"not.normalized_product.keyword":{"type":"string","title":"Filter the search by normalized_product. Search for the matches that are not equal to the value"},"display_product":{"type":"string","title":"Filter the search by display_product. Search for the matches that contain the value"},"display_product.keyword":{"type":"string","title":"Filter the search by display_product. Search for an exact match"},"not.display_product":{"type":"string","title":"Filter the search by display_product. Search for the matches that don't contain the value"},"not.display_product.keyword":{"type":"string","title":"Filter the search by display_product. Search for the matches that are not equal to the value"},"installed_version":{"type":"string","title":"Filter the search by installed_version. Search for the matches that contain the value"},"installed_version.keyword":{"type":"string","title":"Filter the search by installed_version. Search for an exact match"},"not.installed_version":{"type":"string","title":"Filter the search by installed_version. Search for the matches that don't contain the value"},"not.installed_version.keyword":{"type":"string","title":"Filter the search by installed_version. Search for the matches that are not equal to the value"},"normaliazed_installed_version":{"type":"string","title":"Filter the search by normalized_installed_version. Search for the matches that contain the value"},"normaliazed_installed_version.keyword":{"type":"string","title":"Filter the search by normalized_installed_version. Search for an exact match"},"not.normaliazed_installed_version":{"type":"string","title":"Filter the search by normalized_installed_version. Search for the matches that don't contain the value"},"not.normaliazed_installed_version.keyword":{"type":"string","title":"Filter the search by normalized_installed_version. Search for the matches that are not equal to the value"},"display_installed_version":{"type":"string","title":"Filter the search by display_installed_version. Search for the matches that contain the value"},"display_installed_version.keyword":{"type":"string","title":"Filter the search by display_installed_version. Search for an exact match"},"not.display_installed_version":{"type":"string","title":"Filter the search by display_installed_version. Search for the matches that don't contain the value"},"not.display_installed_version.keyword":{"type":"string","title":"Filter the search by display_installed_version. Search for the matches that are not equal to the value"},"os_info.os_type":{"type":"string","title":"Filter the search by os_info.os_type. Search for the matches that contain the value"},"os_info.os_type.keyword":{"type":"string","title":"Filter the search by os_info.os_type. Search for an exact match"},"not.os_info.os_type":{"type":"string","title":"Filter the search by os_info.os_type. Search for the matches that don't contain the value"},"not.os_info.os_type.keyword":{"type":"string","title":"Filter the search by os_info.os_type. Search for the matches that are not equal to the value"},"os_info.os_version":{"type":"string","title":"Filter the search by os_info.os_version. Search for the matches that contain the value"},"os_info.os_version.keyword":{"type":"string","title":"Filter the search by os_info.os_version. Search for an exact match"},"not.os_info.os_version":{"type":"string","title":"Filter the search by os_info.os_version. Search for the matches that don't contain the value"},"not.os_info.os_version.keyword":{"type":"string","title":"Filter the search by os_info.os_version. Search for the matches that are not equal to the value"},"os_info.os_platform":{"type":"string","title":"Filter the search by os_info.os_platform. Search for the matches that contain the value"},"os_info.os_platform.keyword":{"type":"string","title":"Filter the search by os_info.os_platform. Search for an exact match"},"not.os_info.os_platform":{"type":"string","title":"Filter the search by os_info.os_platform. Search for the matches that don't contain the value"},"not.os_info.os_platform.keyword":{"type":"string","title":"Filter the search by os_info.os_platform. Search for the matches that are not equal to the value"},"os_info.os_platforms":{"type":"array","title":"Filter the search by multiple os_info.os_platform. Search for exact matches","items":{"type":"string"}},"os_info.os_architecture":{"type":"string","title":"Filter the search by os_info.os_architecture. Search for the matches that contain the value"},"os_info.os_architecture.keyword":{"type":"string","title":"Filter the search by os_info.os_architecture. Search for an exact match"},"not.os_info.os_architecture":{"type":"string","title":"Filter the search by os_info.os_architecture. Search for the matches that don't contain the value"},"not.os_info.os_architecture.keyword":{"type":"string","title":"Filter the search by os_info.os_architecture. Search for the matches that are not equal to the value"},"os_info.os_release_name":{"type":"string","title":"Filter the search by os_info.os_release_name. Search for the matches that contain the value"},"os_info.os_release_name.keyword":{"type":"string","title":"Filter the search by os_info.os_release_name. Search for an exact match"},"not.os_info.os_release_name":{"type":"string","title":"Filter the search by os_info.os_release_name. Search for the matches that don't contain the value"},"not.os_info.os_release_name.keyword":{"type":"string","title":"Filter the search by os_info.os_release_name. Search for the matches that are not equal to the value"},"installation_date_before":{"type":"string","format":"date-time","title":"Results include assets that have been created before the specified date"},"installation_date_after":{"type":"string","format":"date-time","title":"Results include assets that have been installed after the specified date"},"created_at_before":{"type":"string","format":"date-time","title":"Results include assets that have been created before the specified date"},"created_at_after":{"type":"string","format":"date-time","title":"Results include assets that have been installed after the specified date"},"name_multi_search":{"type":"string","title":"Aliases for this machine"},"group_name":{"type":"string","title":"Filter the search by group name. Search for the matches that contain the value"},"group_name.keyword":{"type":"string","title":"Filter the search by group name. Search for an exact match"},"not.group_name":{"type":"string","title":"Filter the search by group name. Search for the matches that don't contain the value"},"not.group_name.keyword":{"type":"string","title":"Filter the search by group name. Search for the matches that are not equal to the value"},"object_guid":{"type":"string","title":"Filter the search by object_guid. Search for the matches that contain the value"},"object_guid.keyword":{"type":"string","title":"Filter the search by object_guid. Search for an exact match"},"not.object_guid":{"type":"string","title":"Filter the search by object_guid. Search for the matches that don't contain the value"},"not.object_guid.keyword":{"type":"string","title":"Filter the search by object_guid. Search for the matches that are not equal to the value"},"latest_version_available":{"type":"string","title":"Filter the search by latest_version_available. Search for an exact match"},"latest_version_available.keyword":{"type":"string","title":"Filter the search by latest_version_available.keyword. Search for the matches that contain the value"},"not.latest_version_available":{"type":"string","title":"Filter the search by not.latest_version_available. Search for the matches that are not equal to the value"},"not.latest_version_available.keyword":{"type":"string","title":"Filter the search by not.latest_version_available.keyword. Search for the matches that doesnt contain the value"},"cves":{"type":"array","items":{"type":"string"},"title":"Filter the search by cves. Search for an exact match"},"cves.keyword":{"type":"array","items":{"type":"string"},"title":"Filter the search by cves.keyword. Search for the matches that contain the value"},"not.cves":{"type":"array","items":{"type":"string"},"title":"Filter the search by not.cves. Search for the matches that are not equal to the value"},"not.cves.keyword":{"type":"array","items":{"type":"string"},"title":"Filter the search by not.cves.keyword. Search for the matches that doesnt contain the value"},"cves_by_status.unknown":{"type":"string","title":"Filter the search by cves_by_status.unknown. Search for an exact match"},"cves_by_status.unknown.keyword":{"type":"string","title":"Filter the search by cves_by_status.unknown.keyword. Search for the matches that contain the value"},"not.cves_by_status.unknown":{"type":"string","title":"Filter the search by not.cves_by_status.unknown. Search for the matches that are not equal to the value"},"not.cves_by_status.unknown.keyword":{"type":"string","title":"Filter the search by not.cves_by_status.unknown.keyword. Search for the matches that doesnt contain the value"},"cves_by_status.low":{"type":"string","title":"Filter the search by cves_by_status.low. Search for an exact match"},"cves_by_status.low.keyword":{"type":"string","title":"Filter the search by cves_by_status.low.keyword. Search for the matches that contain the value"},"not.cves_by_status.low":{"type":"string","title":"Filter the search by not.cves_by_status.low. Search for the matches that are not equal to the value"},"not.cves_by_status.low.keyword":{"type":"string","title":"Filter the search by not.cves_by_status.low.keyword. Search for the matches that doesnt contain the value"},"cves_by_status.medium":{"type":"string","title":"Filter the search by cves_by_status.medium. Search for an exact match"},"cves_by_status.medium.keyword":{"type":"string","title":"Filter the search by cves_by_status.medium.keyword. Search for the matches that contain the value"},"not.cves_by_status.medium":{"type":"string","title":"Filter the search by not.cves_by_status.medium. Search for the matches that are not equal to the value"},"not.cves_by_status.medium.keyword":{"type":"string","title":"Filter the search by not.cves_by_status.medium.keyword. Search for the matches that doesnt contain the value"},"cves_by_status.high":{"type":"string","title":"Filter the search by cves_by_status.high. Search for an exact match"},"cves_by_status.high.keyword":{"type":"string","title":"Filter the search by cves_by_status.high.keyword. Search for the matches that contain the value"},"not.cves_by_status.high":{"type":"string","title":"Filter the search by not.cves_by_status.high. Search for the matches that are not equal to the value"},"not.cves_by_status.high.keyword":{"type":"string","title":"Filter the search by not.cves_by_status.high.keyword. Search for the matches that doesnt contain the value"},"cves_by_status.critical":{"type":"string","title":"Filter the search by cves_by_status.critical. Search for an exact match"},"cves_by_status.critical.keyword":{"type":"string","title":"Filter the search by cves_by_status.critical.keyword. Search for the matches that contain the value"},"not.cves_by_status.critical":{"type":"string","title":"Filter the search by not.cves_by_status.critical. Search for the matches that are not equal to the value"},"not.cves_by_status.critical.keyword":{"type":"string","title":"Filter the search by not.cves_by_status.critical.keyword. Search for the matches that doesnt contain the value"},"cves_score":{"type":"string","title":"Filter the search by cves_score. Search for an exact match"},"cves_count":{"type":"string","title":"Filter the search by cves_count. Search for an exact match"},"product_signature":{"type":"number","title":"Filter the search by product_signature. Search for an exact match"},"categories":{"type":"number","title":"Filter the search by category. Search for an exact match"},"cves_count_by_status.unknown":{"type":"string","title":"Filter the search by cves_count_by_status.unknown. Search for an exact match"},"cves_count_by_status.low":{"type":"string","title":"Filter the search by cves_count_by_status.low. Search for an exact match"},"cves_count_by_status.medium":{"type":"string","title":"Filter the search by cves_count_by_status.medium. Search for an exact match"},"cves_count_by_status.high":{"type":"string","title":"Filter the search by cves_count_by_status.high. Search for an exact match"},"cves_count_by_status.critical":{"type":"string","title":"Filter the search by cves_count_by_status.critical. Search for an exact match"},"language":{"type":"string","title":"Filter the search by language. Search for an exact match"},"language.keyword":{"type":"string","title":"Filter the search by language.keyword. Search for the matches that contain the value"},"not.language":{"type":"string","title":"Filter the search by not.language. Search for the matches that are not equal to the value"},"not.language.keyword":{"type":"string","title":"Filter the search by not.language.keyword. Search for the matches that doesnt contain the value"},"architecture":{"type":"string","title":"Filter the search by architecture. Search for an exact match"},"architecture.keyword":{"type":"string","title":"Filter the search by architecture.keyword. Search for the matches that contain the value"},"not.architecture":{"type":"string","title":"Filter the search by not.architecture. Search for the matches that are not equal to the value"},"not.architecture.keyword":{"type":"string","title":"Filter the search by not.architecture.keyword. Search for the matches that doesnt contain the value"},"supports_update":{"type":"boolean","title":"Filter the search by supports_update. Search for an exact match"},"not.supports_update":{"type":"boolean","title":"Filter the search by not.supports_update. Search for the matches that are not equal to the value"},"supports_uninstall":{"type":"boolean","title":"Filter the search by supports_uninstall. Search for an exact match"},"not.supports_uninstall":{"type":"boolean","title":"Filter the search by not.supports_uninstall. Search for the matches that are not equal to the value"},"update_available":{"type":"boolean","title":"Filter the search by update_available. Search for an exact match"},"update_ignored":{"type":"boolean","title":"Filter the search to only include ignored software updates"},"exists":{"type":"array","title":"Filter the results for records that have these fields","items":{"type":"string","enum":["account_id","parent_account_id","group_id","root_group_id","machine_id","account_name","host_name","fully_qualified_host_name","alias","name_multi_search","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","installed_version","normalized_installed_version","display_installed_version","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","installation_date","created_at","object_guid","latest_version_available","cves","cves_by_status.unknown","cves_by_status.low","cves_by_status.medium","cves_by_status.high","cves_by_status.critical","cves_score","cves_count","cves_count_by_status.unknown","cves_count_by_status.low","cves_count_by_status.medium","cves_count_by_status.high","cves_count_by_status.critical","language","architecture","product_signature","categories","supports_update","supports_uninstall","update_available"]}},"not.exists":{"type":"array","title":"Filter out the results for records that doesn't have these fields","items":{"type":"string","enum":["account_id","parent_account_id","group_id","root_group_id","machine_id","account_name","host_name","fully_qualified_host_name","alias","name_multi_search","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","installed_version","normalized_installed_version","display_installed_version","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","installation_date","created_at","object_guid","latest_version_available","cves","cves_by_status.unknown","cves_by_status.low","cves_by_status.medium","cves_by_status.high","cves_by_status.critical","cves_score","cves_count","cves_count_by_status.unknown","cves_count_by_status.low","cves_count_by_status.medium","cves_count_by_status.high","cves_count_by_status.critical","language","architecture","product_signature","categories","supports_update","supports_uninstall","update_available"]}},"sort_field":{"type":"string","title":"Sort field","enum":["account_id","parent_account_id","group_id","root_group_id","machine_id","account_name","host_name","fully_qualified_host_name","alias","name_multi_search","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","installed_version","normalized_installed_version","display_installed_version","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","installation_date","created_at","object_guid","latest_version_available","cves","cves_by_status.unknown","cves_by_status.low","cves_by_status.medium","cves_by_status.high","cves_by_status.critical","cves_score","cves_count","cves_count_by_status.unknown","cves_count_by_status.low","cves_count_by_status.medium","cves_count_by_status.high","cves_count_by_status.critical","language","architecture","product_signature","categories","supports_update","supports_uninstall","update_available","domain_name","active_directory.user.display_name","active_directory.machine.display_name","active_directory.user.ou","active_directory.machine.ou","active_directory.user.sam_account_name","active_directory.machine.sam_account_name","ignored_until"]},"sort_order":{"type":"string","title":"Sorting direction","default":"asc","enum":["asc","desc"]},"page_size":{"type":"number","title":"The size of the page. If you only need aggregations, set it to 0","minimum":0,"default":50,"maximum":2000},"aggregations":{"type":"array","title":"The Aggregations Schema","items":{"type":"string","title":"Aggregations","default":[],"enum":["account_id","parent_account_id","group_id","root_group_id","machine_id","host_name","fully_qualified_host_name","alias","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","installed_version","normalized_installed_version","display_installed_version","object_guid","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","latest_version_available","cves","cves_by_status.unknown","cves_by_status.low","cves_by_status.medium","cves_by_status.high","cves_by_status.critical","supports_update","supports_uninstall","update_available","language","architecture"]}},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}},"allOf":[{"type":"object","title":"Active Directory Search Filters","properties":{"active_directory.user.display_name":{"type":"string","title":"Filter the search by active_directory.user.display_name. Search for the matches that are equal to the value"},"active_directory.user.display_name.keyword":{"type":"string","title":"Filter the search by active_directory.user.display_name.keyword. Search for the matches that contain the value"},"active_directory.user.ou":{"type":"string","title":"Filter the search by active_directory.user.ou. Search for the matches that are equal to the value"},"active_directory.user.ou.keyword":{"type":"string","title":"Filter the search by active_directory.user.ou.keyword. Search for the matches that contain the value"},"active_directory.user.ou.path":{"type":"string","title":"Filter the search by active_directory.user.ou.path. Search for the matches that are equal to the value"},"active_directory.user.ou.path.keyword":{"type":"string","title":"Filter the search by active_directory.user.ou.path.keyword. Search for the matches that contain the value"},"active_directory.user.sam_account_name":{"type":"string","title":"Filter the search by active_directory.user.sam_account_name. Search for the matches that are equal to the value"},"active_directory.user.sam_account_name.keyword":{"type":"string","title":"Filter the search by active_directory.user.sam_account_name.keyword. Search for the matches that contain the value"},"active_directory.machine.display_name":{"type":"string","title":"Filter the search by active_directory.machine.display_name. Search for the matches that are equal to the value"},"active_directory.machine.display_name.keyword":{"type":"string","title":"Filter the search by active_directory.machine.display_name.keyword. Search for the matches that contain the value"},"active_directory.machine.ou":{"type":"string","title":"Filter the search by active_directory.machine.ou. Search for the matches that are equal to the value"},"active_directory.machine.ou.keyword":{"type":"string","title":"Filter the search by active_directory.machine.ou.keyword. Search for the matches that contain the value"},"active_directory.machine.ou.path":{"type":"string","title":"Filter the search by active_directory.machine.ou.path. Search for the matches that are equal to the value"},"active_directory.machine.ou.path.keyword":{"type":"string","title":"Filter the search by active_directory.machine.ou.path.keyword. Search for the matches that contain the value"},"active_directory.machine.sam_account_name":{"type":"string","title":"Filter the search by active_directory.machine.sam_account_name. Search for the matches that are equal to the value"},"active_directory.machine.sam_account_name.keyword":{"type":"string","title":"Filter the search by active_directory.machine.sam_account_name.keyword. Search for the matches that contain the value"}}}]},{"type":"object","required":["account_ids"],"properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Search assets software result","properties":{"assets":{"type":"array","items":{"properties":{"account_id":{"type":"string"},"parent_account_id":{"type":"string"},"group_id":{"type":"string"},"root_group_id":{"type":"string"},"machine_id":{"type":"string"},"vendor":{"type":"string"},"normalized_vendor":{"type":"string"},"display_vendor":{"type":"string"},"product":{"type":"string"},"normalized_product":{"type":"string"},"display_product":{"type":"string"},"installed_version":{"type":"string"},"normalized_installed_version":{"type":"string"},"display_installed_version":{"type":"string"},"installation_date":{"type":"string"},"language":{"type":"string"},"architecture":{"type":"string"},"product_signature":{"type":"integer"},"categories":{"type":"array","items":{"type":"integer"}},"account_name":{"type":"string"},"host_name":{"type":"string"},"fully_qualified_host_name":{"type":"string"},"domain_name":{"type":"string"},"alias":{"type":"string"},"created_at":{"type":"string"},"object_guid":{"type":"string"},"os_info":{"properties":{"os_type":{"type":"string"},"os_version":{"type":"string"},"os_platform":{"type":"string"},"os_architecture":{"type":"string"},"os_release_name":{"type":"string"}}},"group_name":{"type":"string"},"policy_id":{"type":"string"},"policy_name":{"type":"string"},"cves":{"type":"array","items":{"type":"string"}},"cves_count":{"type":"integer"},"cves_score":{"type":"number"},"cves_by_status":{"properties":{"none":{"type":"array","items":{"type":"string"}},"low":{"type":"array","items":{"type":"string"}},"medium":{"type":"array","items":{"type":"string"}},"high":{"type":"array","items":{"type":"string"}},"critical":{"type":"array","items":{"type":"string"}}}},"cves_count_by_status":{"properties":{"none":{"type":"integer"},"low":{"type":"integer"},"medium":{"type":"integer"},"high":{"type":"integer"},"critical":{"type":"integer"}}},"latest_version_available":{"type":"string"},"ignored_until":{"type":"string","format":"date-time"},"ignore_rule_ids":{"type":"array","items":{"type":"string","format":"uuid"}},"active_directory":{"type":"object","patternProperties":{"^(user|machine)$":{"type":"object","properties":{"display_name":{"type":"string"},"distinguished_name":{"type":"string"},"sam_account_name":{"type":"string"},"ou":{"type":"string"}}}}},"ai_tool":{"type":["string","null"],"title":"Canonical AI tool name. null if not an AI tool."},"ai_category":{"type":["string","null"],"title":"AI tool category, e.g. \"AI Assistant\", \"AI Code Tool\"."},"ai_risk":{"type":["string","null"],"title":"Risk level from the AI whitelist.","enum":["Low","Medium","High",null]},"ai_tier":{"type":["string","null"],"title":"Confidence/tier from the AI whitelist."},"ai_flags":{"type":"array","title":"Zero or more AI whitelist flags, e.g. \"browser_access\", \"local_llm_execution\".","items":{"type":"string"}},"ai_status":{"type":["string","null"],"title":"Effective governance status resolved from AIDR rules. null when ai_tool is null.","enum":["authorized","unauthorized","pending",null]}}}},"aggregations":{"type":"object","title":"Aggregations","additionalProperties":true},"total_count":{"type":"integer","title":"Total count of found detections"},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}},"required":["assets","total_count"]}}}}},"tags":["Assets"],"operationId":"api.v2.rmm.search.assets.software"}},"/oneview/v1/assets/software/search-groupby":{"post":{"description":"Search assets software grouped by a specific field across all your managed account.","summary":"Search assets software groupBy","security":[{"client_credentials":["read"]},{"user_permissions":["softwareInventory.view"]}],"status":{"incident":["read_nebula_data"],"outage":["auth","search_stateful"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"allOf":[{"type":"object","title":"The Post Assets Search GroupBy Request","allOf":[{"type":"object","title":"Search assets software request. Leading wildcards are not supported for constraint fields without '.keyword' suffix.","properties":{"parent_account_id":{"type":"string","title":"Filter the search by parent_account_id. Search for an exact match"},"not.parent_account_id":{"type":"string","title":"Filter the search by parent_account_id. Search for the matches that are not equal to the value"},"group_id":{"type":"string","title":"Filter the search by group_id. Search for an exact match"},"not.group_id":{"type":"string","title":"Filter the search by group_id. Search for the matches that are not equal to the value"},"root_group_id":{"type":"string","title":"Filter the search by root_group_id. Search for an exact match"},"not.root_group_id":{"type":"string","title":"Filter the search by root_group_id. Search for the matches that are not equal to the value"},"machine_id":{"type":"string","title":"Filter the search by machine_id. Search for an exact match"},"not.machine_id":{"type":"string","title":"Filter the search by machine_id. Search for the matches that are not equal to the value"},"account_name":{"type":"string","title":"Filter the search by account_name. Search for the matches that contain the value"},"account_name.keyword":{"type":"string","title":"Filter the search by account_name. Search for an exact match"},"not.account_name":{"type":"string","title":"Filter the search by account_name. Search for the matches that don't contain the value"},"not.account_name.keyword":{"type":"string","title":"Filter the search by account_name. Search for the matches that are not equal to the value"},"host_name":{"type":"string","title":"Filter the search by host_name. Search for the matches that contain the value"},"host_name.keyword":{"type":"string","title":"Filter the search by host_name. Search for an exact match"},"not.host_name":{"type":"string","title":"Filter the search by host_name. Search for the matches that don't contain the value"},"not.host_name.keyword":{"type":"string","title":"Filter the search by host_name. Search for the matches that are not equal to the value"},"fully_qualified_host_name":{"type":"string","title":"Filter the search by fully_qualified_host_name. Search for the matches that contain the value"},"fully_qualified_host_name.keyword":{"type":"string","title":"Filter the search by fully_qualified_host_name. Search for an exact match"},"not.fully_qualified_host_name":{"type":"string","title":"Filter the search by fully_qualified_host_name. Search for the matches that don't contain the value"},"not.fully_qualified_host_name.keyword":{"type":"string","title":"Filter the search by fully_qualified_host_name. Search for the matches that are not equal to the value"},"domain_name":{"type":"string","title":"Filter the search by domain_name. Search for an exact match"},"domain_name.keyword":{"type":"string","title":"Filter the search by domain_name. Search for the matches that contain the value"},"not.domain_name":{"type":"string","title":"Filter the search by domain_name. Search for the matches that are not equal to the value"},"not.domain_name.keyword":{"type":"string","title":"Filter the search by domain_name. Search for the matches that do not contain the value"},"alias":{"type":"string","title":"Filter the search by aliasn. Search for the matches that contain the value"},"alias.keyword":{"type":"string","title":"Filter the search by aliasn. Search for an exact match"},"not.alias":{"type":"string","title":"Filter the search by aliasn. Search for the matches that don't contain the value"},"not.alias.keyword":{"type":"string","title":"Filter the search by aliasn. Search for the matches that are not equal to the value"},"vendor":{"type":"string","title":"Filter the search by vendor. Search for the matches that contain the value"},"vendor.keyword":{"type":"string","title":"Filter the search by vendor. Search for an exact match"},"not.vendor":{"type":"string","title":"Filter the search by vendor. Search for the matches that don't contain the value"},"not.vendor.keyword":{"type":"string","title":"Filter the search by vendor. Search for the matches that are not equal to the value"},"normalized_vendor":{"type":"string","title":"Filter the search by normalized_vendor. Search for the matches that contain the value"},"normalized_vendor.keyword":{"type":"string","title":"Filter the search by normalized_vendor. Search for an exact match"},"not.normalized_vendor":{"type":"string","title":"Filter the search by normalized_vendor. Search for the matches that don't contain the value"},"not.normalized_vendor.keyword":{"type":"string","title":"Filter the search by normalized_vendor. Search for the matches that are not equal to the value"},"display_vendor":{"type":"string","title":"Filter the search by display_vendor. Search for the matches that contain the value"},"display_vendor.keyword":{"type":"string","title":"Filter the search by display_vendor. Search for an exact match"},"not.display_vendor":{"type":"string","title":"Filter the search by display_vendor. Search for the matches that don't contain the value"},"not.display_vendor.keyword":{"type":"string","title":"Filter the search by display_vendor. Search for the matches that are not equal to the value"},"product":{"type":"string","title":"Filter the search by product. Search for the matches that contain the value"},"product.keyword":{"type":"string","title":"Filter the search by product. Search for an exact match"},"not.product":{"type":"string","title":"Filter the search by product. Search for the matches that don't contain the value"},"not.product.keyword":{"type":"string","title":"Filter the search by product. Search for the matches that are not equal to the value"},"normalized_product":{"type":"string","title":"Filter the search by normalized_product. Search for the matches that contain the value"},"normalized_product.keyword":{"type":"string","title":"Filter the search by normalized_product. Search for an exact match"},"not.normalized_product":{"type":"string","title":"Filter the search by normalized_product. Search for the matches that don't contain the value"},"not.normalized_product.keyword":{"type":"string","title":"Filter the search by normalized_product. Search for the matches that are not equal to the value"},"display_product":{"type":"string","title":"Filter the search by display_product. Search for the matches that contain the value"},"display_product.keyword":{"type":"string","title":"Filter the search by display_product. Search for an exact match"},"not.display_product":{"type":"string","title":"Filter the search by display_product. Search for the matches that don't contain the value"},"not.display_product.keyword":{"type":"string","title":"Filter the search by display_product. Search for the matches that are not equal to the value"},"installed_version":{"type":"string","title":"Filter the search by installed_version. Search for the matches that contain the value"},"installed_version.keyword":{"type":"string","title":"Filter the search by installed_version. Search for an exact match"},"not.installed_version":{"type":"string","title":"Filter the search by installed_version. Search for the matches that don't contain the value"},"not.installed_version.keyword":{"type":"string","title":"Filter the search by installed_version. Search for the matches that are not equal to the value"},"normaliazed_installed_version":{"type":"string","title":"Filter the search by normalized_installed_version. Search for the matches that contain the value"},"normaliazed_installed_version.keyword":{"type":"string","title":"Filter the search by normalized_installed_version. Search for an exact match"},"not.normaliazed_installed_version":{"type":"string","title":"Filter the search by normalized_installed_version. Search for the matches that don't contain the value"},"not.normaliazed_installed_version.keyword":{"type":"string","title":"Filter the search by normalized_installed_version. Search for the matches that are not equal to the value"},"display_installed_version":{"type":"string","title":"Filter the search by display_installed_version. Search for the matches that contain the value"},"display_installed_version.keyword":{"type":"string","title":"Filter the search by display_installed_version. Search for an exact match"},"not.display_installed_version":{"type":"string","title":"Filter the search by display_installed_version. Search for the matches that don't contain the value"},"not.display_installed_version.keyword":{"type":"string","title":"Filter the search by display_installed_version. Search for the matches that are not equal to the value"},"os_info.os_type":{"type":"string","title":"Filter the search by os_info.os_type. Search for the matches that contain the value"},"os_info.os_type.keyword":{"type":"string","title":"Filter the search by os_info.os_type. Search for an exact match"},"not.os_info.os_type":{"type":"string","title":"Filter the search by os_info.os_type. Search for the matches that don't contain the value"},"not.os_info.os_type.keyword":{"type":"string","title":"Filter the search by os_info.os_type. Search for the matches that are not equal to the value"},"os_info.os_version":{"type":"string","title":"Filter the search by os_info.os_version. Search for the matches that contain the value"},"os_info.os_version.keyword":{"type":"string","title":"Filter the search by os_info.os_version. Search for an exact match"},"not.os_info.os_version":{"type":"string","title":"Filter the search by os_info.os_version. Search for the matches that don't contain the value"},"not.os_info.os_version.keyword":{"type":"string","title":"Filter the search by os_info.os_version. Search for the matches that are not equal to the value"},"os_info.os_platform":{"type":"string","title":"Filter the search by os_info.os_platform. Search for the matches that contain the value"},"os_info.os_platform.keyword":{"type":"string","title":"Filter the search by os_info.os_platform. Search for an exact match"},"not.os_info.os_platform":{"type":"string","title":"Filter the search by os_info.os_platform. Search for the matches that don't contain the value"},"not.os_info.os_platform.keyword":{"type":"string","title":"Filter the search by os_info.os_platform. Search for the matches that are not equal to the value"},"os_info.os_platforms":{"type":"array","title":"Filter the search by multiple os_info.os_platform. Search for exact matches","items":{"type":"string"}},"os_info.os_architecture":{"type":"string","title":"Filter the search by os_info.os_architecture. Search for the matches that contain the value"},"os_info.os_architecture.keyword":{"type":"string","title":"Filter the search by os_info.os_architecture. Search for an exact match"},"not.os_info.os_architecture":{"type":"string","title":"Filter the search by os_info.os_architecture. Search for the matches that don't contain the value"},"not.os_info.os_architecture.keyword":{"type":"string","title":"Filter the search by os_info.os_architecture. Search for the matches that are not equal to the value"},"os_info.os_release_name":{"type":"string","title":"Filter the search by os_info.os_release_name. Search for the matches that contain the value"},"os_info.os_release_name.keyword":{"type":"string","title":"Filter the search by os_info.os_release_name. Search for an exact match"},"not.os_info.os_release_name":{"type":"string","title":"Filter the search by os_info.os_release_name. Search for the matches that don't contain the value"},"not.os_info.os_release_name.keyword":{"type":"string","title":"Filter the search by os_info.os_release_name. Search for the matches that are not equal to the value"},"installation_date_before":{"type":"string","format":"date-time","title":"Results include assets that have been created before the specified date"},"installation_date_after":{"type":"string","format":"date-time","title":"Results include assets that have been installed after the specified date"},"created_at_before":{"type":"string","format":"date-time","title":"Results include assets that have been created before the specified date"},"created_at_after":{"type":"string","format":"date-time","title":"Results include assets that have been installed after the specified date"},"name_multi_search":{"type":"string","title":"Aliases for this machine"},"group_name":{"type":"string","title":"Filter the search by group name. Search for the matches that contain the value"},"group_name.keyword":{"type":"string","title":"Filter the search by group name. Search for an exact match"},"not.group_name":{"type":"string","title":"Filter the search by group name. Search for the matches that don't contain the value"},"not.group_name.keyword":{"type":"string","title":"Filter the search by group name. Search for the matches that are not equal to the value"},"object_guid":{"type":"string","title":"Filter the search by object_guid. Search for the matches that contain the value"},"object_guid.keyword":{"type":"string","title":"Filter the search by object_guid. Search for an exact match"},"not.object_guid":{"type":"string","title":"Filter the search by object_guid. Search for the matches that don't contain the value"},"not.object_guid.keyword":{"type":"string","title":"Filter the search by object_guid. Search for the matches that are not equal to the value"},"latest_version_available":{"type":"string","title":"Filter the search by latest_version_available. Search for an exact match"},"latest_version_available.keyword":{"type":"string","title":"Filter the search by latest_version_available.keyword. Search for the matches that contain the value"},"not.latest_version_available":{"type":"string","title":"Filter the search by not.latest_version_available. Search for the matches that are not equal to the value"},"not.latest_version_available.keyword":{"type":"string","title":"Filter the search by not.latest_version_available.keyword. Search for the matches that doesnt contain the value"},"cves":{"type":"array","items":{"type":"string"},"title":"Filter the search by cves. Search for an exact match"},"cves.keyword":{"type":"array","items":{"type":"string"},"title":"Filter the search by cves.keyword. Search for the matches that contain the value"},"not.cves":{"type":"array","items":{"type":"string"},"title":"Filter the search by not.cves. Search for the matches that are not equal to the value"},"not.cves.keyword":{"type":"array","items":{"type":"string"},"title":"Filter the search by not.cves.keyword. Search for the matches that doesnt contain the value"},"cves_by_status.unknown":{"type":"string","title":"Filter the search by cves_by_status.unknown. Search for an exact match"},"cves_by_status.unknown.keyword":{"type":"string","title":"Filter the search by cves_by_status.unknown.keyword. Search for the matches that contain the value"},"not.cves_by_status.unknown":{"type":"string","title":"Filter the search by not.cves_by_status.unknown. Search for the matches that are not equal to the value"},"not.cves_by_status.unknown.keyword":{"type":"string","title":"Filter the search by not.cves_by_status.unknown.keyword. Search for the matches that doesnt contain the value"},"cves_by_status.low":{"type":"string","title":"Filter the search by cves_by_status.low. Search for an exact match"},"cves_by_status.low.keyword":{"type":"string","title":"Filter the search by cves_by_status.low.keyword. Search for the matches that contain the value"},"not.cves_by_status.low":{"type":"string","title":"Filter the search by not.cves_by_status.low. Search for the matches that are not equal to the value"},"not.cves_by_status.low.keyword":{"type":"string","title":"Filter the search by not.cves_by_status.low.keyword. Search for the matches that doesnt contain the value"},"cves_by_status.medium":{"type":"string","title":"Filter the search by cves_by_status.medium. Search for an exact match"},"cves_by_status.medium.keyword":{"type":"string","title":"Filter the search by cves_by_status.medium.keyword. Search for the matches that contain the value"},"not.cves_by_status.medium":{"type":"string","title":"Filter the search by not.cves_by_status.medium. Search for the matches that are not equal to the value"},"not.cves_by_status.medium.keyword":{"type":"string","title":"Filter the search by not.cves_by_status.medium.keyword. Search for the matches that doesnt contain the value"},"cves_by_status.high":{"type":"string","title":"Filter the search by cves_by_status.high. Search for an exact match"},"cves_by_status.high.keyword":{"type":"string","title":"Filter the search by cves_by_status.high.keyword. Search for the matches that contain the value"},"not.cves_by_status.high":{"type":"string","title":"Filter the search by not.cves_by_status.high. Search for the matches that are not equal to the value"},"not.cves_by_status.high.keyword":{"type":"string","title":"Filter the search by not.cves_by_status.high.keyword. Search for the matches that doesnt contain the value"},"cves_by_status.critical":{"type":"string","title":"Filter the search by cves_by_status.critical. Search for an exact match"},"cves_by_status.critical.keyword":{"type":"string","title":"Filter the search by cves_by_status.critical.keyword. Search for the matches that contain the value"},"not.cves_by_status.critical":{"type":"string","title":"Filter the search by not.cves_by_status.critical. Search for the matches that are not equal to the value"},"not.cves_by_status.critical.keyword":{"type":"string","title":"Filter the search by not.cves_by_status.critical.keyword. Search for the matches that doesnt contain the value"},"cves_score":{"type":"string","title":"Filter the search by cves_score. Search for an exact match"},"cves_count":{"type":"string","title":"Filter the search by cves_count. Search for an exact match"},"product_signature":{"type":"number","title":"Filter the search by product_signature. Search for an exact match"},"categories":{"type":"number","title":"Filter the search by category. Search for an exact match"},"cves_count_by_status.unknown":{"type":"string","title":"Filter the search by cves_count_by_status.unknown. Search for an exact match"},"cves_count_by_status.low":{"type":"string","title":"Filter the search by cves_count_by_status.low. Search for an exact match"},"cves_count_by_status.medium":{"type":"string","title":"Filter the search by cves_count_by_status.medium. Search for an exact match"},"cves_count_by_status.high":{"type":"string","title":"Filter the search by cves_count_by_status.high. Search for an exact match"},"cves_count_by_status.critical":{"type":"string","title":"Filter the search by cves_count_by_status.critical. Search for an exact match"},"language":{"type":"string","title":"Filter the search by language. Search for an exact match"},"language.keyword":{"type":"string","title":"Filter the search by language.keyword. Search for the matches that contain the value"},"not.language":{"type":"string","title":"Filter the search by not.language. Search for the matches that are not equal to the value"},"not.language.keyword":{"type":"string","title":"Filter the search by not.language.keyword. Search for the matches that doesnt contain the value"},"architecture":{"type":"string","title":"Filter the search by architecture. Search for an exact match"},"architecture.keyword":{"type":"string","title":"Filter the search by architecture.keyword. Search for the matches that contain the value"},"not.architecture":{"type":"string","title":"Filter the search by not.architecture. Search for the matches that are not equal to the value"},"not.architecture.keyword":{"type":"string","title":"Filter the search by not.architecture.keyword. Search for the matches that doesnt contain the value"},"supports_update":{"type":"boolean","title":"Filter the search by supports_update. Search for an exact match"},"not.supports_update":{"type":"boolean","title":"Filter the search by not.supports_update. Search for the matches that are not equal to the value"},"supports_uninstall":{"type":"boolean","title":"Filter the search by supports_uninstall. Search for an exact match"},"not.supports_uninstall":{"type":"boolean","title":"Filter the search by not.supports_uninstall. Search for the matches that are not equal to the value"},"update_available":{"type":"boolean","title":"Filter the search by update_available. Search for an exact match"},"update_ignored":{"type":"boolean","title":"Filter the search to only include ignored software updates"},"exists":{"type":"array","title":"Filter the results for records that have these fields","items":{"type":"string","enum":["account_id","parent_account_id","group_id","root_group_id","machine_id","account_name","host_name","fully_qualified_host_name","alias","name_multi_search","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","installed_version","normalized_installed_version","display_installed_version","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","installation_date","created_at","object_guid","latest_version_available","cves","cves_by_status.unknown","cves_by_status.low","cves_by_status.medium","cves_by_status.high","cves_by_status.critical","cves_score","cves_count","cves_count_by_status.unknown","cves_count_by_status.low","cves_count_by_status.medium","cves_count_by_status.high","cves_count_by_status.critical","language","architecture","product_signature","categories","supports_update","supports_uninstall","update_available"]}},"not.exists":{"type":"array","title":"Filter out the results for records that doesn't have these fields","items":{"type":"string","enum":["account_id","parent_account_id","group_id","root_group_id","machine_id","account_name","host_name","fully_qualified_host_name","alias","name_multi_search","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","installed_version","normalized_installed_version","display_installed_version","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","installation_date","created_at","object_guid","latest_version_available","cves","cves_by_status.unknown","cves_by_status.low","cves_by_status.medium","cves_by_status.high","cves_by_status.critical","cves_score","cves_count","cves_count_by_status.unknown","cves_count_by_status.low","cves_count_by_status.medium","cves_count_by_status.high","cves_count_by_status.critical","language","architecture","product_signature","categories","supports_update","supports_uninstall","update_available"]}},"sort_field":{"type":"string","title":"Sort field","enum":["account_id","parent_account_id","group_id","root_group_id","machine_id","account_name","host_name","fully_qualified_host_name","alias","name_multi_search","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","installed_version","normalized_installed_version","display_installed_version","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","installation_date","created_at","object_guid","latest_version_available","cves","cves_by_status.unknown","cves_by_status.low","cves_by_status.medium","cves_by_status.high","cves_by_status.critical","cves_score","cves_count","cves_count_by_status.unknown","cves_count_by_status.low","cves_count_by_status.medium","cves_count_by_status.high","cves_count_by_status.critical","language","architecture","product_signature","categories","supports_update","supports_uninstall","update_available","domain_name","active_directory.user.display_name","active_directory.machine.display_name","active_directory.user.ou","active_directory.machine.ou","active_directory.user.sam_account_name","active_directory.machine.sam_account_name","ignored_until"]},"sort_order":{"type":"string","title":"Sorting direction","default":"asc","enum":["asc","desc"]},"page_size":{"type":"number","title":"The size of the page. If you only need aggregations, set it to 0","minimum":0,"default":50,"maximum":2000},"aggregations":{"type":"array","title":"The Aggregations Schema","items":{"type":"string","title":"Aggregations","default":[],"enum":["account_id","parent_account_id","group_id","root_group_id","machine_id","host_name","fully_qualified_host_name","alias","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","installed_version","normalized_installed_version","display_installed_version","object_guid","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","latest_version_available","cves","cves_by_status.unknown","cves_by_status.low","cves_by_status.medium","cves_by_status.high","cves_by_status.critical","supports_update","supports_uninstall","update_available","language","architecture"]}},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}},"allOf":[{"type":"object","title":"Active Directory Search Filters","properties":{"active_directory.user.display_name":{"type":"string","title":"Filter the search by active_directory.user.display_name. Search for the matches that are equal to the value"},"active_directory.user.display_name.keyword":{"type":"string","title":"Filter the search by active_directory.user.display_name.keyword. Search for the matches that contain the value"},"active_directory.user.ou":{"type":"string","title":"Filter the search by active_directory.user.ou. Search for the matches that are equal to the value"},"active_directory.user.ou.keyword":{"type":"string","title":"Filter the search by active_directory.user.ou.keyword. Search for the matches that contain the value"},"active_directory.user.ou.path":{"type":"string","title":"Filter the search by active_directory.user.ou.path. Search for the matches that are equal to the value"},"active_directory.user.ou.path.keyword":{"type":"string","title":"Filter the search by active_directory.user.ou.path.keyword. Search for the matches that contain the value"},"active_directory.user.sam_account_name":{"type":"string","title":"Filter the search by active_directory.user.sam_account_name. Search for the matches that are equal to the value"},"active_directory.user.sam_account_name.keyword":{"type":"string","title":"Filter the search by active_directory.user.sam_account_name.keyword. Search for the matches that contain the value"},"active_directory.machine.display_name":{"type":"string","title":"Filter the search by active_directory.machine.display_name. Search for the matches that are equal to the value"},"active_directory.machine.display_name.keyword":{"type":"string","title":"Filter the search by active_directory.machine.display_name.keyword. Search for the matches that contain the value"},"active_directory.machine.ou":{"type":"string","title":"Filter the search by active_directory.machine.ou. Search for the matches that are equal to the value"},"active_directory.machine.ou.keyword":{"type":"string","title":"Filter the search by active_directory.machine.ou.keyword. Search for the matches that contain the value"},"active_directory.machine.ou.path":{"type":"string","title":"Filter the search by active_directory.machine.ou.path. Search for the matches that are equal to the value"},"active_directory.machine.ou.path.keyword":{"type":"string","title":"Filter the search by active_directory.machine.ou.path.keyword. Search for the matches that contain the value"},"active_directory.machine.sam_account_name":{"type":"string","title":"Filter the search by active_directory.machine.sam_account_name. Search for the matches that are equal to the value"},"active_directory.machine.sam_account_name.keyword":{"type":"string","title":"Filter the search by active_directory.machine.sam_account_name.keyword. Search for the matches that contain the value"}}}]},{"required":["group_by","page_size"],"properties":{"group_by":{"type":"string","title":"The sort field Schema","enum":["account_id","parent_account_id","group_id","root_group_id","machine_id","account_name","host_name","fully_qualified_host_name","alias","vendor","normalized_vendor","display_vendor","product","normalized_product","display_product","installed_version","normalized_installed_version","display_installed_version","object_guid","os_info.os_type","os_info.os_version","os_info.os_platform","os_info.os_architecture","os_info.os_release_name","latest_version_available","cves","cves_by_status.unknown","cves_by_status.low","cves_by_status.medium","cves_by_status.high","cves_by_status.critical","cves_score","cves_count","cves_count_by_status.unknown","cves_count_by_status.low","cves_count_by_status.medium","cves_count_by_status.high","cves_count_by_status.critical","language","architecture","product_signature","categories","created_at","domain_name","active_directory.user.display_name","active_directory.user.ou","active_directory.machine.display_name","active_directory.machine.ou"]},"page_size":{"type":"number","title":"The page_size Schema","minimum":50,"maximum":2000},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}]},{"type":"object","required":["account_ids"],"properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"The Post Assets Search GroupBy Response Schema","required":["results","next_cursor"],"properties":{"results":{"type":"array","title":"The Results Schema","default":[],"items":{"type":"object","title":"The Items Schema","required":["value","total"],"properties":{"value":{"type":"string","title":"The Value Schema"},"total":{"type":"integer","title":"The Total Schema"},"host_name":{"type":"string","title":"The host name Schema (only for machine_id aggregation)"},"fully_qualified_host_name":{"type":"string","title":"The host name Schema (only for machine_id aggregation)"},"tags":{"type":"object","additionalProperties":true,"title":"The tags Schema (only for machine_id aggregation)"},"account_id":{"type":"string","title":"The account_id Schema (only for machine_id aggregation)"},"group_name":{"type":"string","title":"The group name Schema (only for group_id aggregation)"},"account_name":{"type":"string","title":"The account_name Schema (only for group_id and account_id aggregation)"},"signature_name":{"type":"string","title":"The signature_name Schema (only for product_signature aggregation)"},"vendor":{"type":"string","title":"The vendor Schema (only for product_signature aggregation)"},"platform":{"type":"string","title":"The platform Schema (only for product_signature aggregation)"}}}},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}}}}},"tags":["Assets"],"operationId":"api.v2.rmm.search.assets.software.group"}},"/oneview/v1/accounts/{account_id}/reports/change-owner":{"put":{"description":"Change reports owner.","summary":"Change reports owner","security":[{"client_credentials":["write"]},{"user_permissions":["reports.editOthers"]}],"status":{"outage":["auth"]},"parameters":[{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$schema":"http://json-schema.org/draft-07/schema#","title":"Change reports owner","description":"Change reports owner","type":"object","required":["owner","reports"],"properties":{"owner":{"type":"string","description":"New owner user ID","format":"uuid"},"reports":{"type":"array","minLength":1,"description":"Reports IDs","items":{"type":"string","description":"Report ID","format":"uuid"}}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{}}}},"tags":["Reports"],"operationId":"api.rmm.put.reports.change_owner"}},"/oneview/v1/accounts/{account_id}/reports/{id}":{"delete":{"description":"Delete report by id.","summary":"Delete report by id","security":[{"client_credentials":["write"]},{"user_permissions":["reports.deleteOwn"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":true,"in":"path","description":"ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":false,"in":"header","description":"Authorization token","schema":{"type":"string"}},{"name":"on-behalf-of","required":false,"in":"header","schema":{"type":"string"}}],"responses":{"200":{"description":"Successful response"}},"tags":["Reports"],"operationId":"api.rmm.delete.reports"},"get":{"description":"Get report by id.","summary":"Get report by id","security":[{"client_credentials":["read"]},{"user_permissions":["reports.viewOwn"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":true,"in":"path","description":"ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":false,"in":"header","description":"Authorization token","schema":{"type":"string"}},{"name":"on-behalf-of","required":false,"in":"header","schema":{"type":"string"}},{"name":"populate","required":false,"in":"query","schema":{"type":"string","enum":["users"]}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"OneView Report","allOf":[{"type":"object","title":"Report","required":["id","name","type","format","period","units","time_zone","created_by","owner","account_id","created_at"],"properties":{"id":{"type":"string","title":"The Id of the report (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"account_id":{"type":"string","title":"The account Id (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"name":{"type":"string","title":"Name"},"type":{"type":"string","enum":["Detections","Quarantine","Endpoints","Assets","Events","Tasks","Executive","DeviceControl","Vulnerabilities","Cisa","Updates","Patch","DNS","CloudStorageDetections","AppBlock","Usage","PatchHistory","SoftwareUpdateHistory","CveEvents","EmailSecurity","MssMetrics","Firewall","Itdr","DriveEncryption","TrialSecurityAssessment"],"title":"Report type"},"format":{"type":"string","enum":["csv","pdf"],"title":"Report format"},"period":{"type":"integer","title":"Period for the report data","description":"Period for the report data. if 0 it must be selected when the report is manually generated","min":0},"units":{"type":"string","enum":["Days","Weeks","Months"],"title":"Unit for period"},"time_zone":{"type":"string","title":"Time Zone"},"recurrence":{"type":"object","nullable":true,"title":"Recurrence details","properties":{"days_of_month":{"type":"array","items":{"type":"integer","min":1,"max":31}},"days_of_week":{"type":"array","items":{"type":"string","enum":["Monday","Tuesday","Wednesday","Thursday","Friday","Saturday","Sunday"]}},"recur":{"type":"string","enum":["Daily","Weekly","Monthly"],"title":"Recurrence type"}}},"recipients":{"type":"array","title":"Email addresses of recipients","items":{"type":"string","format":"idn-email","title":"Email of a recipient"}},"email_subject":{"type":"string","title":"Report email subject"},"notes":{"type":"string","title":"Additional notes"},"meta":{"type":"object","properties":{"subtype":{"type":"string","description":"Report subtype for specific reports","enum":["Executive","Technical"]}}},"created_by":{"type":"string","title":"Created by user Id (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"updated_by":{"type":"string","title":"Updated by user Id (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"owner":{"type":"string","title":"Owner user Id (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"created_by_username":{"type":"string","title":"Created by username"},"created_by_email":{"type":"string","title":"Created by email"},"owner_username":{"type":"string","title":"Owner username"},"owner_email":{"type":"string","title":"Owner email"},"updated_by_username":{"type":"string","title":"Updated by username"},"updated_by_email":{"type":"string","title":"Updated by email"},"created_at":{"type":"string","title":"Created at","examples":["2021-03-16T15:31:48.241991Z"]},"updated_at":{"type":"string","title":"Updated at","examples":["2021-03-16T15:34:54.805926Z"]},"last_generation_at":{"type":"string","title":"Last generated at","examples":["2021-03-16T15:34:54.759098Z"]},"next_generation_at":{"type":"string","title":"Next generation scheduled at","nullable":true,"examples":["2021-03-16T15:34:54.759098Z"]}}},{"properties":{"account_ids":{"type":"array","default":[],"items":{"type":"string","format":"uuid","description":"Account ID"}},"all_sites_enabled":{"type":"boolean","default":false,"description":"Flag to indicate whether report is enabled for all sites"},"enabled":{"type":"boolean","description":"Flag to indicate whether the report is enabled"},"meta":{"type":"object","properties":{"aggregate":{"type":"boolean","description":"Flag to indicate whether report should aggregate selected sites"},"subtype":{"type":"string","description":"Report subtype for specific reports","enum":["Executive","Technical"]},"is_default_report":{"type":"boolean","description":"Flag to indicate whether report is default"}},"additionalProperties":false}}}]}}}}},"tags":["Reports"],"operationId":"api.rmm.get.reports"},"put":{"description":"Update report.","summary":"Update report","security":[{"client_credentials":["write"]},{"user_permissions":["reports.editOwn"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":true,"in":"path","description":"ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":false,"in":"header","description":"Authorization token","schema":{"type":"string"}},{"name":"on-behalf-of","required":false,"in":"header","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Report Save OneView","description":"Payload for creating a report","additionalProperties":false,"required":["name","type","account_ids","format","period","units","time_zone"],"properties":{"name":{"type":"string","title":"Name"},"type":{"type":"string","enum":["Detections","Quarantine","Endpoints","Assets","Events","Tasks","Executive","DeviceControl","Vulnerabilities","Cisa","Updates","Patch","DNS","AppBlock","Usage","PatchHistory","SoftwareUpdateHistory","CveEvents","EmailSecurity","MssMetrics","Firewall","Itdr","DriveEncryption","TrialSecurityAssessment"],"title":"Report type"},"period":{"type":"integer","title":"Period for the report data","description":"Period for the report data. if 0 it must be selected when the report is manually generated","min":0},"units":{"type":"string","enum":["Days","Weeks","Months"],"title":"Unit for period"},"format":{"type":"string","title":"Format of report document","enum":["csv","pdf"]},"owner":{"type":"string","title":"owner user (nebula user ID)","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"},"recurrence":{"type":"object","nullable":true,"title":"Recurrence details","properties":{"days_of_month":{"type":"array","items":{"type":"integer","min":1,"max":31}},"days_of_week":{"type":"array","items":{"type":"string","enum":["Monday","Tuesday","Wednesday","Thursday","Friday","Saturday","Sunday"]}},"recur":{"type":"string","enum":["Daily","Weekly","Monthly"],"title":"Recurrence type"}}},"time_zone":{"type":"string","title":"Time zone"},"recipients":{"type":"array","title":"Email addresses of recipients","items":{"type":"string","format":"idn-email","title":"Email of a recipient"}},"email_subject":{"type":"string","title":"Report email subject","maxLength":60},"notes":{"type":"string","title":"Additional notes","maxLength":1024},"account_ids":{"type":"array","items":{"type":"string","format":"uuid","description":"Account ID"}},"all_sites_enabled":{"type":"boolean","default":false,"description":"Flag to indicate whether report is enabled for all sites"},"enabled":{"type":"boolean","description":"Flag to indicate whether the report is enabled","default":true},"meta":{"type":"object","properties":{"aggregate":{"type":"boolean","description":"Flag to indicate whether report should aggregate selected sites"},"subtype":{"type":"string","description":"Report subtype for specific reports","enum":["Executive","Technical"]}}}},"allOf":[{"if":{"properties":{"type":{"const":"Executive"}}},"then":{"errorMessage":"Executive report must have pdf format","properties":{"format":{"const":"pdf"}}}},{"if":{"properties":{"type":{"enum":["Tasks","DeviceControl","Vulnerabilities","Cisa","Updates","Patch","DNS","CloudStorageDetections","AppBlock"]}}},"then":{"properties":{"format":{"const":"csv"}}}},{"if":{"properties":{"type":{"enum":["Endpoints","Assets"]}}},"then":{"properties":{"period":{"const":0}}}},{"if":{"properties":{"units":{"const":"Months"}}},"then":{"errorMessage":"The maximum period is 3 months","properties":{"period":{"min":0,"max":3}}}},{"if":{"properties":{"units":{"const":"Weeks"}}},"then":{"errorMessage":"The maximum period is 3 months","properties":{"period":{"min":0,"max":13}}}},{"if":{"properties":{"units":{"const":"Days"}}},"then":{"errorMessage":"The maximum period is 3 months","properties":{"period":{"min":0,"max":90}}}},{"if":{"properties":{"all_sites_enabled":{"const":true}}},"then":{"properties":{"account_ids":{"const":[]}}}}]}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"OneView Report","allOf":[{"type":"object","title":"Report","required":["id","name","type","format","period","units","time_zone","created_by","owner","account_id","created_at"],"properties":{"id":{"type":"string","title":"The Id of the report (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"account_id":{"type":"string","title":"The account Id (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"name":{"type":"string","title":"Name"},"type":{"type":"string","enum":["Detections","Quarantine","Endpoints","Assets","Events","Tasks","Executive","DeviceControl","Vulnerabilities","Cisa","Updates","Patch","DNS","CloudStorageDetections","AppBlock","Usage","PatchHistory","SoftwareUpdateHistory","CveEvents","EmailSecurity","MssMetrics","Firewall","Itdr","DriveEncryption","TrialSecurityAssessment"],"title":"Report type"},"format":{"type":"string","enum":["csv","pdf"],"title":"Report format"},"period":{"type":"integer","title":"Period for the report data","description":"Period for the report data. if 0 it must be selected when the report is manually generated","min":0},"units":{"type":"string","enum":["Days","Weeks","Months"],"title":"Unit for period"},"time_zone":{"type":"string","title":"Time Zone"},"recurrence":{"type":"object","nullable":true,"title":"Recurrence details","properties":{"days_of_month":{"type":"array","items":{"type":"integer","min":1,"max":31}},"days_of_week":{"type":"array","items":{"type":"string","enum":["Monday","Tuesday","Wednesday","Thursday","Friday","Saturday","Sunday"]}},"recur":{"type":"string","enum":["Daily","Weekly","Monthly"],"title":"Recurrence type"}}},"recipients":{"type":"array","title":"Email addresses of recipients","items":{"type":"string","format":"idn-email","title":"Email of a recipient"}},"email_subject":{"type":"string","title":"Report email subject"},"notes":{"type":"string","title":"Additional notes"},"meta":{"type":"object","properties":{"subtype":{"type":"string","description":"Report subtype for specific reports","enum":["Executive","Technical"]}}},"created_by":{"type":"string","title":"Created by user Id (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"updated_by":{"type":"string","title":"Updated by user Id (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"owner":{"type":"string","title":"Owner user Id (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"created_by_username":{"type":"string","title":"Created by username"},"created_by_email":{"type":"string","title":"Created by email"},"owner_username":{"type":"string","title":"Owner username"},"owner_email":{"type":"string","title":"Owner email"},"updated_by_username":{"type":"string","title":"Updated by username"},"updated_by_email":{"type":"string","title":"Updated by email"},"created_at":{"type":"string","title":"Created at","examples":["2021-03-16T15:31:48.241991Z"]},"updated_at":{"type":"string","title":"Updated at","examples":["2021-03-16T15:34:54.805926Z"]},"last_generation_at":{"type":"string","title":"Last generated at","examples":["2021-03-16T15:34:54.759098Z"]},"next_generation_at":{"type":"string","title":"Next generation scheduled at","nullable":true,"examples":["2021-03-16T15:34:54.759098Z"]}}},{"properties":{"account_ids":{"type":"array","default":[],"items":{"type":"string","format":"uuid","description":"Account ID"}},"all_sites_enabled":{"type":"boolean","default":false,"description":"Flag to indicate whether report is enabled for all sites"},"enabled":{"type":"boolean","description":"Flag to indicate whether the report is enabled"},"meta":{"type":"object","properties":{"aggregate":{"type":"boolean","description":"Flag to indicate whether report should aggregate selected sites"},"subtype":{"type":"string","description":"Report subtype for specific reports","enum":["Executive","Technical"]},"is_default_report":{"type":"boolean","description":"Flag to indicate whether report is default"}},"additionalProperties":false}}}]}}}}},"tags":["Reports"],"operationId":"api.rmm.put.reports"}},"/oneview/v1/accounts/{account_id}/reports":{"delete":{"description":"Delete reports bulk.","summary":"Delete reports bulk","security":[{"client_credentials":["write"]},{"user_permissions":["reports.deleteOwn"]}],"status":{"outage":["auth"]},"parameters":[{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":false,"in":"header","description":"Authorization token","schema":{"type":"string"}},{"name":"on-behalf-of","required":false,"in":"header","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"report delete bulk","required":["ids"],"properties":{"ids":{"type":"array","items":{"type":"string"},"title":"Report ids to delete"}}}}}},"responses":{"200":{"description":"Successful response"}},"tags":["Reports"],"operationId":"api.rmm.delete.reports.bulk"},"get":{"description":"Get all reports of the OneView account.","summary":"Get all reports","security":[{"client_credentials":["read"]},{"user_permissions":["reports.viewOwn"]}],"status":{"outage":["auth"]},"parameters":[{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":false,"in":"header","description":"Authorization token","schema":{"type":"string"}},{"name":"on-behalf-of","required":false,"in":"header","schema":{"type":"string"}},{"name":"populate","required":false,"in":"query","schema":{"type":"string","enum":["users"]}},{"name":"page_size","required":false,"in":"query","description":"The page_size Schema","schema":{"type":"string","pattern":"^(?:[1-9][0-9]{0,2}|1[0-9]{3}|2000)$"}},{"name":"next_cursor","required":false,"in":"query","description":"The pagination cursor for next set of results. For further documentation, check Pagination section.","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Collection of records","required":["reports"],"properties":{"reports":{"type":"array","title":"Reports","items":{"type":"object","title":"OneView Report","allOf":[{"type":"object","title":"Report","required":["id","name","type","format","period","units","time_zone","created_by","owner","account_id","created_at"],"properties":{"id":{"type":"string","title":"The Id of the report (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"account_id":{"type":"string","title":"The account Id (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"name":{"type":"string","title":"Name"},"type":{"type":"string","enum":["Detections","Quarantine","Endpoints","Assets","Events","Tasks","Executive","DeviceControl","Vulnerabilities","Cisa","Updates","Patch","DNS","CloudStorageDetections","AppBlock","Usage","PatchHistory","SoftwareUpdateHistory","CveEvents","EmailSecurity","MssMetrics","Firewall","Itdr","DriveEncryption","TrialSecurityAssessment"],"title":"Report type"},"format":{"type":"string","enum":["csv","pdf"],"title":"Report format"},"period":{"type":"integer","title":"Period for the report data","description":"Period for the report data. if 0 it must be selected when the report is manually generated","min":0},"units":{"type":"string","enum":["Days","Weeks","Months"],"title":"Unit for period"},"time_zone":{"type":"string","title":"Time Zone"},"recurrence":{"type":"object","nullable":true,"title":"Recurrence details","properties":{"days_of_month":{"type":"array","items":{"type":"integer","min":1,"max":31}},"days_of_week":{"type":"array","items":{"type":"string","enum":["Monday","Tuesday","Wednesday","Thursday","Friday","Saturday","Sunday"]}},"recur":{"type":"string","enum":["Daily","Weekly","Monthly"],"title":"Recurrence type"}}},"recipients":{"type":"array","title":"Email addresses of recipients","items":{"type":"string","format":"idn-email","title":"Email of a recipient"}},"email_subject":{"type":"string","title":"Report email subject"},"notes":{"type":"string","title":"Additional notes"},"meta":{"type":"object","properties":{"subtype":{"type":"string","description":"Report subtype for specific reports","enum":["Executive","Technical"]}}},"created_by":{"type":"string","title":"Created by user Id (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"updated_by":{"type":"string","title":"Updated by user Id (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"owner":{"type":"string","title":"Owner user Id (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"created_by_username":{"type":"string","title":"Created by username"},"created_by_email":{"type":"string","title":"Created by email"},"owner_username":{"type":"string","title":"Owner username"},"owner_email":{"type":"string","title":"Owner email"},"updated_by_username":{"type":"string","title":"Updated by username"},"updated_by_email":{"type":"string","title":"Updated by email"},"created_at":{"type":"string","title":"Created at","examples":["2021-03-16T15:31:48.241991Z"]},"updated_at":{"type":"string","title":"Updated at","examples":["2021-03-16T15:34:54.805926Z"]},"last_generation_at":{"type":"string","title":"Last generated at","examples":["2021-03-16T15:34:54.759098Z"]},"next_generation_at":{"type":"string","title":"Next generation scheduled at","nullable":true,"examples":["2021-03-16T15:34:54.759098Z"]}}},{"properties":{"account_ids":{"type":"array","default":[],"items":{"type":"string","format":"uuid","description":"Account ID"}},"all_sites_enabled":{"type":"boolean","default":false,"description":"Flag to indicate whether report is enabled for all sites"},"enabled":{"type":"boolean","description":"Flag to indicate whether the report is enabled"},"meta":{"type":"object","properties":{"aggregate":{"type":"boolean","description":"Flag to indicate whether report should aggregate selected sites"},"subtype":{"type":"string","description":"Report subtype for specific reports","enum":["Executive","Technical"]},"is_default_report":{"type":"boolean","description":"Flag to indicate whether report is default"}},"additionalProperties":false}}}]}},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}}}}},"tags":["Reports"],"operationId":"api.rmm.getall.reports"},"post":{"description":"Create report.","summary":"Create report","security":[{"client_credentials":["write"]},{"user_permissions":["reports.createOwn"]}],"status":{"outage":["auth"]},"parameters":[{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":false,"in":"header","description":"Authorization token","schema":{"type":"string"}},{"name":"on-behalf-of","required":false,"in":"header","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Report Save OneView","description":"Payload for creating a report","additionalProperties":false,"required":["name","type","account_ids","format","period","units","time_zone"],"properties":{"name":{"type":"string","title":"Name"},"type":{"type":"string","enum":["Detections","Quarantine","Endpoints","Assets","Events","Tasks","Executive","DeviceControl","Vulnerabilities","Cisa","Updates","Patch","DNS","AppBlock","Usage","PatchHistory","SoftwareUpdateHistory","CveEvents","EmailSecurity","MssMetrics","Firewall","Itdr","DriveEncryption","TrialSecurityAssessment"],"title":"Report type"},"period":{"type":"integer","title":"Period for the report data","description":"Period for the report data. if 0 it must be selected when the report is manually generated","min":0},"units":{"type":"string","enum":["Days","Weeks","Months"],"title":"Unit for period"},"format":{"type":"string","title":"Format of report document","enum":["csv","pdf"]},"owner":{"type":"string","title":"owner user (nebula user ID)","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"},"recurrence":{"type":"object","nullable":true,"title":"Recurrence details","properties":{"days_of_month":{"type":"array","items":{"type":"integer","min":1,"max":31}},"days_of_week":{"type":"array","items":{"type":"string","enum":["Monday","Tuesday","Wednesday","Thursday","Friday","Saturday","Sunday"]}},"recur":{"type":"string","enum":["Daily","Weekly","Monthly"],"title":"Recurrence type"}}},"time_zone":{"type":"string","title":"Time zone"},"recipients":{"type":"array","title":"Email addresses of recipients","items":{"type":"string","format":"idn-email","title":"Email of a recipient"}},"email_subject":{"type":"string","title":"Report email subject","maxLength":60},"notes":{"type":"string","title":"Additional notes","maxLength":1024},"account_ids":{"type":"array","items":{"type":"string","format":"uuid","description":"Account ID"}},"all_sites_enabled":{"type":"boolean","default":false,"description":"Flag to indicate whether report is enabled for all sites"},"enabled":{"type":"boolean","description":"Flag to indicate whether the report is enabled","default":true},"meta":{"type":"object","properties":{"aggregate":{"type":"boolean","description":"Flag to indicate whether report should aggregate selected sites"},"subtype":{"type":"string","description":"Report subtype for specific reports","enum":["Executive","Technical"]}}}},"allOf":[{"if":{"properties":{"type":{"const":"Executive"}}},"then":{"errorMessage":"Executive report must have pdf format","properties":{"format":{"const":"pdf"}}}},{"if":{"properties":{"type":{"enum":["Tasks","DeviceControl","Vulnerabilities","Cisa","Updates","Patch","DNS","CloudStorageDetections","AppBlock"]}}},"then":{"properties":{"format":{"const":"csv"}}}},{"if":{"properties":{"type":{"enum":["Endpoints","Assets"]}}},"then":{"properties":{"period":{"const":0}}}},{"if":{"properties":{"units":{"const":"Months"}}},"then":{"errorMessage":"The maximum period is 3 months","properties":{"period":{"min":0,"max":3}}}},{"if":{"properties":{"units":{"const":"Weeks"}}},"then":{"errorMessage":"The maximum period is 3 months","properties":{"period":{"min":0,"max":13}}}},{"if":{"properties":{"units":{"const":"Days"}}},"then":{"errorMessage":"The maximum period is 3 months","properties":{"period":{"min":0,"max":90}}}},{"if":{"properties":{"all_sites_enabled":{"const":true}}},"then":{"properties":{"account_ids":{"const":[]}}}}]}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"OneView Report","allOf":[{"type":"object","title":"Report","required":["id","name","type","format","period","units","time_zone","created_by","owner","account_id","created_at"],"properties":{"id":{"type":"string","title":"The Id of the report (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"account_id":{"type":"string","title":"The account Id (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"name":{"type":"string","title":"Name"},"type":{"type":"string","enum":["Detections","Quarantine","Endpoints","Assets","Events","Tasks","Executive","DeviceControl","Vulnerabilities","Cisa","Updates","Patch","DNS","CloudStorageDetections","AppBlock","Usage","PatchHistory","SoftwareUpdateHistory","CveEvents","EmailSecurity","MssMetrics","Firewall","Itdr","DriveEncryption","TrialSecurityAssessment"],"title":"Report type"},"format":{"type":"string","enum":["csv","pdf"],"title":"Report format"},"period":{"type":"integer","title":"Period for the report data","description":"Period for the report data. if 0 it must be selected when the report is manually generated","min":0},"units":{"type":"string","enum":["Days","Weeks","Months"],"title":"Unit for period"},"time_zone":{"type":"string","title":"Time Zone"},"recurrence":{"type":"object","nullable":true,"title":"Recurrence details","properties":{"days_of_month":{"type":"array","items":{"type":"integer","min":1,"max":31}},"days_of_week":{"type":"array","items":{"type":"string","enum":["Monday","Tuesday","Wednesday","Thursday","Friday","Saturday","Sunday"]}},"recur":{"type":"string","enum":["Daily","Weekly","Monthly"],"title":"Recurrence type"}}},"recipients":{"type":"array","title":"Email addresses of recipients","items":{"type":"string","format":"idn-email","title":"Email of a recipient"}},"email_subject":{"type":"string","title":"Report email subject"},"notes":{"type":"string","title":"Additional notes"},"meta":{"type":"object","properties":{"subtype":{"type":"string","description":"Report subtype for specific reports","enum":["Executive","Technical"]}}},"created_by":{"type":"string","title":"Created by user Id (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"updated_by":{"type":"string","title":"Updated by user Id (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"owner":{"type":"string","title":"Owner user Id (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"created_by_username":{"type":"string","title":"Created by username"},"created_by_email":{"type":"string","title":"Created by email"},"owner_username":{"type":"string","title":"Owner username"},"owner_email":{"type":"string","title":"Owner email"},"updated_by_username":{"type":"string","title":"Updated by username"},"updated_by_email":{"type":"string","title":"Updated by email"},"created_at":{"type":"string","title":"Created at","examples":["2021-03-16T15:31:48.241991Z"]},"updated_at":{"type":"string","title":"Updated at","examples":["2021-03-16T15:34:54.805926Z"]},"last_generation_at":{"type":"string","title":"Last generated at","examples":["2021-03-16T15:34:54.759098Z"]},"next_generation_at":{"type":"string","title":"Next generation scheduled at","nullable":true,"examples":["2021-03-16T15:34:54.759098Z"]}}},{"properties":{"account_ids":{"type":"array","default":[],"items":{"type":"string","format":"uuid","description":"Account ID"}},"all_sites_enabled":{"type":"boolean","default":false,"description":"Flag to indicate whether report is enabled for all sites"},"enabled":{"type":"boolean","description":"Flag to indicate whether the report is enabled"},"meta":{"type":"object","properties":{"aggregate":{"type":"boolean","description":"Flag to indicate whether report should aggregate selected sites"},"subtype":{"type":"string","description":"Report subtype for specific reports","enum":["Executive","Technical"]},"is_default_report":{"type":"boolean","description":"Flag to indicate whether report is default"}},"additionalProperties":false}}}]}}}}},"tags":["Reports"],"operationId":"api.rmm.post.reports"}},"/oneview/v1/accounts/{account_id}/reports/{id}/generate":{"post":{"description":"Generate report.","summary":"Generate report","security":[{"client_credentials":["write"]},{"user_permissions":["reports.createOwn"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":true,"in":"path","description":"ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":false,"in":"header","description":"Authorization token","schema":{"type":"string"}},{"name":"on-behalf-of","required":false,"in":"header","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"report Generate","properties":{"start":{"type":"string","format":"date-time","title":"Period start"},"end":{"type":"string","format":"date-time","title":"Period end"}}}}}},"responses":{"200":{"description":"Successful response"}},"tags":["Reports"],"operationId":"api.rmm.post.reports.generate"}},"/oneview/v1/accounts/{account_id}/content-filtering":{"post":{"description":"Create a new content filtering rule","summary":"Create content filtering rule","security":[{"client_credentials":["write"]},{"user_permissions":["dnsFiltering.createRule"]}],"status":{"outage":["auth"]},"parameters":[{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Create/Update content filtering rule request","required":["name","enabled"],"properties":{"name":{"type":"string","description":"Name of the content filtering rule","examples":["test_rule_1"]},"description":{"type":"string","description":"Description of the content filtering rule","examples":["This is a test rule"]},"security_categories":{"type":"array","description":"Security categories","items":{"type":"integer"},"examples":[[150,151,152,153]]},"content_categories":{"type":"array","description":"Content categories","items":{"type":"integer"},"examples":[[130,131,133,134,135]]},"allow_domains":{"type":"array","description":"List of allowed domains","items":{"type":"string"},"examples":[["ex.com","we.com","eee.com"]]},"block_domains":{"type":"array","description":"List of blocked domains","items":{"type":"string"},"examples":[["a.com","b.com","c.com"]]},"allow_ips":{"type":"array","description":"List of allowed IPs (IPV4 address or CIDR block)","items":{"type":"string"},"examples":[["10.20.20.0","192.168.0.0/24"]]},"block_ips":{"type":"array","description":"List of blocked IPs (IPV4 address or CIDR block)","items":{"type":"string"},"examples":[["10.20.30.40","192.168.10.0/24"]]},"block_tlds":{"type":"array","description":"Blocked Top Level Domains (TLDs)","items":{"type":"string"},"examples":[["pt"]]},"doh_url":{"type":"string","description":"DOH URL","examples":["abcdef.cloudflare.com"]},"policy_ids":{"type":"array","description":"List of policy IDs","items":{"type":"string"},"examples":[["575ec9d1-9ade-4a2b-98cd-d6b5e5ea63d7"]]},"enabled":{"type":"boolean","description":"Content filtering rule enabled/disabled status","examples":[true]}},"examples":[{"name":"test_rule_1","description":"This is a test rule","security_categories":[150,151,152,153],"content_categories":[130,131,133,134,135],"allow_domains":["ex.com","we.com","eee.com"],"block_domains":["a.com","b.com","c.com"],"allow_ips":["10.20.20.0","192.168.0.0/24"],"block_ips":["10.20.30.40","192.168.10.0/24"],"block_tlds":["pt"],"policy_ids":["575ec9d1-9ade-4a2b-98cd-d6b5e5ea63d7"],"enabled":true}]}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Content filtering rule","properties":{"id":{"type":"string","description":"Content filtering rule ID","examples":["a54d8a47-d802-49e3-88b9-e8eaf7d8f148"]},"account_id":{"type":"string","description":"Your account ID","examples":["550a20b8-6d36-4222-afbc-54d100f2e894"]},"parent_account_id":{"type":"string","description":"Parent account ID","examples":["550a20b8-6d36-4222-afbc-54d100f2e894"]},"name":{"type":"string","description":"Name of the content filtering rule","examples":["test_rule_1"]},"description":{"type":"string","description":"Description of the content filtering rule","examples":["This is a test rule"]},"security_categories":{"type":"array","description":"Security categories","items":{"type":"integer"},"examples":[[150,151,152,153]]},"content_categories":{"type":"array","description":"Content categories","items":{"type":"integer"},"examples":[[130,131,133,134,135]]},"allow_domains":{"type":"array","description":"Allow domains","items":{"type":"string"},"examples":[["ex.com","we.com","eee.com"]]},"block_domains":{"type":"array","description":"Block domains","items":{"type":"string"},"examples":[["a.com","b.com","c.com"]]},"allow_ips":{"type":"array","description":"List of allowed IPs (IPV4 address or CIDR block)","items":{"type":"string"},"examples":[["10.20.20.0","192.168.0.0/24"]]},"block_ips":{"type":"array","description":"List of blocked IPs (IPV4 address or CIDR block)","items":{"type":"string"},"examples":[["10.20.30.40","192.168.10.0/24"]]},"block_tlds":{"type":"array","description":"Blocked Top Level Domains (TLDs)","items":{"type":"string"},"examples":[["pt"]]},"doh_url":{"type":"string","description":"DOH URL","examples":["abcdef.cloudflare.com"]},"policies":{"type":"array","description":"Policies","items":{"type":"object","properties":{"policy_id":{"type":"string","description":"Policy ID"},"policy_name":{"type":"string","description":"Policy name"}}}},"created_at":{"type":"string","description":"Rule creation time","examples":["2022-03-22T11:04:30.977497Z"]},"created_by":{"type":"string","description":"Rule creator ID","examples":["d338949c-a186-4e06-aebe-67249e48a88c"]},"updated_at":{"type":"string","description":"Rule update time","examples":["2022-03-22T11:44:38.35927Z"]},"updated_by":{"type":"string","description":"Rule updated by","examples":["d338949c-a186-4e06-aebe-67249e48a88c"]},"enabled":{"type":"boolean","description":"Content filtering rule enabled/disabled status","examples":[true]}},"examples":[{"id":"a54d8a47-d802-49e3-88b9-e8eaf7d8f148","account_id":"550a20b8-6d36-4222-afbc-54d100f2e894","parent_account_id":"550a20b8-6d36-4222-afbc-54d100f2e894","name":"test_rule_1_modified","description":"This is a test rule","security_categories":[150,151,152,153],"content_categories":[1,2,3,4,5],"allow_domains":["ex.com","we.com","eee.com"],"block_domains":["a.com","b.com","c.com"],"allow_ips":["10.20.20.0","192.168.0.0/24"],"block_ips":["10.20.30.40","192.168.10.0/24"],"block_tlds":["pt"],"doh_url":"abcdef.cloudflare.com","policies":[{"policy_id":"59bd2afa-501c-41a5-aa8e-c5886b6c7f36","policy_name":"Policy Test"}],"created_at":"2022-03-22T11:04:30.977497Z","created_by":"d338949c-a186-4e06-aebe-67249e48a88c","updated_at":"2022-03-22T11:44:38.35927Z","updated_by":"d338949c-a186-4e06-aebe-67249e48a88c","enabled":true}]}}}}},"tags":["Content Filtering"],"operationId":"api.rmm.post.content_filtering_rule"}},"/oneview/v1/accounts/{account_id}/content-filtering/{id}":{"delete":{"description":"Delete a content filtering rule","summary":"Delete content filtering rule","security":[{"client_credentials":["write"]},{"user_permissions":["dnsFiltering.deleteRule"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":true,"in":"path","description":"ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"Successful response"}},"tags":["Content Filtering"],"operationId":"api.rmm.delete.content_filtering_rule"},"get":{"description":"Get a content filtering rule details by id","summary":"Get a content filtering rule details","security":[{"client_credentials":["read"]},{"user_permissions":["dnsFiltering.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":true,"in":"path","description":"ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Content filtering rule","properties":{"id":{"type":"string","description":"Content filtering rule ID","examples":["a54d8a47-d802-49e3-88b9-e8eaf7d8f148"]},"account_id":{"type":"string","description":"Your account ID","examples":["550a20b8-6d36-4222-afbc-54d100f2e894"]},"parent_account_id":{"type":"string","description":"Parent account ID","examples":["550a20b8-6d36-4222-afbc-54d100f2e894"]},"name":{"type":"string","description":"Name of the content filtering rule","examples":["test_rule_1"]},"description":{"type":"string","description":"Description of the content filtering rule","examples":["This is a test rule"]},"security_categories":{"type":"array","description":"Security categories","items":{"type":"integer"},"examples":[[150,151,152,153]]},"content_categories":{"type":"array","description":"Content categories","items":{"type":"integer"},"examples":[[130,131,133,134,135]]},"allow_domains":{"type":"array","description":"Allow domains","items":{"type":"string"},"examples":[["ex.com","we.com","eee.com"]]},"block_domains":{"type":"array","description":"Block domains","items":{"type":"string"},"examples":[["a.com","b.com","c.com"]]},"allow_ips":{"type":"array","description":"List of allowed IPs (IPV4 address or CIDR block)","items":{"type":"string"},"examples":[["10.20.20.0","192.168.0.0/24"]]},"block_ips":{"type":"array","description":"List of blocked IPs (IPV4 address or CIDR block)","items":{"type":"string"},"examples":[["10.20.30.40","192.168.10.0/24"]]},"block_tlds":{"type":"array","description":"Blocked Top Level Domains (TLDs)","items":{"type":"string"},"examples":[["pt"]]},"doh_url":{"type":"string","description":"DOH URL","examples":["abcdef.cloudflare.com"]},"policies":{"type":"array","description":"Policies","items":{"type":"object","properties":{"policy_id":{"type":"string","description":"Policy ID"},"policy_name":{"type":"string","description":"Policy name"}}}},"created_at":{"type":"string","description":"Rule creation time","examples":["2022-03-22T11:04:30.977497Z"]},"created_by":{"type":"string","description":"Rule creator ID","examples":["d338949c-a186-4e06-aebe-67249e48a88c"]},"updated_at":{"type":"string","description":"Rule update time","examples":["2022-03-22T11:44:38.35927Z"]},"updated_by":{"type":"string","description":"Rule updated by","examples":["d338949c-a186-4e06-aebe-67249e48a88c"]},"enabled":{"type":"boolean","description":"Content filtering rule enabled/disabled status","examples":[true]}},"examples":[{"id":"a54d8a47-d802-49e3-88b9-e8eaf7d8f148","account_id":"550a20b8-6d36-4222-afbc-54d100f2e894","parent_account_id":"550a20b8-6d36-4222-afbc-54d100f2e894","name":"test_rule_1_modified","description":"This is a test rule","security_categories":[150,151,152,153],"content_categories":[1,2,3,4,5],"allow_domains":["ex.com","we.com","eee.com"],"block_domains":["a.com","b.com","c.com"],"allow_ips":["10.20.20.0","192.168.0.0/24"],"block_ips":["10.20.30.40","192.168.10.0/24"],"block_tlds":["pt"],"doh_url":"abcdef.cloudflare.com","policies":[{"policy_id":"59bd2afa-501c-41a5-aa8e-c5886b6c7f36","policy_name":"Policy Test"}],"created_at":"2022-03-22T11:04:30.977497Z","created_by":"d338949c-a186-4e06-aebe-67249e48a88c","updated_at":"2022-03-22T11:44:38.35927Z","updated_by":"d338949c-a186-4e06-aebe-67249e48a88c","enabled":true}]}}}}},"tags":["Content Filtering"],"operationId":"api.rmm.get.content_filtering_rule.id"},"put":{"description":"Update a content filtering rule","summary":"Update content filtering rule","security":[{"client_credentials":["write"]},{"user_permissions":["dnsFiltering.editRule"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":true,"in":"path","description":"ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Create/Update content filtering rule request","required":["name","enabled"],"properties":{"name":{"type":"string","description":"Name of the content filtering rule","examples":["test_rule_1"]},"description":{"type":"string","description":"Description of the content filtering rule","examples":["This is a test rule"]},"security_categories":{"type":"array","description":"Security categories","items":{"type":"integer"},"examples":[[150,151,152,153]]},"content_categories":{"type":"array","description":"Content categories","items":{"type":"integer"},"examples":[[130,131,133,134,135]]},"allow_domains":{"type":"array","description":"List of allowed domains","items":{"type":"string"},"examples":[["ex.com","we.com","eee.com"]]},"block_domains":{"type":"array","description":"List of blocked domains","items":{"type":"string"},"examples":[["a.com","b.com","c.com"]]},"allow_ips":{"type":"array","description":"List of allowed IPs (IPV4 address or CIDR block)","items":{"type":"string"},"examples":[["10.20.20.0","192.168.0.0/24"]]},"block_ips":{"type":"array","description":"List of blocked IPs (IPV4 address or CIDR block)","items":{"type":"string"},"examples":[["10.20.30.40","192.168.10.0/24"]]},"block_tlds":{"type":"array","description":"Blocked Top Level Domains (TLDs)","items":{"type":"string"},"examples":[["pt"]]},"doh_url":{"type":"string","description":"DOH URL","examples":["abcdef.cloudflare.com"]},"policy_ids":{"type":"array","description":"List of policy IDs","items":{"type":"string"},"examples":[["575ec9d1-9ade-4a2b-98cd-d6b5e5ea63d7"]]},"enabled":{"type":"boolean","description":"Content filtering rule enabled/disabled status","examples":[true]}},"examples":[{"name":"test_rule_1","description":"This is a test rule","security_categories":[150,151,152,153],"content_categories":[130,131,133,134,135],"allow_domains":["ex.com","we.com","eee.com"],"block_domains":["a.com","b.com","c.com"],"allow_ips":["10.20.20.0","192.168.0.0/24"],"block_ips":["10.20.30.40","192.168.10.0/24"],"block_tlds":["pt"],"policy_ids":["575ec9d1-9ade-4a2b-98cd-d6b5e5ea63d7"],"enabled":true}]}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Content filtering rule","properties":{"id":{"type":"string","description":"Content filtering rule ID","examples":["a54d8a47-d802-49e3-88b9-e8eaf7d8f148"]},"account_id":{"type":"string","description":"Your account ID","examples":["550a20b8-6d36-4222-afbc-54d100f2e894"]},"parent_account_id":{"type":"string","description":"Parent account ID","examples":["550a20b8-6d36-4222-afbc-54d100f2e894"]},"name":{"type":"string","description":"Name of the content filtering rule","examples":["test_rule_1"]},"description":{"type":"string","description":"Description of the content filtering rule","examples":["This is a test rule"]},"security_categories":{"type":"array","description":"Security categories","items":{"type":"integer"},"examples":[[150,151,152,153]]},"content_categories":{"type":"array","description":"Content categories","items":{"type":"integer"},"examples":[[130,131,133,134,135]]},"allow_domains":{"type":"array","description":"Allow domains","items":{"type":"string"},"examples":[["ex.com","we.com","eee.com"]]},"block_domains":{"type":"array","description":"Block domains","items":{"type":"string"},"examples":[["a.com","b.com","c.com"]]},"allow_ips":{"type":"array","description":"List of allowed IPs (IPV4 address or CIDR block)","items":{"type":"string"},"examples":[["10.20.20.0","192.168.0.0/24"]]},"block_ips":{"type":"array","description":"List of blocked IPs (IPV4 address or CIDR block)","items":{"type":"string"},"examples":[["10.20.30.40","192.168.10.0/24"]]},"block_tlds":{"type":"array","description":"Blocked Top Level Domains (TLDs)","items":{"type":"string"},"examples":[["pt"]]},"doh_url":{"type":"string","description":"DOH URL","examples":["abcdef.cloudflare.com"]},"policies":{"type":"array","description":"Policies","items":{"type":"object","properties":{"policy_id":{"type":"string","description":"Policy ID"},"policy_name":{"type":"string","description":"Policy name"}}}},"created_at":{"type":"string","description":"Rule creation time","examples":["2022-03-22T11:04:30.977497Z"]},"created_by":{"type":"string","description":"Rule creator ID","examples":["d338949c-a186-4e06-aebe-67249e48a88c"]},"updated_at":{"type":"string","description":"Rule update time","examples":["2022-03-22T11:44:38.35927Z"]},"updated_by":{"type":"string","description":"Rule updated by","examples":["d338949c-a186-4e06-aebe-67249e48a88c"]},"enabled":{"type":"boolean","description":"Content filtering rule enabled/disabled status","examples":[true]}},"examples":[{"id":"a54d8a47-d802-49e3-88b9-e8eaf7d8f148","account_id":"550a20b8-6d36-4222-afbc-54d100f2e894","parent_account_id":"550a20b8-6d36-4222-afbc-54d100f2e894","name":"test_rule_1_modified","description":"This is a test rule","security_categories":[150,151,152,153],"content_categories":[1,2,3,4,5],"allow_domains":["ex.com","we.com","eee.com"],"block_domains":["a.com","b.com","c.com"],"allow_ips":["10.20.20.0","192.168.0.0/24"],"block_ips":["10.20.30.40","192.168.10.0/24"],"block_tlds":["pt"],"doh_url":"abcdef.cloudflare.com","policies":[{"policy_id":"59bd2afa-501c-41a5-aa8e-c5886b6c7f36","policy_name":"Policy Test"}],"created_at":"2022-03-22T11:04:30.977497Z","created_by":"d338949c-a186-4e06-aebe-67249e48a88c","updated_at":"2022-03-22T11:44:38.35927Z","updated_by":"d338949c-a186-4e06-aebe-67249e48a88c","enabled":true}]}}}}},"tags":["Content Filtering"],"operationId":"api.rmm.put.content_filtering_rule"}},"/oneview/v1/accounts/{account_id}/content-filtering/{id}/enable":{"put":{"description":"Enable/Disable a content filtering rule","summary":"Enable/Disable content filtering rule","security":[{"client_credentials":["write"]},{"user_permissions":["dnsFiltering.editRule"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":true,"in":"path","description":"ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Enable/Disable content filtering rule","required":["enabled"],"properties":{"enabled":{"type":"boolean","description":"Enable/Disable content filtering rule"}},"examples":[{"enabled":"true"}]}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Enable/Disable content filtering rule","required":["dns_rule_id","enabled"],"properties":{"dns_rule_id":{"type":"string","description":"Content filtering rule ID"},"enabled":{"type":"boolean","description":"Enable/Disable content filtering rule"}},"examples":[{"dns_rule_id":"6fab50d8-4c75-4a03-9549-66f147fcf093","enabled":true}]}}}}},"tags":["Content Filtering"],"operationId":"api.rmm.enable.content_filtering_rule"}},"/oneview/v1/accounts/{account_id}/content-filtering/{id}/enable-for-policy":{"put":{"description":"Enable/Disable a content filtering rule for a Nebula policy","summary":"Enable/Disable content filtering rule for policy","security":[{"client_credentials":["write"]},{"user_permissions":["dnsFiltering.editRule"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":true,"in":"path","description":"ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Enable/Disable content filtering rule","required":["enabled"],"properties":{"enabled":{"type":"boolean","description":"Enable/Disable content filtering rule"}},"examples":[{"enabled":"true"}]}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Enable/Disable content filtering rule for a nebula policy","required":["policy_id","enabled"],"properties":{"policy_id":{"type":"string","description":"Policy ID"},"enabled":{"type":"boolean","description":"Enable/Disable content filtering rule for a nebula policy"}},"examples":[{"policy_id":"575ec9d1-9ade-4a2b-98cd-d6b5e5ea63d7","enabled":"true"}]}}}}},"tags":["Content Filtering"],"operationId":"api.rmm.enable.content_filtering_rule.policy"}},"/oneview/v1/accounts/{account_id}/content-filtering/categories":{"get":{"description":"Get a collection of DNS content filtering categories with detailed information, including id, name, description and the respective list of subcategories.","summary":"Get list of categories","security":[{"client_credentials":["read"]},{"user_permissions":["dnsFiltering.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Content filtering categories","properties":{"categories":{"type":"array","description":"Collection of content filtering categories.","items":{"type":"object","title":"Content filtering category","properties":{"id":{"type":"integer","description":"Category ID","examples":[1]},"name":{"type":"string","description":"Category name","examples":["Ads"]},"description":{"type":"string","description":"Category description","examples":["Sites that are providing ads for websites."]},"subcategories":{"type":"array","description":"Subcategories of this category","items":{"type":"object","properties":{"id":{"type":"integer","description":"Subcategory ID","examples":[66]},"name":{"type":"string","description":"Subcategory name","examples":["Advertisements"]},"description":{"type":"string","description":"Subcategory Description","examples":["Sites displaying advertisements for websites."]}}}}},"examples":[{"description":"Sites that are providing ads for websites.","id":1,"name":"Ads","subcategories":[{"description":"Sites displaying advertisements for websites.","id":66,"name":"Advertisements"}]}]}}},"examples":[{"categories":[{"description":"Sites that are providing ads for websites.","id":1,"name":"Ads","subcategories":[{"description":"Sites displaying advertisements for websites.","id":66,"name":"Advertisements"}]},{"description":"Sites that are related to pornography, nudity, sexuality, and other adult themes.","id":2,"name":"Adult Themes","subcategories":[{"description":"Sites related to adult themes not included in other categories like Pornography and Nudity.","id":67,"name":"Adult Themes"},{"description":"Sites displaying nudity.","id":125,"name":"Nudity"},{"description":"Sites displaying pornography.","id":133,"name":"Pornography"}]}]}]}}}}},"tags":["Content Filtering"],"operationId":"api.rmm.get.content_filtering_categories"}},"/oneview/v1/content-filtering":{"post":{"description":"Get a list of content filtering rules for current account","summary":"Get a list of content filtering rules","security":[{"client_credentials":["read"]},{"user_permissions":["dnsFiltering.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","description":"Request body for getting all content filtering rules","required":["account_ids"],"properties":{"populate":{"type":"object","title":"Populate object schema","properties":{"users":{"type":"boolean","title":"Populate with the user email"}}},"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}},"page_size":{"type":"number","title":"The size of the page","minimum":1,"maximum":2000},"next_cursor":{"type":"string","title":"The cursor for the next page"}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Content filtering rules and their total count","properties":{"content_filtering_rules":{"type":"array","description":"Collection of content filtering rules","items":{"type":"object","title":"Content filtering rule","properties":{"id":{"type":"string","description":"Content filtering rule ID","examples":["a54d8a47-d802-49e3-88b9-e8eaf7d8f148"]},"account_id":{"type":"string","description":"Your account ID","examples":["550a20b8-6d36-4222-afbc-54d100f2e894"]},"parent_account_id":{"type":"string","description":"Parent account ID","examples":["550a20b8-6d36-4222-afbc-54d100f2e894"]},"name":{"type":"string","description":"Name of the content filtering rule","examples":["test_rule_1"]},"description":{"type":"string","description":"Description of the content filtering rule","examples":["This is a test rule"]},"security_categories":{"type":"array","description":"Security categories","items":{"type":"integer"},"examples":[[150,151,152,153]]},"content_categories":{"type":"array","description":"Content categories","items":{"type":"integer"},"examples":[[130,131,133,134,135]]},"allow_domains":{"type":"array","description":"Allow domains","items":{"type":"string"},"examples":[["ex.com","we.com","eee.com"]]},"block_domains":{"type":"array","description":"Block domains","items":{"type":"string"},"examples":[["a.com","b.com","c.com"]]},"allow_ips":{"type":"array","description":"List of allowed IPs (IPV4 address or CIDR block)","items":{"type":"string"},"examples":[["10.20.20.0","192.168.0.0/24"]]},"block_ips":{"type":"array","description":"List of blocked IPs (IPV4 address or CIDR block)","items":{"type":"string"},"examples":[["10.20.30.40","192.168.10.0/24"]]},"block_tlds":{"type":"array","description":"Blocked Top Level Domains (TLDs)","items":{"type":"string"},"examples":[["pt"]]},"doh_url":{"type":"string","description":"DOH URL","examples":["abcdef.cloudflare.com"]},"policies":{"type":"array","description":"Policies","items":{"type":"object","properties":{"policy_id":{"type":"string","description":"Policy ID"},"policy_name":{"type":"string","description":"Policy name"}}}},"created_at":{"type":"string","description":"Rule creation time","examples":["2022-03-22T11:04:30.977497Z"]},"created_by":{"type":"string","description":"Rule creator ID","examples":["d338949c-a186-4e06-aebe-67249e48a88c"]},"updated_at":{"type":"string","description":"Rule update time","examples":["2022-03-22T11:44:38.35927Z"]},"updated_by":{"type":"string","description":"Rule updated by","examples":["d338949c-a186-4e06-aebe-67249e48a88c"]},"enabled":{"type":"boolean","description":"Content filtering rule enabled/disabled status","examples":[true]}},"examples":[{"id":"a54d8a47-d802-49e3-88b9-e8eaf7d8f148","account_id":"550a20b8-6d36-4222-afbc-54d100f2e894","parent_account_id":"550a20b8-6d36-4222-afbc-54d100f2e894","name":"test_rule_1_modified","description":"This is a test rule","security_categories":[150,151,152,153],"content_categories":[1,2,3,4,5],"allow_domains":["ex.com","we.com","eee.com"],"block_domains":["a.com","b.com","c.com"],"allow_ips":["10.20.20.0","192.168.0.0/24"],"block_ips":["10.20.30.40","192.168.10.0/24"],"block_tlds":["pt"],"doh_url":"abcdef.cloudflare.com","policies":[{"policy_id":"59bd2afa-501c-41a5-aa8e-c5886b6c7f36","policy_name":"Policy Test"}],"created_at":"2022-03-22T11:04:30.977497Z","created_by":"d338949c-a186-4e06-aebe-67249e48a88c","updated_at":"2022-03-22T11:44:38.35927Z","updated_by":"d338949c-a186-4e06-aebe-67249e48a88c","enabled":true}]}},"total_count":{"$type":"integer","description":"Total count of rules"}},"examples":[{"content_filtering_rules":[{"id":"718d94e9-cc90-474c-a483-134fbc2268cd","account_id":"f29c5663-100a-4cd5-a5c3-b9a45e67ad21","parent_account_id":"f29c5663-100a-4cd5-a5c3-b9a45e67ad21","name":"test1","description":"this is a test rule","security_categories":[150,151,152,153],"content_categories":[130,131,133,134,135],"allow_domains":["ex.com","we.com","eee.com"],"block_domains":["a.com","b.com","c.com"],"block_ips":["10.20.30.40","192.168.10.0/24"],"block_tlds":["pt"],"enabled":false,"created_at":"2022-03-22T11:04:30.977497Z","created_by":"d338949c-a186-4e06-aebe-67249e48a88c","updated_at":"2022-03-22T11:44:38.35927Z","updated_by":"d338949c-a186-4e06-aebe-67249e48a88c"},{"id":"0c9d6c60-53ee-412b-81f7-4244a4e6d115","account_id":"f29c5663-100a-4cd5-a5c3-b9a45e67ad21","parent_account_id":"f29c5663-100a-4cd5-a5c3-b9a45e67ad21","name":"test10","description":"this is a test rule","security_categories":[150,151,152,153],"content_categories":[130,131,133,134,135],"allow_domains":["ex.com","we.com","eee.com"],"block_domains":["a.com","b.com","c.com"],"block_ips":["10.20.30.40","192.168.10.0/24"],"block_tlds":["actor"],"doh_url":"https://jqt5h6pzfd.cloudflare-gateway.com/dns-query","enabled":false,"created_at":"2022-03-22T11:04:30.977497Z","created_by":"d338949c-a186-4e06-aebe-67249e48a88c"},{"id":"be7b7c91-2371-478d-bf9d-7daa704d290d","account_id":"f29c5663-100a-4cd5-a5c3-b9a45e67ad21","parent_account_id":"f29c5663-100a-4cd5-a5c3-b9a45e67ad21","name":"test11","description":"this is a test rule","security_categories":[150,151,152,153],"content_categories":[130,131,133,134,135],"allow_domains":["ex.com","we.com","eee.com"],"block_domains":["a.com","b.com","c.com"],"block_ips":["10.20.30.40","192.168.10.0/24"],"block_tlds":["ceb"],"allow_ips":["10.20.20.0","192.168.0.0/24"],"doh_url":"https://rddpnori5n.cloudflare-gateway.com/dns-query","enabled":false,"created_at":"2022-03-22T11:04:30.977497Z","created_by":"d338949c-a186-4e06-aebe-67249e48a88c"},{"id":"6fab50d8-4c75-4a03-9549-66f147fcf093","account_id":"f29c5663-100a-4cd5-a5c3-b9a45e67ad21","parent_account_id":"f29c5663-100a-4cd5-a5c3-b9a45e67ad21","name":"test12","description":"this is a test rule","security_categories":[150,151,152,153],"content_categories":[130,131,133,134,135],"allow_domains":["ex.com","we.com","eee.com"],"block_domains":["a.com","b.com","c.com"],"block_ips":["10.20.30.40","192.168.10.0/24"],"doh_url":"https://y8i1259oyo.cloudflare-gateway.com/dns-query","enabled":true,"created_at":"2022-03-22T11:04:30.977497Z","created_by":"d338949c-a186-4e06-aebe-67249e48a88c"}],"total_count":15}]}}}}},"tags":["Content Filtering"],"operationId":"api.rmm.get.content_filtering_rules"}},"/oneview/v1/accounts/{account_id}/content-filtering/blockpage":{"get":{"description":"Get DNS Blockpage settings for account","summary":"Get DNS BlockPage Settings","security":[{"client_credentials":["read"]},{"user_permissions":["dnsFiltering.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}},{"name":"populate_users","required":false,"in":"query","schema":{"type":"boolean"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"DNS Blockpage Settings","properties":{"id":{"type":"string","description":"BlockPage identifier"},"account_id":{"type":"string","description":"BlockPage account identifier"},"enabled":{"type":"boolean","description":"Enabled"},"inherited":{"type":"boolean","description":"Inherited from a parent account"},"footer_text":{"type":"string","description":"Footer text"},"header_text":{"type":"string","description":"Header text"},"logo_path":{"type":"string","description":"Logo path","format":"uri"},"background_color":{"type":"string","description":"Background color"},"name":{"type":"string","description":"Name"},"mailto_address":{"type":"string","description":"Mailto address"},"mailto_subject":{"type":"string","description":"Mailto subject"},"created_at":{"type":"string","description":"Created date"},"updated_at":{"type":"string","description":"Updated date"},"created_by":{"type":"string","description":"User that created the BlockPage"},"updated_by":{"type":"string","description":"User that last updated the BlockPage"}},"examples":[{"id":"9432a6c0-262c-4ea8-8a23-ee19cbe580dd","account_id":"d4048783-6ba2-4f33-a4b4-f90dd06e8609","inherited":false,"enabled":true,"footer_text":"This site has been blocked by Malwarebytes Content Filtering per your organization.","header_text":"This is a test","logo_path":"https://eml.malwarebytes.com/mailer/MWB_logo.png","background_color":"#ffffff","name":"Malwarebytes","mailto_address":"admin@mail.com","mailto_subject":"Your custom subject","created_at":"2022-04-26T16:18:40.629491Z","updated_at":"2025-02-07T14:50:38.019689Z","created_by":"f7b21a15-557e-4458-afd2-e7cf74ec20b8","updated_by":"846aa1f3-abe3-4e54-b5c6-0fec92913a27"}]}}}}},"tags":["Content Filtering"],"operationId":"api.rmm.get.content_filtering_blockpage"},"put":{"description":"Save DNS Blockpage settings for account","summary":"Save DNS BlockPage Settings","security":[{"client_credentials":["write"]},{"user_permissions":["dnsFiltering.editRule"]}],"status":{"outage":["auth"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}},{"name":"populate_users","required":false,"in":"query","schema":{"type":"boolean"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"DNS BlockPage Settings","required":["enabled","footer_text","header_text","logo_path","background_color","name","mailto_address","mailto_subject"],"properties":{"enabled":{"type":"boolean","description":"Enabled"},"inherited":{"type":"boolean","description":"Set to true to inherit the BlockPage from a parent account"},"footer_text":{"type":"string","description":"Footer text"},"header_text":{"type":"string","description":"Header text"},"logo_path":{"type":"string","description":"Logo path","format":"uri"},"background_color":{"type":"string","description":"Background color"},"name":{"type":"string","description":"Name"},"mailto_address":{"type":"string","description":"Mailto address"},"mailto_subject":{"type":"string","description":"Mailto subject"}},"examples":[{"id":"9432a6c0-262c-4ea8-8a23-ee19cbe580dd","account_id":"d4048783-6ba2-4f33-a4b4-f90dd06e8609","enabled":true,"footer_text":"This site has been blocked by Malwarebytes Content Filtering per your organization.","header_text":"This is a test","logo_path":"https://eml.malwarebytes.com/mailer/MWB_logo.png","background_color":"#ffffff","name":"Malwarebytes","mailto_address":"pchaves@mail.com","mailto_subject":"Your custom subject"}]}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"DNS Blockpage Settings","properties":{"id":{"type":"string","description":"BlockPage identifier"},"account_id":{"type":"string","description":"BlockPage account identifier"},"enabled":{"type":"boolean","description":"Enabled"},"inherited":{"type":"boolean","description":"Inherited from a parent account"},"footer_text":{"type":"string","description":"Footer text"},"header_text":{"type":"string","description":"Header text"},"logo_path":{"type":"string","description":"Logo path","format":"uri"},"background_color":{"type":"string","description":"Background color"},"name":{"type":"string","description":"Name"},"mailto_address":{"type":"string","description":"Mailto address"},"mailto_subject":{"type":"string","description":"Mailto subject"},"created_at":{"type":"string","description":"Created date"},"updated_at":{"type":"string","description":"Updated date"},"created_by":{"type":"string","description":"User that created the BlockPage"},"updated_by":{"type":"string","description":"User that last updated the BlockPage"}},"examples":[{"id":"9432a6c0-262c-4ea8-8a23-ee19cbe580dd","account_id":"d4048783-6ba2-4f33-a4b4-f90dd06e8609","inherited":false,"enabled":true,"footer_text":"This site has been blocked by Malwarebytes Content Filtering per your organization.","header_text":"This is a test","logo_path":"https://eml.malwarebytes.com/mailer/MWB_logo.png","background_color":"#ffffff","name":"Malwarebytes","mailto_address":"admin@mail.com","mailto_subject":"Your custom subject","created_at":"2022-04-26T16:18:40.629491Z","updated_at":"2025-02-07T14:50:38.019689Z","created_by":"f7b21a15-557e-4458-afd2-e7cf74ec20b8","updated_by":"846aa1f3-abe3-4e54-b5c6-0fec92913a27"}]}}}}},"tags":["Content Filtering"],"operationId":"api.rmm.put.content_filtering_blockpage"}},"/oneview/v1/accounts/{account_id}/content-filtering/exclusions":{"get":{"description":"Get DNS Global Exclusions for account","summary":"Get DNS Global Exclusions","security":[{"client_credentials":["read"]},{"user_permissions":["dnsFiltering.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}},{"name":"populate_users","required":false,"in":"query","schema":{"type":"boolean"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"DNS Global Exclusions","properties":{"id":{"type":"string","description":"Exclusion Identifier"},"account_id":{"type":"string","description":"Account Identifier"},"exclusions":{"type":"array","title":"The global exclusions array","items":{"type":"string","title":"Exclusion Domains","pattern":"^(?!://)([a-zA-Z0-9-_]{1,63}.)+[a-zA-Z]{2,63}$","examples":["example.com"]}},"created_at":{"type":"string","description":"Created date"},"updated_at":{"type":"string","description":"Updated date"},"created_by":{"type":"string","description":"User that created the exclusions"},"updated_by":{"type":"string","description":"User that last updated the exclusions"}},"examples":[{"id":"c85e25f8-9e84-4a75-b8c2-c118d9df2424","account_id":"d4048783-6ba2-4f33-a4b4-f90dd06e8609","exclusions":["test.com"],"created_at":"2022-04-26T16:18:40.629491Z","updated_at":"2025-02-07T14:50:38.019689Z","created_by":"f7b21a15-557e-4458-afd2-e7cf74ec20b8","updated_by":"846aa1f3-abe3-4e54-b5c6-0fec92913a27"}]}}}}},"tags":["Content Filtering"],"operationId":"api.rmm.get.content_filtering_exclusions"},"put":{"description":"Save DNS Global Exclusions for account","summary":"Save DNS Global Exclusions","security":[{"client_credentials":["write"]},{"user_permissions":["dnsFiltering.editRule"]}],"status":{"outage":["auth"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}},{"name":"populate_users","required":false,"in":"query","schema":{"type":"boolean"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"DNS Global Exclusions","required":["exclusions"],"properties":{"exclusions":{"type":"array","title":"The global exclusions array","items":{"type":"string","title":"Exclusion Domains","pattern":"^(?!://)([a-zA-Z0-9-_]{1,63}.)+[a-zA-Z]{2,63}$","examples":["example.com"]}}},"examples":[{"exclusions":["test.com"]}]}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"DNS Global Exclusions","properties":{"id":{"type":"string","description":"Exclusion Identifier"},"account_id":{"type":"string","description":"Account Identifier"},"exclusions":{"type":"array","title":"The global exclusions array","items":{"type":"string","title":"Exclusion Domains","pattern":"^(?!://)([a-zA-Z0-9-_]{1,63}.)+[a-zA-Z]{2,63}$","examples":["example.com"]}},"created_at":{"type":"string","description":"Created date"},"updated_at":{"type":"string","description":"Updated date"},"created_by":{"type":"string","description":"User that created the exclusions"},"updated_by":{"type":"string","description":"User that last updated the exclusions"}},"examples":[{"id":"c85e25f8-9e84-4a75-b8c2-c118d9df2424","account_id":"d4048783-6ba2-4f33-a4b4-f90dd06e8609","exclusions":["test.com"],"created_at":"2022-04-26T16:18:40.629491Z","updated_at":"2025-02-07T14:50:38.019689Z","created_by":"f7b21a15-557e-4458-afd2-e7cf74ec20b8","updated_by":"846aa1f3-abe3-4e54-b5c6-0fec92913a27"}]}}}}},"tags":["Content Filtering"],"operationId":"api.rmm.put.content_filtering_exclusions"}},"/oneview/v1/accounts/{account_id}/content-filtering/domain":{"get":{"description":"Get domain details","summary":"Get domain details","security":[{"client_credentials":["read"]},{"user_permissions":["dnsFiltering.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"Successful response"}},"tags":["Content Filtering"],"operationId":"api.rmm.get.domain"}},"/oneview/v1/accounts/{account_id}/content-filtering/frequent-domains":{"get":{"description":"Get frequently used domain names","summary":"Get frequently used domain names","security":[{"client_credentials":["read"]},{"user_permissions":["dnsFiltering.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Domain Names","properties":{"domains":{"type":"array","items":{"type":"string","description":"Frequent domains"}}},"examples":[{"domains":["a.com","b.com","c.com","eee.com","ex.com","we.com"]}]}}}}},"tags":["Content Filtering"],"operationId":"api.rmm.get.frequent.domains"}},"/oneview/v1/accounts/{account_id}/content-filtering/policies":{"get":{"description":"Get list of policies","summary":"Get list of policies","security":[{"client_credentials":["read"]},{"user_permissions":["dnsFiltering.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Content filtering rules and their total count","properties":{"content_filtering_rules":{"type":"array","description":"Collection of content filtering rules","items":{"type":"object","title":"Content filtering rule","properties":{"id":{"type":"string","description":"Content filtering rule ID","examples":["a54d8a47-d802-49e3-88b9-e8eaf7d8f148"]},"account_id":{"type":"string","description":"Your account ID","examples":["550a20b8-6d36-4222-afbc-54d100f2e894"]},"parent_account_id":{"type":"string","description":"Parent account ID","examples":["550a20b8-6d36-4222-afbc-54d100f2e894"]},"name":{"type":"string","description":"Name of the content filtering rule","examples":["test_rule_1"]},"description":{"type":"string","description":"Description of the content filtering rule","examples":["This is a test rule"]},"security_categories":{"type":"array","description":"Security categories","items":{"type":"integer"},"examples":[[150,151,152,153]]},"content_categories":{"type":"array","description":"Content categories","items":{"type":"integer"},"examples":[[130,131,133,134,135]]},"allow_domains":{"type":"array","description":"Allow domains","items":{"type":"string"},"examples":[["ex.com","we.com","eee.com"]]},"block_domains":{"type":"array","description":"Block domains","items":{"type":"string"},"examples":[["a.com","b.com","c.com"]]},"allow_ips":{"type":"array","description":"List of allowed IPs (IPV4 address or CIDR block)","items":{"type":"string"},"examples":[["10.20.20.0","192.168.0.0/24"]]},"block_ips":{"type":"array","description":"List of blocked IPs (IPV4 address or CIDR block)","items":{"type":"string"},"examples":[["10.20.30.40","192.168.10.0/24"]]},"block_tlds":{"type":"array","description":"Blocked Top Level Domains (TLDs)","items":{"type":"string"},"examples":[["pt"]]},"doh_url":{"type":"string","description":"DOH URL","examples":["abcdef.cloudflare.com"]},"policies":{"type":"array","description":"Policies","items":{"type":"object","properties":{"policy_id":{"type":"string","description":"Policy ID"},"policy_name":{"type":"string","description":"Policy name"}}}},"created_at":{"type":"string","description":"Rule creation time","examples":["2022-03-22T11:04:30.977497Z"]},"created_by":{"type":"string","description":"Rule creator ID","examples":["d338949c-a186-4e06-aebe-67249e48a88c"]},"updated_at":{"type":"string","description":"Rule update time","examples":["2022-03-22T11:44:38.35927Z"]},"updated_by":{"type":"string","description":"Rule updated by","examples":["d338949c-a186-4e06-aebe-67249e48a88c"]},"enabled":{"type":"boolean","description":"Content filtering rule enabled/disabled status","examples":[true]}},"examples":[{"id":"a54d8a47-d802-49e3-88b9-e8eaf7d8f148","account_id":"550a20b8-6d36-4222-afbc-54d100f2e894","parent_account_id":"550a20b8-6d36-4222-afbc-54d100f2e894","name":"test_rule_1_modified","description":"This is a test rule","security_categories":[150,151,152,153],"content_categories":[1,2,3,4,5],"allow_domains":["ex.com","we.com","eee.com"],"block_domains":["a.com","b.com","c.com"],"allow_ips":["10.20.20.0","192.168.0.0/24"],"block_ips":["10.20.30.40","192.168.10.0/24"],"block_tlds":["pt"],"doh_url":"abcdef.cloudflare.com","policies":[{"policy_id":"59bd2afa-501c-41a5-aa8e-c5886b6c7f36","policy_name":"Policy Test"}],"created_at":"2022-03-22T11:04:30.977497Z","created_by":"d338949c-a186-4e06-aebe-67249e48a88c","updated_at":"2022-03-22T11:44:38.35927Z","updated_by":"d338949c-a186-4e06-aebe-67249e48a88c","enabled":true}]}},"total_count":{"$type":"integer","description":"Total count of rules"}},"examples":[{"content_filtering_rules":[{"id":"718d94e9-cc90-474c-a483-134fbc2268cd","account_id":"f29c5663-100a-4cd5-a5c3-b9a45e67ad21","parent_account_id":"f29c5663-100a-4cd5-a5c3-b9a45e67ad21","name":"test1","description":"this is a test rule","security_categories":[150,151,152,153],"content_categories":[130,131,133,134,135],"allow_domains":["ex.com","we.com","eee.com"],"block_domains":["a.com","b.com","c.com"],"block_ips":["10.20.30.40","192.168.10.0/24"],"block_tlds":["pt"],"enabled":false,"created_at":"2022-03-22T11:04:30.977497Z","created_by":"d338949c-a186-4e06-aebe-67249e48a88c","updated_at":"2022-03-22T11:44:38.35927Z","updated_by":"d338949c-a186-4e06-aebe-67249e48a88c"},{"id":"0c9d6c60-53ee-412b-81f7-4244a4e6d115","account_id":"f29c5663-100a-4cd5-a5c3-b9a45e67ad21","parent_account_id":"f29c5663-100a-4cd5-a5c3-b9a45e67ad21","name":"test10","description":"this is a test rule","security_categories":[150,151,152,153],"content_categories":[130,131,133,134,135],"allow_domains":["ex.com","we.com","eee.com"],"block_domains":["a.com","b.com","c.com"],"block_ips":["10.20.30.40","192.168.10.0/24"],"block_tlds":["actor"],"doh_url":"https://jqt5h6pzfd.cloudflare-gateway.com/dns-query","enabled":false,"created_at":"2022-03-22T11:04:30.977497Z","created_by":"d338949c-a186-4e06-aebe-67249e48a88c"},{"id":"be7b7c91-2371-478d-bf9d-7daa704d290d","account_id":"f29c5663-100a-4cd5-a5c3-b9a45e67ad21","parent_account_id":"f29c5663-100a-4cd5-a5c3-b9a45e67ad21","name":"test11","description":"this is a test rule","security_categories":[150,151,152,153],"content_categories":[130,131,133,134,135],"allow_domains":["ex.com","we.com","eee.com"],"block_domains":["a.com","b.com","c.com"],"block_ips":["10.20.30.40","192.168.10.0/24"],"block_tlds":["ceb"],"allow_ips":["10.20.20.0","192.168.0.0/24"],"doh_url":"https://rddpnori5n.cloudflare-gateway.com/dns-query","enabled":false,"created_at":"2022-03-22T11:04:30.977497Z","created_by":"d338949c-a186-4e06-aebe-67249e48a88c"},{"id":"6fab50d8-4c75-4a03-9549-66f147fcf093","account_id":"f29c5663-100a-4cd5-a5c3-b9a45e67ad21","parent_account_id":"f29c5663-100a-4cd5-a5c3-b9a45e67ad21","name":"test12","description":"this is a test rule","security_categories":[150,151,152,153],"content_categories":[130,131,133,134,135],"allow_domains":["ex.com","we.com","eee.com"],"block_domains":["a.com","b.com","c.com"],"block_ips":["10.20.30.40","192.168.10.0/24"],"doh_url":"https://y8i1259oyo.cloudflare-gateway.com/dns-query","enabled":true,"created_at":"2022-03-22T11:04:30.977497Z","created_by":"d338949c-a186-4e06-aebe-67249e48a88c"}],"total_count":15}]}}}}},"tags":["Content Filtering"],"operationId":"api.rmm.get.content_filtering_rule_policies"}},"/oneview/v1/accounts/{account_id}/content-filtering/tlds":{"get":{"description":"Get all known top level domains (TLDs)","summary":"Get Top Level Domains","security":[{"client_credentials":["read"]},{"user_permissions":["dnsFiltering.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Content filtering Top Level Domains","properties":{"tlds":{"type":"array","description":"Collection of all known Top Level Domains (TLDs)","items":{"type":"object","title":"Content filtering Top Level Domain (TLD)","properties":{"domain":{"type":"string","description":"Domain name","examples":["pt"]},"domain_type":{"type":"string","description":"Domain Type","examples":["country-code"]},"entity":{"type":"string","description":"Domain Entity","examples":["Canada"]}},"examples":[{"Domain":"aaa","DomainType":"generic","Entity":"American Automobile Association, Inc."},{"Domain":"aarp","DomainType":"generic","Entity":"AARP"},{"Domain":"abarth","DomainType":"generic","Entity":"Not assigned"},{"Domain":"pt","DomainType":"country-code","Entity":"Portugal"}]}}},"examples":[{"tlds":[{"Domain":"aaa","DomainType":"generic","Entity":"American Automobile Association, Inc."},{"Domain":"aarp","DomainType":"generic","Entity":"AARP"},{"Domain":"abarth","DomainType":"generic","Entity":"Not assigned"},{"Domain":"pt","DomainType":"country-code","Entity":"Portugal"}]}]}}}}},"tags":["Content Filtering"],"operationId":"api.rmm.get.content_filtering_tlds"}},"/oneview/v1/content-filtering/blockpage":{"post":{"description":"Search DNS blockPages for a given set of accounts","summary":"Search DNS blockPages for accounts","security":[{"client_credentials":["read"]},{"user_permissions":["dnsFiltering.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Get BlockPage Settings for multiple account ids","required":["account_ids"],"properties":{"account_ids":{"type":"array","minItems":1,"title":"The account ids","items":{"type":"string","title":"Account id items","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}},"page_size":{"type":"number","title":"The size of the page","minimum":1,"default":100,"maximum":2000},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]},"populate":{"type":"object","title":"Populate object schema","properties":{"users":{"type":"boolean","title":"Populate with the user email"}}}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"title":"Get BlockPage settings by account","type":"object","properties":{"exclusions":{"type":"array","title":"BlockPages","items":{"type":"object","title":"DNS Blockpage Settings","properties":{"id":{"type":"string","description":"BlockPage identifier"},"account_id":{"type":"string","description":"BlockPage account identifier"},"enabled":{"type":"boolean","description":"Enabled"},"inherited":{"type":"boolean","description":"Inherited from a parent account"},"footer_text":{"type":"string","description":"Footer text"},"header_text":{"type":"string","description":"Header text"},"logo_path":{"type":"string","description":"Logo path","format":"uri"},"background_color":{"type":"string","description":"Background color"},"name":{"type":"string","description":"Name"},"mailto_address":{"type":"string","description":"Mailto address"},"mailto_subject":{"type":"string","description":"Mailto subject"},"created_at":{"type":"string","description":"Created date"},"updated_at":{"type":"string","description":"Updated date"},"created_by":{"type":"string","description":"User that created the BlockPage"},"updated_by":{"type":"string","description":"User that last updated the BlockPage"}},"examples":[{"id":"9432a6c0-262c-4ea8-8a23-ee19cbe580dd","account_id":"d4048783-6ba2-4f33-a4b4-f90dd06e8609","inherited":false,"enabled":true,"footer_text":"This site has been blocked by Malwarebytes Content Filtering per your organization.","header_text":"This is a test","logo_path":"https://eml.malwarebytes.com/mailer/MWB_logo.png","background_color":"#ffffff","name":"Malwarebytes","mailto_address":"admin@mail.com","mailto_subject":"Your custom subject","created_at":"2022-04-26T16:18:40.629491Z","updated_at":"2025-02-07T14:50:38.019689Z","created_by":"f7b21a15-557e-4458-afd2-e7cf74ec20b8","updated_by":"846aa1f3-abe3-4e54-b5c6-0fec92913a27"}]}},"total_count":{"type":"integer","title":"Total Count","description":"Total count of results."},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}}}}},"tags":["Content Filtering"],"operationId":"api.v2.rmm.search.content_filtering.blockpage"}},"/oneview/v1/content-filtering/exclusions":{"post":{"description":"Search DNS global exclusions for a given set of accounts","summary":"Search DNS global exclusions for accounts","security":[{"client_credentials":["read"]},{"user_permissions":["dnsFiltering.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Get Global Exclusion Settings for multiple account ids","required":["account_ids"],"properties":{"account_ids":{"type":"array","minItems":1,"title":"The account ids","items":{"type":"string","title":"Account id items","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}},"page_size":{"type":"number","title":"The size of the page","minimum":1,"default":100,"maximum":2000},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"title":"Get Global Exclusions settings by account","type":"object","properties":{"exclusions":{"type":"array","title":"Exclusions","items":{"type":"object","title":"DNS Global Exclusions","properties":{"id":{"type":"string","description":"Exclusion Identifier"},"account_id":{"type":"string","description":"Account Identifier"},"exclusions":{"type":"array","title":"The global exclusions array","items":{"type":"string","title":"Exclusion Domains","pattern":"^(?!://)([a-zA-Z0-9-_]{1,63}.)+[a-zA-Z]{2,63}$","examples":["example.com"]}},"created_at":{"type":"string","description":"Created date"},"updated_at":{"type":"string","description":"Updated date"},"created_by":{"type":"string","description":"User that created the exclusions"},"updated_by":{"type":"string","description":"User that last updated the exclusions"}},"examples":[{"id":"c85e25f8-9e84-4a75-b8c2-c118d9df2424","account_id":"d4048783-6ba2-4f33-a4b4-f90dd06e8609","exclusions":["test.com"],"created_at":"2022-04-26T16:18:40.629491Z","updated_at":"2025-02-07T14:50:38.019689Z","created_by":"f7b21a15-557e-4458-afd2-e7cf74ec20b8","updated_by":"846aa1f3-abe3-4e54-b5c6-0fec92913a27"}]}},"total_count":{"type":"integer","title":"Total Count","description":"Total count of results."},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}}}}},"tags":["Content Filtering"],"operationId":"api.v2.rmm.search.content_filtering.exclusions"}},"/oneview/v1/accounts/{account_id}/app-block/rules":{"post":{"description":"Create a new App Block Rule","summary":"Create App Block Rule","security":[{"client_credentials":["write"]},{"user_permissions":["appBlock.createRule"]}],"status":{"outage":["auth"]},"parameters":[{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Create App Block Rule Schema","allOf":[{"type":"object","title":"Create App Block Rule Schema","required":["rule"],"properties":{"rule":{"type":"object","title":"App Block Rule","required":["name","action"],"oneOf":[{"title":"Files","required":["files"],"errorMessage":"Rule must have only one among files, (hashes_md5 and/or hashes_sha1 and/or hashes_sha256), file_properties, applications, vendors, digital_signatures, categories."},{"title":"File properties","required":["file_properties"],"errorMessage":"Rule must have only one among files, (hashes_md5 and/or hashes_sha1 and/or hashes_sha256), file_properties, applications, vendors, digital_signatures, categories."},{"title":"Hash","anyOf":[{"title":"Hash MD5","required":["hashes_md5"]},{"title":"Hash SHA1","required":["hashes_sha1"]},{"title":"Hash SHA256","required":["hashes_sha256"]}],"errorMessage":"Rule must have only one among files, (hashes_md5 and/or hashes_sha1 and/or hashes_sha256), file_properties, applications, vendors, digital_signatures, categories."},{"title":"Applications","required":["applications"],"errorMessage":"Rule must have only one among files, (hashes_md5 and/or hashes_sha1 and/or hashes_sha256), file_properties, applications, vendors, digital_signatures, categories."},{"title":"Vendors","required":["vendors"],"errorMessage":"Rule must have only one among files, (hashes_md5 and/or hashes_sha1 and/or hashes_sha256), file_properties, applications, vendors, digital_signatures, categories."},{"title":"Certificate property","required":["digital_signatures"],"errorMessage":"Rule must have only one among files, (hashes_md5 and/or hashes_sha1 and/or hashes_sha256), file_properties, applications, vendors, digital_signatures, categories."},{"title":"Categories","required":["categories"],"errorMessage":"Rule must have only one among files, (hashes_md5 and/or hashes_sha1 and/or hashes_sha256), file_properties, applications, vendors, digital_signatures, categories."}],"properties":{"name":{"type":"string","description":"App Block Rule Name","examples":["app_block_rule_1"]},"action":{"type":"string","descripion":"App Block Rule Action","enum":["block","report","allow"]},"files":{"type":"array","description":"Blocked file paths","items":{"type":"string"},"examples":[["/example/path/1","/exapmle/path/2"]]},"file_properties":{"type":"array","description":"Blocked file properties","items":{"type":"object","properties":{"property":{"type":"string"},"value":{"type":"string"}}}},"hashes_md5":{"type":"array","description":"Blocked Md5 hashes","items":{"type":"object","properties":{"hash":{"type":"string"},"size":{"type":"number"}}},"examples":[[{"hash":"36c5d12033b2eaf251bae61c00690ffb17fddc87","size":123},{"hash":"36c5d12033b2eaf251bae61c00690ffb17fddc87","size":456}]]},"hashes_sha1":{"type":"array","description":"Blocked SHA1 hashes","items":{"type":"object","properties":{"hash":{"type":"string"},"size":{"type":"number"}}},"examples":[[{"hash":"36c5d12033b2eaf251bae61c00690ffb17fddc87","size":123},{"hash":"36c5d12033b2eaf251bae61c00690ffb17fddc87","size":456}]]},"hashes_sha256":{"type":"array","description":"Blocked SHA256 hashes","items":{"type":"object","properties":{"hash":{"type":"string"},"size":{"type":"number"}}},"examples":[[{"hash":"36c5d12033b2eaf251bae61c00690ffb17fddc87","size":123},{"hash":"36c5d12033b2eaf251bae61c00690ffb17fddc87","size":456}]]},"applications":{"type":"array","description":"Blocked Applications","items":{"type":"object","properties":{"vendor_id":{"type":"integer","description":"OPSWAT Vendor Id"},"vendor_name":{"type":"string","description":"OPSWAT Vendor Name"},"signature_id":{"type":"integer","description":"OPSWAT Signature Id"},"signature_name":{"type":"string","description":"OPSWAT Signature Name"},"product_name":{"type":"string","description":"OPSWAT Product Name"},"product_id":{"type":"integer","description":"OPSWAT Product ID"}},"required":["signature_id"]},"examples":[[{"vendor_id":"111","vendor_name":"Example Vendor","signature_id":"1111","signature_name":"Example Signature","product_id":"Example Product Id","product_name":"Example Produc Name"}]]},"vendors":{"type":"array","description":"Blocked Vendors","items":{"type":"object","properties":{"vendor_id":{"type":"integer","description":"OPSWAT Vendor Id"},"vendor_name":{"type":"string","description":"OPSWAT Vendor Name"}}},"examples":[[{"vendor_id":"1111","vendor_name":"Example Vendor"}]]},"digital_signatures":{"type":"array","description":"Blocked digital signatures","items":{"type":"object","properties":{"property":{"type":"string"},"value":{"type":"string"}}}},"categories":{"type":"array","description":"Blocked categories","items":{"type":"integer","description":"0: ALL, 1: PUBLIC_FILE_SHARING, 2: BACKUP, 3: ENCRYPTION, 4: ANTIPHISHING, 5: ANTIMALWARE, 6: BROWSER, 7: FIREWALL, 8: MESSENGER, 9: CLOUD_STORAGE, 10: UNCLASSIFIED, 11: DATA_LOSS_PREVENTION, 12: PATCH_MANAGEMENT, 13: VPN_CLIENT, 14: VIRTUAL_MACHINE, 15: HEALTH_AGENT, 16: REMOTE_CONTROL, 17: P2PA, 18: WEB_CONFERENCE"},"examples":[[1]]},"type":{"type":"string","examples":["files","hashes","file_properties","applications","vendors","digital_signatures","categories"]}}}},"oneOf":[{"title":"app block rule with new rule_set","required":["enabled"],"properties":{"name":{"type":"string","description":"App Block Rule Set Name"},"policy_ids":{"type":"array","title":"Policies associated with the rule","items":{"type":"string","title":"Policy ID","format":"uuid"},"examples":[["59bd2afa-501c-41a5-aa8e-c5886b6c7f36","a54d8a47-d802-49e3-88b9-e8eaf7d8f148"]]},"policies_exclude":{"type":"boolean","title":"If the property is true, the specified policies are excluded","default":false},"enabled":{"type":"boolean","title":"Enable the rule","default":true}}},{"title":"app block rule with existing rule_set","required":["rule_set_id"],"properties":{"rule_set_id":{"type":"string","title":"Existing Rule set ID","format":"uuid"}}}]},{"properties":{"accounts_exclude":{"title":"If property is true, specified account ids are excluded","type":"boolean","default":"false"},"account_ids":{"title":"Child account ids","type":"array","items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","properties":{"rule":{"allOf":[{"type":"object","title":"App Block Rule","required":["name","action"],"oneOf":[{"title":"Files","required":["files"],"errorMessage":"Rule must have only one among files, (hashes_md5 and/or hashes_sha1 and/or hashes_sha256), file_properties, applications, vendors, digital_signatures, categories."},{"title":"File properties","required":["file_properties"],"errorMessage":"Rule must have only one among files, (hashes_md5 and/or hashes_sha1 and/or hashes_sha256), file_properties, applications, vendors, digital_signatures, categories."},{"title":"Hash","anyOf":[{"title":"Hash MD5","required":["hashes_md5"]},{"title":"Hash SHA1","required":["hashes_sha1"]},{"title":"Hash SHA256","required":["hashes_sha256"]}],"errorMessage":"Rule must have only one among files, (hashes_md5 and/or hashes_sha1 and/or hashes_sha256), file_properties, applications, vendors, digital_signatures, categories."},{"title":"Applications","required":["applications"],"errorMessage":"Rule must have only one among files, (hashes_md5 and/or hashes_sha1 and/or hashes_sha256), file_properties, applications, vendors, digital_signatures, categories."},{"title":"Vendors","required":["vendors"],"errorMessage":"Rule must have only one among files, (hashes_md5 and/or hashes_sha1 and/or hashes_sha256), file_properties, applications, vendors, digital_signatures, categories."},{"title":"Certificate property","required":["digital_signatures"],"errorMessage":"Rule must have only one among files, (hashes_md5 and/or hashes_sha1 and/or hashes_sha256), file_properties, applications, vendors, digital_signatures, categories."},{"title":"Categories","required":["categories"],"errorMessage":"Rule must have only one among files, (hashes_md5 and/or hashes_sha1 and/or hashes_sha256), file_properties, applications, vendors, digital_signatures, categories."}],"properties":{"name":{"type":"string","description":"App Block Rule Name","examples":["app_block_rule_1"]},"action":{"type":"string","descripion":"App Block Rule Action","enum":["block","report","allow"]},"files":{"type":"array","description":"Blocked file paths","items":{"type":"string"},"examples":[["/example/path/1","/exapmle/path/2"]]},"file_properties":{"type":"array","description":"Blocked file properties","items":{"type":"object","properties":{"property":{"type":"string"},"value":{"type":"string"}}}},"hashes_md5":{"type":"array","description":"Blocked Md5 hashes","items":{"type":"object","properties":{"hash":{"type":"string"},"size":{"type":"number"}}},"examples":[[{"hash":"36c5d12033b2eaf251bae61c00690ffb17fddc87","size":123},{"hash":"36c5d12033b2eaf251bae61c00690ffb17fddc87","size":456}]]},"hashes_sha1":{"type":"array","description":"Blocked SHA1 hashes","items":{"type":"object","properties":{"hash":{"type":"string"},"size":{"type":"number"}}},"examples":[[{"hash":"36c5d12033b2eaf251bae61c00690ffb17fddc87","size":123},{"hash":"36c5d12033b2eaf251bae61c00690ffb17fddc87","size":456}]]},"hashes_sha256":{"type":"array","description":"Blocked SHA256 hashes","items":{"type":"object","properties":{"hash":{"type":"string"},"size":{"type":"number"}}},"examples":[[{"hash":"36c5d12033b2eaf251bae61c00690ffb17fddc87","size":123},{"hash":"36c5d12033b2eaf251bae61c00690ffb17fddc87","size":456}]]},"applications":{"type":"array","description":"Blocked Applications","items":{"type":"object","properties":{"vendor_id":{"type":"integer","description":"OPSWAT Vendor Id"},"vendor_name":{"type":"string","description":"OPSWAT Vendor Name"},"signature_id":{"type":"integer","description":"OPSWAT Signature Id"},"signature_name":{"type":"string","description":"OPSWAT Signature Name"},"product_name":{"type":"string","description":"OPSWAT Product Name"},"product_id":{"type":"integer","description":"OPSWAT Product ID"}},"required":["signature_id"]},"examples":[[{"vendor_id":"111","vendor_name":"Example Vendor","signature_id":"1111","signature_name":"Example Signature","product_id":"Example Product Id","product_name":"Example Produc Name"}]]},"vendors":{"type":"array","description":"Blocked Vendors","items":{"type":"object","properties":{"vendor_id":{"type":"integer","description":"OPSWAT Vendor Id"},"vendor_name":{"type":"string","description":"OPSWAT Vendor Name"}}},"examples":[[{"vendor_id":"1111","vendor_name":"Example Vendor"}]]},"digital_signatures":{"type":"array","description":"Blocked digital signatures","items":{"type":"object","properties":{"property":{"type":"string"},"value":{"type":"string"}}}},"categories":{"type":"array","description":"Blocked categories","items":{"type":"integer","description":"0: ALL, 1: PUBLIC_FILE_SHARING, 2: BACKUP, 3: ENCRYPTION, 4: ANTIPHISHING, 5: ANTIMALWARE, 6: BROWSER, 7: FIREWALL, 8: MESSENGER, 9: CLOUD_STORAGE, 10: UNCLASSIFIED, 11: DATA_LOSS_PREVENTION, 12: PATCH_MANAGEMENT, 13: VPN_CLIENT, 14: VIRTUAL_MACHINE, 15: HEALTH_AGENT, 16: REMOTE_CONTROL, 17: P2PA, 18: WEB_CONFERENCE"},"examples":[[1]]},"type":{"type":"string","examples":["files","hashes","file_properties","applications","vendors","digital_signatures","categories"]}}},{"required":["id"],"properties":{"id":{"title":"Rule ID","type":"string","examples":["3606af9f-f539-426c-be76-6f9bc18531e2"]},"created_at":{"type":"string","examples":["2022-11-09T14:34:04.181428Z"]},"created_by":{"type":"string","examples":["a197e54e-facb-4767-81fe-1e55bd34f0c9"]},"updated_at":{"type":"string","examples":["2022-11-09T14:34:04.181428Z"]},"updated_by":{"type":"string","examples":["a197e54e-facb-4767-81fe-1e55bd34f0c9"]}}}]},"rule_set_id":{"type":"string","format":"uuid","title":"Rule Set ID"},"created_at":{"type":"string","examples":["2022-11-09T14:34:04.181428Z"]},"created_by":{"type":"string","examples":["a197e54e-facb-4767-81fe-1e55bd34f0c9"]},"updated_at":{"type":"string","examples":["2022-11-09T14:34:04.181428Z"]},"updated_by":{"type":"string","examples":["a197e54e-facb-4767-81fe-1e55bd34f0c9"]},"policies":{"type":"array","items":{"type":"object","properties":{"policy_id":{"type":"string"},"policy_name":{"type":"string"},"deleted_at":{"type":"string"}}}},"accounts":{"type":"array","items":{"type":"object","properties":{"account_id":{"type":"string"},"account_name":{"type":"string"},"deleted_at":{"type":"string"}}}}}}}}}},"tags":["App Block"],"operationId":"api.rmm.post.app_block_rule"}},"/oneview/v1/accounts/{account_id}/app-block/rules/{id}":{"delete":{"description":"Delete an existing App Block Rule","summary":"Delete App Block Rule","security":[{"client_credentials":["write"]},{"user_permissions":["appBlock.delete"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":true,"in":"path","description":"ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"Successful response"}},"tags":["App Block"],"operationId":"api.rmm.delete.app_block_rule"},"get":{"description":"Get an App Block Rule by ID","summary":"Get App Block Rule","security":[{"client_credentials":["read"]},{"user_permissions":["appBlock.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":true,"in":"path","description":"ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","properties":{"rule":{"allOf":[{"type":"object","title":"App Block Rule","required":["name","action"],"oneOf":[{"title":"Files","required":["files"],"errorMessage":"Rule must have only one among files, (hashes_md5 and/or hashes_sha1 and/or hashes_sha256), file_properties, applications, vendors, digital_signatures, categories."},{"title":"File properties","required":["file_properties"],"errorMessage":"Rule must have only one among files, (hashes_md5 and/or hashes_sha1 and/or hashes_sha256), file_properties, applications, vendors, digital_signatures, categories."},{"title":"Hash","anyOf":[{"title":"Hash MD5","required":["hashes_md5"]},{"title":"Hash SHA1","required":["hashes_sha1"]},{"title":"Hash SHA256","required":["hashes_sha256"]}],"errorMessage":"Rule must have only one among files, (hashes_md5 and/or hashes_sha1 and/or hashes_sha256), file_properties, applications, vendors, digital_signatures, categories."},{"title":"Applications","required":["applications"],"errorMessage":"Rule must have only one among files, (hashes_md5 and/or hashes_sha1 and/or hashes_sha256), file_properties, applications, vendors, digital_signatures, categories."},{"title":"Vendors","required":["vendors"],"errorMessage":"Rule must have only one among files, (hashes_md5 and/or hashes_sha1 and/or hashes_sha256), file_properties, applications, vendors, digital_signatures, categories."},{"title":"Certificate property","required":["digital_signatures"],"errorMessage":"Rule must have only one among files, (hashes_md5 and/or hashes_sha1 and/or hashes_sha256), file_properties, applications, vendors, digital_signatures, categories."},{"title":"Categories","required":["categories"],"errorMessage":"Rule must have only one among files, (hashes_md5 and/or hashes_sha1 and/or hashes_sha256), file_properties, applications, vendors, digital_signatures, categories."}],"properties":{"name":{"type":"string","description":"App Block Rule Name","examples":["app_block_rule_1"]},"action":{"type":"string","descripion":"App Block Rule Action","enum":["block","report","allow"]},"files":{"type":"array","description":"Blocked file paths","items":{"type":"string"},"examples":[["/example/path/1","/exapmle/path/2"]]},"file_properties":{"type":"array","description":"Blocked file properties","items":{"type":"object","properties":{"property":{"type":"string"},"value":{"type":"string"}}}},"hashes_md5":{"type":"array","description":"Blocked Md5 hashes","items":{"type":"object","properties":{"hash":{"type":"string"},"size":{"type":"number"}}},"examples":[[{"hash":"36c5d12033b2eaf251bae61c00690ffb17fddc87","size":123},{"hash":"36c5d12033b2eaf251bae61c00690ffb17fddc87","size":456}]]},"hashes_sha1":{"type":"array","description":"Blocked SHA1 hashes","items":{"type":"object","properties":{"hash":{"type":"string"},"size":{"type":"number"}}},"examples":[[{"hash":"36c5d12033b2eaf251bae61c00690ffb17fddc87","size":123},{"hash":"36c5d12033b2eaf251bae61c00690ffb17fddc87","size":456}]]},"hashes_sha256":{"type":"array","description":"Blocked SHA256 hashes","items":{"type":"object","properties":{"hash":{"type":"string"},"size":{"type":"number"}}},"examples":[[{"hash":"36c5d12033b2eaf251bae61c00690ffb17fddc87","size":123},{"hash":"36c5d12033b2eaf251bae61c00690ffb17fddc87","size":456}]]},"applications":{"type":"array","description":"Blocked Applications","items":{"type":"object","properties":{"vendor_id":{"type":"integer","description":"OPSWAT Vendor Id"},"vendor_name":{"type":"string","description":"OPSWAT Vendor Name"},"signature_id":{"type":"integer","description":"OPSWAT Signature Id"},"signature_name":{"type":"string","description":"OPSWAT Signature Name"},"product_name":{"type":"string","description":"OPSWAT Product Name"},"product_id":{"type":"integer","description":"OPSWAT Product ID"}},"required":["signature_id"]},"examples":[[{"vendor_id":"111","vendor_name":"Example Vendor","signature_id":"1111","signature_name":"Example Signature","product_id":"Example Product Id","product_name":"Example Produc Name"}]]},"vendors":{"type":"array","description":"Blocked Vendors","items":{"type":"object","properties":{"vendor_id":{"type":"integer","description":"OPSWAT Vendor Id"},"vendor_name":{"type":"string","description":"OPSWAT Vendor Name"}}},"examples":[[{"vendor_id":"1111","vendor_name":"Example Vendor"}]]},"digital_signatures":{"type":"array","description":"Blocked digital signatures","items":{"type":"object","properties":{"property":{"type":"string"},"value":{"type":"string"}}}},"categories":{"type":"array","description":"Blocked categories","items":{"type":"integer","description":"0: ALL, 1: PUBLIC_FILE_SHARING, 2: BACKUP, 3: ENCRYPTION, 4: ANTIPHISHING, 5: ANTIMALWARE, 6: BROWSER, 7: FIREWALL, 8: MESSENGER, 9: CLOUD_STORAGE, 10: UNCLASSIFIED, 11: DATA_LOSS_PREVENTION, 12: PATCH_MANAGEMENT, 13: VPN_CLIENT, 14: VIRTUAL_MACHINE, 15: HEALTH_AGENT, 16: REMOTE_CONTROL, 17: P2PA, 18: WEB_CONFERENCE"},"examples":[[1]]},"type":{"type":"string","examples":["files","hashes","file_properties","applications","vendors","digital_signatures","categories"]}}},{"required":["id"],"properties":{"id":{"title":"Rule ID","type":"string","examples":["3606af9f-f539-426c-be76-6f9bc18531e2"]},"created_at":{"type":"string","examples":["2022-11-09T14:34:04.181428Z"]},"created_by":{"type":"string","examples":["a197e54e-facb-4767-81fe-1e55bd34f0c9"]},"updated_at":{"type":"string","examples":["2022-11-09T14:34:04.181428Z"]},"updated_by":{"type":"string","examples":["a197e54e-facb-4767-81fe-1e55bd34f0c9"]}}}]},"rule_set_id":{"type":"string","format":"uuid","title":"Rule Set ID"},"created_at":{"type":"string","examples":["2022-11-09T14:34:04.181428Z"]},"created_by":{"type":"string","examples":["a197e54e-facb-4767-81fe-1e55bd34f0c9"]},"updated_at":{"type":"string","examples":["2022-11-09T14:34:04.181428Z"]},"updated_by":{"type":"string","examples":["a197e54e-facb-4767-81fe-1e55bd34f0c9"]},"policies":{"type":"array","items":{"type":"object","properties":{"policy_id":{"type":"string"},"policy_name":{"type":"string"},"deleted_at":{"type":"string"}}}},"accounts":{"type":"array","items":{"type":"object","properties":{"account_id":{"type":"string"},"account_name":{"type":"string"},"deleted_at":{"type":"string"}}}}}}}}}},"tags":["App Block"],"operationId":"api.rmm.get.app_block_rule"},"put":{"description":"Update an existing App Block Rule","summary":"Update App Block Rule","security":[{"client_credentials":["write"]},{"user_permissions":["appBlock.manage"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":true,"in":"path","description":"ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Create App Block Rule Schema","allOf":[{"type":"object","title":"Create App Block Rule Schema","required":["rule"],"properties":{"rule":{"type":"object","title":"App Block Rule","required":["name","action"],"oneOf":[{"title":"Files","required":["files"],"errorMessage":"Rule must have only one among files, (hashes_md5 and/or hashes_sha1 and/or hashes_sha256), file_properties, applications, vendors, digital_signatures, categories."},{"title":"File properties","required":["file_properties"],"errorMessage":"Rule must have only one among files, (hashes_md5 and/or hashes_sha1 and/or hashes_sha256), file_properties, applications, vendors, digital_signatures, categories."},{"title":"Hash","anyOf":[{"title":"Hash MD5","required":["hashes_md5"]},{"title":"Hash SHA1","required":["hashes_sha1"]},{"title":"Hash SHA256","required":["hashes_sha256"]}],"errorMessage":"Rule must have only one among files, (hashes_md5 and/or hashes_sha1 and/or hashes_sha256), file_properties, applications, vendors, digital_signatures, categories."},{"title":"Applications","required":["applications"],"errorMessage":"Rule must have only one among files, (hashes_md5 and/or hashes_sha1 and/or hashes_sha256), file_properties, applications, vendors, digital_signatures, categories."},{"title":"Vendors","required":["vendors"],"errorMessage":"Rule must have only one among files, (hashes_md5 and/or hashes_sha1 and/or hashes_sha256), file_properties, applications, vendors, digital_signatures, categories."},{"title":"Certificate property","required":["digital_signatures"],"errorMessage":"Rule must have only one among files, (hashes_md5 and/or hashes_sha1 and/or hashes_sha256), file_properties, applications, vendors, digital_signatures, categories."},{"title":"Categories","required":["categories"],"errorMessage":"Rule must have only one among files, (hashes_md5 and/or hashes_sha1 and/or hashes_sha256), file_properties, applications, vendors, digital_signatures, categories."}],"properties":{"name":{"type":"string","description":"App Block Rule Name","examples":["app_block_rule_1"]},"action":{"type":"string","descripion":"App Block Rule Action","enum":["block","report","allow"]},"files":{"type":"array","description":"Blocked file paths","items":{"type":"string"},"examples":[["/example/path/1","/exapmle/path/2"]]},"file_properties":{"type":"array","description":"Blocked file properties","items":{"type":"object","properties":{"property":{"type":"string"},"value":{"type":"string"}}}},"hashes_md5":{"type":"array","description":"Blocked Md5 hashes","items":{"type":"object","properties":{"hash":{"type":"string"},"size":{"type":"number"}}},"examples":[[{"hash":"36c5d12033b2eaf251bae61c00690ffb17fddc87","size":123},{"hash":"36c5d12033b2eaf251bae61c00690ffb17fddc87","size":456}]]},"hashes_sha1":{"type":"array","description":"Blocked SHA1 hashes","items":{"type":"object","properties":{"hash":{"type":"string"},"size":{"type":"number"}}},"examples":[[{"hash":"36c5d12033b2eaf251bae61c00690ffb17fddc87","size":123},{"hash":"36c5d12033b2eaf251bae61c00690ffb17fddc87","size":456}]]},"hashes_sha256":{"type":"array","description":"Blocked SHA256 hashes","items":{"type":"object","properties":{"hash":{"type":"string"},"size":{"type":"number"}}},"examples":[[{"hash":"36c5d12033b2eaf251bae61c00690ffb17fddc87","size":123},{"hash":"36c5d12033b2eaf251bae61c00690ffb17fddc87","size":456}]]},"applications":{"type":"array","description":"Blocked Applications","items":{"type":"object","properties":{"vendor_id":{"type":"integer","description":"OPSWAT Vendor Id"},"vendor_name":{"type":"string","description":"OPSWAT Vendor Name"},"signature_id":{"type":"integer","description":"OPSWAT Signature Id"},"signature_name":{"type":"string","description":"OPSWAT Signature Name"},"product_name":{"type":"string","description":"OPSWAT Product Name"},"product_id":{"type":"integer","description":"OPSWAT Product ID"}},"required":["signature_id"]},"examples":[[{"vendor_id":"111","vendor_name":"Example Vendor","signature_id":"1111","signature_name":"Example Signature","product_id":"Example Product Id","product_name":"Example Produc Name"}]]},"vendors":{"type":"array","description":"Blocked Vendors","items":{"type":"object","properties":{"vendor_id":{"type":"integer","description":"OPSWAT Vendor Id"},"vendor_name":{"type":"string","description":"OPSWAT Vendor Name"}}},"examples":[[{"vendor_id":"1111","vendor_name":"Example Vendor"}]]},"digital_signatures":{"type":"array","description":"Blocked digital signatures","items":{"type":"object","properties":{"property":{"type":"string"},"value":{"type":"string"}}}},"categories":{"type":"array","description":"Blocked categories","items":{"type":"integer","description":"0: ALL, 1: PUBLIC_FILE_SHARING, 2: BACKUP, 3: ENCRYPTION, 4: ANTIPHISHING, 5: ANTIMALWARE, 6: BROWSER, 7: FIREWALL, 8: MESSENGER, 9: CLOUD_STORAGE, 10: UNCLASSIFIED, 11: DATA_LOSS_PREVENTION, 12: PATCH_MANAGEMENT, 13: VPN_CLIENT, 14: VIRTUAL_MACHINE, 15: HEALTH_AGENT, 16: REMOTE_CONTROL, 17: P2PA, 18: WEB_CONFERENCE"},"examples":[[1]]},"type":{"type":"string","examples":["files","hashes","file_properties","applications","vendors","digital_signatures","categories"]}}}},"oneOf":[{"title":"app block rule with new rule_set","required":["enabled"],"properties":{"name":{"type":"string","description":"App Block Rule Set Name"},"policy_ids":{"type":"array","title":"Policies associated with the rule","items":{"type":"string","title":"Policy ID","format":"uuid"},"examples":[["59bd2afa-501c-41a5-aa8e-c5886b6c7f36","a54d8a47-d802-49e3-88b9-e8eaf7d8f148"]]},"policies_exclude":{"type":"boolean","title":"If the property is true, the specified policies are excluded","default":false},"enabled":{"type":"boolean","title":"Enable the rule","default":true}}},{"title":"app block rule with existing rule_set","required":["rule_set_id"],"properties":{"rule_set_id":{"type":"string","title":"Existing Rule set ID","format":"uuid"}}}]},{"properties":{"accounts_exclude":{"title":"If property is true, specified account ids are excluded","type":"boolean","default":"false"},"account_ids":{"title":"Child account ids","type":"array","items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","properties":{"rule":{"allOf":[{"type":"object","title":"App Block Rule","required":["name","action"],"oneOf":[{"title":"Files","required":["files"],"errorMessage":"Rule must have only one among files, (hashes_md5 and/or hashes_sha1 and/or hashes_sha256), file_properties, applications, vendors, digital_signatures, categories."},{"title":"File properties","required":["file_properties"],"errorMessage":"Rule must have only one among files, (hashes_md5 and/or hashes_sha1 and/or hashes_sha256), file_properties, applications, vendors, digital_signatures, categories."},{"title":"Hash","anyOf":[{"title":"Hash MD5","required":["hashes_md5"]},{"title":"Hash SHA1","required":["hashes_sha1"]},{"title":"Hash SHA256","required":["hashes_sha256"]}],"errorMessage":"Rule must have only one among files, (hashes_md5 and/or hashes_sha1 and/or hashes_sha256), file_properties, applications, vendors, digital_signatures, categories."},{"title":"Applications","required":["applications"],"errorMessage":"Rule must have only one among files, (hashes_md5 and/or hashes_sha1 and/or hashes_sha256), file_properties, applications, vendors, digital_signatures, categories."},{"title":"Vendors","required":["vendors"],"errorMessage":"Rule must have only one among files, (hashes_md5 and/or hashes_sha1 and/or hashes_sha256), file_properties, applications, vendors, digital_signatures, categories."},{"title":"Certificate property","required":["digital_signatures"],"errorMessage":"Rule must have only one among files, (hashes_md5 and/or hashes_sha1 and/or hashes_sha256), file_properties, applications, vendors, digital_signatures, categories."},{"title":"Categories","required":["categories"],"errorMessage":"Rule must have only one among files, (hashes_md5 and/or hashes_sha1 and/or hashes_sha256), file_properties, applications, vendors, digital_signatures, categories."}],"properties":{"name":{"type":"string","description":"App Block Rule Name","examples":["app_block_rule_1"]},"action":{"type":"string","descripion":"App Block Rule Action","enum":["block","report","allow"]},"files":{"type":"array","description":"Blocked file paths","items":{"type":"string"},"examples":[["/example/path/1","/exapmle/path/2"]]},"file_properties":{"type":"array","description":"Blocked file properties","items":{"type":"object","properties":{"property":{"type":"string"},"value":{"type":"string"}}}},"hashes_md5":{"type":"array","description":"Blocked Md5 hashes","items":{"type":"object","properties":{"hash":{"type":"string"},"size":{"type":"number"}}},"examples":[[{"hash":"36c5d12033b2eaf251bae61c00690ffb17fddc87","size":123},{"hash":"36c5d12033b2eaf251bae61c00690ffb17fddc87","size":456}]]},"hashes_sha1":{"type":"array","description":"Blocked SHA1 hashes","items":{"type":"object","properties":{"hash":{"type":"string"},"size":{"type":"number"}}},"examples":[[{"hash":"36c5d12033b2eaf251bae61c00690ffb17fddc87","size":123},{"hash":"36c5d12033b2eaf251bae61c00690ffb17fddc87","size":456}]]},"hashes_sha256":{"type":"array","description":"Blocked SHA256 hashes","items":{"type":"object","properties":{"hash":{"type":"string"},"size":{"type":"number"}}},"examples":[[{"hash":"36c5d12033b2eaf251bae61c00690ffb17fddc87","size":123},{"hash":"36c5d12033b2eaf251bae61c00690ffb17fddc87","size":456}]]},"applications":{"type":"array","description":"Blocked Applications","items":{"type":"object","properties":{"vendor_id":{"type":"integer","description":"OPSWAT Vendor Id"},"vendor_name":{"type":"string","description":"OPSWAT Vendor Name"},"signature_id":{"type":"integer","description":"OPSWAT Signature Id"},"signature_name":{"type":"string","description":"OPSWAT Signature Name"},"product_name":{"type":"string","description":"OPSWAT Product Name"},"product_id":{"type":"integer","description":"OPSWAT Product ID"}},"required":["signature_id"]},"examples":[[{"vendor_id":"111","vendor_name":"Example Vendor","signature_id":"1111","signature_name":"Example Signature","product_id":"Example Product Id","product_name":"Example Produc Name"}]]},"vendors":{"type":"array","description":"Blocked Vendors","items":{"type":"object","properties":{"vendor_id":{"type":"integer","description":"OPSWAT Vendor Id"},"vendor_name":{"type":"string","description":"OPSWAT Vendor Name"}}},"examples":[[{"vendor_id":"1111","vendor_name":"Example Vendor"}]]},"digital_signatures":{"type":"array","description":"Blocked digital signatures","items":{"type":"object","properties":{"property":{"type":"string"},"value":{"type":"string"}}}},"categories":{"type":"array","description":"Blocked categories","items":{"type":"integer","description":"0: ALL, 1: PUBLIC_FILE_SHARING, 2: BACKUP, 3: ENCRYPTION, 4: ANTIPHISHING, 5: ANTIMALWARE, 6: BROWSER, 7: FIREWALL, 8: MESSENGER, 9: CLOUD_STORAGE, 10: UNCLASSIFIED, 11: DATA_LOSS_PREVENTION, 12: PATCH_MANAGEMENT, 13: VPN_CLIENT, 14: VIRTUAL_MACHINE, 15: HEALTH_AGENT, 16: REMOTE_CONTROL, 17: P2PA, 18: WEB_CONFERENCE"},"examples":[[1]]},"type":{"type":"string","examples":["files","hashes","file_properties","applications","vendors","digital_signatures","categories"]}}},{"required":["id"],"properties":{"id":{"title":"Rule ID","type":"string","examples":["3606af9f-f539-426c-be76-6f9bc18531e2"]},"created_at":{"type":"string","examples":["2022-11-09T14:34:04.181428Z"]},"created_by":{"type":"string","examples":["a197e54e-facb-4767-81fe-1e55bd34f0c9"]},"updated_at":{"type":"string","examples":["2022-11-09T14:34:04.181428Z"]},"updated_by":{"type":"string","examples":["a197e54e-facb-4767-81fe-1e55bd34f0c9"]}}}]},"rule_set_id":{"type":"string","format":"uuid","title":"Rule Set ID"},"created_at":{"type":"string","examples":["2022-11-09T14:34:04.181428Z"]},"created_by":{"type":"string","examples":["a197e54e-facb-4767-81fe-1e55bd34f0c9"]},"updated_at":{"type":"string","examples":["2022-11-09T14:34:04.181428Z"]},"updated_by":{"type":"string","examples":["a197e54e-facb-4767-81fe-1e55bd34f0c9"]},"policies":{"type":"array","items":{"type":"object","properties":{"policy_id":{"type":"string"},"policy_name":{"type":"string"},"deleted_at":{"type":"string"}}}},"accounts":{"type":"array","items":{"type":"object","properties":{"account_id":{"type":"string"},"account_name":{"type":"string"},"deleted_at":{"type":"string"}}}}}}}}}},"tags":["App Block"],"operationId":"api.rmm.put.app_block_rule"}},"/oneview/v1/app-block/activity/export":{"post":{"description":"Export app block activity","summary":"Export app block activity","security":[{"client_credentials":["write"]},{"user_permissions":["appBlock.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Export request","allOf":[{"type":"object","title":"Export Activity Request","properties":{"format":{"type":"string","title":"The output file","enum":["csv","xlsx","html","ods","txt","rtf","json"]},"type":{"type":"string","title":"The encoding of the output","enum":["string","base64","binary"],"default":"string"},"download":{"type":"boolean","title":"Whether to instruct the client to download the response as a file. Only clients like browsers are supported"},"select":{"type":"array","title":"Which fields to select from the response","items":{"type":"object","title":"Field","required":["field","newField"],"properties":{"newField":{"type":"string","title":"The new value"},"field":{"type":"string","title":"The response field to map to a new value","enum":["type","group_id","path","status","id","machine_id","account_id","account.name","group_name","detection_id","scanned_at","scanned_at_offset_seconds","reported_at","category","is_rtp_stream_event","process_name","cleaned_at","machine_name","machine_ip","child_trace_count","source_location","destination_location","machine_location","trace_ip","trace_port","threat_name","is_root_detection","agent.at","agent.last_user","agent.fully_qualified_host_name","agent.started_at_local","agent.started_at_offset","agent.os_info.os_type","agent.os_info.os_version","agent.os_info.os_platform","agent.os_info.os_architecture","agent.os_info.os_release_name","agent.domain_name","agent.engine_version","agent.policy_etag","agent.host_name","agent.nics.ips","agent.nics.mac_address","agent.protection_status","agent.object_guid","sha256","md5","app_block.app_block_rules","app_block.file_path","policy_name","active_directory.user.display_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.machine.display_name","active_directory.machine.sam_account_name","active_directory.machine.ou"]}}}},"groups":{"type":"array","title":"List of queries","items":{"type":"object","title":"Query to fetch app block activities","allOf":[{"type":"object","title":"Search App Block Activity Request","properties":{"sort_field":{"type":"string","title":"Sort Field","enum":["scanned_at","reported_at","status","machine_name","account_name","file_path","policy_name","last_user","engine_version","group_id","group_name","nics.ips","os_info.os_platform","os_info.os_release_name","os_info.os_type","os_info.os_version","active_directory.user.display_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.machine.display_name","active_directory.machine.sam_account_name","active_directory.machine.ou"]},"sort_order":{"type":"string","title":"Sort Order","enum":["asc","desc"]},"scanned_at_before":{"type":"string","title":"Filter by scanned_at_before"},"scanned_at_after":{"type":"string","title":"Filter by scanned_at_after"},"status":{"type":"string","title":"Filter by status"},"action_taken":{"type":"string","title":"Filter by action taken","examples":["unknown","failed","noActionByUser","quarantined","replaced","deleteOnReboot","replaceOnReboot","blocked","whitelisted","unquarantined"]},"name_multi_search":{"type":"string","title":"Filter by either alias, host name of fully qualified host name"},"rule_id":{"type":"string","title":"Filter by rule_id"},"rule_name":{"type":"string","title":"Filter by rule_name"},"rule_name.keyword":{"type":"string","title":"Filter by rule name. 'Contains' type search."},"policy_name":{"type":"string","title":"Filter by policy_name"},"policy_name.keyword":{"type":"string","title":"Filter by policy name. 'Contains' type search."},"account_name":{"type":"string","title":"Filter by account_name"},"account_name.keyword":{"type":"string","title":"Filter by account_name. 'Contains' type search"},"last_user":{"type":"string","title":"Filter by last_user"},"engine_version":{"type":"string","title":"Filter by engine_version"},"group_id":{"type":"string","title":"Filter by group_id"},"group_name":{"type":"string","title":"Filter by group_name"},"nics.ips":{"type":"string","title":"Filter by nic.ips"},"os_info.os_platform":{"type":"string","title":"Filter by os_info.os_platform"},"os_info.os_release_name":{"type":"string","title":"Filter by os_info.os_release_name"},"os_info.os_release_name.keyword":{"type":"string","title":"Filter by os_info.os_release_name. 'Contains' type search"},"os_info.os_type":{"type":"string","title":"Filter by os_info.os_type"},"file_path":{"type":"string","title":"Filter by file_path"},"file_path.keyword":{"type":"string","title":"Filter by file_path. 'Contains' type search."},"os_info.os_version":{"type":"string","title":"Filter by os_info.os_version"},"histogram_time_zone":{"type":"string","pattern":"^(?:Z|([+-])([0-9]{2}):?([0-9]{2}))$","title":"Specify time zone for daily_detections_by_category and daily_app_block_by_file_path aggregations (Ex. \"+04:00\")","examples":["+04:00"]},"start_date":{"type":"string","title":"Get results after this date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"end_date":{"type":"string","title":"Get results before this date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"aggregations":{"type":"array","title":"The Aggregations Schema","items":{"type":"string","title":"Aggregations","default":[],"enum":["trace_id","scan_id","machine_id","group_id","account_id","detection_id","parent_detection_id","correlation_hash","status","threat_name.keyword","type","path.keyword","category","md5","affected_application.keyword","process_name.keyword","machine_name.keyword","daily_detections_by_category","daily_app_block_by_file_path","protection_status","os_info.os_release_name.keyword","nics.ips","nics.mac_address","nics.description.keyword","os_info.os_type","os_info.os_version.keyword","os_info.os_platform","os_info.os_architecture","host_name.keyword","fully_qualified_host_name.keyword","plugins.asset_manager.plugin_version.keyword","plugins.asset_manager.reboot_reason","plugins.endpoint_protection.plugin_version.keyword","plugins.endpoint_protection.sdk_version.keyword","plugins.endpoint_protection.component_package_version.keyword","plugins.endpoint_protection.update_package_version.keyword","plugins.endpoint_protection.reboot_reason","plugins.endpoint_detection_response.plugin_version.keyword","plugins.endpoint_detection_response.reboot_reason","plugins.endpoint_detection_and_response.plugin_version.keyword","plugins.endpoint_detection_and_response.reboot_reason","plugins.incident_response.plugin_version.keyword","plugins.incident_response.reboot_reason","plugins.siem.plugin_version.keyword","plugins.siem.reboot_reason","plugins.browser_phishing_protection.plugin_version.keyword","engine_version.keyword","domain_name.keyword","policy_etag","last_user.keyword","object_guid","file_path"]}},"page_size":{"type":"number","title":"The size of the page. If you only need aggregations, set it to 0","minimum":0,"maximum":2000},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}},"allOf":[{"type":"object","title":"Active Directory Search Filters","properties":{"active_directory.user.display_name":{"type":"string","title":"Filter the search by active_directory.user.display_name. Search for the matches that are equal to the value"},"active_directory.user.display_name.keyword":{"type":"string","title":"Filter the search by active_directory.user.display_name.keyword. Search for the matches that contain the value"},"active_directory.user.ou":{"type":"string","title":"Filter the search by active_directory.user.ou. Search for the matches that are equal to the value"},"active_directory.user.ou.keyword":{"type":"string","title":"Filter the search by active_directory.user.ou.keyword. Search for the matches that contain the value"},"active_directory.user.ou.path":{"type":"string","title":"Filter the search by active_directory.user.ou.path. Search for the matches that are equal to the value"},"active_directory.user.ou.path.keyword":{"type":"string","title":"Filter the search by active_directory.user.ou.path.keyword. Search for the matches that contain the value"},"active_directory.user.sam_account_name":{"type":"string","title":"Filter the search by active_directory.user.sam_account_name. Search for the matches that are equal to the value"},"active_directory.user.sam_account_name.keyword":{"type":"string","title":"Filter the search by active_directory.user.sam_account_name.keyword. Search for the matches that contain the value"},"active_directory.machine.display_name":{"type":"string","title":"Filter the search by active_directory.machine.display_name. Search for the matches that are equal to the value"},"active_directory.machine.display_name.keyword":{"type":"string","title":"Filter the search by active_directory.machine.display_name.keyword. Search for the matches that contain the value"},"active_directory.machine.ou":{"type":"string","title":"Filter the search by active_directory.machine.ou. Search for the matches that are equal to the value"},"active_directory.machine.ou.keyword":{"type":"string","title":"Filter the search by active_directory.machine.ou.keyword. Search for the matches that contain the value"},"active_directory.machine.ou.path":{"type":"string","title":"Filter the search by active_directory.machine.ou.path. Search for the matches that are equal to the value"},"active_directory.machine.ou.path.keyword":{"type":"string","title":"Filter the search by active_directory.machine.ou.path.keyword. Search for the matches that contain the value"},"active_directory.machine.sam_account_name":{"type":"string","title":"Filter the search by active_directory.machine.sam_account_name. Search for the matches that are equal to the value"},"active_directory.machine.sam_account_name.keyword":{"type":"string","title":"Filter the search by active_directory.machine.sam_account_name.keyword. Search for the matches that contain the value"}}}]}]}}}}],"properties":{"groups":{"type":"array","title":"List of search queries","items":{"type":"object","required":["account_ids"],"allOf":[{"type":"object","title":"Search App Block Activity Request","properties":{"sort_field":{"type":"string","title":"Sort Field","enum":["scanned_at","reported_at","status","machine_name","account_name","file_path","policy_name","last_user","engine_version","group_id","group_name","nics.ips","os_info.os_platform","os_info.os_release_name","os_info.os_type","os_info.os_version","active_directory.user.display_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.machine.display_name","active_directory.machine.sam_account_name","active_directory.machine.ou"]},"sort_order":{"type":"string","title":"Sort Order","enum":["asc","desc"]},"scanned_at_before":{"type":"string","title":"Filter by scanned_at_before"},"scanned_at_after":{"type":"string","title":"Filter by scanned_at_after"},"status":{"type":"string","title":"Filter by status"},"action_taken":{"type":"string","title":"Filter by action taken","examples":["unknown","failed","noActionByUser","quarantined","replaced","deleteOnReboot","replaceOnReboot","blocked","whitelisted","unquarantined"]},"name_multi_search":{"type":"string","title":"Filter by either alias, host name of fully qualified host name"},"rule_id":{"type":"string","title":"Filter by rule_id"},"rule_name":{"type":"string","title":"Filter by rule_name"},"rule_name.keyword":{"type":"string","title":"Filter by rule name. 'Contains' type search."},"policy_name":{"type":"string","title":"Filter by policy_name"},"policy_name.keyword":{"type":"string","title":"Filter by policy name. 'Contains' type search."},"account_name":{"type":"string","title":"Filter by account_name"},"account_name.keyword":{"type":"string","title":"Filter by account_name. 'Contains' type search"},"last_user":{"type":"string","title":"Filter by last_user"},"engine_version":{"type":"string","title":"Filter by engine_version"},"group_id":{"type":"string","title":"Filter by group_id"},"group_name":{"type":"string","title":"Filter by group_name"},"nics.ips":{"type":"string","title":"Filter by nic.ips"},"os_info.os_platform":{"type":"string","title":"Filter by os_info.os_platform"},"os_info.os_release_name":{"type":"string","title":"Filter by os_info.os_release_name"},"os_info.os_release_name.keyword":{"type":"string","title":"Filter by os_info.os_release_name. 'Contains' type search"},"os_info.os_type":{"type":"string","title":"Filter by os_info.os_type"},"file_path":{"type":"string","title":"Filter by file_path"},"file_path.keyword":{"type":"string","title":"Filter by file_path. 'Contains' type search."},"os_info.os_version":{"type":"string","title":"Filter by os_info.os_version"},"histogram_time_zone":{"type":"string","pattern":"^(?:Z|([+-])([0-9]{2}):?([0-9]{2}))$","title":"Specify time zone for daily_detections_by_category and daily_app_block_by_file_path aggregations (Ex. \"+04:00\")","examples":["+04:00"]},"start_date":{"type":"string","title":"Get results after this date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"end_date":{"type":"string","title":"Get results before this date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"aggregations":{"type":"array","title":"The Aggregations Schema","items":{"type":"string","title":"Aggregations","default":[],"enum":["trace_id","scan_id","machine_id","group_id","account_id","detection_id","parent_detection_id","correlation_hash","status","threat_name.keyword","type","path.keyword","category","md5","affected_application.keyword","process_name.keyword","machine_name.keyword","daily_detections_by_category","daily_app_block_by_file_path","protection_status","os_info.os_release_name.keyword","nics.ips","nics.mac_address","nics.description.keyword","os_info.os_type","os_info.os_version.keyword","os_info.os_platform","os_info.os_architecture","host_name.keyword","fully_qualified_host_name.keyword","plugins.asset_manager.plugin_version.keyword","plugins.asset_manager.reboot_reason","plugins.endpoint_protection.plugin_version.keyword","plugins.endpoint_protection.sdk_version.keyword","plugins.endpoint_protection.component_package_version.keyword","plugins.endpoint_protection.update_package_version.keyword","plugins.endpoint_protection.reboot_reason","plugins.endpoint_detection_response.plugin_version.keyword","plugins.endpoint_detection_response.reboot_reason","plugins.endpoint_detection_and_response.plugin_version.keyword","plugins.endpoint_detection_and_response.reboot_reason","plugins.incident_response.plugin_version.keyword","plugins.incident_response.reboot_reason","plugins.siem.plugin_version.keyword","plugins.siem.reboot_reason","plugins.browser_phishing_protection.plugin_version.keyword","engine_version.keyword","domain_name.keyword","policy_etag","last_user.keyword","object_guid","file_path"]}},"page_size":{"type":"number","title":"The size of the page. If you only need aggregations, set it to 0","minimum":0,"maximum":2000},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}},"allOf":[{"type":"object","title":"Active Directory Search Filters","properties":{"active_directory.user.display_name":{"type":"string","title":"Filter the search by active_directory.user.display_name. Search for the matches that are equal to the value"},"active_directory.user.display_name.keyword":{"type":"string","title":"Filter the search by active_directory.user.display_name.keyword. Search for the matches that contain the value"},"active_directory.user.ou":{"type":"string","title":"Filter the search by active_directory.user.ou. Search for the matches that are equal to the value"},"active_directory.user.ou.keyword":{"type":"string","title":"Filter the search by active_directory.user.ou.keyword. Search for the matches that contain the value"},"active_directory.user.ou.path":{"type":"string","title":"Filter the search by active_directory.user.ou.path. Search for the matches that are equal to the value"},"active_directory.user.ou.path.keyword":{"type":"string","title":"Filter the search by active_directory.user.ou.path.keyword. Search for the matches that contain the value"},"active_directory.user.sam_account_name":{"type":"string","title":"Filter the search by active_directory.user.sam_account_name. Search for the matches that are equal to the value"},"active_directory.user.sam_account_name.keyword":{"type":"string","title":"Filter the search by active_directory.user.sam_account_name.keyword. Search for the matches that contain the value"},"active_directory.machine.display_name":{"type":"string","title":"Filter the search by active_directory.machine.display_name. Search for the matches that are equal to the value"},"active_directory.machine.display_name.keyword":{"type":"string","title":"Filter the search by active_directory.machine.display_name.keyword. Search for the matches that contain the value"},"active_directory.machine.ou":{"type":"string","title":"Filter the search by active_directory.machine.ou. Search for the matches that are equal to the value"},"active_directory.machine.ou.keyword":{"type":"string","title":"Filter the search by active_directory.machine.ou.keyword. Search for the matches that contain the value"},"active_directory.machine.ou.path":{"type":"string","title":"Filter the search by active_directory.machine.ou.path. Search for the matches that are equal to the value"},"active_directory.machine.ou.path.keyword":{"type":"string","title":"Filter the search by active_directory.machine.ou.path.keyword. Search for the matches that contain the value"},"active_directory.machine.sam_account_name":{"type":"string","title":"Filter the search by active_directory.machine.sam_account_name. Search for the matches that are equal to the value"},"active_directory.machine.sam_account_name.keyword":{"type":"string","title":"Filter the search by active_directory.machine.sam_account_name.keyword. Search for the matches that contain the value"}}}]},{"type":"object","required":["account_ids"],"properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]}}}}}}},"responses":{"200":{"description":"Successful response"}},"tags":["App Block"],"operationId":"api.rmm.export.app_block.activity"}},"/oneview/v1/app-block/activity/export/async":{"post":{"description":"Export app block activity","summary":"Export app block activity asynchronously","security":[{"client_credentials":["write"]},{"user_permissions":["appBlock.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Export request","allOf":[{"type":"object","title":"Export Activity Request","properties":{"format":{"type":"string","title":"The output file","enum":["csv","xlsx","html","ods","txt","rtf","json"]},"type":{"type":"string","title":"The encoding of the output","enum":["string","base64","binary"],"default":"string"},"download":{"type":"boolean","title":"Whether to instruct the client to download the response as a file. Only clients like browsers are supported"},"select":{"type":"array","title":"Which fields to select from the response","items":{"type":"object","title":"Field","required":["field","newField"],"properties":{"newField":{"type":"string","title":"The new value"},"field":{"type":"string","title":"The response field to map to a new value","enum":["type","group_id","path","status","id","machine_id","account_id","account.name","group_name","detection_id","scanned_at","scanned_at_offset_seconds","reported_at","category","is_rtp_stream_event","process_name","cleaned_at","machine_name","machine_ip","child_trace_count","source_location","destination_location","machine_location","trace_ip","trace_port","threat_name","is_root_detection","agent.at","agent.last_user","agent.fully_qualified_host_name","agent.started_at_local","agent.started_at_offset","agent.os_info.os_type","agent.os_info.os_version","agent.os_info.os_platform","agent.os_info.os_architecture","agent.os_info.os_release_name","agent.domain_name","agent.engine_version","agent.policy_etag","agent.host_name","agent.nics.ips","agent.nics.mac_address","agent.protection_status","agent.object_guid","sha256","md5","app_block.app_block_rules","app_block.file_path","policy_name","active_directory.user.display_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.machine.display_name","active_directory.machine.sam_account_name","active_directory.machine.ou"]}}}},"groups":{"type":"array","title":"List of queries","items":{"type":"object","title":"Query to fetch app block activities","allOf":[{"type":"object","title":"Search App Block Activity Request","properties":{"sort_field":{"type":"string","title":"Sort Field","enum":["scanned_at","reported_at","status","machine_name","account_name","file_path","policy_name","last_user","engine_version","group_id","group_name","nics.ips","os_info.os_platform","os_info.os_release_name","os_info.os_type","os_info.os_version","active_directory.user.display_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.machine.display_name","active_directory.machine.sam_account_name","active_directory.machine.ou"]},"sort_order":{"type":"string","title":"Sort Order","enum":["asc","desc"]},"scanned_at_before":{"type":"string","title":"Filter by scanned_at_before"},"scanned_at_after":{"type":"string","title":"Filter by scanned_at_after"},"status":{"type":"string","title":"Filter by status"},"action_taken":{"type":"string","title":"Filter by action taken","examples":["unknown","failed","noActionByUser","quarantined","replaced","deleteOnReboot","replaceOnReboot","blocked","whitelisted","unquarantined"]},"name_multi_search":{"type":"string","title":"Filter by either alias, host name of fully qualified host name"},"rule_id":{"type":"string","title":"Filter by rule_id"},"rule_name":{"type":"string","title":"Filter by rule_name"},"rule_name.keyword":{"type":"string","title":"Filter by rule name. 'Contains' type search."},"policy_name":{"type":"string","title":"Filter by policy_name"},"policy_name.keyword":{"type":"string","title":"Filter by policy name. 'Contains' type search."},"account_name":{"type":"string","title":"Filter by account_name"},"account_name.keyword":{"type":"string","title":"Filter by account_name. 'Contains' type search"},"last_user":{"type":"string","title":"Filter by last_user"},"engine_version":{"type":"string","title":"Filter by engine_version"},"group_id":{"type":"string","title":"Filter by group_id"},"group_name":{"type":"string","title":"Filter by group_name"},"nics.ips":{"type":"string","title":"Filter by nic.ips"},"os_info.os_platform":{"type":"string","title":"Filter by os_info.os_platform"},"os_info.os_release_name":{"type":"string","title":"Filter by os_info.os_release_name"},"os_info.os_release_name.keyword":{"type":"string","title":"Filter by os_info.os_release_name. 'Contains' type search"},"os_info.os_type":{"type":"string","title":"Filter by os_info.os_type"},"file_path":{"type":"string","title":"Filter by file_path"},"file_path.keyword":{"type":"string","title":"Filter by file_path. 'Contains' type search."},"os_info.os_version":{"type":"string","title":"Filter by os_info.os_version"},"histogram_time_zone":{"type":"string","pattern":"^(?:Z|([+-])([0-9]{2}):?([0-9]{2}))$","title":"Specify time zone for daily_detections_by_category and daily_app_block_by_file_path aggregations (Ex. \"+04:00\")","examples":["+04:00"]},"start_date":{"type":"string","title":"Get results after this date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"end_date":{"type":"string","title":"Get results before this date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"aggregations":{"type":"array","title":"The Aggregations Schema","items":{"type":"string","title":"Aggregations","default":[],"enum":["trace_id","scan_id","machine_id","group_id","account_id","detection_id","parent_detection_id","correlation_hash","status","threat_name.keyword","type","path.keyword","category","md5","affected_application.keyword","process_name.keyword","machine_name.keyword","daily_detections_by_category","daily_app_block_by_file_path","protection_status","os_info.os_release_name.keyword","nics.ips","nics.mac_address","nics.description.keyword","os_info.os_type","os_info.os_version.keyword","os_info.os_platform","os_info.os_architecture","host_name.keyword","fully_qualified_host_name.keyword","plugins.asset_manager.plugin_version.keyword","plugins.asset_manager.reboot_reason","plugins.endpoint_protection.plugin_version.keyword","plugins.endpoint_protection.sdk_version.keyword","plugins.endpoint_protection.component_package_version.keyword","plugins.endpoint_protection.update_package_version.keyword","plugins.endpoint_protection.reboot_reason","plugins.endpoint_detection_response.plugin_version.keyword","plugins.endpoint_detection_response.reboot_reason","plugins.endpoint_detection_and_response.plugin_version.keyword","plugins.endpoint_detection_and_response.reboot_reason","plugins.incident_response.plugin_version.keyword","plugins.incident_response.reboot_reason","plugins.siem.plugin_version.keyword","plugins.siem.reboot_reason","plugins.browser_phishing_protection.plugin_version.keyword","engine_version.keyword","domain_name.keyword","policy_etag","last_user.keyword","object_guid","file_path"]}},"page_size":{"type":"number","title":"The size of the page. If you only need aggregations, set it to 0","minimum":0,"maximum":2000},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}},"allOf":[{"type":"object","title":"Active Directory Search Filters","properties":{"active_directory.user.display_name":{"type":"string","title":"Filter the search by active_directory.user.display_name. Search for the matches that are equal to the value"},"active_directory.user.display_name.keyword":{"type":"string","title":"Filter the search by active_directory.user.display_name.keyword. Search for the matches that contain the value"},"active_directory.user.ou":{"type":"string","title":"Filter the search by active_directory.user.ou. Search for the matches that are equal to the value"},"active_directory.user.ou.keyword":{"type":"string","title":"Filter the search by active_directory.user.ou.keyword. Search for the matches that contain the value"},"active_directory.user.ou.path":{"type":"string","title":"Filter the search by active_directory.user.ou.path. Search for the matches that are equal to the value"},"active_directory.user.ou.path.keyword":{"type":"string","title":"Filter the search by active_directory.user.ou.path.keyword. Search for the matches that contain the value"},"active_directory.user.sam_account_name":{"type":"string","title":"Filter the search by active_directory.user.sam_account_name. Search for the matches that are equal to the value"},"active_directory.user.sam_account_name.keyword":{"type":"string","title":"Filter the search by active_directory.user.sam_account_name.keyword. Search for the matches that contain the value"},"active_directory.machine.display_name":{"type":"string","title":"Filter the search by active_directory.machine.display_name. Search for the matches that are equal to the value"},"active_directory.machine.display_name.keyword":{"type":"string","title":"Filter the search by active_directory.machine.display_name.keyword. Search for the matches that contain the value"},"active_directory.machine.ou":{"type":"string","title":"Filter the search by active_directory.machine.ou. Search for the matches that are equal to the value"},"active_directory.machine.ou.keyword":{"type":"string","title":"Filter the search by active_directory.machine.ou.keyword. Search for the matches that contain the value"},"active_directory.machine.ou.path":{"type":"string","title":"Filter the search by active_directory.machine.ou.path. Search for the matches that are equal to the value"},"active_directory.machine.ou.path.keyword":{"type":"string","title":"Filter the search by active_directory.machine.ou.path.keyword. Search for the matches that contain the value"},"active_directory.machine.sam_account_name":{"type":"string","title":"Filter the search by active_directory.machine.sam_account_name. Search for the matches that are equal to the value"},"active_directory.machine.sam_account_name.keyword":{"type":"string","title":"Filter the search by active_directory.machine.sam_account_name.keyword. Search for the matches that contain the value"}}}]}]}}}}],"properties":{"groups":{"type":"array","title":"List of search queries","items":{"type":"object","required":["account_ids"],"allOf":[{"type":"object","title":"Search App Block Activity Request","properties":{"sort_field":{"type":"string","title":"Sort Field","enum":["scanned_at","reported_at","status","machine_name","account_name","file_path","policy_name","last_user","engine_version","group_id","group_name","nics.ips","os_info.os_platform","os_info.os_release_name","os_info.os_type","os_info.os_version","active_directory.user.display_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.machine.display_name","active_directory.machine.sam_account_name","active_directory.machine.ou"]},"sort_order":{"type":"string","title":"Sort Order","enum":["asc","desc"]},"scanned_at_before":{"type":"string","title":"Filter by scanned_at_before"},"scanned_at_after":{"type":"string","title":"Filter by scanned_at_after"},"status":{"type":"string","title":"Filter by status"},"action_taken":{"type":"string","title":"Filter by action taken","examples":["unknown","failed","noActionByUser","quarantined","replaced","deleteOnReboot","replaceOnReboot","blocked","whitelisted","unquarantined"]},"name_multi_search":{"type":"string","title":"Filter by either alias, host name of fully qualified host name"},"rule_id":{"type":"string","title":"Filter by rule_id"},"rule_name":{"type":"string","title":"Filter by rule_name"},"rule_name.keyword":{"type":"string","title":"Filter by rule name. 'Contains' type search."},"policy_name":{"type":"string","title":"Filter by policy_name"},"policy_name.keyword":{"type":"string","title":"Filter by policy name. 'Contains' type search."},"account_name":{"type":"string","title":"Filter by account_name"},"account_name.keyword":{"type":"string","title":"Filter by account_name. 'Contains' type search"},"last_user":{"type":"string","title":"Filter by last_user"},"engine_version":{"type":"string","title":"Filter by engine_version"},"group_id":{"type":"string","title":"Filter by group_id"},"group_name":{"type":"string","title":"Filter by group_name"},"nics.ips":{"type":"string","title":"Filter by nic.ips"},"os_info.os_platform":{"type":"string","title":"Filter by os_info.os_platform"},"os_info.os_release_name":{"type":"string","title":"Filter by os_info.os_release_name"},"os_info.os_release_name.keyword":{"type":"string","title":"Filter by os_info.os_release_name. 'Contains' type search"},"os_info.os_type":{"type":"string","title":"Filter by os_info.os_type"},"file_path":{"type":"string","title":"Filter by file_path"},"file_path.keyword":{"type":"string","title":"Filter by file_path. 'Contains' type search."},"os_info.os_version":{"type":"string","title":"Filter by os_info.os_version"},"histogram_time_zone":{"type":"string","pattern":"^(?:Z|([+-])([0-9]{2}):?([0-9]{2}))$","title":"Specify time zone for daily_detections_by_category and daily_app_block_by_file_path aggregations (Ex. \"+04:00\")","examples":["+04:00"]},"start_date":{"type":"string","title":"Get results after this date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"end_date":{"type":"string","title":"Get results before this date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"aggregations":{"type":"array","title":"The Aggregations Schema","items":{"type":"string","title":"Aggregations","default":[],"enum":["trace_id","scan_id","machine_id","group_id","account_id","detection_id","parent_detection_id","correlation_hash","status","threat_name.keyword","type","path.keyword","category","md5","affected_application.keyword","process_name.keyword","machine_name.keyword","daily_detections_by_category","daily_app_block_by_file_path","protection_status","os_info.os_release_name.keyword","nics.ips","nics.mac_address","nics.description.keyword","os_info.os_type","os_info.os_version.keyword","os_info.os_platform","os_info.os_architecture","host_name.keyword","fully_qualified_host_name.keyword","plugins.asset_manager.plugin_version.keyword","plugins.asset_manager.reboot_reason","plugins.endpoint_protection.plugin_version.keyword","plugins.endpoint_protection.sdk_version.keyword","plugins.endpoint_protection.component_package_version.keyword","plugins.endpoint_protection.update_package_version.keyword","plugins.endpoint_protection.reboot_reason","plugins.endpoint_detection_response.plugin_version.keyword","plugins.endpoint_detection_response.reboot_reason","plugins.endpoint_detection_and_response.plugin_version.keyword","plugins.endpoint_detection_and_response.reboot_reason","plugins.incident_response.plugin_version.keyword","plugins.incident_response.reboot_reason","plugins.siem.plugin_version.keyword","plugins.siem.reboot_reason","plugins.browser_phishing_protection.plugin_version.keyword","engine_version.keyword","domain_name.keyword","policy_etag","last_user.keyword","object_guid","file_path"]}},"page_size":{"type":"number","title":"The size of the page. If you only need aggregations, set it to 0","minimum":0,"maximum":2000},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}},"allOf":[{"type":"object","title":"Active Directory Search Filters","properties":{"active_directory.user.display_name":{"type":"string","title":"Filter the search by active_directory.user.display_name. Search for the matches that are equal to the value"},"active_directory.user.display_name.keyword":{"type":"string","title":"Filter the search by active_directory.user.display_name.keyword. Search for the matches that contain the value"},"active_directory.user.ou":{"type":"string","title":"Filter the search by active_directory.user.ou. Search for the matches that are equal to the value"},"active_directory.user.ou.keyword":{"type":"string","title":"Filter the search by active_directory.user.ou.keyword. Search for the matches that contain the value"},"active_directory.user.ou.path":{"type":"string","title":"Filter the search by active_directory.user.ou.path. Search for the matches that are equal to the value"},"active_directory.user.ou.path.keyword":{"type":"string","title":"Filter the search by active_directory.user.ou.path.keyword. Search for the matches that contain the value"},"active_directory.user.sam_account_name":{"type":"string","title":"Filter the search by active_directory.user.sam_account_name. Search for the matches that are equal to the value"},"active_directory.user.sam_account_name.keyword":{"type":"string","title":"Filter the search by active_directory.user.sam_account_name.keyword. Search for the matches that contain the value"},"active_directory.machine.display_name":{"type":"string","title":"Filter the search by active_directory.machine.display_name. Search for the matches that are equal to the value"},"active_directory.machine.display_name.keyword":{"type":"string","title":"Filter the search by active_directory.machine.display_name.keyword. Search for the matches that contain the value"},"active_directory.machine.ou":{"type":"string","title":"Filter the search by active_directory.machine.ou. Search for the matches that are equal to the value"},"active_directory.machine.ou.keyword":{"type":"string","title":"Filter the search by active_directory.machine.ou.keyword. Search for the matches that contain the value"},"active_directory.machine.ou.path":{"type":"string","title":"Filter the search by active_directory.machine.ou.path. Search for the matches that are equal to the value"},"active_directory.machine.ou.path.keyword":{"type":"string","title":"Filter the search by active_directory.machine.ou.path.keyword. Search for the matches that contain the value"},"active_directory.machine.sam_account_name":{"type":"string","title":"Filter the search by active_directory.machine.sam_account_name. Search for the matches that are equal to the value"},"active_directory.machine.sam_account_name.keyword":{"type":"string","title":"Filter the search by active_directory.machine.sam_account_name.keyword. Search for the matches that contain the value"}}}]},{"type":"object","required":["account_ids"],"properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]}}}}}}},"responses":{"200":{"description":"Successful response"}},"tags":["App Block"],"operationId":"api.rmm.export.app_block.activity.async"}},"/oneview/v1/accounts/{account_id}/app-block/rulesets/{id}":{"get":{"description":"Placeholder. Please extend this","summary":"Placeholder. Please extend this","deprecated":false,"security":[{"client_credentials":["read"]},{"user_permissions":["appBlock.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":true,"in":"path","description":"Valid UUID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"App Block Rule Set","required":["rules","id"],"properties":{"rules":{"type":"array","items":{"allOf":[{"type":"object","title":"App Block Rule","required":["name","action"],"oneOf":[{"title":"Files","required":["files"],"errorMessage":"Rule must have only one among files, (hashes_md5 and/or hashes_sha1 and/or hashes_sha256), file_properties, applications, vendors, digital_signatures, categories."},{"title":"File properties","required":["file_properties"],"errorMessage":"Rule must have only one among files, (hashes_md5 and/or hashes_sha1 and/or hashes_sha256), file_properties, applications, vendors, digital_signatures, categories."},{"title":"Hash","anyOf":[{"title":"Hash MD5","required":["hashes_md5"]},{"title":"Hash SHA1","required":["hashes_sha1"]},{"title":"Hash SHA256","required":["hashes_sha256"]}],"errorMessage":"Rule must have only one among files, (hashes_md5 and/or hashes_sha1 and/or hashes_sha256), file_properties, applications, vendors, digital_signatures, categories."},{"title":"Applications","required":["applications"],"errorMessage":"Rule must have only one among files, (hashes_md5 and/or hashes_sha1 and/or hashes_sha256), file_properties, applications, vendors, digital_signatures, categories."},{"title":"Vendors","required":["vendors"],"errorMessage":"Rule must have only one among files, (hashes_md5 and/or hashes_sha1 and/or hashes_sha256), file_properties, applications, vendors, digital_signatures, categories."},{"title":"Certificate property","required":["digital_signatures"],"errorMessage":"Rule must have only one among files, (hashes_md5 and/or hashes_sha1 and/or hashes_sha256), file_properties, applications, vendors, digital_signatures, categories."},{"title":"Categories","required":["categories"],"errorMessage":"Rule must have only one among files, (hashes_md5 and/or hashes_sha1 and/or hashes_sha256), file_properties, applications, vendors, digital_signatures, categories."}],"properties":{"name":{"type":"string","description":"App Block Rule Name","examples":["app_block_rule_1"]},"action":{"type":"string","descripion":"App Block Rule Action","enum":["block","report","allow"]},"files":{"type":"array","description":"Blocked file paths","items":{"type":"string"},"examples":[["/example/path/1","/exapmle/path/2"]]},"file_properties":{"type":"array","description":"Blocked file properties","items":{"type":"object","properties":{"property":{"type":"string"},"value":{"type":"string"}}}},"hashes_md5":{"type":"array","description":"Blocked Md5 hashes","items":{"type":"object","properties":{"hash":{"type":"string"},"size":{"type":"number"}}},"examples":[[{"hash":"36c5d12033b2eaf251bae61c00690ffb17fddc87","size":123},{"hash":"36c5d12033b2eaf251bae61c00690ffb17fddc87","size":456}]]},"hashes_sha1":{"type":"array","description":"Blocked SHA1 hashes","items":{"type":"object","properties":{"hash":{"type":"string"},"size":{"type":"number"}}},"examples":[[{"hash":"36c5d12033b2eaf251bae61c00690ffb17fddc87","size":123},{"hash":"36c5d12033b2eaf251bae61c00690ffb17fddc87","size":456}]]},"hashes_sha256":{"type":"array","description":"Blocked SHA256 hashes","items":{"type":"object","properties":{"hash":{"type":"string"},"size":{"type":"number"}}},"examples":[[{"hash":"36c5d12033b2eaf251bae61c00690ffb17fddc87","size":123},{"hash":"36c5d12033b2eaf251bae61c00690ffb17fddc87","size":456}]]},"applications":{"type":"array","description":"Blocked Applications","items":{"type":"object","properties":{"vendor_id":{"type":"integer","description":"OPSWAT Vendor Id"},"vendor_name":{"type":"string","description":"OPSWAT Vendor Name"},"signature_id":{"type":"integer","description":"OPSWAT Signature Id"},"signature_name":{"type":"string","description":"OPSWAT Signature Name"},"product_name":{"type":"string","description":"OPSWAT Product Name"},"product_id":{"type":"integer","description":"OPSWAT Product ID"}},"required":["signature_id"]},"examples":[[{"vendor_id":"111","vendor_name":"Example Vendor","signature_id":"1111","signature_name":"Example Signature","product_id":"Example Product Id","product_name":"Example Produc Name"}]]},"vendors":{"type":"array","description":"Blocked Vendors","items":{"type":"object","properties":{"vendor_id":{"type":"integer","description":"OPSWAT Vendor Id"},"vendor_name":{"type":"string","description":"OPSWAT Vendor Name"}}},"examples":[[{"vendor_id":"1111","vendor_name":"Example Vendor"}]]},"digital_signatures":{"type":"array","description":"Blocked digital signatures","items":{"type":"object","properties":{"property":{"type":"string"},"value":{"type":"string"}}}},"categories":{"type":"array","description":"Blocked categories","items":{"type":"integer","description":"0: ALL, 1: PUBLIC_FILE_SHARING, 2: BACKUP, 3: ENCRYPTION, 4: ANTIPHISHING, 5: ANTIMALWARE, 6: BROWSER, 7: FIREWALL, 8: MESSENGER, 9: CLOUD_STORAGE, 10: UNCLASSIFIED, 11: DATA_LOSS_PREVENTION, 12: PATCH_MANAGEMENT, 13: VPN_CLIENT, 14: VIRTUAL_MACHINE, 15: HEALTH_AGENT, 16: REMOTE_CONTROL, 17: P2PA, 18: WEB_CONFERENCE"},"examples":[[1]]},"type":{"type":"string","examples":["files","hashes","file_properties","applications","vendors","digital_signatures","categories"]}}},{"required":["id"],"properties":{"id":{"title":"Rule ID","type":"string","examples":["3606af9f-f539-426c-be76-6f9bc18531e2"]},"created_at":{"type":"string","examples":["2022-11-09T14:34:04.181428Z"]},"created_by":{"type":"string","examples":["a197e54e-facb-4767-81fe-1e55bd34f0c9"]},"updated_at":{"type":"string","examples":["2022-11-09T14:34:04.181428Z"]},"updated_by":{"type":"string","examples":["a197e54e-facb-4767-81fe-1e55bd34f0c9"]}}}]}},"id":{"type":"string","format":"uuid","title":"Rule Set ID"},"created_at":{"type":"string","examples":["2022-11-09T14:34:04.181428Z"]},"created_by":{"type":"string","examples":["a197e54e-facb-4767-81fe-1e55bd34f0c9"]},"updated_at":{"type":"string","examples":["2022-11-09T14:34:04.181428Z"]},"updated_by":{"type":"string","examples":["a197e54e-facb-4767-81fe-1e55bd34f0c9"]},"policies":{"type":"array","items":{"type":"object","properties":{"policy_id":{"type":"string"},"policy_name":{"type":"string"},"deleted_at":{"type":"string"}}}},"accounts":{"type":"array","items":{"type":"object","properties":{"account_id":{"type":"string"},"account_name":{"type":"string"},"deleted_at":{"type":"string"}}}}}}}}}},"tags":["App Block"],"operationId":"api.rmm.get.app_block_ruleset"}},"/oneview/v1/accounts/{account_id}/app-block/rulesets":{"get":{"description":"Placeholder. Please extend this","summary":"Placeholder. Please extend this","deprecated":false,"security":[{"client_credentials":["read"]},{"user_permissions":["appBlock.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}},{"name":"page_size","required":false,"in":"query","description":"The size of the page. If you only need aggregations, set it to 0","schema":{"type":"number"}},{"name":"next_cursor","required":false,"in":"query","description":"The pagination cursor for next set of results. For further documentation, check Pagination section.","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Search App Block Rules Result","required":["app_block_rule_sets"],"properties":{"app_block_rule_sets":{"title":"Rule Sets list","type":"array","items":{"type":"object","title":"App Block Rule Set","required":["rules","id"],"properties":{"rules":{"type":"array","items":{"allOf":[{"type":"object","title":"App Block Rule","required":["name","action"],"oneOf":[{"title":"Files","required":["files"],"errorMessage":"Rule must have only one among files, (hashes_md5 and/or hashes_sha1 and/or hashes_sha256), file_properties, applications, vendors, digital_signatures, categories."},{"title":"File properties","required":["file_properties"],"errorMessage":"Rule must have only one among files, (hashes_md5 and/or hashes_sha1 and/or hashes_sha256), file_properties, applications, vendors, digital_signatures, categories."},{"title":"Hash","anyOf":[{"title":"Hash MD5","required":["hashes_md5"]},{"title":"Hash SHA1","required":["hashes_sha1"]},{"title":"Hash SHA256","required":["hashes_sha256"]}],"errorMessage":"Rule must have only one among files, (hashes_md5 and/or hashes_sha1 and/or hashes_sha256), file_properties, applications, vendors, digital_signatures, categories."},{"title":"Applications","required":["applications"],"errorMessage":"Rule must have only one among files, (hashes_md5 and/or hashes_sha1 and/or hashes_sha256), file_properties, applications, vendors, digital_signatures, categories."},{"title":"Vendors","required":["vendors"],"errorMessage":"Rule must have only one among files, (hashes_md5 and/or hashes_sha1 and/or hashes_sha256), file_properties, applications, vendors, digital_signatures, categories."},{"title":"Certificate property","required":["digital_signatures"],"errorMessage":"Rule must have only one among files, (hashes_md5 and/or hashes_sha1 and/or hashes_sha256), file_properties, applications, vendors, digital_signatures, categories."},{"title":"Categories","required":["categories"],"errorMessage":"Rule must have only one among files, (hashes_md5 and/or hashes_sha1 and/or hashes_sha256), file_properties, applications, vendors, digital_signatures, categories."}],"properties":{"name":{"type":"string","description":"App Block Rule Name","examples":["app_block_rule_1"]},"action":{"type":"string","descripion":"App Block Rule Action","enum":["block","report","allow"]},"files":{"type":"array","description":"Blocked file paths","items":{"type":"string"},"examples":[["/example/path/1","/exapmle/path/2"]]},"file_properties":{"type":"array","description":"Blocked file properties","items":{"type":"object","properties":{"property":{"type":"string"},"value":{"type":"string"}}}},"hashes_md5":{"type":"array","description":"Blocked Md5 hashes","items":{"type":"object","properties":{"hash":{"type":"string"},"size":{"type":"number"}}},"examples":[[{"hash":"36c5d12033b2eaf251bae61c00690ffb17fddc87","size":123},{"hash":"36c5d12033b2eaf251bae61c00690ffb17fddc87","size":456}]]},"hashes_sha1":{"type":"array","description":"Blocked SHA1 hashes","items":{"type":"object","properties":{"hash":{"type":"string"},"size":{"type":"number"}}},"examples":[[{"hash":"36c5d12033b2eaf251bae61c00690ffb17fddc87","size":123},{"hash":"36c5d12033b2eaf251bae61c00690ffb17fddc87","size":456}]]},"hashes_sha256":{"type":"array","description":"Blocked SHA256 hashes","items":{"type":"object","properties":{"hash":{"type":"string"},"size":{"type":"number"}}},"examples":[[{"hash":"36c5d12033b2eaf251bae61c00690ffb17fddc87","size":123},{"hash":"36c5d12033b2eaf251bae61c00690ffb17fddc87","size":456}]]},"applications":{"type":"array","description":"Blocked Applications","items":{"type":"object","properties":{"vendor_id":{"type":"integer","description":"OPSWAT Vendor Id"},"vendor_name":{"type":"string","description":"OPSWAT Vendor Name"},"signature_id":{"type":"integer","description":"OPSWAT Signature Id"},"signature_name":{"type":"string","description":"OPSWAT Signature Name"},"product_name":{"type":"string","description":"OPSWAT Product Name"},"product_id":{"type":"integer","description":"OPSWAT Product ID"}},"required":["signature_id"]},"examples":[[{"vendor_id":"111","vendor_name":"Example Vendor","signature_id":"1111","signature_name":"Example Signature","product_id":"Example Product Id","product_name":"Example Produc Name"}]]},"vendors":{"type":"array","description":"Blocked Vendors","items":{"type":"object","properties":{"vendor_id":{"type":"integer","description":"OPSWAT Vendor Id"},"vendor_name":{"type":"string","description":"OPSWAT Vendor Name"}}},"examples":[[{"vendor_id":"1111","vendor_name":"Example Vendor"}]]},"digital_signatures":{"type":"array","description":"Blocked digital signatures","items":{"type":"object","properties":{"property":{"type":"string"},"value":{"type":"string"}}}},"categories":{"type":"array","description":"Blocked categories","items":{"type":"integer","description":"0: ALL, 1: PUBLIC_FILE_SHARING, 2: BACKUP, 3: ENCRYPTION, 4: ANTIPHISHING, 5: ANTIMALWARE, 6: BROWSER, 7: FIREWALL, 8: MESSENGER, 9: CLOUD_STORAGE, 10: UNCLASSIFIED, 11: DATA_LOSS_PREVENTION, 12: PATCH_MANAGEMENT, 13: VPN_CLIENT, 14: VIRTUAL_MACHINE, 15: HEALTH_AGENT, 16: REMOTE_CONTROL, 17: P2PA, 18: WEB_CONFERENCE"},"examples":[[1]]},"type":{"type":"string","examples":["files","hashes","file_properties","applications","vendors","digital_signatures","categories"]}}},{"required":["id"],"properties":{"id":{"title":"Rule ID","type":"string","examples":["3606af9f-f539-426c-be76-6f9bc18531e2"]},"created_at":{"type":"string","examples":["2022-11-09T14:34:04.181428Z"]},"created_by":{"type":"string","examples":["a197e54e-facb-4767-81fe-1e55bd34f0c9"]},"updated_at":{"type":"string","examples":["2022-11-09T14:34:04.181428Z"]},"updated_by":{"type":"string","examples":["a197e54e-facb-4767-81fe-1e55bd34f0c9"]}}}]}},"id":{"type":"string","format":"uuid","title":"Rule Set ID"},"created_at":{"type":"string","examples":["2022-11-09T14:34:04.181428Z"]},"created_by":{"type":"string","examples":["a197e54e-facb-4767-81fe-1e55bd34f0c9"]},"updated_at":{"type":"string","examples":["2022-11-09T14:34:04.181428Z"]},"updated_by":{"type":"string","examples":["a197e54e-facb-4767-81fe-1e55bd34f0c9"]},"policies":{"type":"array","items":{"type":"object","properties":{"policy_id":{"type":"string"},"policy_name":{"type":"string"},"deleted_at":{"type":"string"}}}},"accounts":{"type":"array","items":{"type":"object","properties":{"account_id":{"type":"string"},"account_name":{"type":"string"},"deleted_at":{"type":"string"}}}}}}},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}}}}},"tags":["App Block"],"operationId":"api.rmm.get.app_block_rulesets"}},"/oneview/v1/accounts/{account_id}/app-block/settings":{"get":{"description":"Get App Block settings for account","summary":"Get App Block settings","security":[{"client_credentials":["read"]},{"user_permissions":["appBlock.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"title":"app_block_settings","type":"object","properties":{"message_title":{"type":"string","title":"Message Title"},"message_body":{"type":"string","title":"Message Body"}}}}}}},"tags":["App Block"],"operationId":"api.rmm.get.app_block.settings"},"put":{"description":"Create or update App Block settings for account","summary":"Create App Block settings","security":[{"client_credentials":["write"]},{"user_permissions":["appBlock.manage"]}],"status":{"outage":["auth"]},"parameters":[{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"title":"app_block_settings","type":"object","properties":{"message_title":{"type":"string","title":"Message Title"},"message_body":{"type":"string","title":"Message Body"}}}}}},"responses":{"200":{"description":"Successful response"}},"tags":["App Block"],"operationId":"api.rmm.put.app_block.settings"}},"/oneview/v1/app-block/activity":{"post":{"description":"Search app block activity log","summary":"Search app block activity","security":[{"client_credentials":["read"]},{"user_permissions":["appBlock.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Search Activity","allOf":[{"type":"object","title":"Search App Block Activity Request","properties":{"sort_field":{"type":"string","title":"Sort Field","enum":["scanned_at","reported_at","status","machine_name","account_name","file_path","policy_name","last_user","engine_version","group_id","group_name","nics.ips","os_info.os_platform","os_info.os_release_name","os_info.os_type","os_info.os_version","active_directory.user.display_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.machine.display_name","active_directory.machine.sam_account_name","active_directory.machine.ou"]},"sort_order":{"type":"string","title":"Sort Order","enum":["asc","desc"]},"scanned_at_before":{"type":"string","title":"Filter by scanned_at_before"},"scanned_at_after":{"type":"string","title":"Filter by scanned_at_after"},"status":{"type":"string","title":"Filter by status"},"action_taken":{"type":"string","title":"Filter by action taken","examples":["unknown","failed","noActionByUser","quarantined","replaced","deleteOnReboot","replaceOnReboot","blocked","whitelisted","unquarantined"]},"name_multi_search":{"type":"string","title":"Filter by either alias, host name of fully qualified host name"},"rule_id":{"type":"string","title":"Filter by rule_id"},"rule_name":{"type":"string","title":"Filter by rule_name"},"rule_name.keyword":{"type":"string","title":"Filter by rule name. 'Contains' type search."},"policy_name":{"type":"string","title":"Filter by policy_name"},"policy_name.keyword":{"type":"string","title":"Filter by policy name. 'Contains' type search."},"account_name":{"type":"string","title":"Filter by account_name"},"account_name.keyword":{"type":"string","title":"Filter by account_name. 'Contains' type search"},"last_user":{"type":"string","title":"Filter by last_user"},"engine_version":{"type":"string","title":"Filter by engine_version"},"group_id":{"type":"string","title":"Filter by group_id"},"group_name":{"type":"string","title":"Filter by group_name"},"nics.ips":{"type":"string","title":"Filter by nic.ips"},"os_info.os_platform":{"type":"string","title":"Filter by os_info.os_platform"},"os_info.os_release_name":{"type":"string","title":"Filter by os_info.os_release_name"},"os_info.os_release_name.keyword":{"type":"string","title":"Filter by os_info.os_release_name. 'Contains' type search"},"os_info.os_type":{"type":"string","title":"Filter by os_info.os_type"},"file_path":{"type":"string","title":"Filter by file_path"},"file_path.keyword":{"type":"string","title":"Filter by file_path. 'Contains' type search."},"os_info.os_version":{"type":"string","title":"Filter by os_info.os_version"},"histogram_time_zone":{"type":"string","pattern":"^(?:Z|([+-])([0-9]{2}):?([0-9]{2}))$","title":"Specify time zone for daily_detections_by_category and daily_app_block_by_file_path aggregations (Ex. \"+04:00\")","examples":["+04:00"]},"start_date":{"type":"string","title":"Get results after this date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"end_date":{"type":"string","title":"Get results before this date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"aggregations":{"type":"array","title":"The Aggregations Schema","items":{"type":"string","title":"Aggregations","default":[],"enum":["trace_id","scan_id","machine_id","group_id","account_id","detection_id","parent_detection_id","correlation_hash","status","threat_name.keyword","type","path.keyword","category","md5","affected_application.keyword","process_name.keyword","machine_name.keyword","daily_detections_by_category","daily_app_block_by_file_path","protection_status","os_info.os_release_name.keyword","nics.ips","nics.mac_address","nics.description.keyword","os_info.os_type","os_info.os_version.keyword","os_info.os_platform","os_info.os_architecture","host_name.keyword","fully_qualified_host_name.keyword","plugins.asset_manager.plugin_version.keyword","plugins.asset_manager.reboot_reason","plugins.endpoint_protection.plugin_version.keyword","plugins.endpoint_protection.sdk_version.keyword","plugins.endpoint_protection.component_package_version.keyword","plugins.endpoint_protection.update_package_version.keyword","plugins.endpoint_protection.reboot_reason","plugins.endpoint_detection_response.plugin_version.keyword","plugins.endpoint_detection_response.reboot_reason","plugins.endpoint_detection_and_response.plugin_version.keyword","plugins.endpoint_detection_and_response.reboot_reason","plugins.incident_response.plugin_version.keyword","plugins.incident_response.reboot_reason","plugins.siem.plugin_version.keyword","plugins.siem.reboot_reason","plugins.browser_phishing_protection.plugin_version.keyword","engine_version.keyword","domain_name.keyword","policy_etag","last_user.keyword","object_guid","file_path"]}},"page_size":{"type":"number","title":"The size of the page. If you only need aggregations, set it to 0","minimum":0,"maximum":2000},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}},"allOf":[{"type":"object","title":"Active Directory Search Filters","properties":{"active_directory.user.display_name":{"type":"string","title":"Filter the search by active_directory.user.display_name. Search for the matches that are equal to the value"},"active_directory.user.display_name.keyword":{"type":"string","title":"Filter the search by active_directory.user.display_name.keyword. Search for the matches that contain the value"},"active_directory.user.ou":{"type":"string","title":"Filter the search by active_directory.user.ou. Search for the matches that are equal to the value"},"active_directory.user.ou.keyword":{"type":"string","title":"Filter the search by active_directory.user.ou.keyword. Search for the matches that contain the value"},"active_directory.user.ou.path":{"type":"string","title":"Filter the search by active_directory.user.ou.path. Search for the matches that are equal to the value"},"active_directory.user.ou.path.keyword":{"type":"string","title":"Filter the search by active_directory.user.ou.path.keyword. Search for the matches that contain the value"},"active_directory.user.sam_account_name":{"type":"string","title":"Filter the search by active_directory.user.sam_account_name. Search for the matches that are equal to the value"},"active_directory.user.sam_account_name.keyword":{"type":"string","title":"Filter the search by active_directory.user.sam_account_name.keyword. Search for the matches that contain the value"},"active_directory.machine.display_name":{"type":"string","title":"Filter the search by active_directory.machine.display_name. Search for the matches that are equal to the value"},"active_directory.machine.display_name.keyword":{"type":"string","title":"Filter the search by active_directory.machine.display_name.keyword. Search for the matches that contain the value"},"active_directory.machine.ou":{"type":"string","title":"Filter the search by active_directory.machine.ou. Search for the matches that are equal to the value"},"active_directory.machine.ou.keyword":{"type":"string","title":"Filter the search by active_directory.machine.ou.keyword. Search for the matches that contain the value"},"active_directory.machine.ou.path":{"type":"string","title":"Filter the search by active_directory.machine.ou.path. Search for the matches that are equal to the value"},"active_directory.machine.ou.path.keyword":{"type":"string","title":"Filter the search by active_directory.machine.ou.path.keyword. Search for the matches that contain the value"},"active_directory.machine.sam_account_name":{"type":"string","title":"Filter the search by active_directory.machine.sam_account_name. Search for the matches that are equal to the value"},"active_directory.machine.sam_account_name.keyword":{"type":"string","title":"Filter the search by active_directory.machine.sam_account_name.keyword. Search for the matches that contain the value"}}}]},{"type":"object","required":["account_ids"],"properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"title":"App Block Activities","type":"object","properties":{"total_count":{"type":"number","description":"Total number of results"},"results":{"type":"array","items":{"type":"object","title":"App Block Activity Schema","properties":{"id":{"type":"string","description":"Activity Id","examples":["f2bcafe1-cb2b-4833-b6c9-6148b9511c8f"]},"status":{"type":"string","description":"Status"},"path":{"type":"string","description":"Path"},"group_id":{"type":"string","description":"Group Id","examples":["f2bcafe1-cb2b-4833-b6c9-6148b9511c8f"]},"is_root_detection":{"type":"string"},"machine_id":{"type":"string","examples":["3606af9f-f539-426c-be76-6f9bc18531e2"]},"account_id":{"type":"string","examples":["3606af9f-f539-426c-be76-6f9bc18531e2"]},"detection_id":{"type":"string","examples":["3606af9f-f539-426c-be76-6f9bc18531e2"]},"scanned_at":{"type":"string","examples":["2020-10-23T14:20:51.006558Z"]},"scanned_at_offset_seconds":{"type":"number","examples":[0]},"reported_at":{"type":"string","examples":["2020-10-23T14:20:51.006558Z"]},"threat_name":{"type":"string"},"category":{"type":"string"},"is_rtp_stream_event":{"type":"boolean","example":[true]},"machine_name":{"type":"string"},"trace_id":{"type":"string"},"scan_id":{"type":"string"},"affected_application":{"type":"string"},"agent":{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"The root schema","description":"The root schema comprises the entire JSON document.","default":{},"examples":[{"at":"2020-10-23T14:20:51.006558Z","is_software_update_available":false,"started_at_local":"2020-10-23T14:20:50.920306Z","started_at_offset":-25200,"nics":[{"ips":["10.151.110.52"],"description":"Intel(R) 82574L Gigabit Network Connection","mac_address":"005056B91173"}],"os_info":{"os_type":"Workstation","os_version":"6.3.9600","os_platform":"Windows","os_architecture":"x86","os_release_name":"Microsoft Windows 8.1 Pro"},"fully_qualified_host_name":"sahamedw8-1x86","plugins":{"windows_remote_intrusion_detection_and_prevention":{"product_name":"Windows Remote Intrusion Detection and Prevention","plugin_version":"1.2.0.21"},"endpoint_protection":{"sdk_version":"4.2.1.90","product_name":"Endpoint Protection","plugin_version":"1.2.0.844","update_package_version":"1.0.31870","component_package_version":"1.0.1085","reboot_reasons":0},"asset_manager":{"product_name":"Asset Manager","plugin_version":"1.2.0.330","reboot_reasons":0},"endpoint_detection_and_response":{"product_name":"Endpoint Detection and Response","plugin_version":"1.2.0.297","reboot_reasons":0}},"engine_version":"1.2.0.821","policy_etag":"c6ea44914b72c92cba939ac3bd369dc4","last_user":"SAHAMEDW8-1X86\\Administrator","serial_number":"c02thb32g8wn","host_name":"sahamedw8-1x86","machine_id":"f2bcafe1-cb2b-4833-b6c9-6148b9511c8f","machine_ip":"216.75.233.210"}],"properties":{"at":{"type":"string","title":"The at schema","default":"","examples":["2020-10-23T14:20:51.006558Z"]},"is_software_update_available":{"type":"boolean","title":"The is_software_update_available schema","default":false,"examples":[false]},"started_at_local":{"type":"string","title":"The started_at_local schema","default":"","examples":["2020-10-23T14:20:50.920306Z"]},"started_at_offset":{"type":"integer","title":"The started_at_offset schema","default":0,"examples":[-25200]},"nics":{"type":"array","title":"The nics schema","default":[],"examples":[[{"ips":["10.151.110.52"],"description":"Intel(R) 82574L Gigabit Network Connection","mac_address":"005056B91173"}]],"additionalItems":true,"items":{"anyOf":[{"type":"object","title":"The first anyOf schema","default":{},"examples":[{"ips":["10.151.110.52"],"description":"Intel(R) 82574L Gigabit Network Connection","mac_address":"005056B91173"}],"properties":{"ips":{"type":"array","title":"The ips schema","default":[],"examples":[["10.151.110.52"]],"additionalItems":true,"items":{"anyOf":[{"type":"string","title":"The first anyOf schema","default":"","examples":["10.151.110.52"]}]}},"description":{"type":"string","title":"The description schema","default":"","examples":["Intel(R) 82574L Gigabit Network Connection"]},"mac_address":{"type":"string","title":"The mac_address schema","default":"","examples":["005056B91173"]}},"additionalProperties":true}]}},"os_info":{"type":"object","title":"The os_info schema","default":{},"examples":[{"os_type":"Workstation","os_version":"6.3.9600","os_platform":"Windows","os_architecture":"x86","os_release_name":"Microsoft Windows 8.1 Pro"}],"properties":{"os_type":{"type":"string","title":"The os_type schema","default":"","examples":["Workstation"]},"os_version":{"type":"string","title":"The os_version schema","default":"","examples":["6.3.9600"]},"os_platform":{"type":"string","title":"The os_platform schema","default":"","examples":["Windows"]},"os_architecture":{"type":"string","title":"The os_architecture schema","default":"","examples":["x86"]},"os_release_name":{"type":"string","title":"The os_release_name schema","default":"","examples":["Microsoft Windows 8.1 Pro"]}},"additionalProperties":true},"fully_qualified_host_name":{"type":"string","title":"The fully_qualified_host_name schema","default":"","examples":["sahamedw8-1x86"]},"plugins":{"type":"object","title":"The plugins schema","default":{},"examples":[{"windows_remote_intrusion_detection_and_prevention":{"product_name":"Windows Remote Intrusion Detection and Prevention","plugin_version":"1.2.0.21"},"endpoint_protection":{"sdk_version":"4.2.1.90","product_name":"Endpoint Protection","plugin_version":"1.2.0.844","update_package_version":"1.0.31870","component_package_version":"1.0.1085","reboot_reasons":0},"asset_manager":{"product_name":"Asset Manager","plugin_version":"1.2.0.330","reboot_reasons":0},"endpoint_detection_and_response":{"product_name":"Endpoint Detection and Response","plugin_version":"1.2.0.297","reboot_reasons":0}}],"properties":{"windows_remote_intrusion_detection_and_prevention":{"type":"object","title":"The windows_remote_intrusion_detection_and_prevention schema","default":{},"examples":[{"product_name":"Windows Remote Intrusion Detection and Prevention","plugin_version":"1.2.0.21"}],"properties":{"product_name":{"type":"string","title":"The product_name schema","default":"","examples":["Windows Remote Intrusion Detection and Prevention"]},"plugin_version":{"type":"string","title":"The plugin_version schema","default":"","examples":["1.2.0.21"]}},"additionalProperties":true},"endpoint_protection":{"type":"object","title":"The endpoint_protection schema","default":{},"examples":[{"sdk_version":"4.2.1.90","product_name":"Endpoint Protection","plugin_version":"1.2.0.844","update_package_version":"1.0.31870","component_package_version":"1.0.1085","reboot_reasons":0}],"properties":{"sdk_version":{"type":"string","title":"The sdk_version schema","default":"","examples":["4.2.1.90"]},"product_name":{"type":"string","title":"The product_name schema","default":"","examples":["Endpoint Protection"]},"plugin_version":{"type":"string","title":"The plugin_version schema","default":"","examples":["1.2.0.844"]},"update_package_version":{"type":"string","title":"The update_package_version schema","default":"","examples":["1.0.31870"]},"component_package_version":{"type":"string","title":"The component_package_version schema","default":"","examples":["1.0.1085"]},"reboot_reasons":{"type":"integer","title":"The reboot_reasons schema","default":0,"examples":[0]}},"additionalProperties":true},"asset_manager":{"type":"object","title":"The asset_manager schema","default":{},"examples":[{"product_name":"Asset Manager","plugin_version":"1.2.0.330","reboot_reasons":0}],"properties":{"product_name":{"type":"string","title":"The product_name schema","default":"","examples":["Asset Manager"]},"plugin_version":{"type":"string","title":"The plugin_version schema","default":"","examples":["1.2.0.330"]},"reboot_reasons":{"type":"integer","title":"The reboot_reasons schema","default":0,"examples":[0]}},"additionalProperties":true},"endpoint_detection_and_response":{"type":"object","title":"The endpoint_detection_and_response schema","default":{},"examples":[{"product_name":"Endpoint Detection and Response","plugin_version":"1.2.0.297","reboot_reasons":0}],"properties":{"product_name":{"type":"string","title":"The product_name schema","default":"","examples":["Endpoint Detection and Response"]},"plugin_version":{"type":"string","title":"The plugin_version schema","default":"","examples":["1.2.0.297"]},"reboot_reasons":{"type":"integer","title":"The reboot_reasons schema","default":0,"examples":[0]}},"additionalProperties":true}},"additionalProperties":true},"engine_version":{"type":"string","title":"The engine_version schema","default":"","examples":["1.2.0.821"]},"policy_etag":{"type":"string","title":"The policy_etag schema","default":"","examples":["c6ea44914b72c92cba939ac3bd369dc4"]},"last_user":{"type":"string","title":"The last_user schema","default":"","examples":["SAHAMEDW8-1X86\\Administrator"]},"host_name":{"type":"string","title":"The host_name schema","default":"","examples":["sahamedw8-1x86"]},"machine_id":{"type":"string","title":"The machine_id schema","default":"","examples":["f2bcafe1-cb2b-4833-b6c9-6148b9511c8f"]},"machine_ip":{"type":"string","title":"The machine_ip schema","default":"","examples":["216.75.233.210"]},"object_guid":{"type":"string","title":"The object_guid schema","default":""}}},"account":{"type":"object","properties":{"parent":{"type":"string"},"name":{"type":"string"},"deleted":{"type":"boolean"}}},"group":{"type":"object","properties":{"account_id":{"type":"string","examples":["3606af9f-f539-426c-be76-6f9bc18531e2"]},"id":{"type":"string"},"machines_count":{"type":"integer"},"name":{"type":"string"},"policy_id":{"type":"string","examples":["3606af9f-f539-426c-be76-6f9bc18531e2"]},"root_id":{"type":"string"}}},"active_directory":{"type":"object","patternProperties":{"^(user|machine)$":{"type":"object","properties":{"display_name":{"type":"string"},"distinguished_name":{"type":"string"},"sam_account_name":{"type":"string"},"ou":{"type":"string"}}}}},"app_block":{"type":"object","properties":{"file_path":{"type":"string"},"app_block_rules":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string","examples":["3606af9f-f539-426c-be76-6f9bc18531e2"]},"account_id":{"type":"string","examples":["3606af9f-f539-426c-be76-6f9bc18531e2"]},"name":{"type":"string"},"type":{"type":"string"}}}}}}}}},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}}}}},"tags":["App Block"],"operationId":"api.rmm.search.app_block.activity"}},"/oneview/v1/app-block/activity/search-groupby":{"post":{"description":"Search app block activity log groupby","summary":"Search app block activity groupby","security":[{"client_credentials":["read"]},{"user_permissions":["appBlock.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Search Activity","allOf":[{"title":"Search groupby activity request","type":"object","allOf":[{"type":"object","title":"Search App Block Activity Request","properties":{"sort_field":{"type":"string","title":"Sort Field","enum":["scanned_at","reported_at","status","machine_name","account_name","file_path","policy_name","last_user","engine_version","group_id","group_name","nics.ips","os_info.os_platform","os_info.os_release_name","os_info.os_type","os_info.os_version","active_directory.user.display_name","active_directory.user.sam_account_name","active_directory.user.ou","active_directory.machine.display_name","active_directory.machine.sam_account_name","active_directory.machine.ou"]},"sort_order":{"type":"string","title":"Sort Order","enum":["asc","desc"]},"scanned_at_before":{"type":"string","title":"Filter by scanned_at_before"},"scanned_at_after":{"type":"string","title":"Filter by scanned_at_after"},"status":{"type":"string","title":"Filter by status"},"action_taken":{"type":"string","title":"Filter by action taken","examples":["unknown","failed","noActionByUser","quarantined","replaced","deleteOnReboot","replaceOnReboot","blocked","whitelisted","unquarantined"]},"name_multi_search":{"type":"string","title":"Filter by either alias, host name of fully qualified host name"},"rule_id":{"type":"string","title":"Filter by rule_id"},"rule_name":{"type":"string","title":"Filter by rule_name"},"rule_name.keyword":{"type":"string","title":"Filter by rule name. 'Contains' type search."},"policy_name":{"type":"string","title":"Filter by policy_name"},"policy_name.keyword":{"type":"string","title":"Filter by policy name. 'Contains' type search."},"account_name":{"type":"string","title":"Filter by account_name"},"account_name.keyword":{"type":"string","title":"Filter by account_name. 'Contains' type search"},"last_user":{"type":"string","title":"Filter by last_user"},"engine_version":{"type":"string","title":"Filter by engine_version"},"group_id":{"type":"string","title":"Filter by group_id"},"group_name":{"type":"string","title":"Filter by group_name"},"nics.ips":{"type":"string","title":"Filter by nic.ips"},"os_info.os_platform":{"type":"string","title":"Filter by os_info.os_platform"},"os_info.os_release_name":{"type":"string","title":"Filter by os_info.os_release_name"},"os_info.os_release_name.keyword":{"type":"string","title":"Filter by os_info.os_release_name. 'Contains' type search"},"os_info.os_type":{"type":"string","title":"Filter by os_info.os_type"},"file_path":{"type":"string","title":"Filter by file_path"},"file_path.keyword":{"type":"string","title":"Filter by file_path. 'Contains' type search."},"os_info.os_version":{"type":"string","title":"Filter by os_info.os_version"},"histogram_time_zone":{"type":"string","pattern":"^(?:Z|([+-])([0-9]{2}):?([0-9]{2}))$","title":"Specify time zone for daily_detections_by_category and daily_app_block_by_file_path aggregations (Ex. \"+04:00\")","examples":["+04:00"]},"start_date":{"type":"string","title":"Get results after this date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"end_date":{"type":"string","title":"Get results before this date (Ex. \"2020-03-23T17:23:17.860482Z\")","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2020-03-23T17:23:17.860482Z"]},"aggregations":{"type":"array","title":"The Aggregations Schema","items":{"type":"string","title":"Aggregations","default":[],"enum":["trace_id","scan_id","machine_id","group_id","account_id","detection_id","parent_detection_id","correlation_hash","status","threat_name.keyword","type","path.keyword","category","md5","affected_application.keyword","process_name.keyword","machine_name.keyword","daily_detections_by_category","daily_app_block_by_file_path","protection_status","os_info.os_release_name.keyword","nics.ips","nics.mac_address","nics.description.keyword","os_info.os_type","os_info.os_version.keyword","os_info.os_platform","os_info.os_architecture","host_name.keyword","fully_qualified_host_name.keyword","plugins.asset_manager.plugin_version.keyword","plugins.asset_manager.reboot_reason","plugins.endpoint_protection.plugin_version.keyword","plugins.endpoint_protection.sdk_version.keyword","plugins.endpoint_protection.component_package_version.keyword","plugins.endpoint_protection.update_package_version.keyword","plugins.endpoint_protection.reboot_reason","plugins.endpoint_detection_response.plugin_version.keyword","plugins.endpoint_detection_response.reboot_reason","plugins.endpoint_detection_and_response.plugin_version.keyword","plugins.endpoint_detection_and_response.reboot_reason","plugins.incident_response.plugin_version.keyword","plugins.incident_response.reboot_reason","plugins.siem.plugin_version.keyword","plugins.siem.reboot_reason","plugins.browser_phishing_protection.plugin_version.keyword","engine_version.keyword","domain_name.keyword","policy_etag","last_user.keyword","object_guid","file_path"]}},"page_size":{"type":"number","title":"The size of the page. If you only need aggregations, set it to 0","minimum":0,"maximum":2000},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}},"allOf":[{"type":"object","title":"Active Directory Search Filters","properties":{"active_directory.user.display_name":{"type":"string","title":"Filter the search by active_directory.user.display_name. Search for the matches that are equal to the value"},"active_directory.user.display_name.keyword":{"type":"string","title":"Filter the search by active_directory.user.display_name.keyword. Search for the matches that contain the value"},"active_directory.user.ou":{"type":"string","title":"Filter the search by active_directory.user.ou. Search for the matches that are equal to the value"},"active_directory.user.ou.keyword":{"type":"string","title":"Filter the search by active_directory.user.ou.keyword. Search for the matches that contain the value"},"active_directory.user.ou.path":{"type":"string","title":"Filter the search by active_directory.user.ou.path. Search for the matches that are equal to the value"},"active_directory.user.ou.path.keyword":{"type":"string","title":"Filter the search by active_directory.user.ou.path.keyword. Search for the matches that contain the value"},"active_directory.user.sam_account_name":{"type":"string","title":"Filter the search by active_directory.user.sam_account_name. Search for the matches that are equal to the value"},"active_directory.user.sam_account_name.keyword":{"type":"string","title":"Filter the search by active_directory.user.sam_account_name.keyword. Search for the matches that contain the value"},"active_directory.machine.display_name":{"type":"string","title":"Filter the search by active_directory.machine.display_name. Search for the matches that are equal to the value"},"active_directory.machine.display_name.keyword":{"type":"string","title":"Filter the search by active_directory.machine.display_name.keyword. Search for the matches that contain the value"},"active_directory.machine.ou":{"type":"string","title":"Filter the search by active_directory.machine.ou. Search for the matches that are equal to the value"},"active_directory.machine.ou.keyword":{"type":"string","title":"Filter the search by active_directory.machine.ou.keyword. Search for the matches that contain the value"},"active_directory.machine.ou.path":{"type":"string","title":"Filter the search by active_directory.machine.ou.path. Search for the matches that are equal to the value"},"active_directory.machine.ou.path.keyword":{"type":"string","title":"Filter the search by active_directory.machine.ou.path.keyword. Search for the matches that contain the value"},"active_directory.machine.sam_account_name":{"type":"string","title":"Filter the search by active_directory.machine.sam_account_name. Search for the matches that are equal to the value"},"active_directory.machine.sam_account_name.keyword":{"type":"string","title":"Filter the search by active_directory.machine.sam_account_name.keyword. Search for the matches that contain the value"}}}]},{"properties":{"group_by":{"type":"string","title":"Group by one of the following fields","enum":["account_id","status","machine_id","file_path","policy_id","last_user","engine_version","group_id","os_info.os_platform","os_info.os_release_name","os_info.os_type","os_info.os_version","active_directory.user.display_name","active_directory.user.ou","active_directory.machine.display_name","active_directory.machine.ou"]}},"required":["group_by"]}]},{"type":"object","required":["account_ids"],"properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Search App Block Activity Response","required":["results","next_cursor"],"properties":{"results":{"type":"array","title":"The Results Schema","default":[],"items":{"properties":{"value":{"type":"string"},"total":{"type":"number"}}}},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}}}}},"tags":["App Block"],"operationId":"api.rmm.search.app_block.activity.groupby"}},"/oneview/v1/app-block/rules/search":{"post":{"description":"Search App Block Rules","summary":"Search App Block Rules","security":[{"client_credentials":["read"]},{"user_permissions":["appBlock.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Search App Block Rules","allOf":[{"type":"object","title":"Search App Block Activity Constraint","properties":{"page_size":{"type":"number","title":"The size of the page. If you only need aggregations, set it to 0","minimum":0,"maximum":2000},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}},{"type":"object","required":["account_ids"],"properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Search App Block Rules Result","required":["app_block_rules","total_count"],"properties":{"total_count":{"title":"Total Count","type":"number"},"app_block_rules":{"title":"Rules list","type":"array","items":{"type":"object","properties":{"rule":{"allOf":[{"type":"object","title":"App Block Rule","required":["name","action"],"oneOf":[{"title":"Files","required":["files"],"errorMessage":"Rule must have only one among files, (hashes_md5 and/or hashes_sha1 and/or hashes_sha256), file_properties, applications, vendors, digital_signatures, categories."},{"title":"File properties","required":["file_properties"],"errorMessage":"Rule must have only one among files, (hashes_md5 and/or hashes_sha1 and/or hashes_sha256), file_properties, applications, vendors, digital_signatures, categories."},{"title":"Hash","anyOf":[{"title":"Hash MD5","required":["hashes_md5"]},{"title":"Hash SHA1","required":["hashes_sha1"]},{"title":"Hash SHA256","required":["hashes_sha256"]}],"errorMessage":"Rule must have only one among files, (hashes_md5 and/or hashes_sha1 and/or hashes_sha256), file_properties, applications, vendors, digital_signatures, categories."},{"title":"Applications","required":["applications"],"errorMessage":"Rule must have only one among files, (hashes_md5 and/or hashes_sha1 and/or hashes_sha256), file_properties, applications, vendors, digital_signatures, categories."},{"title":"Vendors","required":["vendors"],"errorMessage":"Rule must have only one among files, (hashes_md5 and/or hashes_sha1 and/or hashes_sha256), file_properties, applications, vendors, digital_signatures, categories."},{"title":"Certificate property","required":["digital_signatures"],"errorMessage":"Rule must have only one among files, (hashes_md5 and/or hashes_sha1 and/or hashes_sha256), file_properties, applications, vendors, digital_signatures, categories."},{"title":"Categories","required":["categories"],"errorMessage":"Rule must have only one among files, (hashes_md5 and/or hashes_sha1 and/or hashes_sha256), file_properties, applications, vendors, digital_signatures, categories."}],"properties":{"name":{"type":"string","description":"App Block Rule Name","examples":["app_block_rule_1"]},"action":{"type":"string","descripion":"App Block Rule Action","enum":["block","report","allow"]},"files":{"type":"array","description":"Blocked file paths","items":{"type":"string"},"examples":[["/example/path/1","/exapmle/path/2"]]},"file_properties":{"type":"array","description":"Blocked file properties","items":{"type":"object","properties":{"property":{"type":"string"},"value":{"type":"string"}}}},"hashes_md5":{"type":"array","description":"Blocked Md5 hashes","items":{"type":"object","properties":{"hash":{"type":"string"},"size":{"type":"number"}}},"examples":[[{"hash":"36c5d12033b2eaf251bae61c00690ffb17fddc87","size":123},{"hash":"36c5d12033b2eaf251bae61c00690ffb17fddc87","size":456}]]},"hashes_sha1":{"type":"array","description":"Blocked SHA1 hashes","items":{"type":"object","properties":{"hash":{"type":"string"},"size":{"type":"number"}}},"examples":[[{"hash":"36c5d12033b2eaf251bae61c00690ffb17fddc87","size":123},{"hash":"36c5d12033b2eaf251bae61c00690ffb17fddc87","size":456}]]},"hashes_sha256":{"type":"array","description":"Blocked SHA256 hashes","items":{"type":"object","properties":{"hash":{"type":"string"},"size":{"type":"number"}}},"examples":[[{"hash":"36c5d12033b2eaf251bae61c00690ffb17fddc87","size":123},{"hash":"36c5d12033b2eaf251bae61c00690ffb17fddc87","size":456}]]},"applications":{"type":"array","description":"Blocked Applications","items":{"type":"object","properties":{"vendor_id":{"type":"integer","description":"OPSWAT Vendor Id"},"vendor_name":{"type":"string","description":"OPSWAT Vendor Name"},"signature_id":{"type":"integer","description":"OPSWAT Signature Id"},"signature_name":{"type":"string","description":"OPSWAT Signature Name"},"product_name":{"type":"string","description":"OPSWAT Product Name"},"product_id":{"type":"integer","description":"OPSWAT Product ID"}},"required":["signature_id"]},"examples":[[{"vendor_id":"111","vendor_name":"Example Vendor","signature_id":"1111","signature_name":"Example Signature","product_id":"Example Product Id","product_name":"Example Produc Name"}]]},"vendors":{"type":"array","description":"Blocked Vendors","items":{"type":"object","properties":{"vendor_id":{"type":"integer","description":"OPSWAT Vendor Id"},"vendor_name":{"type":"string","description":"OPSWAT Vendor Name"}}},"examples":[[{"vendor_id":"1111","vendor_name":"Example Vendor"}]]},"digital_signatures":{"type":"array","description":"Blocked digital signatures","items":{"type":"object","properties":{"property":{"type":"string"},"value":{"type":"string"}}}},"categories":{"type":"array","description":"Blocked categories","items":{"type":"integer","description":"0: ALL, 1: PUBLIC_FILE_SHARING, 2: BACKUP, 3: ENCRYPTION, 4: ANTIPHISHING, 5: ANTIMALWARE, 6: BROWSER, 7: FIREWALL, 8: MESSENGER, 9: CLOUD_STORAGE, 10: UNCLASSIFIED, 11: DATA_LOSS_PREVENTION, 12: PATCH_MANAGEMENT, 13: VPN_CLIENT, 14: VIRTUAL_MACHINE, 15: HEALTH_AGENT, 16: REMOTE_CONTROL, 17: P2PA, 18: WEB_CONFERENCE"},"examples":[[1]]},"type":{"type":"string","examples":["files","hashes","file_properties","applications","vendors","digital_signatures","categories"]}}},{"required":["id"],"properties":{"id":{"title":"Rule ID","type":"string","examples":["3606af9f-f539-426c-be76-6f9bc18531e2"]},"created_at":{"type":"string","examples":["2022-11-09T14:34:04.181428Z"]},"created_by":{"type":"string","examples":["a197e54e-facb-4767-81fe-1e55bd34f0c9"]},"updated_at":{"type":"string","examples":["2022-11-09T14:34:04.181428Z"]},"updated_by":{"type":"string","examples":["a197e54e-facb-4767-81fe-1e55bd34f0c9"]}}}]},"rule_set_id":{"type":"string","format":"uuid","title":"Rule Set ID"},"created_at":{"type":"string","examples":["2022-11-09T14:34:04.181428Z"]},"created_by":{"type":"string","examples":["a197e54e-facb-4767-81fe-1e55bd34f0c9"]},"updated_at":{"type":"string","examples":["2022-11-09T14:34:04.181428Z"]},"updated_by":{"type":"string","examples":["a197e54e-facb-4767-81fe-1e55bd34f0c9"]},"policies":{"type":"array","items":{"type":"object","properties":{"policy_id":{"type":"string"},"policy_name":{"type":"string"},"deleted_at":{"type":"string"}}}},"accounts":{"type":"array","items":{"type":"object","properties":{"account_id":{"type":"string"},"account_name":{"type":"string"},"deleted_at":{"type":"string"}}}}}}},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}}}}},"tags":["App Block"],"operationId":"api.rmm.search.app_block_rule"}},"/oneview/v1/accounts/{account_id}/firewall/policies":{"post":{"description":"Create a new firewall policy","summary":"Create a new firewall policy","security":[{"client_credentials":["write"]},{"user_permissions":["firewall.createPolicy"]}],"status":{"outage":["auth"]},"parameters":[{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Create firewall policy","required":["name","allow_store","enabled"],"allOf":[{"type":"object","title":"Firewall policy","properties":{"name":{"type":"string","title":"Firewall policy name"},"description":{"type":"string","title":"Firewall policy description"},"allow_store":{"type":"boolean","title":"Allow store"},"enabled":{"type":"boolean","title":"Enabled controls if the agent is sent the Firewall plugin."},"profiles":{"type":"array","title":"Profiles","items":{"type":"object","title":"Firewall profile","properties":{"type":{"type":"number","title":"Firewall profile type(1=Domain, 2=Private, 4=Public)","enum":[1,2,4]},"firewall_enabled":{"type":"boolean","title":"Firewall enabled"},"inbound_mode":{"type":"string","title":"Inbound mode","enum":["ALLOW","BLOCK","BLOCK_ALL"]},"outbound_mode":{"type":"string","title":"Outbound mode","enum":["ALLOW","BLOCK"]}}}},"report_frequency":{"type":"number","title":"Report frequency in minutes","minimum":5,"default":60,"maximum":1440}}},{"properties":{"policies":{"type":"array","title":"Policy IDs","items":{"type":"string","format":"uuid"}},"rulesets":{"type":"array","title":"Ruleset IDs","items":{"type":"string","format":"uuid"}}}}]}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"title":"Get firewall policy response","type":"object","required":["id"],"allOf":[{"type":"object","title":"Firewall policy","properties":{"name":{"type":"string","title":"Firewall policy name"},"description":{"type":"string","title":"Firewall policy description"},"allow_store":{"type":"boolean","title":"Allow store"},"enabled":{"type":"boolean","title":"Enabled controls if the agent is sent the Firewall plugin."},"profiles":{"type":"array","title":"Profiles","items":{"type":"object","title":"Firewall profile","properties":{"type":{"type":"number","title":"Firewall profile type(1=Domain, 2=Private, 4=Public)","enum":[1,2,4]},"firewall_enabled":{"type":"boolean","title":"Firewall enabled"},"inbound_mode":{"type":"string","title":"Inbound mode","enum":["ALLOW","BLOCK","BLOCK_ALL"]},"outbound_mode":{"type":"string","title":"Outbound mode","enum":["ALLOW","BLOCK"]}}}},"report_frequency":{"type":"number","title":"Report frequency in minutes","minimum":5,"default":60,"maximum":1440}}},{"properties":{"id":{"type":"string","title":"Firewall policy ID"},"rulesets":{"type":"array","title":"Rulesets","items":{"title":"Get firewall ruleset response","type":"object","required":["id"],"allOf":[{"title":"Firewall ruleset","type":"object","properties":{"name":{"type":"string","title":"Firewall ruleset name"},"description":{"type":"string","title":"Firewall ruleset description"}}},{"properties":{"id":{"type":"string","title":"Firewall rule ID"},"created_at":{"type":"string","title":"Created at","format":"date-time"},"updated_at":{"type":"string","title":"Updated at","format":"date-time"},"deleted_at":{"type":"string","title":"Deleted at","format":"date-time"},"created_by":{"type":"string","title":"Created by"},"updated_by":{"type":"string","title":"Updated by"},"deleted_by":{"type":"string","title":"Deleted by"},"account_id":{"type":"string","title":"Account ID","format":"uuid"},"parent_account_id":{"type":"string","title":"Parent account ID","format":"uuid"},"etag":{"type":"string","title":"ETag"},"rules":{"type":"array","title":"Rules","items":{"type":"object","title":"Get firewall rule response","required":["id"],"allOf":[{"type":"object","title":"Firewall rule","properties":{"name":{"type":"string","title":"Firewall rule name"},"description":{"type":"string","title":"Firewall rule description"},"program":{"type":"string","title":"Firewall rule program"},"action":{"type":"string","title":"Firewall rule action","enum":["ALLOW","BLOCK"]},"direction":{"type":"string","title":"Firewall rule direction","enum":["IN","OUT"]},"enabled":{"type":"boolean","title":"Enabled"},"location":{"type":"number","title":"Location"},"local_addresses":{"type":"array","title":"Local addresses","items":{"anyOf":[{"type":"string","description":"local IPv4 address","format":"ipv4"},{"type":"string","description":"local explicit IPv4 range","pattern":"^(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)(-)(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$"},{"type":"string","description":"local CIDR IPv4 range","pattern":"^(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)/([0-9]|[12][0-9]|3[012])$"},{"type":"string","description":"IPv6 address","format":"ipv6"},{"type":"string","description":"IPv6 range CIDR","pattern":"^(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}/[0-9]{1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,7}:/[0-9]{1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}/[0-9]{1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}/[0-9]{1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}/[0-9]{1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}/[0-9]{1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}/[0-9]{1,3}$|^[0-9a-fA-F]{1,4}:(?::[0-9a-fA-F]{1,4}){1,6}/[0-9]{1,3}$|^:(?::[0-9a-fA-F]{1,4}){1,7}/[0-9]{1,3}$|^fe80:(?::[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}/[0-9]{1,3}$|^::(?:ffff(:0{1,4}){0,1}:){0,1}((?:[0-9]{1,3}\\.){3}[0-9]{1,3})/[0-9]{1,3}$|^::/[0-9]{1,3}$"},{"type":"string","description":"explicit IPv6 range","pattern":"^(?:(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|(?:[0-9a-fA-F]{1,4}:){1,7}:|(?:[0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|(?:[0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|(?:[0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|(?:[0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|(?:[0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:(?::[0-9a-fA-F]{1,4}){1,6}|:(?::[0-9a-fA-F]{1,4}){1,7}|fe80:(?::[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(?:ffff(:0{1,4}){0,1}:){0,1}((?:[0-9]{1,3}\\.){3}[0-9]{1,3}))-(?:(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|(?:[0-9a-fA-F]{1,4}:){1,7}:|(?:[0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|(?:[0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|(?:[0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|(?:[0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|(?:[0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:(?::[0-9a-fA-F]{1,4}){1,6}|:(?::[0-9a-fA-F]{1,4}){1,7}|fe80:(?::[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(?:ffff(:0{1,4}){0,1}:){0,1}((?:[0-9]{1,3}\\.){3}[0-9]{1,3}))$"},{"type":"string","const":"LocalSubnet"}]}},"local_ports":{"type":"array","title":"Local ports","items":{"type":"string"}},"remote_addresses":{"type":"array","title":"Remote addresses","items":{"type":"string"}},"remote_ports":{"type":"array","title":"Remote ports","items":{"type":"string"}},"protocol":{"type":["integer","null"],"description":"Protocol number (1=ICMPv4, 6=TCP, 17=UDP, 58=ICMPv6, 256=ANY)","enum":[0,1,2,6,17,41,43,44,47,50,51,58,59,60,112,113,115,256]},"service":{"type":"string"},"os_type":{"type":"integer","description":"The OS type to which the rule applies. (1=workstation, 2=server, 3=both)","enum":[1,2,3]}}},{"properties":{"id":{"type":"string","title":"Firewall rule ID"},"created_at":{"type":"string","title":"Created at","format":"date-time"},"updated_at":{"type":"string","title":"Updated at","format":"date-time"},"deleted_at":{"type":"string","title":"Deleted at","format":"date-time"},"created_by":{"type":"string","title":"Created by"},"updated_by":{"type":"string","title":"Updated by"},"deleted_by":{"type":"string","title":"Deleted by"},"account_id":{"type":"string","title":"Account ID","format":"uuid"},"parent_account_id":{"type":"string","title":"Parent account ID","format":"uuid"},"etag":{"type":"string","title":"ETag"},"is_default":{"type":"boolean","title":"Indicated whether the rule is default"},"edge_traversal":{"type":"integer","title":"Edge traversal"},"icmp_types":{"type":"string","description":"ICMP types"}}}]}},"is_default":{"type":"boolean","title":"Indicated whether the ruleset is default"},"internal_name":{"type":"string","title":"Internal name"}}}]}},"policies":{"type":"array","items":{"type":"object"}},"created_at":{"type":"string","title":"Created at","format":"date-time"},"updated_at":{"type":"string","title":"Updated at","format":"date-time"},"deleted_at":{"type":"string","title":"Deleted at","format":"date-time"},"created_by":{"type":"string","title":"Created by"},"updated_by":{"type":"string","title":"Updated by"},"deleted_by":{"type":"string","title":"Deleted by"},"account_id":{"type":"string","title":"Account ID","format":"uuid"},"parent_account_id":{"type":"string","title":"Parent account ID","format":"uuid"}}}]}}}}},"tags":["Firewall Management"],"operationId":"api.rmm.post.firewall.policy"},"get":{"description":"Get firewall policies","summary":"Get firewall policies","security":[{"client_credentials":["read"]},{"user_permissions":["firewall.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}},{"name":"page_size","required":false,"in":"query","schema":{"type":"number"}},{"name":"next_cursor","required":false,"in":"query","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Get firewall policies response","properties":{"total":{"type":"number","title":"Total number of firewall policies"},"policies":{"type":"array","title":"Firewall policies","items":{"title":"Get firewall policy response","type":"object","required":["id"],"allOf":[{"type":"object","title":"Firewall policy","properties":{"name":{"type":"string","title":"Firewall policy name"},"description":{"type":"string","title":"Firewall policy description"},"allow_store":{"type":"boolean","title":"Allow store"},"enabled":{"type":"boolean","title":"Enabled controls if the agent is sent the Firewall plugin."},"profiles":{"type":"array","title":"Profiles","items":{"type":"object","title":"Firewall profile","properties":{"type":{"type":"number","title":"Firewall profile type(1=Domain, 2=Private, 4=Public)","enum":[1,2,4]},"firewall_enabled":{"type":"boolean","title":"Firewall enabled"},"inbound_mode":{"type":"string","title":"Inbound mode","enum":["ALLOW","BLOCK","BLOCK_ALL"]},"outbound_mode":{"type":"string","title":"Outbound mode","enum":["ALLOW","BLOCK"]}}}},"report_frequency":{"type":"number","title":"Report frequency in minutes","minimum":5,"default":60,"maximum":1440}}},{"properties":{"id":{"type":"string","title":"Firewall policy ID"},"rulesets":{"type":"array","title":"Rulesets","items":{"title":"Get firewall ruleset response","type":"object","required":["id"],"allOf":[{"title":"Firewall ruleset","type":"object","properties":{"name":{"type":"string","title":"Firewall ruleset name"},"description":{"type":"string","title":"Firewall ruleset description"}}},{"properties":{"id":{"type":"string","title":"Firewall rule ID"},"created_at":{"type":"string","title":"Created at","format":"date-time"},"updated_at":{"type":"string","title":"Updated at","format":"date-time"},"deleted_at":{"type":"string","title":"Deleted at","format":"date-time"},"created_by":{"type":"string","title":"Created by"},"updated_by":{"type":"string","title":"Updated by"},"deleted_by":{"type":"string","title":"Deleted by"},"account_id":{"type":"string","title":"Account ID","format":"uuid"},"parent_account_id":{"type":"string","title":"Parent account ID","format":"uuid"},"etag":{"type":"string","title":"ETag"},"rules":{"type":"array","title":"Rules","items":{"type":"object","title":"Get firewall rule response","required":["id"],"allOf":[{"type":"object","title":"Firewall rule","properties":{"name":{"type":"string","title":"Firewall rule name"},"description":{"type":"string","title":"Firewall rule description"},"program":{"type":"string","title":"Firewall rule program"},"action":{"type":"string","title":"Firewall rule action","enum":["ALLOW","BLOCK"]},"direction":{"type":"string","title":"Firewall rule direction","enum":["IN","OUT"]},"enabled":{"type":"boolean","title":"Enabled"},"location":{"type":"number","title":"Location"},"local_addresses":{"type":"array","title":"Local addresses","items":{"anyOf":[{"type":"string","description":"local IPv4 address","format":"ipv4"},{"type":"string","description":"local explicit IPv4 range","pattern":"^(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)(-)(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$"},{"type":"string","description":"local CIDR IPv4 range","pattern":"^(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)/([0-9]|[12][0-9]|3[012])$"},{"type":"string","description":"IPv6 address","format":"ipv6"},{"type":"string","description":"IPv6 range CIDR","pattern":"^(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}/[0-9]{1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,7}:/[0-9]{1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}/[0-9]{1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}/[0-9]{1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}/[0-9]{1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}/[0-9]{1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}/[0-9]{1,3}$|^[0-9a-fA-F]{1,4}:(?::[0-9a-fA-F]{1,4}){1,6}/[0-9]{1,3}$|^:(?::[0-9a-fA-F]{1,4}){1,7}/[0-9]{1,3}$|^fe80:(?::[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}/[0-9]{1,3}$|^::(?:ffff(:0{1,4}){0,1}:){0,1}((?:[0-9]{1,3}\\.){3}[0-9]{1,3})/[0-9]{1,3}$|^::/[0-9]{1,3}$"},{"type":"string","description":"explicit IPv6 range","pattern":"^(?:(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|(?:[0-9a-fA-F]{1,4}:){1,7}:|(?:[0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|(?:[0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|(?:[0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|(?:[0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|(?:[0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:(?::[0-9a-fA-F]{1,4}){1,6}|:(?::[0-9a-fA-F]{1,4}){1,7}|fe80:(?::[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(?:ffff(:0{1,4}){0,1}:){0,1}((?:[0-9]{1,3}\\.){3}[0-9]{1,3}))-(?:(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|(?:[0-9a-fA-F]{1,4}:){1,7}:|(?:[0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|(?:[0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|(?:[0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|(?:[0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|(?:[0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:(?::[0-9a-fA-F]{1,4}){1,6}|:(?::[0-9a-fA-F]{1,4}){1,7}|fe80:(?::[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(?:ffff(:0{1,4}){0,1}:){0,1}((?:[0-9]{1,3}\\.){3}[0-9]{1,3}))$"},{"type":"string","const":"LocalSubnet"}]}},"local_ports":{"type":"array","title":"Local ports","items":{"type":"string"}},"remote_addresses":{"type":"array","title":"Remote addresses","items":{"type":"string"}},"remote_ports":{"type":"array","title":"Remote ports","items":{"type":"string"}},"protocol":{"type":["integer","null"],"description":"Protocol number (1=ICMPv4, 6=TCP, 17=UDP, 58=ICMPv6, 256=ANY)","enum":[0,1,2,6,17,41,43,44,47,50,51,58,59,60,112,113,115,256]},"service":{"type":"string"},"os_type":{"type":"integer","description":"The OS type to which the rule applies. (1=workstation, 2=server, 3=both)","enum":[1,2,3]}}},{"properties":{"id":{"type":"string","title":"Firewall rule ID"},"created_at":{"type":"string","title":"Created at","format":"date-time"},"updated_at":{"type":"string","title":"Updated at","format":"date-time"},"deleted_at":{"type":"string","title":"Deleted at","format":"date-time"},"created_by":{"type":"string","title":"Created by"},"updated_by":{"type":"string","title":"Updated by"},"deleted_by":{"type":"string","title":"Deleted by"},"account_id":{"type":"string","title":"Account ID","format":"uuid"},"parent_account_id":{"type":"string","title":"Parent account ID","format":"uuid"},"etag":{"type":"string","title":"ETag"},"is_default":{"type":"boolean","title":"Indicated whether the rule is default"},"edge_traversal":{"type":"integer","title":"Edge traversal"},"icmp_types":{"type":"string","description":"ICMP types"}}}]}},"is_default":{"type":"boolean","title":"Indicated whether the ruleset is default"},"internal_name":{"type":"string","title":"Internal name"}}}]}},"policies":{"type":"array","items":{"type":"object"}},"created_at":{"type":"string","title":"Created at","format":"date-time"},"updated_at":{"type":"string","title":"Updated at","format":"date-time"},"deleted_at":{"type":"string","title":"Deleted at","format":"date-time"},"created_by":{"type":"string","title":"Created by"},"updated_by":{"type":"string","title":"Updated by"},"deleted_by":{"type":"string","title":"Deleted by"},"account_id":{"type":"string","title":"Account ID","format":"uuid"},"parent_account_id":{"type":"string","title":"Parent account ID","format":"uuid"}}}]}}}}}}}},"tags":["Firewall Management"],"operationId":"api.rmm.get.firewall.policies"}},"/oneview/v1/accounts/{account_id}/firewall/rules":{"post":{"description":"Create a new firewall rule","summary":"Create a new firewall rule","security":[{"client_credentials":["write"]},{"user_permissions":["firewall.createPolicy"]}],"status":{"outage":["auth"]},"parameters":[{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Create firewall rule","required":["name","action","direction","enabled","os_type"],"allOf":[{"type":"object","title":"Firewall rule","properties":{"name":{"type":"string","title":"Firewall rule name"},"description":{"type":"string","title":"Firewall rule description"},"program":{"type":"string","title":"Firewall rule program"},"action":{"type":"string","title":"Firewall rule action","enum":["ALLOW","BLOCK"]},"direction":{"type":"string","title":"Firewall rule direction","enum":["IN","OUT"]},"enabled":{"type":"boolean","title":"Enabled"},"location":{"type":"number","title":"Location"},"local_addresses":{"type":"array","title":"Local addresses","items":{"anyOf":[{"type":"string","description":"local IPv4 address","format":"ipv4"},{"type":"string","description":"local explicit IPv4 range","pattern":"^(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)(-)(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$"},{"type":"string","description":"local CIDR IPv4 range","pattern":"^(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)/([0-9]|[12][0-9]|3[012])$"},{"type":"string","description":"IPv6 address","format":"ipv6"},{"type":"string","description":"IPv6 range CIDR","pattern":"^(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}/[0-9]{1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,7}:/[0-9]{1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}/[0-9]{1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}/[0-9]{1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}/[0-9]{1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}/[0-9]{1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}/[0-9]{1,3}$|^[0-9a-fA-F]{1,4}:(?::[0-9a-fA-F]{1,4}){1,6}/[0-9]{1,3}$|^:(?::[0-9a-fA-F]{1,4}){1,7}/[0-9]{1,3}$|^fe80:(?::[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}/[0-9]{1,3}$|^::(?:ffff(:0{1,4}){0,1}:){0,1}((?:[0-9]{1,3}\\.){3}[0-9]{1,3})/[0-9]{1,3}$|^::/[0-9]{1,3}$"},{"type":"string","description":"explicit IPv6 range","pattern":"^(?:(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|(?:[0-9a-fA-F]{1,4}:){1,7}:|(?:[0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|(?:[0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|(?:[0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|(?:[0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|(?:[0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:(?::[0-9a-fA-F]{1,4}){1,6}|:(?::[0-9a-fA-F]{1,4}){1,7}|fe80:(?::[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(?:ffff(:0{1,4}){0,1}:){0,1}((?:[0-9]{1,3}\\.){3}[0-9]{1,3}))-(?:(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|(?:[0-9a-fA-F]{1,4}:){1,7}:|(?:[0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|(?:[0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|(?:[0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|(?:[0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|(?:[0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:(?::[0-9a-fA-F]{1,4}){1,6}|:(?::[0-9a-fA-F]{1,4}){1,7}|fe80:(?::[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(?:ffff(:0{1,4}){0,1}:){0,1}((?:[0-9]{1,3}\\.){3}[0-9]{1,3}))$"},{"type":"string","const":"LocalSubnet"}]}},"local_ports":{"type":"array","title":"Local ports","items":{"type":"string"}},"remote_addresses":{"type":"array","title":"Remote addresses","items":{"type":"string"}},"remote_ports":{"type":"array","title":"Remote ports","items":{"type":"string"}},"protocol":{"type":["integer","null"],"description":"Protocol number (1=ICMPv4, 6=TCP, 17=UDP, 58=ICMPv6, 256=ANY)","enum":[0,1,2,6,17,41,43,44,47,50,51,58,59,60,112,113,115,256]},"service":{"type":"string"},"os_type":{"type":"integer","description":"The OS type to which the rule applies. (1=workstation, 2=server, 3=both)","enum":[1,2,3]}}},{"properties":{"protocol":{"type":"integer","description":"Protocol number (1=ICMPv4, 6=TCP, 17=UDP, 58=ICMPv6, 256=ANY)","enum":[0,1,2,6,17,41,43,44,47,50,51,58,59,60,112,113,115,256],"default":256},"rulesets":{"type":"array","title":"Ruleset IDs","items":{"type":"string"}}}}]}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Get firewall rule response","required":["id"],"allOf":[{"type":"object","title":"Firewall rule","properties":{"name":{"type":"string","title":"Firewall rule name"},"description":{"type":"string","title":"Firewall rule description"},"program":{"type":"string","title":"Firewall rule program"},"action":{"type":"string","title":"Firewall rule action","enum":["ALLOW","BLOCK"]},"direction":{"type":"string","title":"Firewall rule direction","enum":["IN","OUT"]},"enabled":{"type":"boolean","title":"Enabled"},"location":{"type":"number","title":"Location"},"local_addresses":{"type":"array","title":"Local addresses","items":{"anyOf":[{"type":"string","description":"local IPv4 address","format":"ipv4"},{"type":"string","description":"local explicit IPv4 range","pattern":"^(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)(-)(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$"},{"type":"string","description":"local CIDR IPv4 range","pattern":"^(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)/([0-9]|[12][0-9]|3[012])$"},{"type":"string","description":"IPv6 address","format":"ipv6"},{"type":"string","description":"IPv6 range CIDR","pattern":"^(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}/[0-9]{1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,7}:/[0-9]{1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}/[0-9]{1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}/[0-9]{1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}/[0-9]{1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}/[0-9]{1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}/[0-9]{1,3}$|^[0-9a-fA-F]{1,4}:(?::[0-9a-fA-F]{1,4}){1,6}/[0-9]{1,3}$|^:(?::[0-9a-fA-F]{1,4}){1,7}/[0-9]{1,3}$|^fe80:(?::[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}/[0-9]{1,3}$|^::(?:ffff(:0{1,4}){0,1}:){0,1}((?:[0-9]{1,3}\\.){3}[0-9]{1,3})/[0-9]{1,3}$|^::/[0-9]{1,3}$"},{"type":"string","description":"explicit IPv6 range","pattern":"^(?:(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|(?:[0-9a-fA-F]{1,4}:){1,7}:|(?:[0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|(?:[0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|(?:[0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|(?:[0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|(?:[0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:(?::[0-9a-fA-F]{1,4}){1,6}|:(?::[0-9a-fA-F]{1,4}){1,7}|fe80:(?::[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(?:ffff(:0{1,4}){0,1}:){0,1}((?:[0-9]{1,3}\\.){3}[0-9]{1,3}))-(?:(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|(?:[0-9a-fA-F]{1,4}:){1,7}:|(?:[0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|(?:[0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|(?:[0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|(?:[0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|(?:[0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:(?::[0-9a-fA-F]{1,4}){1,6}|:(?::[0-9a-fA-F]{1,4}){1,7}|fe80:(?::[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(?:ffff(:0{1,4}){0,1}:){0,1}((?:[0-9]{1,3}\\.){3}[0-9]{1,3}))$"},{"type":"string","const":"LocalSubnet"}]}},"local_ports":{"type":"array","title":"Local ports","items":{"type":"string"}},"remote_addresses":{"type":"array","title":"Remote addresses","items":{"type":"string"}},"remote_ports":{"type":"array","title":"Remote ports","items":{"type":"string"}},"protocol":{"type":["integer","null"],"description":"Protocol number (1=ICMPv4, 6=TCP, 17=UDP, 58=ICMPv6, 256=ANY)","enum":[0,1,2,6,17,41,43,44,47,50,51,58,59,60,112,113,115,256]},"service":{"type":"string"},"os_type":{"type":"integer","description":"The OS type to which the rule applies. (1=workstation, 2=server, 3=both)","enum":[1,2,3]}}},{"properties":{"id":{"type":"string","title":"Firewall rule ID"},"created_at":{"type":"string","title":"Created at","format":"date-time"},"updated_at":{"type":"string","title":"Updated at","format":"date-time"},"deleted_at":{"type":"string","title":"Deleted at","format":"date-time"},"created_by":{"type":"string","title":"Created by"},"updated_by":{"type":"string","title":"Updated by"},"deleted_by":{"type":"string","title":"Deleted by"},"account_id":{"type":"string","title":"Account ID","format":"uuid"},"parent_account_id":{"type":"string","title":"Parent account ID","format":"uuid"},"etag":{"type":"string","title":"ETag"},"is_default":{"type":"boolean","title":"Indicated whether the rule is default"},"edge_traversal":{"type":"integer","title":"Edge traversal"},"icmp_types":{"type":"string","description":"ICMP types"}}}]}}}}},"tags":["Firewall Management"],"operationId":"api.rmm.post.firewall.rule"},"get":{"description":"Get firewall rules","summary":"Get firewall rules","security":[{"client_credentials":["read"]},{"user_permissions":["firewall.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}},{"name":"page_size","required":false,"in":"query","schema":{"type":"number"}},{"name":"next_cursor","required":false,"in":"query","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Get firewall rules response","properties":{"total":{"type":"number","title":"Total number of firewall rules"},"rules":{"type":"array","title":"Firewall rules","items":{"type":"object","title":"Get firewall rule response","required":["id"],"allOf":[{"type":"object","title":"Firewall rule","properties":{"name":{"type":"string","title":"Firewall rule name"},"description":{"type":"string","title":"Firewall rule description"},"program":{"type":"string","title":"Firewall rule program"},"action":{"type":"string","title":"Firewall rule action","enum":["ALLOW","BLOCK"]},"direction":{"type":"string","title":"Firewall rule direction","enum":["IN","OUT"]},"enabled":{"type":"boolean","title":"Enabled"},"location":{"type":"number","title":"Location"},"local_addresses":{"type":"array","title":"Local addresses","items":{"anyOf":[{"type":"string","description":"local IPv4 address","format":"ipv4"},{"type":"string","description":"local explicit IPv4 range","pattern":"^(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)(-)(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$"},{"type":"string","description":"local CIDR IPv4 range","pattern":"^(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)/([0-9]|[12][0-9]|3[012])$"},{"type":"string","description":"IPv6 address","format":"ipv6"},{"type":"string","description":"IPv6 range CIDR","pattern":"^(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}/[0-9]{1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,7}:/[0-9]{1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}/[0-9]{1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}/[0-9]{1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}/[0-9]{1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}/[0-9]{1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}/[0-9]{1,3}$|^[0-9a-fA-F]{1,4}:(?::[0-9a-fA-F]{1,4}){1,6}/[0-9]{1,3}$|^:(?::[0-9a-fA-F]{1,4}){1,7}/[0-9]{1,3}$|^fe80:(?::[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}/[0-9]{1,3}$|^::(?:ffff(:0{1,4}){0,1}:){0,1}((?:[0-9]{1,3}\\.){3}[0-9]{1,3})/[0-9]{1,3}$|^::/[0-9]{1,3}$"},{"type":"string","description":"explicit IPv6 range","pattern":"^(?:(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|(?:[0-9a-fA-F]{1,4}:){1,7}:|(?:[0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|(?:[0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|(?:[0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|(?:[0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|(?:[0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:(?::[0-9a-fA-F]{1,4}){1,6}|:(?::[0-9a-fA-F]{1,4}){1,7}|fe80:(?::[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(?:ffff(:0{1,4}){0,1}:){0,1}((?:[0-9]{1,3}\\.){3}[0-9]{1,3}))-(?:(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|(?:[0-9a-fA-F]{1,4}:){1,7}:|(?:[0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|(?:[0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|(?:[0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|(?:[0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|(?:[0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:(?::[0-9a-fA-F]{1,4}){1,6}|:(?::[0-9a-fA-F]{1,4}){1,7}|fe80:(?::[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(?:ffff(:0{1,4}){0,1}:){0,1}((?:[0-9]{1,3}\\.){3}[0-9]{1,3}))$"},{"type":"string","const":"LocalSubnet"}]}},"local_ports":{"type":"array","title":"Local ports","items":{"type":"string"}},"remote_addresses":{"type":"array","title":"Remote addresses","items":{"type":"string"}},"remote_ports":{"type":"array","title":"Remote ports","items":{"type":"string"}},"protocol":{"type":["integer","null"],"description":"Protocol number (1=ICMPv4, 6=TCP, 17=UDP, 58=ICMPv6, 256=ANY)","enum":[0,1,2,6,17,41,43,44,47,50,51,58,59,60,112,113,115,256]},"service":{"type":"string"},"os_type":{"type":"integer","description":"The OS type to which the rule applies. (1=workstation, 2=server, 3=both)","enum":[1,2,3]}}},{"properties":{"id":{"type":"string","title":"Firewall rule ID"},"created_at":{"type":"string","title":"Created at","format":"date-time"},"updated_at":{"type":"string","title":"Updated at","format":"date-time"},"deleted_at":{"type":"string","title":"Deleted at","format":"date-time"},"created_by":{"type":"string","title":"Created by"},"updated_by":{"type":"string","title":"Updated by"},"deleted_by":{"type":"string","title":"Deleted by"},"account_id":{"type":"string","title":"Account ID","format":"uuid"},"parent_account_id":{"type":"string","title":"Parent account ID","format":"uuid"},"etag":{"type":"string","title":"ETag"},"is_default":{"type":"boolean","title":"Indicated whether the rule is default"},"edge_traversal":{"type":"integer","title":"Edge traversal"},"icmp_types":{"type":"string","description":"ICMP types"}}}]}}}}}}}},"tags":["Firewall Management"],"operationId":"api.rmm.get.firewall.rules"}},"/oneview/v1/accounts/{account_id}/firewall/rulesets":{"post":{"description":"Create a new firewall ruleset","summary":"Create a new firewall ruleset","security":[{"client_credentials":["write"]},{"user_permissions":["firewall.createPolicy"]}],"status":{"outage":["auth"]},"parameters":[{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Create firewall ruleset","required":["name"],"allOf":[{"title":"Firewall ruleset","type":"object","properties":{"name":{"type":"string","title":"Firewall ruleset name"},"description":{"type":"string","title":"Firewall ruleset description"}}},{"properties":{"rules":{"type":"array","title":"Rule IDs","items":{"type":"string","format":"uuid"}},"firewall_policies":{"type":"array","title":"Firewall policy IDs","items":{"type":"string","format":"uuid"}}}}]}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"title":"Get firewall ruleset response","type":"object","required":["id"],"allOf":[{"title":"Firewall ruleset","type":"object","properties":{"name":{"type":"string","title":"Firewall ruleset name"},"description":{"type":"string","title":"Firewall ruleset description"}}},{"properties":{"id":{"type":"string","title":"Firewall rule ID"},"created_at":{"type":"string","title":"Created at","format":"date-time"},"updated_at":{"type":"string","title":"Updated at","format":"date-time"},"deleted_at":{"type":"string","title":"Deleted at","format":"date-time"},"created_by":{"type":"string","title":"Created by"},"updated_by":{"type":"string","title":"Updated by"},"deleted_by":{"type":"string","title":"Deleted by"},"account_id":{"type":"string","title":"Account ID","format":"uuid"},"parent_account_id":{"type":"string","title":"Parent account ID","format":"uuid"},"etag":{"type":"string","title":"ETag"},"rules":{"type":"array","title":"Rules","items":{"type":"object","title":"Get firewall rule response","required":["id"],"allOf":[{"type":"object","title":"Firewall rule","properties":{"name":{"type":"string","title":"Firewall rule name"},"description":{"type":"string","title":"Firewall rule description"},"program":{"type":"string","title":"Firewall rule program"},"action":{"type":"string","title":"Firewall rule action","enum":["ALLOW","BLOCK"]},"direction":{"type":"string","title":"Firewall rule direction","enum":["IN","OUT"]},"enabled":{"type":"boolean","title":"Enabled"},"location":{"type":"number","title":"Location"},"local_addresses":{"type":"array","title":"Local addresses","items":{"anyOf":[{"type":"string","description":"local IPv4 address","format":"ipv4"},{"type":"string","description":"local explicit IPv4 range","pattern":"^(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)(-)(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$"},{"type":"string","description":"local CIDR IPv4 range","pattern":"^(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)/([0-9]|[12][0-9]|3[012])$"},{"type":"string","description":"IPv6 address","format":"ipv6"},{"type":"string","description":"IPv6 range CIDR","pattern":"^(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}/[0-9]{1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,7}:/[0-9]{1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}/[0-9]{1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}/[0-9]{1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}/[0-9]{1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}/[0-9]{1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}/[0-9]{1,3}$|^[0-9a-fA-F]{1,4}:(?::[0-9a-fA-F]{1,4}){1,6}/[0-9]{1,3}$|^:(?::[0-9a-fA-F]{1,4}){1,7}/[0-9]{1,3}$|^fe80:(?::[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}/[0-9]{1,3}$|^::(?:ffff(:0{1,4}){0,1}:){0,1}((?:[0-9]{1,3}\\.){3}[0-9]{1,3})/[0-9]{1,3}$|^::/[0-9]{1,3}$"},{"type":"string","description":"explicit IPv6 range","pattern":"^(?:(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|(?:[0-9a-fA-F]{1,4}:){1,7}:|(?:[0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|(?:[0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|(?:[0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|(?:[0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|(?:[0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:(?::[0-9a-fA-F]{1,4}){1,6}|:(?::[0-9a-fA-F]{1,4}){1,7}|fe80:(?::[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(?:ffff(:0{1,4}){0,1}:){0,1}((?:[0-9]{1,3}\\.){3}[0-9]{1,3}))-(?:(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|(?:[0-9a-fA-F]{1,4}:){1,7}:|(?:[0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|(?:[0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|(?:[0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|(?:[0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|(?:[0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:(?::[0-9a-fA-F]{1,4}){1,6}|:(?::[0-9a-fA-F]{1,4}){1,7}|fe80:(?::[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(?:ffff(:0{1,4}){0,1}:){0,1}((?:[0-9]{1,3}\\.){3}[0-9]{1,3}))$"},{"type":"string","const":"LocalSubnet"}]}},"local_ports":{"type":"array","title":"Local ports","items":{"type":"string"}},"remote_addresses":{"type":"array","title":"Remote addresses","items":{"type":"string"}},"remote_ports":{"type":"array","title":"Remote ports","items":{"type":"string"}},"protocol":{"type":["integer","null"],"description":"Protocol number (1=ICMPv4, 6=TCP, 17=UDP, 58=ICMPv6, 256=ANY)","enum":[0,1,2,6,17,41,43,44,47,50,51,58,59,60,112,113,115,256]},"service":{"type":"string"},"os_type":{"type":"integer","description":"The OS type to which the rule applies. (1=workstation, 2=server, 3=both)","enum":[1,2,3]}}},{"properties":{"id":{"type":"string","title":"Firewall rule ID"},"created_at":{"type":"string","title":"Created at","format":"date-time"},"updated_at":{"type":"string","title":"Updated at","format":"date-time"},"deleted_at":{"type":"string","title":"Deleted at","format":"date-time"},"created_by":{"type":"string","title":"Created by"},"updated_by":{"type":"string","title":"Updated by"},"deleted_by":{"type":"string","title":"Deleted by"},"account_id":{"type":"string","title":"Account ID","format":"uuid"},"parent_account_id":{"type":"string","title":"Parent account ID","format":"uuid"},"etag":{"type":"string","title":"ETag"},"is_default":{"type":"boolean","title":"Indicated whether the rule is default"},"edge_traversal":{"type":"integer","title":"Edge traversal"},"icmp_types":{"type":"string","description":"ICMP types"}}}]}},"is_default":{"type":"boolean","title":"Indicated whether the ruleset is default"},"internal_name":{"type":"string","title":"Internal name"}}}]}}}}},"tags":["Firewall Management"],"operationId":"api.rmm.post.firewall.ruleset"},"get":{"description":"Get firewall rulesets","summary":"Get firewall rulesets","security":[{"client_credentials":["read"]},{"user_permissions":["firewall.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}},{"name":"page_size","required":false,"in":"query","schema":{"type":"number"}},{"name":"next_cursor","required":false,"in":"query","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Get firewall rulesets response","properties":{"total":{"type":"number","title":"Total number of firewall rulesets"},"rulesets":{"type":"array","title":"Firewall rulesets","items":{"title":"Get firewall ruleset response","type":"object","required":["id"],"allOf":[{"title":"Firewall ruleset","type":"object","properties":{"name":{"type":"string","title":"Firewall ruleset name"},"description":{"type":"string","title":"Firewall ruleset description"}}},{"properties":{"id":{"type":"string","title":"Firewall rule ID"},"created_at":{"type":"string","title":"Created at","format":"date-time"},"updated_at":{"type":"string","title":"Updated at","format":"date-time"},"deleted_at":{"type":"string","title":"Deleted at","format":"date-time"},"created_by":{"type":"string","title":"Created by"},"updated_by":{"type":"string","title":"Updated by"},"deleted_by":{"type":"string","title":"Deleted by"},"account_id":{"type":"string","title":"Account ID","format":"uuid"},"parent_account_id":{"type":"string","title":"Parent account ID","format":"uuid"},"etag":{"type":"string","title":"ETag"},"rules":{"type":"array","title":"Rules","items":{"type":"object","title":"Get firewall rule response","required":["id"],"allOf":[{"type":"object","title":"Firewall rule","properties":{"name":{"type":"string","title":"Firewall rule name"},"description":{"type":"string","title":"Firewall rule description"},"program":{"type":"string","title":"Firewall rule program"},"action":{"type":"string","title":"Firewall rule action","enum":["ALLOW","BLOCK"]},"direction":{"type":"string","title":"Firewall rule direction","enum":["IN","OUT"]},"enabled":{"type":"boolean","title":"Enabled"},"location":{"type":"number","title":"Location"},"local_addresses":{"type":"array","title":"Local addresses","items":{"anyOf":[{"type":"string","description":"local IPv4 address","format":"ipv4"},{"type":"string","description":"local explicit IPv4 range","pattern":"^(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)(-)(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$"},{"type":"string","description":"local CIDR IPv4 range","pattern":"^(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)/([0-9]|[12][0-9]|3[012])$"},{"type":"string","description":"IPv6 address","format":"ipv6"},{"type":"string","description":"IPv6 range CIDR","pattern":"^(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}/[0-9]{1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,7}:/[0-9]{1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}/[0-9]{1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}/[0-9]{1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}/[0-9]{1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}/[0-9]{1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}/[0-9]{1,3}$|^[0-9a-fA-F]{1,4}:(?::[0-9a-fA-F]{1,4}){1,6}/[0-9]{1,3}$|^:(?::[0-9a-fA-F]{1,4}){1,7}/[0-9]{1,3}$|^fe80:(?::[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}/[0-9]{1,3}$|^::(?:ffff(:0{1,4}){0,1}:){0,1}((?:[0-9]{1,3}\\.){3}[0-9]{1,3})/[0-9]{1,3}$|^::/[0-9]{1,3}$"},{"type":"string","description":"explicit IPv6 range","pattern":"^(?:(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|(?:[0-9a-fA-F]{1,4}:){1,7}:|(?:[0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|(?:[0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|(?:[0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|(?:[0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|(?:[0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:(?::[0-9a-fA-F]{1,4}){1,6}|:(?::[0-9a-fA-F]{1,4}){1,7}|fe80:(?::[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(?:ffff(:0{1,4}){0,1}:){0,1}((?:[0-9]{1,3}\\.){3}[0-9]{1,3}))-(?:(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|(?:[0-9a-fA-F]{1,4}:){1,7}:|(?:[0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|(?:[0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|(?:[0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|(?:[0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|(?:[0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:(?::[0-9a-fA-F]{1,4}){1,6}|:(?::[0-9a-fA-F]{1,4}){1,7}|fe80:(?::[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(?:ffff(:0{1,4}){0,1}:){0,1}((?:[0-9]{1,3}\\.){3}[0-9]{1,3}))$"},{"type":"string","const":"LocalSubnet"}]}},"local_ports":{"type":"array","title":"Local ports","items":{"type":"string"}},"remote_addresses":{"type":"array","title":"Remote addresses","items":{"type":"string"}},"remote_ports":{"type":"array","title":"Remote ports","items":{"type":"string"}},"protocol":{"type":["integer","null"],"description":"Protocol number (1=ICMPv4, 6=TCP, 17=UDP, 58=ICMPv6, 256=ANY)","enum":[0,1,2,6,17,41,43,44,47,50,51,58,59,60,112,113,115,256]},"service":{"type":"string"},"os_type":{"type":"integer","description":"The OS type to which the rule applies. (1=workstation, 2=server, 3=both)","enum":[1,2,3]}}},{"properties":{"id":{"type":"string","title":"Firewall rule ID"},"created_at":{"type":"string","title":"Created at","format":"date-time"},"updated_at":{"type":"string","title":"Updated at","format":"date-time"},"deleted_at":{"type":"string","title":"Deleted at","format":"date-time"},"created_by":{"type":"string","title":"Created by"},"updated_by":{"type":"string","title":"Updated by"},"deleted_by":{"type":"string","title":"Deleted by"},"account_id":{"type":"string","title":"Account ID","format":"uuid"},"parent_account_id":{"type":"string","title":"Parent account ID","format":"uuid"},"etag":{"type":"string","title":"ETag"},"is_default":{"type":"boolean","title":"Indicated whether the rule is default"},"edge_traversal":{"type":"integer","title":"Edge traversal"},"icmp_types":{"type":"string","description":"ICMP types"}}}]}},"is_default":{"type":"boolean","title":"Indicated whether the ruleset is default"},"internal_name":{"type":"string","title":"Internal name"}}}]}}}}}}}},"tags":["Firewall Management"],"operationId":"api.rmm.get.firewall.rulesets"}},"/oneview/v1/accounts/{account_id}/firewall/policies/{id}":{"delete":{"description":"Delete a firewall policy","summary":"Delete a firewall policy","security":[{"client_credentials":["write"]},{"user_permissions":["firewall.deletePolicy"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":true,"in":"path","description":"ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"Successful response"}},"tags":["Firewall Management"],"operationId":"api.rmm.delete.firewall.policy"},"get":{"description":"Get a firewall policy","summary":"Get a firewall policy","security":[{"client_credentials":["read"]},{"user_permissions":["firewall.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":true,"in":"path","description":"ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}},{"name":"fields[firewall_policy]","required":false,"in":"query","description":"Specify which fields will be included in the response. Formatted as comma separated list of fields. Allowed fields are: id, created_at, updated_at, created_by, updated_by, account_id, parent_account_id, name, description, profiles, allow_store, report_frequency, version.","schema":{"type":"string","pattern":"^((?:id|created_at|updated_at|created_by|updated_by|account_id|parent_account_id|name|description|profiles|allow_store|report_frequency|version|enabled)(?:,|$))+$"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"title":"Get firewall policy response","type":"object","required":["id"],"allOf":[{"type":"object","title":"Firewall policy","properties":{"name":{"type":"string","title":"Firewall policy name"},"description":{"type":"string","title":"Firewall policy description"},"allow_store":{"type":"boolean","title":"Allow store"},"enabled":{"type":"boolean","title":"Enabled controls if the agent is sent the Firewall plugin."},"profiles":{"type":"array","title":"Profiles","items":{"type":"object","title":"Firewall profile","properties":{"type":{"type":"number","title":"Firewall profile type(1=Domain, 2=Private, 4=Public)","enum":[1,2,4]},"firewall_enabled":{"type":"boolean","title":"Firewall enabled"},"inbound_mode":{"type":"string","title":"Inbound mode","enum":["ALLOW","BLOCK","BLOCK_ALL"]},"outbound_mode":{"type":"string","title":"Outbound mode","enum":["ALLOW","BLOCK"]}}}},"report_frequency":{"type":"number","title":"Report frequency in minutes","minimum":5,"default":60,"maximum":1440}}},{"properties":{"id":{"type":"string","title":"Firewall policy ID"},"rulesets":{"type":"array","title":"Rulesets","items":{"title":"Get firewall ruleset response","type":"object","required":["id"],"allOf":[{"title":"Firewall ruleset","type":"object","properties":{"name":{"type":"string","title":"Firewall ruleset name"},"description":{"type":"string","title":"Firewall ruleset description"}}},{"properties":{"id":{"type":"string","title":"Firewall rule ID"},"created_at":{"type":"string","title":"Created at","format":"date-time"},"updated_at":{"type":"string","title":"Updated at","format":"date-time"},"deleted_at":{"type":"string","title":"Deleted at","format":"date-time"},"created_by":{"type":"string","title":"Created by"},"updated_by":{"type":"string","title":"Updated by"},"deleted_by":{"type":"string","title":"Deleted by"},"account_id":{"type":"string","title":"Account ID","format":"uuid"},"parent_account_id":{"type":"string","title":"Parent account ID","format":"uuid"},"etag":{"type":"string","title":"ETag"},"rules":{"type":"array","title":"Rules","items":{"type":"object","title":"Get firewall rule response","required":["id"],"allOf":[{"type":"object","title":"Firewall rule","properties":{"name":{"type":"string","title":"Firewall rule name"},"description":{"type":"string","title":"Firewall rule description"},"program":{"type":"string","title":"Firewall rule program"},"action":{"type":"string","title":"Firewall rule action","enum":["ALLOW","BLOCK"]},"direction":{"type":"string","title":"Firewall rule direction","enum":["IN","OUT"]},"enabled":{"type":"boolean","title":"Enabled"},"location":{"type":"number","title":"Location"},"local_addresses":{"type":"array","title":"Local addresses","items":{"anyOf":[{"type":"string","description":"local IPv4 address","format":"ipv4"},{"type":"string","description":"local explicit IPv4 range","pattern":"^(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)(-)(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$"},{"type":"string","description":"local CIDR IPv4 range","pattern":"^(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)/([0-9]|[12][0-9]|3[012])$"},{"type":"string","description":"IPv6 address","format":"ipv6"},{"type":"string","description":"IPv6 range CIDR","pattern":"^(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}/[0-9]{1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,7}:/[0-9]{1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}/[0-9]{1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}/[0-9]{1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}/[0-9]{1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}/[0-9]{1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}/[0-9]{1,3}$|^[0-9a-fA-F]{1,4}:(?::[0-9a-fA-F]{1,4}){1,6}/[0-9]{1,3}$|^:(?::[0-9a-fA-F]{1,4}){1,7}/[0-9]{1,3}$|^fe80:(?::[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}/[0-9]{1,3}$|^::(?:ffff(:0{1,4}){0,1}:){0,1}((?:[0-9]{1,3}\\.){3}[0-9]{1,3})/[0-9]{1,3}$|^::/[0-9]{1,3}$"},{"type":"string","description":"explicit IPv6 range","pattern":"^(?:(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|(?:[0-9a-fA-F]{1,4}:){1,7}:|(?:[0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|(?:[0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|(?:[0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|(?:[0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|(?:[0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:(?::[0-9a-fA-F]{1,4}){1,6}|:(?::[0-9a-fA-F]{1,4}){1,7}|fe80:(?::[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(?:ffff(:0{1,4}){0,1}:){0,1}((?:[0-9]{1,3}\\.){3}[0-9]{1,3}))-(?:(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|(?:[0-9a-fA-F]{1,4}:){1,7}:|(?:[0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|(?:[0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|(?:[0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|(?:[0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|(?:[0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:(?::[0-9a-fA-F]{1,4}){1,6}|:(?::[0-9a-fA-F]{1,4}){1,7}|fe80:(?::[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(?:ffff(:0{1,4}){0,1}:){0,1}((?:[0-9]{1,3}\\.){3}[0-9]{1,3}))$"},{"type":"string","const":"LocalSubnet"}]}},"local_ports":{"type":"array","title":"Local ports","items":{"type":"string"}},"remote_addresses":{"type":"array","title":"Remote addresses","items":{"type":"string"}},"remote_ports":{"type":"array","title":"Remote ports","items":{"type":"string"}},"protocol":{"type":["integer","null"],"description":"Protocol number (1=ICMPv4, 6=TCP, 17=UDP, 58=ICMPv6, 256=ANY)","enum":[0,1,2,6,17,41,43,44,47,50,51,58,59,60,112,113,115,256]},"service":{"type":"string"},"os_type":{"type":"integer","description":"The OS type to which the rule applies. (1=workstation, 2=server, 3=both)","enum":[1,2,3]}}},{"properties":{"id":{"type":"string","title":"Firewall rule ID"},"created_at":{"type":"string","title":"Created at","format":"date-time"},"updated_at":{"type":"string","title":"Updated at","format":"date-time"},"deleted_at":{"type":"string","title":"Deleted at","format":"date-time"},"created_by":{"type":"string","title":"Created by"},"updated_by":{"type":"string","title":"Updated by"},"deleted_by":{"type":"string","title":"Deleted by"},"account_id":{"type":"string","title":"Account ID","format":"uuid"},"parent_account_id":{"type":"string","title":"Parent account ID","format":"uuid"},"etag":{"type":"string","title":"ETag"},"is_default":{"type":"boolean","title":"Indicated whether the rule is default"},"edge_traversal":{"type":"integer","title":"Edge traversal"},"icmp_types":{"type":"string","description":"ICMP types"}}}]}},"is_default":{"type":"boolean","title":"Indicated whether the ruleset is default"},"internal_name":{"type":"string","title":"Internal name"}}}]}},"policies":{"type":"array","items":{"type":"object"}},"created_at":{"type":"string","title":"Created at","format":"date-time"},"updated_at":{"type":"string","title":"Updated at","format":"date-time"},"deleted_at":{"type":"string","title":"Deleted at","format":"date-time"},"created_by":{"type":"string","title":"Created by"},"updated_by":{"type":"string","title":"Updated by"},"deleted_by":{"type":"string","title":"Deleted by"},"account_id":{"type":"string","title":"Account ID","format":"uuid"},"parent_account_id":{"type":"string","title":"Parent account ID","format":"uuid"}}}]}}}}},"tags":["Firewall Management"],"operationId":"api.rmm.get.firewall.policy"},"put":{"description":"Update a firewall policy","summary":"Update a firewall policy","security":[{"client_credentials":["write"]},{"user_permissions":["firewall.editPolicy"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":true,"in":"path","description":"ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}},{"name":"fields[firewall_policy]","required":false,"in":"query","description":"Specify which fields will be included in the response. Formatted as comma separated list of fields. Allowed fields are: id, created_at, updated_at, created_by, updated_by, account_id, parent_account_id, name, description, profiles, allow_store, report_frequency, version.","schema":{"type":"string","pattern":"^((?:id|created_at|updated_at|created_by|updated_by|account_id|parent_account_id|name|description|profiles|allow_store|report_frequency|version|enabled)(?:,|$))+$"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Create firewall policy","anyOf":[{"required":["name"]},{"required":["description"]},{"required":["profiles"]},{"required":["allow_store"]},{"required":["enabled"]},{"required":["report_frequency"]}],"allOf":[{"type":"object","title":"Firewall policy","properties":{"name":{"type":"string","title":"Firewall policy name"},"description":{"type":"string","title":"Firewall policy description"},"allow_store":{"type":"boolean","title":"Allow store"},"enabled":{"type":"boolean","title":"Enabled controls if the agent is sent the Firewall plugin."},"profiles":{"type":"array","title":"Profiles","items":{"type":"object","title":"Firewall profile","properties":{"type":{"type":"number","title":"Firewall profile type(1=Domain, 2=Private, 4=Public)","enum":[1,2,4]},"firewall_enabled":{"type":"boolean","title":"Firewall enabled"},"inbound_mode":{"type":"string","title":"Inbound mode","enum":["ALLOW","BLOCK","BLOCK_ALL"]},"outbound_mode":{"type":"string","title":"Outbound mode","enum":["ALLOW","BLOCK"]}}}},"report_frequency":{"type":"number","title":"Report frequency in minutes","minimum":5,"default":60,"maximum":1440}}}]}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"title":"Get firewall policy response","type":"object","required":["id"],"allOf":[{"type":"object","title":"Firewall policy","properties":{"name":{"type":"string","title":"Firewall policy name"},"description":{"type":"string","title":"Firewall policy description"},"allow_store":{"type":"boolean","title":"Allow store"},"enabled":{"type":"boolean","title":"Enabled controls if the agent is sent the Firewall plugin."},"profiles":{"type":"array","title":"Profiles","items":{"type":"object","title":"Firewall profile","properties":{"type":{"type":"number","title":"Firewall profile type(1=Domain, 2=Private, 4=Public)","enum":[1,2,4]},"firewall_enabled":{"type":"boolean","title":"Firewall enabled"},"inbound_mode":{"type":"string","title":"Inbound mode","enum":["ALLOW","BLOCK","BLOCK_ALL"]},"outbound_mode":{"type":"string","title":"Outbound mode","enum":["ALLOW","BLOCK"]}}}},"report_frequency":{"type":"number","title":"Report frequency in minutes","minimum":5,"default":60,"maximum":1440}}},{"properties":{"id":{"type":"string","title":"Firewall policy ID"},"rulesets":{"type":"array","title":"Rulesets","items":{"title":"Get firewall ruleset response","type":"object","required":["id"],"allOf":[{"title":"Firewall ruleset","type":"object","properties":{"name":{"type":"string","title":"Firewall ruleset name"},"description":{"type":"string","title":"Firewall ruleset description"}}},{"properties":{"id":{"type":"string","title":"Firewall rule ID"},"created_at":{"type":"string","title":"Created at","format":"date-time"},"updated_at":{"type":"string","title":"Updated at","format":"date-time"},"deleted_at":{"type":"string","title":"Deleted at","format":"date-time"},"created_by":{"type":"string","title":"Created by"},"updated_by":{"type":"string","title":"Updated by"},"deleted_by":{"type":"string","title":"Deleted by"},"account_id":{"type":"string","title":"Account ID","format":"uuid"},"parent_account_id":{"type":"string","title":"Parent account ID","format":"uuid"},"etag":{"type":"string","title":"ETag"},"rules":{"type":"array","title":"Rules","items":{"type":"object","title":"Get firewall rule response","required":["id"],"allOf":[{"type":"object","title":"Firewall rule","properties":{"name":{"type":"string","title":"Firewall rule name"},"description":{"type":"string","title":"Firewall rule description"},"program":{"type":"string","title":"Firewall rule program"},"action":{"type":"string","title":"Firewall rule action","enum":["ALLOW","BLOCK"]},"direction":{"type":"string","title":"Firewall rule direction","enum":["IN","OUT"]},"enabled":{"type":"boolean","title":"Enabled"},"location":{"type":"number","title":"Location"},"local_addresses":{"type":"array","title":"Local addresses","items":{"anyOf":[{"type":"string","description":"local IPv4 address","format":"ipv4"},{"type":"string","description":"local explicit IPv4 range","pattern":"^(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)(-)(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$"},{"type":"string","description":"local CIDR IPv4 range","pattern":"^(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)/([0-9]|[12][0-9]|3[012])$"},{"type":"string","description":"IPv6 address","format":"ipv6"},{"type":"string","description":"IPv6 range CIDR","pattern":"^(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}/[0-9]{1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,7}:/[0-9]{1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}/[0-9]{1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}/[0-9]{1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}/[0-9]{1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}/[0-9]{1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}/[0-9]{1,3}$|^[0-9a-fA-F]{1,4}:(?::[0-9a-fA-F]{1,4}){1,6}/[0-9]{1,3}$|^:(?::[0-9a-fA-F]{1,4}){1,7}/[0-9]{1,3}$|^fe80:(?::[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}/[0-9]{1,3}$|^::(?:ffff(:0{1,4}){0,1}:){0,1}((?:[0-9]{1,3}\\.){3}[0-9]{1,3})/[0-9]{1,3}$|^::/[0-9]{1,3}$"},{"type":"string","description":"explicit IPv6 range","pattern":"^(?:(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|(?:[0-9a-fA-F]{1,4}:){1,7}:|(?:[0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|(?:[0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|(?:[0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|(?:[0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|(?:[0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:(?::[0-9a-fA-F]{1,4}){1,6}|:(?::[0-9a-fA-F]{1,4}){1,7}|fe80:(?::[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(?:ffff(:0{1,4}){0,1}:){0,1}((?:[0-9]{1,3}\\.){3}[0-9]{1,3}))-(?:(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|(?:[0-9a-fA-F]{1,4}:){1,7}:|(?:[0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|(?:[0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|(?:[0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|(?:[0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|(?:[0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:(?::[0-9a-fA-F]{1,4}){1,6}|:(?::[0-9a-fA-F]{1,4}){1,7}|fe80:(?::[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(?:ffff(:0{1,4}){0,1}:){0,1}((?:[0-9]{1,3}\\.){3}[0-9]{1,3}))$"},{"type":"string","const":"LocalSubnet"}]}},"local_ports":{"type":"array","title":"Local ports","items":{"type":"string"}},"remote_addresses":{"type":"array","title":"Remote addresses","items":{"type":"string"}},"remote_ports":{"type":"array","title":"Remote ports","items":{"type":"string"}},"protocol":{"type":["integer","null"],"description":"Protocol number (1=ICMPv4, 6=TCP, 17=UDP, 58=ICMPv6, 256=ANY)","enum":[0,1,2,6,17,41,43,44,47,50,51,58,59,60,112,113,115,256]},"service":{"type":"string"},"os_type":{"type":"integer","description":"The OS type to which the rule applies. (1=workstation, 2=server, 3=both)","enum":[1,2,3]}}},{"properties":{"id":{"type":"string","title":"Firewall rule ID"},"created_at":{"type":"string","title":"Created at","format":"date-time"},"updated_at":{"type":"string","title":"Updated at","format":"date-time"},"deleted_at":{"type":"string","title":"Deleted at","format":"date-time"},"created_by":{"type":"string","title":"Created by"},"updated_by":{"type":"string","title":"Updated by"},"deleted_by":{"type":"string","title":"Deleted by"},"account_id":{"type":"string","title":"Account ID","format":"uuid"},"parent_account_id":{"type":"string","title":"Parent account ID","format":"uuid"},"etag":{"type":"string","title":"ETag"},"is_default":{"type":"boolean","title":"Indicated whether the rule is default"},"edge_traversal":{"type":"integer","title":"Edge traversal"},"icmp_types":{"type":"string","description":"ICMP types"}}}]}},"is_default":{"type":"boolean","title":"Indicated whether the ruleset is default"},"internal_name":{"type":"string","title":"Internal name"}}}]}},"policies":{"type":"array","items":{"type":"object"}},"created_at":{"type":"string","title":"Created at","format":"date-time"},"updated_at":{"type":"string","title":"Updated at","format":"date-time"},"deleted_at":{"type":"string","title":"Deleted at","format":"date-time"},"created_by":{"type":"string","title":"Created by"},"updated_by":{"type":"string","title":"Updated by"},"deleted_by":{"type":"string","title":"Deleted by"},"account_id":{"type":"string","title":"Account ID","format":"uuid"},"parent_account_id":{"type":"string","title":"Parent account ID","format":"uuid"}}}]}}}}},"tags":["Firewall Management"],"operationId":"api.rmm.put.firewall.policy"}},"/oneview/v1/accounts/{account_id}/firewall/policies/{id}/policies":{"delete":{"description":"Delete policies from firewall policy","summary":"Delete policies from firewall policy","security":[{"client_credentials":["write"]},{"user_permissions":["firewall.deletePolicy"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":true,"in":"path","description":"ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"title":"Set policies on firewall policy","type":"object","required":["policies"],"properties":{"policies":{"type":"array","description":"Policy IDs","items":{"type":"string","format":"uuid"}}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"title":"Get firewall policy response","type":"object","required":["id"],"allOf":[{"type":"object","title":"Firewall policy","properties":{"name":{"type":"string","title":"Firewall policy name"},"description":{"type":"string","title":"Firewall policy description"},"allow_store":{"type":"boolean","title":"Allow store"},"enabled":{"type":"boolean","title":"Enabled controls if the agent is sent the Firewall plugin."},"profiles":{"type":"array","title":"Profiles","items":{"type":"object","title":"Firewall profile","properties":{"type":{"type":"number","title":"Firewall profile type(1=Domain, 2=Private, 4=Public)","enum":[1,2,4]},"firewall_enabled":{"type":"boolean","title":"Firewall enabled"},"inbound_mode":{"type":"string","title":"Inbound mode","enum":["ALLOW","BLOCK","BLOCK_ALL"]},"outbound_mode":{"type":"string","title":"Outbound mode","enum":["ALLOW","BLOCK"]}}}},"report_frequency":{"type":"number","title":"Report frequency in minutes","minimum":5,"default":60,"maximum":1440}}},{"properties":{"id":{"type":"string","title":"Firewall policy ID"},"rulesets":{"type":"array","title":"Rulesets","items":{"title":"Get firewall ruleset response","type":"object","required":["id"],"allOf":[{"title":"Firewall ruleset","type":"object","properties":{"name":{"type":"string","title":"Firewall ruleset name"},"description":{"type":"string","title":"Firewall ruleset description"}}},{"properties":{"id":{"type":"string","title":"Firewall rule ID"},"created_at":{"type":"string","title":"Created at","format":"date-time"},"updated_at":{"type":"string","title":"Updated at","format":"date-time"},"deleted_at":{"type":"string","title":"Deleted at","format":"date-time"},"created_by":{"type":"string","title":"Created by"},"updated_by":{"type":"string","title":"Updated by"},"deleted_by":{"type":"string","title":"Deleted by"},"account_id":{"type":"string","title":"Account ID","format":"uuid"},"parent_account_id":{"type":"string","title":"Parent account ID","format":"uuid"},"etag":{"type":"string","title":"ETag"},"rules":{"type":"array","title":"Rules","items":{"type":"object","title":"Get firewall rule response","required":["id"],"allOf":[{"type":"object","title":"Firewall rule","properties":{"name":{"type":"string","title":"Firewall rule name"},"description":{"type":"string","title":"Firewall rule description"},"program":{"type":"string","title":"Firewall rule program"},"action":{"type":"string","title":"Firewall rule action","enum":["ALLOW","BLOCK"]},"direction":{"type":"string","title":"Firewall rule direction","enum":["IN","OUT"]},"enabled":{"type":"boolean","title":"Enabled"},"location":{"type":"number","title":"Location"},"local_addresses":{"type":"array","title":"Local addresses","items":{"anyOf":[{"type":"string","description":"local IPv4 address","format":"ipv4"},{"type":"string","description":"local explicit IPv4 range","pattern":"^(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)(-)(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$"},{"type":"string","description":"local CIDR IPv4 range","pattern":"^(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)/([0-9]|[12][0-9]|3[012])$"},{"type":"string","description":"IPv6 address","format":"ipv6"},{"type":"string","description":"IPv6 range CIDR","pattern":"^(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}/[0-9]{1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,7}:/[0-9]{1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}/[0-9]{1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}/[0-9]{1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}/[0-9]{1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}/[0-9]{1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}/[0-9]{1,3}$|^[0-9a-fA-F]{1,4}:(?::[0-9a-fA-F]{1,4}){1,6}/[0-9]{1,3}$|^:(?::[0-9a-fA-F]{1,4}){1,7}/[0-9]{1,3}$|^fe80:(?::[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}/[0-9]{1,3}$|^::(?:ffff(:0{1,4}){0,1}:){0,1}((?:[0-9]{1,3}\\.){3}[0-9]{1,3})/[0-9]{1,3}$|^::/[0-9]{1,3}$"},{"type":"string","description":"explicit IPv6 range","pattern":"^(?:(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|(?:[0-9a-fA-F]{1,4}:){1,7}:|(?:[0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|(?:[0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|(?:[0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|(?:[0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|(?:[0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:(?::[0-9a-fA-F]{1,4}){1,6}|:(?::[0-9a-fA-F]{1,4}){1,7}|fe80:(?::[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(?:ffff(:0{1,4}){0,1}:){0,1}((?:[0-9]{1,3}\\.){3}[0-9]{1,3}))-(?:(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|(?:[0-9a-fA-F]{1,4}:){1,7}:|(?:[0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|(?:[0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|(?:[0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|(?:[0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|(?:[0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:(?::[0-9a-fA-F]{1,4}){1,6}|:(?::[0-9a-fA-F]{1,4}){1,7}|fe80:(?::[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(?:ffff(:0{1,4}){0,1}:){0,1}((?:[0-9]{1,3}\\.){3}[0-9]{1,3}))$"},{"type":"string","const":"LocalSubnet"}]}},"local_ports":{"type":"array","title":"Local ports","items":{"type":"string"}},"remote_addresses":{"type":"array","title":"Remote addresses","items":{"type":"string"}},"remote_ports":{"type":"array","title":"Remote ports","items":{"type":"string"}},"protocol":{"type":["integer","null"],"description":"Protocol number (1=ICMPv4, 6=TCP, 17=UDP, 58=ICMPv6, 256=ANY)","enum":[0,1,2,6,17,41,43,44,47,50,51,58,59,60,112,113,115,256]},"service":{"type":"string"},"os_type":{"type":"integer","description":"The OS type to which the rule applies. (1=workstation, 2=server, 3=both)","enum":[1,2,3]}}},{"properties":{"id":{"type":"string","title":"Firewall rule ID"},"created_at":{"type":"string","title":"Created at","format":"date-time"},"updated_at":{"type":"string","title":"Updated at","format":"date-time"},"deleted_at":{"type":"string","title":"Deleted at","format":"date-time"},"created_by":{"type":"string","title":"Created by"},"updated_by":{"type":"string","title":"Updated by"},"deleted_by":{"type":"string","title":"Deleted by"},"account_id":{"type":"string","title":"Account ID","format":"uuid"},"parent_account_id":{"type":"string","title":"Parent account ID","format":"uuid"},"etag":{"type":"string","title":"ETag"},"is_default":{"type":"boolean","title":"Indicated whether the rule is default"},"edge_traversal":{"type":"integer","title":"Edge traversal"},"icmp_types":{"type":"string","description":"ICMP types"}}}]}},"is_default":{"type":"boolean","title":"Indicated whether the ruleset is default"},"internal_name":{"type":"string","title":"Internal name"}}}]}},"policies":{"type":"array","items":{"type":"object"}},"created_at":{"type":"string","title":"Created at","format":"date-time"},"updated_at":{"type":"string","title":"Updated at","format":"date-time"},"deleted_at":{"type":"string","title":"Deleted at","format":"date-time"},"created_by":{"type":"string","title":"Created by"},"updated_by":{"type":"string","title":"Updated by"},"deleted_by":{"type":"string","title":"Deleted by"},"account_id":{"type":"string","title":"Account ID","format":"uuid"},"parent_account_id":{"type":"string","title":"Parent account ID","format":"uuid"}}}]}}}}},"tags":["Firewall Management"],"operationId":"api.rmm.delete.firewall.policies.policies"},"put":{"description":"Set policies for firewall policy","summary":"Set policies for firewall policy","security":[{"client_credentials":["write"]},{"user_permissions":["firewall.editPolicy"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":true,"in":"path","description":"ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"title":"Set policies on firewall policy","type":"object","required":["policies"],"properties":{"policies":{"type":"array","description":"Policy IDs","items":{"type":"string","format":"uuid"}}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"title":"Get firewall policy response","type":"object","required":["id"],"allOf":[{"type":"object","title":"Firewall policy","properties":{"name":{"type":"string","title":"Firewall policy name"},"description":{"type":"string","title":"Firewall policy description"},"allow_store":{"type":"boolean","title":"Allow store"},"enabled":{"type":"boolean","title":"Enabled controls if the agent is sent the Firewall plugin."},"profiles":{"type":"array","title":"Profiles","items":{"type":"object","title":"Firewall profile","properties":{"type":{"type":"number","title":"Firewall profile type(1=Domain, 2=Private, 4=Public)","enum":[1,2,4]},"firewall_enabled":{"type":"boolean","title":"Firewall enabled"},"inbound_mode":{"type":"string","title":"Inbound mode","enum":["ALLOW","BLOCK","BLOCK_ALL"]},"outbound_mode":{"type":"string","title":"Outbound mode","enum":["ALLOW","BLOCK"]}}}},"report_frequency":{"type":"number","title":"Report frequency in minutes","minimum":5,"default":60,"maximum":1440}}},{"properties":{"id":{"type":"string","title":"Firewall policy ID"},"rulesets":{"type":"array","title":"Rulesets","items":{"title":"Get firewall ruleset response","type":"object","required":["id"],"allOf":[{"title":"Firewall ruleset","type":"object","properties":{"name":{"type":"string","title":"Firewall ruleset name"},"description":{"type":"string","title":"Firewall ruleset description"}}},{"properties":{"id":{"type":"string","title":"Firewall rule ID"},"created_at":{"type":"string","title":"Created at","format":"date-time"},"updated_at":{"type":"string","title":"Updated at","format":"date-time"},"deleted_at":{"type":"string","title":"Deleted at","format":"date-time"},"created_by":{"type":"string","title":"Created by"},"updated_by":{"type":"string","title":"Updated by"},"deleted_by":{"type":"string","title":"Deleted by"},"account_id":{"type":"string","title":"Account ID","format":"uuid"},"parent_account_id":{"type":"string","title":"Parent account ID","format":"uuid"},"etag":{"type":"string","title":"ETag"},"rules":{"type":"array","title":"Rules","items":{"type":"object","title":"Get firewall rule response","required":["id"],"allOf":[{"type":"object","title":"Firewall rule","properties":{"name":{"type":"string","title":"Firewall rule name"},"description":{"type":"string","title":"Firewall rule description"},"program":{"type":"string","title":"Firewall rule program"},"action":{"type":"string","title":"Firewall rule action","enum":["ALLOW","BLOCK"]},"direction":{"type":"string","title":"Firewall rule direction","enum":["IN","OUT"]},"enabled":{"type":"boolean","title":"Enabled"},"location":{"type":"number","title":"Location"},"local_addresses":{"type":"array","title":"Local addresses","items":{"anyOf":[{"type":"string","description":"local IPv4 address","format":"ipv4"},{"type":"string","description":"local explicit IPv4 range","pattern":"^(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)(-)(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$"},{"type":"string","description":"local CIDR IPv4 range","pattern":"^(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)/([0-9]|[12][0-9]|3[012])$"},{"type":"string","description":"IPv6 address","format":"ipv6"},{"type":"string","description":"IPv6 range CIDR","pattern":"^(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}/[0-9]{1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,7}:/[0-9]{1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}/[0-9]{1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}/[0-9]{1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}/[0-9]{1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}/[0-9]{1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}/[0-9]{1,3}$|^[0-9a-fA-F]{1,4}:(?::[0-9a-fA-F]{1,4}){1,6}/[0-9]{1,3}$|^:(?::[0-9a-fA-F]{1,4}){1,7}/[0-9]{1,3}$|^fe80:(?::[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}/[0-9]{1,3}$|^::(?:ffff(:0{1,4}){0,1}:){0,1}((?:[0-9]{1,3}\\.){3}[0-9]{1,3})/[0-9]{1,3}$|^::/[0-9]{1,3}$"},{"type":"string","description":"explicit IPv6 range","pattern":"^(?:(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|(?:[0-9a-fA-F]{1,4}:){1,7}:|(?:[0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|(?:[0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|(?:[0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|(?:[0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|(?:[0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:(?::[0-9a-fA-F]{1,4}){1,6}|:(?::[0-9a-fA-F]{1,4}){1,7}|fe80:(?::[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(?:ffff(:0{1,4}){0,1}:){0,1}((?:[0-9]{1,3}\\.){3}[0-9]{1,3}))-(?:(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|(?:[0-9a-fA-F]{1,4}:){1,7}:|(?:[0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|(?:[0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|(?:[0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|(?:[0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|(?:[0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:(?::[0-9a-fA-F]{1,4}){1,6}|:(?::[0-9a-fA-F]{1,4}){1,7}|fe80:(?::[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(?:ffff(:0{1,4}){0,1}:){0,1}((?:[0-9]{1,3}\\.){3}[0-9]{1,3}))$"},{"type":"string","const":"LocalSubnet"}]}},"local_ports":{"type":"array","title":"Local ports","items":{"type":"string"}},"remote_addresses":{"type":"array","title":"Remote addresses","items":{"type":"string"}},"remote_ports":{"type":"array","title":"Remote ports","items":{"type":"string"}},"protocol":{"type":["integer","null"],"description":"Protocol number (1=ICMPv4, 6=TCP, 17=UDP, 58=ICMPv6, 256=ANY)","enum":[0,1,2,6,17,41,43,44,47,50,51,58,59,60,112,113,115,256]},"service":{"type":"string"},"os_type":{"type":"integer","description":"The OS type to which the rule applies. (1=workstation, 2=server, 3=both)","enum":[1,2,3]}}},{"properties":{"id":{"type":"string","title":"Firewall rule ID"},"created_at":{"type":"string","title":"Created at","format":"date-time"},"updated_at":{"type":"string","title":"Updated at","format":"date-time"},"deleted_at":{"type":"string","title":"Deleted at","format":"date-time"},"created_by":{"type":"string","title":"Created by"},"updated_by":{"type":"string","title":"Updated by"},"deleted_by":{"type":"string","title":"Deleted by"},"account_id":{"type":"string","title":"Account ID","format":"uuid"},"parent_account_id":{"type":"string","title":"Parent account ID","format":"uuid"},"etag":{"type":"string","title":"ETag"},"is_default":{"type":"boolean","title":"Indicated whether the rule is default"},"edge_traversal":{"type":"integer","title":"Edge traversal"},"icmp_types":{"type":"string","description":"ICMP types"}}}]}},"is_default":{"type":"boolean","title":"Indicated whether the ruleset is default"},"internal_name":{"type":"string","title":"Internal name"}}}]}},"policies":{"type":"array","items":{"type":"object"}},"created_at":{"type":"string","title":"Created at","format":"date-time"},"updated_at":{"type":"string","title":"Updated at","format":"date-time"},"deleted_at":{"type":"string","title":"Deleted at","format":"date-time"},"created_by":{"type":"string","title":"Created by"},"updated_by":{"type":"string","title":"Updated by"},"deleted_by":{"type":"string","title":"Deleted by"},"account_id":{"type":"string","title":"Account ID","format":"uuid"},"parent_account_id":{"type":"string","title":"Parent account ID","format":"uuid"}}}]}}}}},"tags":["Firewall Management"],"operationId":"api.rmm.set.firewall.policies.policies"}},"/oneview/v1/accounts/{account_id}/firewall/policies/{id}/rulesets":{"delete":{"description":"Delete rulesets from firewall policy","summary":"Delete rulesets from firewall policy","security":[{"client_credentials":["write"]},{"user_permissions":["firewall.deletePolicy"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":true,"in":"path","description":"ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"title":"Set rulesets on firewall policy","type":"object","required":["rulesets"],"properties":{"rulesets":{"type":"array","description":"Ruleset IDs","items":{"type":"string","format":"uuid"}}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"title":"Get firewall policy response","type":"object","required":["id"],"allOf":[{"type":"object","title":"Firewall policy","properties":{"name":{"type":"string","title":"Firewall policy name"},"description":{"type":"string","title":"Firewall policy description"},"allow_store":{"type":"boolean","title":"Allow store"},"enabled":{"type":"boolean","title":"Enabled controls if the agent is sent the Firewall plugin."},"profiles":{"type":"array","title":"Profiles","items":{"type":"object","title":"Firewall profile","properties":{"type":{"type":"number","title":"Firewall profile type(1=Domain, 2=Private, 4=Public)","enum":[1,2,4]},"firewall_enabled":{"type":"boolean","title":"Firewall enabled"},"inbound_mode":{"type":"string","title":"Inbound mode","enum":["ALLOW","BLOCK","BLOCK_ALL"]},"outbound_mode":{"type":"string","title":"Outbound mode","enum":["ALLOW","BLOCK"]}}}},"report_frequency":{"type":"number","title":"Report frequency in minutes","minimum":5,"default":60,"maximum":1440}}},{"properties":{"id":{"type":"string","title":"Firewall policy ID"},"rulesets":{"type":"array","title":"Rulesets","items":{"title":"Get firewall ruleset response","type":"object","required":["id"],"allOf":[{"title":"Firewall ruleset","type":"object","properties":{"name":{"type":"string","title":"Firewall ruleset name"},"description":{"type":"string","title":"Firewall ruleset description"}}},{"properties":{"id":{"type":"string","title":"Firewall rule ID"},"created_at":{"type":"string","title":"Created at","format":"date-time"},"updated_at":{"type":"string","title":"Updated at","format":"date-time"},"deleted_at":{"type":"string","title":"Deleted at","format":"date-time"},"created_by":{"type":"string","title":"Created by"},"updated_by":{"type":"string","title":"Updated by"},"deleted_by":{"type":"string","title":"Deleted by"},"account_id":{"type":"string","title":"Account ID","format":"uuid"},"parent_account_id":{"type":"string","title":"Parent account ID","format":"uuid"},"etag":{"type":"string","title":"ETag"},"rules":{"type":"array","title":"Rules","items":{"type":"object","title":"Get firewall rule response","required":["id"],"allOf":[{"type":"object","title":"Firewall rule","properties":{"name":{"type":"string","title":"Firewall rule name"},"description":{"type":"string","title":"Firewall rule description"},"program":{"type":"string","title":"Firewall rule program"},"action":{"type":"string","title":"Firewall rule action","enum":["ALLOW","BLOCK"]},"direction":{"type":"string","title":"Firewall rule direction","enum":["IN","OUT"]},"enabled":{"type":"boolean","title":"Enabled"},"location":{"type":"number","title":"Location"},"local_addresses":{"type":"array","title":"Local addresses","items":{"anyOf":[{"type":"string","description":"local IPv4 address","format":"ipv4"},{"type":"string","description":"local explicit IPv4 range","pattern":"^(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)(-)(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$"},{"type":"string","description":"local CIDR IPv4 range","pattern":"^(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)/([0-9]|[12][0-9]|3[012])$"},{"type":"string","description":"IPv6 address","format":"ipv6"},{"type":"string","description":"IPv6 range CIDR","pattern":"^(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}/[0-9]{1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,7}:/[0-9]{1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}/[0-9]{1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}/[0-9]{1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}/[0-9]{1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}/[0-9]{1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}/[0-9]{1,3}$|^[0-9a-fA-F]{1,4}:(?::[0-9a-fA-F]{1,4}){1,6}/[0-9]{1,3}$|^:(?::[0-9a-fA-F]{1,4}){1,7}/[0-9]{1,3}$|^fe80:(?::[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}/[0-9]{1,3}$|^::(?:ffff(:0{1,4}){0,1}:){0,1}((?:[0-9]{1,3}\\.){3}[0-9]{1,3})/[0-9]{1,3}$|^::/[0-9]{1,3}$"},{"type":"string","description":"explicit IPv6 range","pattern":"^(?:(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|(?:[0-9a-fA-F]{1,4}:){1,7}:|(?:[0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|(?:[0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|(?:[0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|(?:[0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|(?:[0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:(?::[0-9a-fA-F]{1,4}){1,6}|:(?::[0-9a-fA-F]{1,4}){1,7}|fe80:(?::[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(?:ffff(:0{1,4}){0,1}:){0,1}((?:[0-9]{1,3}\\.){3}[0-9]{1,3}))-(?:(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|(?:[0-9a-fA-F]{1,4}:){1,7}:|(?:[0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|(?:[0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|(?:[0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|(?:[0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|(?:[0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:(?::[0-9a-fA-F]{1,4}){1,6}|:(?::[0-9a-fA-F]{1,4}){1,7}|fe80:(?::[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(?:ffff(:0{1,4}){0,1}:){0,1}((?:[0-9]{1,3}\\.){3}[0-9]{1,3}))$"},{"type":"string","const":"LocalSubnet"}]}},"local_ports":{"type":"array","title":"Local ports","items":{"type":"string"}},"remote_addresses":{"type":"array","title":"Remote addresses","items":{"type":"string"}},"remote_ports":{"type":"array","title":"Remote ports","items":{"type":"string"}},"protocol":{"type":["integer","null"],"description":"Protocol number (1=ICMPv4, 6=TCP, 17=UDP, 58=ICMPv6, 256=ANY)","enum":[0,1,2,6,17,41,43,44,47,50,51,58,59,60,112,113,115,256]},"service":{"type":"string"},"os_type":{"type":"integer","description":"The OS type to which the rule applies. (1=workstation, 2=server, 3=both)","enum":[1,2,3]}}},{"properties":{"id":{"type":"string","title":"Firewall rule ID"},"created_at":{"type":"string","title":"Created at","format":"date-time"},"updated_at":{"type":"string","title":"Updated at","format":"date-time"},"deleted_at":{"type":"string","title":"Deleted at","format":"date-time"},"created_by":{"type":"string","title":"Created by"},"updated_by":{"type":"string","title":"Updated by"},"deleted_by":{"type":"string","title":"Deleted by"},"account_id":{"type":"string","title":"Account ID","format":"uuid"},"parent_account_id":{"type":"string","title":"Parent account ID","format":"uuid"},"etag":{"type":"string","title":"ETag"},"is_default":{"type":"boolean","title":"Indicated whether the rule is default"},"edge_traversal":{"type":"integer","title":"Edge traversal"},"icmp_types":{"type":"string","description":"ICMP types"}}}]}},"is_default":{"type":"boolean","title":"Indicated whether the ruleset is default"},"internal_name":{"type":"string","title":"Internal name"}}}]}},"policies":{"type":"array","items":{"type":"object"}},"created_at":{"type":"string","title":"Created at","format":"date-time"},"updated_at":{"type":"string","title":"Updated at","format":"date-time"},"deleted_at":{"type":"string","title":"Deleted at","format":"date-time"},"created_by":{"type":"string","title":"Created by"},"updated_by":{"type":"string","title":"Updated by"},"deleted_by":{"type":"string","title":"Deleted by"},"account_id":{"type":"string","title":"Account ID","format":"uuid"},"parent_account_id":{"type":"string","title":"Parent account ID","format":"uuid"}}}]}}}}},"tags":["Firewall Management"],"operationId":"api.rmm.delete.firewall.policies.rulesets"},"put":{"description":"Set rulesets for firewall policy","summary":"Set rulesets for firewall policy","security":[{"client_credentials":["write"]},{"user_permissions":["firewall.editPolicy"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":true,"in":"path","description":"ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"title":"Set rulesets on firewall policy","type":"object","required":["rulesets"],"properties":{"rulesets":{"type":"array","description":"Ruleset IDs","items":{"type":"string","format":"uuid"}}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"title":"Get firewall policy response","type":"object","required":["id"],"allOf":[{"type":"object","title":"Firewall policy","properties":{"name":{"type":"string","title":"Firewall policy name"},"description":{"type":"string","title":"Firewall policy description"},"allow_store":{"type":"boolean","title":"Allow store"},"enabled":{"type":"boolean","title":"Enabled controls if the agent is sent the Firewall plugin."},"profiles":{"type":"array","title":"Profiles","items":{"type":"object","title":"Firewall profile","properties":{"type":{"type":"number","title":"Firewall profile type(1=Domain, 2=Private, 4=Public)","enum":[1,2,4]},"firewall_enabled":{"type":"boolean","title":"Firewall enabled"},"inbound_mode":{"type":"string","title":"Inbound mode","enum":["ALLOW","BLOCK","BLOCK_ALL"]},"outbound_mode":{"type":"string","title":"Outbound mode","enum":["ALLOW","BLOCK"]}}}},"report_frequency":{"type":"number","title":"Report frequency in minutes","minimum":5,"default":60,"maximum":1440}}},{"properties":{"id":{"type":"string","title":"Firewall policy ID"},"rulesets":{"type":"array","title":"Rulesets","items":{"title":"Get firewall ruleset response","type":"object","required":["id"],"allOf":[{"title":"Firewall ruleset","type":"object","properties":{"name":{"type":"string","title":"Firewall ruleset name"},"description":{"type":"string","title":"Firewall ruleset description"}}},{"properties":{"id":{"type":"string","title":"Firewall rule ID"},"created_at":{"type":"string","title":"Created at","format":"date-time"},"updated_at":{"type":"string","title":"Updated at","format":"date-time"},"deleted_at":{"type":"string","title":"Deleted at","format":"date-time"},"created_by":{"type":"string","title":"Created by"},"updated_by":{"type":"string","title":"Updated by"},"deleted_by":{"type":"string","title":"Deleted by"},"account_id":{"type":"string","title":"Account ID","format":"uuid"},"parent_account_id":{"type":"string","title":"Parent account ID","format":"uuid"},"etag":{"type":"string","title":"ETag"},"rules":{"type":"array","title":"Rules","items":{"type":"object","title":"Get firewall rule response","required":["id"],"allOf":[{"type":"object","title":"Firewall rule","properties":{"name":{"type":"string","title":"Firewall rule name"},"description":{"type":"string","title":"Firewall rule description"},"program":{"type":"string","title":"Firewall rule program"},"action":{"type":"string","title":"Firewall rule action","enum":["ALLOW","BLOCK"]},"direction":{"type":"string","title":"Firewall rule direction","enum":["IN","OUT"]},"enabled":{"type":"boolean","title":"Enabled"},"location":{"type":"number","title":"Location"},"local_addresses":{"type":"array","title":"Local addresses","items":{"anyOf":[{"type":"string","description":"local IPv4 address","format":"ipv4"},{"type":"string","description":"local explicit IPv4 range","pattern":"^(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)(-)(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$"},{"type":"string","description":"local CIDR IPv4 range","pattern":"^(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)/([0-9]|[12][0-9]|3[012])$"},{"type":"string","description":"IPv6 address","format":"ipv6"},{"type":"string","description":"IPv6 range CIDR","pattern":"^(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}/[0-9]{1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,7}:/[0-9]{1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}/[0-9]{1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}/[0-9]{1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}/[0-9]{1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}/[0-9]{1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}/[0-9]{1,3}$|^[0-9a-fA-F]{1,4}:(?::[0-9a-fA-F]{1,4}){1,6}/[0-9]{1,3}$|^:(?::[0-9a-fA-F]{1,4}){1,7}/[0-9]{1,3}$|^fe80:(?::[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}/[0-9]{1,3}$|^::(?:ffff(:0{1,4}){0,1}:){0,1}((?:[0-9]{1,3}\\.){3}[0-9]{1,3})/[0-9]{1,3}$|^::/[0-9]{1,3}$"},{"type":"string","description":"explicit IPv6 range","pattern":"^(?:(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|(?:[0-9a-fA-F]{1,4}:){1,7}:|(?:[0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|(?:[0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|(?:[0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|(?:[0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|(?:[0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:(?::[0-9a-fA-F]{1,4}){1,6}|:(?::[0-9a-fA-F]{1,4}){1,7}|fe80:(?::[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(?:ffff(:0{1,4}){0,1}:){0,1}((?:[0-9]{1,3}\\.){3}[0-9]{1,3}))-(?:(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|(?:[0-9a-fA-F]{1,4}:){1,7}:|(?:[0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|(?:[0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|(?:[0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|(?:[0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|(?:[0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:(?::[0-9a-fA-F]{1,4}){1,6}|:(?::[0-9a-fA-F]{1,4}){1,7}|fe80:(?::[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(?:ffff(:0{1,4}){0,1}:){0,1}((?:[0-9]{1,3}\\.){3}[0-9]{1,3}))$"},{"type":"string","const":"LocalSubnet"}]}},"local_ports":{"type":"array","title":"Local ports","items":{"type":"string"}},"remote_addresses":{"type":"array","title":"Remote addresses","items":{"type":"string"}},"remote_ports":{"type":"array","title":"Remote ports","items":{"type":"string"}},"protocol":{"type":["integer","null"],"description":"Protocol number (1=ICMPv4, 6=TCP, 17=UDP, 58=ICMPv6, 256=ANY)","enum":[0,1,2,6,17,41,43,44,47,50,51,58,59,60,112,113,115,256]},"service":{"type":"string"},"os_type":{"type":"integer","description":"The OS type to which the rule applies. (1=workstation, 2=server, 3=both)","enum":[1,2,3]}}},{"properties":{"id":{"type":"string","title":"Firewall rule ID"},"created_at":{"type":"string","title":"Created at","format":"date-time"},"updated_at":{"type":"string","title":"Updated at","format":"date-time"},"deleted_at":{"type":"string","title":"Deleted at","format":"date-time"},"created_by":{"type":"string","title":"Created by"},"updated_by":{"type":"string","title":"Updated by"},"deleted_by":{"type":"string","title":"Deleted by"},"account_id":{"type":"string","title":"Account ID","format":"uuid"},"parent_account_id":{"type":"string","title":"Parent account ID","format":"uuid"},"etag":{"type":"string","title":"ETag"},"is_default":{"type":"boolean","title":"Indicated whether the rule is default"},"edge_traversal":{"type":"integer","title":"Edge traversal"},"icmp_types":{"type":"string","description":"ICMP types"}}}]}},"is_default":{"type":"boolean","title":"Indicated whether the ruleset is default"},"internal_name":{"type":"string","title":"Internal name"}}}]}},"policies":{"type":"array","items":{"type":"object"}},"created_at":{"type":"string","title":"Created at","format":"date-time"},"updated_at":{"type":"string","title":"Updated at","format":"date-time"},"deleted_at":{"type":"string","title":"Deleted at","format":"date-time"},"created_by":{"type":"string","title":"Created by"},"updated_by":{"type":"string","title":"Updated by"},"deleted_by":{"type":"string","title":"Deleted by"},"account_id":{"type":"string","title":"Account ID","format":"uuid"},"parent_account_id":{"type":"string","title":"Parent account ID","format":"uuid"}}}]}}}}},"tags":["Firewall Management"],"operationId":"api.rmm.set.firewall.policies.rulesets"}},"/oneview/v1/accounts/{account_id}/firewall/rules/{id}":{"delete":{"description":"Delete a firewall rule","summary":"Delete a firewall rule","security":[{"client_credentials":["write"]},{"user_permissions":["firewall.deletePolicy"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":true,"in":"path","description":"ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"Successful response"}},"tags":["Firewall Management"],"operationId":"api.rmm.delete.firewall.rule"},"get":{"description":"Get a firewall rule","summary":"Get a firewall rule","security":[{"client_credentials":["read"]},{"user_permissions":["firewall.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":true,"in":"path","description":"ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}},{"name":"fields[firewall_rule]","required":false,"in":"query","description":"Specify which fields will be included in the response. Formatted as comma separated list of fields. Allowed fields are: created_at, updated_at, created_by, updated_by, account_id, parent_account_id, name, description, version, program, action, direction, enabled, location, local_addresses, local_ports, remote_addresses, remote_ports, protocol, service, os_type.","schema":{"type":"string","pattern":"^((?:created_at|updated_at|created_by|updated_by|account_id|parent_account_id|name|description|version|program|action|direction|enabled|location|local_addresses|local_ports|remote_addresses|remote_ports|protocol|service|os_type|edge_traversal|icmp_types)(?:,|$))+$"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Get firewall rule response","required":["id"],"allOf":[{"type":"object","title":"Firewall rule","properties":{"name":{"type":"string","title":"Firewall rule name"},"description":{"type":"string","title":"Firewall rule description"},"program":{"type":"string","title":"Firewall rule program"},"action":{"type":"string","title":"Firewall rule action","enum":["ALLOW","BLOCK"]},"direction":{"type":"string","title":"Firewall rule direction","enum":["IN","OUT"]},"enabled":{"type":"boolean","title":"Enabled"},"location":{"type":"number","title":"Location"},"local_addresses":{"type":"array","title":"Local addresses","items":{"anyOf":[{"type":"string","description":"local IPv4 address","format":"ipv4"},{"type":"string","description":"local explicit IPv4 range","pattern":"^(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)(-)(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$"},{"type":"string","description":"local CIDR IPv4 range","pattern":"^(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)/([0-9]|[12][0-9]|3[012])$"},{"type":"string","description":"IPv6 address","format":"ipv6"},{"type":"string","description":"IPv6 range CIDR","pattern":"^(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}/[0-9]{1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,7}:/[0-9]{1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}/[0-9]{1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}/[0-9]{1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}/[0-9]{1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}/[0-9]{1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}/[0-9]{1,3}$|^[0-9a-fA-F]{1,4}:(?::[0-9a-fA-F]{1,4}){1,6}/[0-9]{1,3}$|^:(?::[0-9a-fA-F]{1,4}){1,7}/[0-9]{1,3}$|^fe80:(?::[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}/[0-9]{1,3}$|^::(?:ffff(:0{1,4}){0,1}:){0,1}((?:[0-9]{1,3}\\.){3}[0-9]{1,3})/[0-9]{1,3}$|^::/[0-9]{1,3}$"},{"type":"string","description":"explicit IPv6 range","pattern":"^(?:(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|(?:[0-9a-fA-F]{1,4}:){1,7}:|(?:[0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|(?:[0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|(?:[0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|(?:[0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|(?:[0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:(?::[0-9a-fA-F]{1,4}){1,6}|:(?::[0-9a-fA-F]{1,4}){1,7}|fe80:(?::[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(?:ffff(:0{1,4}){0,1}:){0,1}((?:[0-9]{1,3}\\.){3}[0-9]{1,3}))-(?:(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|(?:[0-9a-fA-F]{1,4}:){1,7}:|(?:[0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|(?:[0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|(?:[0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|(?:[0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|(?:[0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:(?::[0-9a-fA-F]{1,4}){1,6}|:(?::[0-9a-fA-F]{1,4}){1,7}|fe80:(?::[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(?:ffff(:0{1,4}){0,1}:){0,1}((?:[0-9]{1,3}\\.){3}[0-9]{1,3}))$"},{"type":"string","const":"LocalSubnet"}]}},"local_ports":{"type":"array","title":"Local ports","items":{"type":"string"}},"remote_addresses":{"type":"array","title":"Remote addresses","items":{"type":"string"}},"remote_ports":{"type":"array","title":"Remote ports","items":{"type":"string"}},"protocol":{"type":["integer","null"],"description":"Protocol number (1=ICMPv4, 6=TCP, 17=UDP, 58=ICMPv6, 256=ANY)","enum":[0,1,2,6,17,41,43,44,47,50,51,58,59,60,112,113,115,256]},"service":{"type":"string"},"os_type":{"type":"integer","description":"The OS type to which the rule applies. (1=workstation, 2=server, 3=both)","enum":[1,2,3]}}},{"properties":{"id":{"type":"string","title":"Firewall rule ID"},"created_at":{"type":"string","title":"Created at","format":"date-time"},"updated_at":{"type":"string","title":"Updated at","format":"date-time"},"deleted_at":{"type":"string","title":"Deleted at","format":"date-time"},"created_by":{"type":"string","title":"Created by"},"updated_by":{"type":"string","title":"Updated by"},"deleted_by":{"type":"string","title":"Deleted by"},"account_id":{"type":"string","title":"Account ID","format":"uuid"},"parent_account_id":{"type":"string","title":"Parent account ID","format":"uuid"},"etag":{"type":"string","title":"ETag"},"is_default":{"type":"boolean","title":"Indicated whether the rule is default"},"edge_traversal":{"type":"integer","title":"Edge traversal"},"icmp_types":{"type":"string","description":"ICMP types"}}}]}}}}},"tags":["Firewall Management"],"operationId":"api.rmm.get.firewall.rule"},"put":{"description":"Update a firewall rule","summary":"Update a firewall rule","security":[{"client_credentials":["write"]},{"user_permissions":["firewall.editPolicy"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":true,"in":"path","description":"ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}},{"name":"fields[firewall_rule]","required":false,"in":"query","description":"Specify which fields will be included in the response. Formatted as comma separated list of fields. Allowed fields are: created_at, updated_at, created_by, updated_by, account_id, parent_account_id, name, description, version, program, action, direction, enabled, location, local_addresses, local_ports, remote_addresses, remote_ports, protocol, service, os_type.","schema":{"type":"string","pattern":"^((?:created_at|updated_at|created_by|updated_by|account_id|parent_account_id|name|description|version|program|action|direction|enabled|location|local_addresses|local_ports|remote_addresses|remote_ports|protocol|service|os_type|edge_traversal|icmp_types)(?:,|$))+$"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Update firewall rule","anyOf":[{"required":["name"]},{"required":["description"]},{"required":["program"]},{"required":["action"]},{"required":["direction"]},{"required":["enabled"]},{"required":["location"]},{"required":["local_addresses"]},{"required":["local_ports"]},{"required":["remote_addresses"]},{"required":["remote_ports"]},{"required":["protocol"]},{"required":["service"]},{"required":["os_type"]}],"allOf":[{"type":"object","title":"Firewall rule","properties":{"name":{"type":"string","title":"Firewall rule name"},"description":{"type":"string","title":"Firewall rule description"},"program":{"type":"string","title":"Firewall rule program"},"action":{"type":"string","title":"Firewall rule action","enum":["ALLOW","BLOCK"]},"direction":{"type":"string","title":"Firewall rule direction","enum":["IN","OUT"]},"enabled":{"type":"boolean","title":"Enabled"},"location":{"type":"number","title":"Location"},"local_addresses":{"type":"array","title":"Local addresses","items":{"anyOf":[{"type":"string","description":"local IPv4 address","format":"ipv4"},{"type":"string","description":"local explicit IPv4 range","pattern":"^(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)(-)(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$"},{"type":"string","description":"local CIDR IPv4 range","pattern":"^(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)/([0-9]|[12][0-9]|3[012])$"},{"type":"string","description":"IPv6 address","format":"ipv6"},{"type":"string","description":"IPv6 range CIDR","pattern":"^(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}/[0-9]{1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,7}:/[0-9]{1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}/[0-9]{1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}/[0-9]{1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}/[0-9]{1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}/[0-9]{1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}/[0-9]{1,3}$|^[0-9a-fA-F]{1,4}:(?::[0-9a-fA-F]{1,4}){1,6}/[0-9]{1,3}$|^:(?::[0-9a-fA-F]{1,4}){1,7}/[0-9]{1,3}$|^fe80:(?::[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}/[0-9]{1,3}$|^::(?:ffff(:0{1,4}){0,1}:){0,1}((?:[0-9]{1,3}\\.){3}[0-9]{1,3})/[0-9]{1,3}$|^::/[0-9]{1,3}$"},{"type":"string","description":"explicit IPv6 range","pattern":"^(?:(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|(?:[0-9a-fA-F]{1,4}:){1,7}:|(?:[0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|(?:[0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|(?:[0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|(?:[0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|(?:[0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:(?::[0-9a-fA-F]{1,4}){1,6}|:(?::[0-9a-fA-F]{1,4}){1,7}|fe80:(?::[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(?:ffff(:0{1,4}){0,1}:){0,1}((?:[0-9]{1,3}\\.){3}[0-9]{1,3}))-(?:(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|(?:[0-9a-fA-F]{1,4}:){1,7}:|(?:[0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|(?:[0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|(?:[0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|(?:[0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|(?:[0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:(?::[0-9a-fA-F]{1,4}){1,6}|:(?::[0-9a-fA-F]{1,4}){1,7}|fe80:(?::[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(?:ffff(:0{1,4}){0,1}:){0,1}((?:[0-9]{1,3}\\.){3}[0-9]{1,3}))$"},{"type":"string","const":"LocalSubnet"}]}},"local_ports":{"type":"array","title":"Local ports","items":{"type":"string"}},"remote_addresses":{"type":"array","title":"Remote addresses","items":{"type":"string"}},"remote_ports":{"type":"array","title":"Remote ports","items":{"type":"string"}},"protocol":{"type":["integer","null"],"description":"Protocol number (1=ICMPv4, 6=TCP, 17=UDP, 58=ICMPv6, 256=ANY)","enum":[0,1,2,6,17,41,43,44,47,50,51,58,59,60,112,113,115,256]},"service":{"type":"string"},"os_type":{"type":"integer","description":"The OS type to which the rule applies. (1=workstation, 2=server, 3=both)","enum":[1,2,3]}}}]}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Get firewall rule response","required":["id"],"allOf":[{"type":"object","title":"Firewall rule","properties":{"name":{"type":"string","title":"Firewall rule name"},"description":{"type":"string","title":"Firewall rule description"},"program":{"type":"string","title":"Firewall rule program"},"action":{"type":"string","title":"Firewall rule action","enum":["ALLOW","BLOCK"]},"direction":{"type":"string","title":"Firewall rule direction","enum":["IN","OUT"]},"enabled":{"type":"boolean","title":"Enabled"},"location":{"type":"number","title":"Location"},"local_addresses":{"type":"array","title":"Local addresses","items":{"anyOf":[{"type":"string","description":"local IPv4 address","format":"ipv4"},{"type":"string","description":"local explicit IPv4 range","pattern":"^(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)(-)(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$"},{"type":"string","description":"local CIDR IPv4 range","pattern":"^(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)/([0-9]|[12][0-9]|3[012])$"},{"type":"string","description":"IPv6 address","format":"ipv6"},{"type":"string","description":"IPv6 range CIDR","pattern":"^(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}/[0-9]{1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,7}:/[0-9]{1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}/[0-9]{1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}/[0-9]{1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}/[0-9]{1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}/[0-9]{1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}/[0-9]{1,3}$|^[0-9a-fA-F]{1,4}:(?::[0-9a-fA-F]{1,4}){1,6}/[0-9]{1,3}$|^:(?::[0-9a-fA-F]{1,4}){1,7}/[0-9]{1,3}$|^fe80:(?::[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}/[0-9]{1,3}$|^::(?:ffff(:0{1,4}){0,1}:){0,1}((?:[0-9]{1,3}\\.){3}[0-9]{1,3})/[0-9]{1,3}$|^::/[0-9]{1,3}$"},{"type":"string","description":"explicit IPv6 range","pattern":"^(?:(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|(?:[0-9a-fA-F]{1,4}:){1,7}:|(?:[0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|(?:[0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|(?:[0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|(?:[0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|(?:[0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:(?::[0-9a-fA-F]{1,4}){1,6}|:(?::[0-9a-fA-F]{1,4}){1,7}|fe80:(?::[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(?:ffff(:0{1,4}){0,1}:){0,1}((?:[0-9]{1,3}\\.){3}[0-9]{1,3}))-(?:(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|(?:[0-9a-fA-F]{1,4}:){1,7}:|(?:[0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|(?:[0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|(?:[0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|(?:[0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|(?:[0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:(?::[0-9a-fA-F]{1,4}){1,6}|:(?::[0-9a-fA-F]{1,4}){1,7}|fe80:(?::[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(?:ffff(:0{1,4}){0,1}:){0,1}((?:[0-9]{1,3}\\.){3}[0-9]{1,3}))$"},{"type":"string","const":"LocalSubnet"}]}},"local_ports":{"type":"array","title":"Local ports","items":{"type":"string"}},"remote_addresses":{"type":"array","title":"Remote addresses","items":{"type":"string"}},"remote_ports":{"type":"array","title":"Remote ports","items":{"type":"string"}},"protocol":{"type":["integer","null"],"description":"Protocol number (1=ICMPv4, 6=TCP, 17=UDP, 58=ICMPv6, 256=ANY)","enum":[0,1,2,6,17,41,43,44,47,50,51,58,59,60,112,113,115,256]},"service":{"type":"string"},"os_type":{"type":"integer","description":"The OS type to which the rule applies. (1=workstation, 2=server, 3=both)","enum":[1,2,3]}}},{"properties":{"id":{"type":"string","title":"Firewall rule ID"},"created_at":{"type":"string","title":"Created at","format":"date-time"},"updated_at":{"type":"string","title":"Updated at","format":"date-time"},"deleted_at":{"type":"string","title":"Deleted at","format":"date-time"},"created_by":{"type":"string","title":"Created by"},"updated_by":{"type":"string","title":"Updated by"},"deleted_by":{"type":"string","title":"Deleted by"},"account_id":{"type":"string","title":"Account ID","format":"uuid"},"parent_account_id":{"type":"string","title":"Parent account ID","format":"uuid"},"etag":{"type":"string","title":"ETag"},"is_default":{"type":"boolean","title":"Indicated whether the rule is default"},"edge_traversal":{"type":"integer","title":"Edge traversal"},"icmp_types":{"type":"string","description":"ICMP types"}}}]}}}}},"tags":["Firewall Management"],"operationId":"api.rmm.put.firewall.rule"}},"/oneview/v1/accounts/{account_id}/firewall/rulesets/{id}/rules":{"delete":{"description":"Delete rules from firewall ruleset","summary":"Delete rules from firewall ruleset","security":[{"client_credentials":["write"]},{"user_permissions":["firewall.deletePolicy"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":true,"in":"path","description":"ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"title":"Set rules on firewall ruleset","type":"object","required":["rules"],"properties":{"rules":{"type":"array","description":"Rule IDs","items":{"type":"string","format":"uuid"}}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"title":"Get firewall ruleset response","type":"object","required":["id"],"allOf":[{"title":"Firewall ruleset","type":"object","properties":{"name":{"type":"string","title":"Firewall ruleset name"},"description":{"type":"string","title":"Firewall ruleset description"}}},{"properties":{"id":{"type":"string","title":"Firewall rule ID"},"created_at":{"type":"string","title":"Created at","format":"date-time"},"updated_at":{"type":"string","title":"Updated at","format":"date-time"},"deleted_at":{"type":"string","title":"Deleted at","format":"date-time"},"created_by":{"type":"string","title":"Created by"},"updated_by":{"type":"string","title":"Updated by"},"deleted_by":{"type":"string","title":"Deleted by"},"account_id":{"type":"string","title":"Account ID","format":"uuid"},"parent_account_id":{"type":"string","title":"Parent account ID","format":"uuid"},"etag":{"type":"string","title":"ETag"},"rules":{"type":"array","title":"Rules","items":{"type":"object","title":"Get firewall rule response","required":["id"],"allOf":[{"type":"object","title":"Firewall rule","properties":{"name":{"type":"string","title":"Firewall rule name"},"description":{"type":"string","title":"Firewall rule description"},"program":{"type":"string","title":"Firewall rule program"},"action":{"type":"string","title":"Firewall rule action","enum":["ALLOW","BLOCK"]},"direction":{"type":"string","title":"Firewall rule direction","enum":["IN","OUT"]},"enabled":{"type":"boolean","title":"Enabled"},"location":{"type":"number","title":"Location"},"local_addresses":{"type":"array","title":"Local addresses","items":{"anyOf":[{"type":"string","description":"local IPv4 address","format":"ipv4"},{"type":"string","description":"local explicit IPv4 range","pattern":"^(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)(-)(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$"},{"type":"string","description":"local CIDR IPv4 range","pattern":"^(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)/([0-9]|[12][0-9]|3[012])$"},{"type":"string","description":"IPv6 address","format":"ipv6"},{"type":"string","description":"IPv6 range CIDR","pattern":"^(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}/[0-9]{1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,7}:/[0-9]{1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}/[0-9]{1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}/[0-9]{1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}/[0-9]{1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}/[0-9]{1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}/[0-9]{1,3}$|^[0-9a-fA-F]{1,4}:(?::[0-9a-fA-F]{1,4}){1,6}/[0-9]{1,3}$|^:(?::[0-9a-fA-F]{1,4}){1,7}/[0-9]{1,3}$|^fe80:(?::[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}/[0-9]{1,3}$|^::(?:ffff(:0{1,4}){0,1}:){0,1}((?:[0-9]{1,3}\\.){3}[0-9]{1,3})/[0-9]{1,3}$|^::/[0-9]{1,3}$"},{"type":"string","description":"explicit IPv6 range","pattern":"^(?:(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|(?:[0-9a-fA-F]{1,4}:){1,7}:|(?:[0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|(?:[0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|(?:[0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|(?:[0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|(?:[0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:(?::[0-9a-fA-F]{1,4}){1,6}|:(?::[0-9a-fA-F]{1,4}){1,7}|fe80:(?::[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(?:ffff(:0{1,4}){0,1}:){0,1}((?:[0-9]{1,3}\\.){3}[0-9]{1,3}))-(?:(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|(?:[0-9a-fA-F]{1,4}:){1,7}:|(?:[0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|(?:[0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|(?:[0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|(?:[0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|(?:[0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:(?::[0-9a-fA-F]{1,4}){1,6}|:(?::[0-9a-fA-F]{1,4}){1,7}|fe80:(?::[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(?:ffff(:0{1,4}){0,1}:){0,1}((?:[0-9]{1,3}\\.){3}[0-9]{1,3}))$"},{"type":"string","const":"LocalSubnet"}]}},"local_ports":{"type":"array","title":"Local ports","items":{"type":"string"}},"remote_addresses":{"type":"array","title":"Remote addresses","items":{"type":"string"}},"remote_ports":{"type":"array","title":"Remote ports","items":{"type":"string"}},"protocol":{"type":["integer","null"],"description":"Protocol number (1=ICMPv4, 6=TCP, 17=UDP, 58=ICMPv6, 256=ANY)","enum":[0,1,2,6,17,41,43,44,47,50,51,58,59,60,112,113,115,256]},"service":{"type":"string"},"os_type":{"type":"integer","description":"The OS type to which the rule applies. (1=workstation, 2=server, 3=both)","enum":[1,2,3]}}},{"properties":{"id":{"type":"string","title":"Firewall rule ID"},"created_at":{"type":"string","title":"Created at","format":"date-time"},"updated_at":{"type":"string","title":"Updated at","format":"date-time"},"deleted_at":{"type":"string","title":"Deleted at","format":"date-time"},"created_by":{"type":"string","title":"Created by"},"updated_by":{"type":"string","title":"Updated by"},"deleted_by":{"type":"string","title":"Deleted by"},"account_id":{"type":"string","title":"Account ID","format":"uuid"},"parent_account_id":{"type":"string","title":"Parent account ID","format":"uuid"},"etag":{"type":"string","title":"ETag"},"is_default":{"type":"boolean","title":"Indicated whether the rule is default"},"edge_traversal":{"type":"integer","title":"Edge traversal"},"icmp_types":{"type":"string","description":"ICMP types"}}}]}},"is_default":{"type":"boolean","title":"Indicated whether the ruleset is default"},"internal_name":{"type":"string","title":"Internal name"}}}]}}}}},"tags":["Firewall Management"],"operationId":"api.rmm.delete.firewall.ruleset.rules"},"put":{"description":"Set rules for firewall ruleset","summary":"Set rules for firewall ruleset","security":[{"client_credentials":["write"]},{"user_permissions":["firewall.editPolicy"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":true,"in":"path","description":"ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"title":"Set rules on firewall ruleset","type":"object","required":["rules"],"properties":{"rules":{"type":"array","description":"Rule IDs","items":{"type":"string","format":"uuid"}}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"title":"Get firewall ruleset response","type":"object","required":["id"],"allOf":[{"title":"Firewall ruleset","type":"object","properties":{"name":{"type":"string","title":"Firewall ruleset name"},"description":{"type":"string","title":"Firewall ruleset description"}}},{"properties":{"id":{"type":"string","title":"Firewall rule ID"},"created_at":{"type":"string","title":"Created at","format":"date-time"},"updated_at":{"type":"string","title":"Updated at","format":"date-time"},"deleted_at":{"type":"string","title":"Deleted at","format":"date-time"},"created_by":{"type":"string","title":"Created by"},"updated_by":{"type":"string","title":"Updated by"},"deleted_by":{"type":"string","title":"Deleted by"},"account_id":{"type":"string","title":"Account ID","format":"uuid"},"parent_account_id":{"type":"string","title":"Parent account ID","format":"uuid"},"etag":{"type":"string","title":"ETag"},"rules":{"type":"array","title":"Rules","items":{"type":"object","title":"Get firewall rule response","required":["id"],"allOf":[{"type":"object","title":"Firewall rule","properties":{"name":{"type":"string","title":"Firewall rule name"},"description":{"type":"string","title":"Firewall rule description"},"program":{"type":"string","title":"Firewall rule program"},"action":{"type":"string","title":"Firewall rule action","enum":["ALLOW","BLOCK"]},"direction":{"type":"string","title":"Firewall rule direction","enum":["IN","OUT"]},"enabled":{"type":"boolean","title":"Enabled"},"location":{"type":"number","title":"Location"},"local_addresses":{"type":"array","title":"Local addresses","items":{"anyOf":[{"type":"string","description":"local IPv4 address","format":"ipv4"},{"type":"string","description":"local explicit IPv4 range","pattern":"^(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)(-)(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$"},{"type":"string","description":"local CIDR IPv4 range","pattern":"^(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)/([0-9]|[12][0-9]|3[012])$"},{"type":"string","description":"IPv6 address","format":"ipv6"},{"type":"string","description":"IPv6 range CIDR","pattern":"^(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}/[0-9]{1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,7}:/[0-9]{1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}/[0-9]{1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}/[0-9]{1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}/[0-9]{1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}/[0-9]{1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}/[0-9]{1,3}$|^[0-9a-fA-F]{1,4}:(?::[0-9a-fA-F]{1,4}){1,6}/[0-9]{1,3}$|^:(?::[0-9a-fA-F]{1,4}){1,7}/[0-9]{1,3}$|^fe80:(?::[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}/[0-9]{1,3}$|^::(?:ffff(:0{1,4}){0,1}:){0,1}((?:[0-9]{1,3}\\.){3}[0-9]{1,3})/[0-9]{1,3}$|^::/[0-9]{1,3}$"},{"type":"string","description":"explicit IPv6 range","pattern":"^(?:(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|(?:[0-9a-fA-F]{1,4}:){1,7}:|(?:[0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|(?:[0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|(?:[0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|(?:[0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|(?:[0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:(?::[0-9a-fA-F]{1,4}){1,6}|:(?::[0-9a-fA-F]{1,4}){1,7}|fe80:(?::[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(?:ffff(:0{1,4}){0,1}:){0,1}((?:[0-9]{1,3}\\.){3}[0-9]{1,3}))-(?:(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|(?:[0-9a-fA-F]{1,4}:){1,7}:|(?:[0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|(?:[0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|(?:[0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|(?:[0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|(?:[0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:(?::[0-9a-fA-F]{1,4}){1,6}|:(?::[0-9a-fA-F]{1,4}){1,7}|fe80:(?::[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(?:ffff(:0{1,4}){0,1}:){0,1}((?:[0-9]{1,3}\\.){3}[0-9]{1,3}))$"},{"type":"string","const":"LocalSubnet"}]}},"local_ports":{"type":"array","title":"Local ports","items":{"type":"string"}},"remote_addresses":{"type":"array","title":"Remote addresses","items":{"type":"string"}},"remote_ports":{"type":"array","title":"Remote ports","items":{"type":"string"}},"protocol":{"type":["integer","null"],"description":"Protocol number (1=ICMPv4, 6=TCP, 17=UDP, 58=ICMPv6, 256=ANY)","enum":[0,1,2,6,17,41,43,44,47,50,51,58,59,60,112,113,115,256]},"service":{"type":"string"},"os_type":{"type":"integer","description":"The OS type to which the rule applies. (1=workstation, 2=server, 3=both)","enum":[1,2,3]}}},{"properties":{"id":{"type":"string","title":"Firewall rule ID"},"created_at":{"type":"string","title":"Created at","format":"date-time"},"updated_at":{"type":"string","title":"Updated at","format":"date-time"},"deleted_at":{"type":"string","title":"Deleted at","format":"date-time"},"created_by":{"type":"string","title":"Created by"},"updated_by":{"type":"string","title":"Updated by"},"deleted_by":{"type":"string","title":"Deleted by"},"account_id":{"type":"string","title":"Account ID","format":"uuid"},"parent_account_id":{"type":"string","title":"Parent account ID","format":"uuid"},"etag":{"type":"string","title":"ETag"},"is_default":{"type":"boolean","title":"Indicated whether the rule is default"},"edge_traversal":{"type":"integer","title":"Edge traversal"},"icmp_types":{"type":"string","description":"ICMP types"}}}]}},"is_default":{"type":"boolean","title":"Indicated whether the ruleset is default"},"internal_name":{"type":"string","title":"Internal name"}}}]}}}}},"tags":["Firewall Management"],"operationId":"api.rmm.set.firewall.ruleset.rules"}},"/oneview/v1/accounts/{account_id}/firewall/rulesets/{id}":{"delete":{"description":"Delete a firewall ruleset","summary":"Delete a firewall ruleset","security":[{"client_credentials":["write"]},{"user_permissions":["firewall.deletePolicy"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":true,"in":"path","description":"ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"Successful response"}},"tags":["Firewall Management"],"operationId":"api.rmm.delete.firewall.ruleset"},"get":{"description":"Get a firewall ruleset","summary":"Get a firewall ruleset","security":[{"client_credentials":["read"]},{"user_permissions":["firewall.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":true,"in":"path","description":"ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}},{"name":"fields[firewall_ruleset]","required":false,"in":"query","description":"Specify which fields will be included in the response. Formatted as comma separated list of fields. Allowed fields are created_at, updated_at, created_by, updated_by, account_id, parent_account_id, name, description, version.","schema":{"type":"string","pattern":"^((?:created_at|updated_at|created_by|updated_by|account_id|parent_account_id|name|description|version)(?:,|$))+$"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"title":"Get firewall ruleset response","type":"object","required":["id"],"allOf":[{"title":"Firewall ruleset","type":"object","properties":{"name":{"type":"string","title":"Firewall ruleset name"},"description":{"type":"string","title":"Firewall ruleset description"}}},{"properties":{"id":{"type":"string","title":"Firewall rule ID"},"created_at":{"type":"string","title":"Created at","format":"date-time"},"updated_at":{"type":"string","title":"Updated at","format":"date-time"},"deleted_at":{"type":"string","title":"Deleted at","format":"date-time"},"created_by":{"type":"string","title":"Created by"},"updated_by":{"type":"string","title":"Updated by"},"deleted_by":{"type":"string","title":"Deleted by"},"account_id":{"type":"string","title":"Account ID","format":"uuid"},"parent_account_id":{"type":"string","title":"Parent account ID","format":"uuid"},"etag":{"type":"string","title":"ETag"},"rules":{"type":"array","title":"Rules","items":{"type":"object","title":"Get firewall rule response","required":["id"],"allOf":[{"type":"object","title":"Firewall rule","properties":{"name":{"type":"string","title":"Firewall rule name"},"description":{"type":"string","title":"Firewall rule description"},"program":{"type":"string","title":"Firewall rule program"},"action":{"type":"string","title":"Firewall rule action","enum":["ALLOW","BLOCK"]},"direction":{"type":"string","title":"Firewall rule direction","enum":["IN","OUT"]},"enabled":{"type":"boolean","title":"Enabled"},"location":{"type":"number","title":"Location"},"local_addresses":{"type":"array","title":"Local addresses","items":{"anyOf":[{"type":"string","description":"local IPv4 address","format":"ipv4"},{"type":"string","description":"local explicit IPv4 range","pattern":"^(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)(-)(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$"},{"type":"string","description":"local CIDR IPv4 range","pattern":"^(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)/([0-9]|[12][0-9]|3[012])$"},{"type":"string","description":"IPv6 address","format":"ipv6"},{"type":"string","description":"IPv6 range CIDR","pattern":"^(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}/[0-9]{1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,7}:/[0-9]{1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}/[0-9]{1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}/[0-9]{1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}/[0-9]{1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}/[0-9]{1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}/[0-9]{1,3}$|^[0-9a-fA-F]{1,4}:(?::[0-9a-fA-F]{1,4}){1,6}/[0-9]{1,3}$|^:(?::[0-9a-fA-F]{1,4}){1,7}/[0-9]{1,3}$|^fe80:(?::[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}/[0-9]{1,3}$|^::(?:ffff(:0{1,4}){0,1}:){0,1}((?:[0-9]{1,3}\\.){3}[0-9]{1,3})/[0-9]{1,3}$|^::/[0-9]{1,3}$"},{"type":"string","description":"explicit IPv6 range","pattern":"^(?:(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|(?:[0-9a-fA-F]{1,4}:){1,7}:|(?:[0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|(?:[0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|(?:[0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|(?:[0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|(?:[0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:(?::[0-9a-fA-F]{1,4}){1,6}|:(?::[0-9a-fA-F]{1,4}){1,7}|fe80:(?::[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(?:ffff(:0{1,4}){0,1}:){0,1}((?:[0-9]{1,3}\\.){3}[0-9]{1,3}))-(?:(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|(?:[0-9a-fA-F]{1,4}:){1,7}:|(?:[0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|(?:[0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|(?:[0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|(?:[0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|(?:[0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:(?::[0-9a-fA-F]{1,4}){1,6}|:(?::[0-9a-fA-F]{1,4}){1,7}|fe80:(?::[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(?:ffff(:0{1,4}){0,1}:){0,1}((?:[0-9]{1,3}\\.){3}[0-9]{1,3}))$"},{"type":"string","const":"LocalSubnet"}]}},"local_ports":{"type":"array","title":"Local ports","items":{"type":"string"}},"remote_addresses":{"type":"array","title":"Remote addresses","items":{"type":"string"}},"remote_ports":{"type":"array","title":"Remote ports","items":{"type":"string"}},"protocol":{"type":["integer","null"],"description":"Protocol number (1=ICMPv4, 6=TCP, 17=UDP, 58=ICMPv6, 256=ANY)","enum":[0,1,2,6,17,41,43,44,47,50,51,58,59,60,112,113,115,256]},"service":{"type":"string"},"os_type":{"type":"integer","description":"The OS type to which the rule applies. (1=workstation, 2=server, 3=both)","enum":[1,2,3]}}},{"properties":{"id":{"type":"string","title":"Firewall rule ID"},"created_at":{"type":"string","title":"Created at","format":"date-time"},"updated_at":{"type":"string","title":"Updated at","format":"date-time"},"deleted_at":{"type":"string","title":"Deleted at","format":"date-time"},"created_by":{"type":"string","title":"Created by"},"updated_by":{"type":"string","title":"Updated by"},"deleted_by":{"type":"string","title":"Deleted by"},"account_id":{"type":"string","title":"Account ID","format":"uuid"},"parent_account_id":{"type":"string","title":"Parent account ID","format":"uuid"},"etag":{"type":"string","title":"ETag"},"is_default":{"type":"boolean","title":"Indicated whether the rule is default"},"edge_traversal":{"type":"integer","title":"Edge traversal"},"icmp_types":{"type":"string","description":"ICMP types"}}}]}},"is_default":{"type":"boolean","title":"Indicated whether the ruleset is default"},"internal_name":{"type":"string","title":"Internal name"}}}]}}}}},"tags":["Firewall Management"],"operationId":"api.rmm.get.firewall.ruleset"},"put":{"description":"Update a firewall ruleset","summary":"Update a firewall ruleset","security":[{"client_credentials":["write"]},{"user_permissions":["firewall.editPolicy"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":true,"in":"path","description":"ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}},{"name":"fields[firewall_ruleset]","required":false,"in":"query","description":"Specify which fields will be included in the response. Formatted as comma separated list of fields. Allowed fields are created_at, updated_at, created_by, updated_by, account_id, parent_account_id, name, description, version.","schema":{"type":"string","pattern":"^((?:created_at|updated_at|created_by|updated_by|account_id|parent_account_id|name|description|version)(?:,|$))+$"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Update firewall ruleset","anyOf":[{"required":["name"]},{"required":["description"]}],"allOf":[{"title":"Firewall ruleset","type":"object","properties":{"name":{"type":"string","title":"Firewall ruleset name"},"description":{"type":"string","title":"Firewall ruleset description"}}}]}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"title":"Get firewall ruleset response","type":"object","required":["id"],"allOf":[{"title":"Firewall ruleset","type":"object","properties":{"name":{"type":"string","title":"Firewall ruleset name"},"description":{"type":"string","title":"Firewall ruleset description"}}},{"properties":{"id":{"type":"string","title":"Firewall rule ID"},"created_at":{"type":"string","title":"Created at","format":"date-time"},"updated_at":{"type":"string","title":"Updated at","format":"date-time"},"deleted_at":{"type":"string","title":"Deleted at","format":"date-time"},"created_by":{"type":"string","title":"Created by"},"updated_by":{"type":"string","title":"Updated by"},"deleted_by":{"type":"string","title":"Deleted by"},"account_id":{"type":"string","title":"Account ID","format":"uuid"},"parent_account_id":{"type":"string","title":"Parent account ID","format":"uuid"},"etag":{"type":"string","title":"ETag"},"rules":{"type":"array","title":"Rules","items":{"type":"object","title":"Get firewall rule response","required":["id"],"allOf":[{"type":"object","title":"Firewall rule","properties":{"name":{"type":"string","title":"Firewall rule name"},"description":{"type":"string","title":"Firewall rule description"},"program":{"type":"string","title":"Firewall rule program"},"action":{"type":"string","title":"Firewall rule action","enum":["ALLOW","BLOCK"]},"direction":{"type":"string","title":"Firewall rule direction","enum":["IN","OUT"]},"enabled":{"type":"boolean","title":"Enabled"},"location":{"type":"number","title":"Location"},"local_addresses":{"type":"array","title":"Local addresses","items":{"anyOf":[{"type":"string","description":"local IPv4 address","format":"ipv4"},{"type":"string","description":"local explicit IPv4 range","pattern":"^(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)(-)(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$"},{"type":"string","description":"local CIDR IPv4 range","pattern":"^(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)/([0-9]|[12][0-9]|3[012])$"},{"type":"string","description":"IPv6 address","format":"ipv6"},{"type":"string","description":"IPv6 range CIDR","pattern":"^(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}/[0-9]{1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,7}:/[0-9]{1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}/[0-9]{1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}/[0-9]{1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}/[0-9]{1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}/[0-9]{1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}/[0-9]{1,3}$|^[0-9a-fA-F]{1,4}:(?::[0-9a-fA-F]{1,4}){1,6}/[0-9]{1,3}$|^:(?::[0-9a-fA-F]{1,4}){1,7}/[0-9]{1,3}$|^fe80:(?::[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}/[0-9]{1,3}$|^::(?:ffff(:0{1,4}){0,1}:){0,1}((?:[0-9]{1,3}\\.){3}[0-9]{1,3})/[0-9]{1,3}$|^::/[0-9]{1,3}$"},{"type":"string","description":"explicit IPv6 range","pattern":"^(?:(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|(?:[0-9a-fA-F]{1,4}:){1,7}:|(?:[0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|(?:[0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|(?:[0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|(?:[0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|(?:[0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:(?::[0-9a-fA-F]{1,4}){1,6}|:(?::[0-9a-fA-F]{1,4}){1,7}|fe80:(?::[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(?:ffff(:0{1,4}){0,1}:){0,1}((?:[0-9]{1,3}\\.){3}[0-9]{1,3}))-(?:(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|(?:[0-9a-fA-F]{1,4}:){1,7}:|(?:[0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|(?:[0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|(?:[0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|(?:[0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|(?:[0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:(?::[0-9a-fA-F]{1,4}){1,6}|:(?::[0-9a-fA-F]{1,4}){1,7}|fe80:(?::[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(?:ffff(:0{1,4}){0,1}:){0,1}((?:[0-9]{1,3}\\.){3}[0-9]{1,3}))$"},{"type":"string","const":"LocalSubnet"}]}},"local_ports":{"type":"array","title":"Local ports","items":{"type":"string"}},"remote_addresses":{"type":"array","title":"Remote addresses","items":{"type":"string"}},"remote_ports":{"type":"array","title":"Remote ports","items":{"type":"string"}},"protocol":{"type":["integer","null"],"description":"Protocol number (1=ICMPv4, 6=TCP, 17=UDP, 58=ICMPv6, 256=ANY)","enum":[0,1,2,6,17,41,43,44,47,50,51,58,59,60,112,113,115,256]},"service":{"type":"string"},"os_type":{"type":"integer","description":"The OS type to which the rule applies. (1=workstation, 2=server, 3=both)","enum":[1,2,3]}}},{"properties":{"id":{"type":"string","title":"Firewall rule ID"},"created_at":{"type":"string","title":"Created at","format":"date-time"},"updated_at":{"type":"string","title":"Updated at","format":"date-time"},"deleted_at":{"type":"string","title":"Deleted at","format":"date-time"},"created_by":{"type":"string","title":"Created by"},"updated_by":{"type":"string","title":"Updated by"},"deleted_by":{"type":"string","title":"Deleted by"},"account_id":{"type":"string","title":"Account ID","format":"uuid"},"parent_account_id":{"type":"string","title":"Parent account ID","format":"uuid"},"etag":{"type":"string","title":"ETag"},"is_default":{"type":"boolean","title":"Indicated whether the rule is default"},"edge_traversal":{"type":"integer","title":"Edge traversal"},"icmp_types":{"type":"string","description":"ICMP types"}}}]}},"is_default":{"type":"boolean","title":"Indicated whether the ruleset is default"},"internal_name":{"type":"string","title":"Internal name"}}}]}}}}},"tags":["Firewall Management"],"operationId":"api.rmm.put.firewall.ruleset"}},"/oneview/v1/accounts/{account_id}/firewall/policies/{id}/history":{"get":{"description":"Get firewall policy history","summary":"Get firewall policy history","security":[{"client_credentials":["read"]},{"user_permissions":["firewall.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":true,"in":"path","description":"ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"title":"Firewall policy history","type":"array","items":{"type":"object","properties":{"id":{"type":"number"},"timestamp":{"type":"string"},"entity_type":{"type":"string"},"entity_id":{"type":"string"},"operation":{"type":"string"},"relation_id":{"type":"string"},"relation_entity_type":{"type":"string"},"user_id":{"type":["string","null"]}}}}}}}},"tags":["Firewall Management"],"operationId":"api.rmm.get.firewall.policy.history"}},"/oneview/v1/casemgmt/accounts/{account_id}/cases/comments":{"get":{"description":"Get cases comments","summary":"Get cases comments","security":[{"client_credentials":["read"]},{"user_permissions":["mss.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}},{"name":"region","required":false,"in":"query","description":"Region","schema":{"type":"string","enum":["us","emea","secops"]}},{"name":"caseId","required":false,"in":"query","description":"ID of Case","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"$schema":"http://json-schema.org/draft-07/schema","type":"array","title":"Case comments response","examples":[[{"comment":null,"lastEditorId":null,"lastEditorFullName":null,"fileId":1002,"fileType":null,"fileName":null,"isDeleted":false,"creatorUserId":"Automation","creatorFullName":null,"id":1002,"type":4,"caseId":56,"isFavorite":false,"modificationTimeUnixTimeInMs":1725537349316,"creationTimeUnixTimeInMs":1725537349316,"alertIdentifier":"f7099fbd-1e1e-54dc-a8fb-dddef362f715"}]],"items":[{"type":"object","properties":{"comment":{"type":"string","title":"comment","default":""},"lastEditorId":{"type":"string","title":"lastEditorId","default":""},"lastEditorFullName":{"type":"string","title":"lastEditorFullName","default":""},"fileId":{"type":"number","title":"fileId","default":0},"fileType":{"type":"string","title":"fileType","default":""},"fileName":{"type":"string","title":"fileName","default":""},"isDeleted":{"type":"boolean","title":"isDeleted","default":false},"creatorUserId":{"type":"string","title":"creatorUserId","default":""},"creatorFullName":{"type":"string","title":"creatorFullName","default":""},"alertIdentifier":{"type":"string","title":"alertIdentifier","default":""},"id":{"type":"number","title":"id","default":0},"type":{"type":"number","title":"type","default":0},"caseId":{"type":"number","title":"caseId","default":0},"isFavorite":{"type":"boolean","title":"isFavorite","default":false},"modificationTimeUnixTimeInMs":{"type":"number","title":"modificationTimeUnixTimeInMs","default":0},"creationTimeUnixTimeInMs":{"type":"number","title":"creationTimeUnixTimeInMs","default":0}}}]}}}}},"tags":["Case Management"],"operationId":"api.rmm.casemgmt.cases.comments.get"},"post":{"description":"Post cases comments","summary":"Post cases comments","security":[{"client_credentials":["write"]},{"user_permissions":["mss.manage"]}],"status":{"outage":["auth"]},"parameters":[{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}},{"name":"region","required":true,"in":"query","description":"Region","schema":{"type":"string","enum":["us","emea","secops"]}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Post Case Comments","required":["caseId","alertIdentifier"],"properties":{"caseId":{"type":"number","title":"caseId"},"alertIdentifier":{"type":"string","title":"alertIdentifier"},"base64Blob":{"type":"string","title":"base64Blob"},"fileType":{"type":"string","title":"fileType"},"fileName":{"type":"string","title":"fileName"},"comment":{"type":"string","title":"comment"}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"Post cases comments response","examples":[{"comment":null,"lastEditorId":null,"lastEditorFullName":null,"fileId":1013,"fileType":null,"fileName":null,"isDeleted":false,"creatorUserId":"Automation","creatorFullName":null,"id":1013,"type":4,"caseId":71,"isFavorite":false,"modificationTimeUnixTimeInMs":1725968640120,"creationTimeUnixTimeInMs":1725968640120,"alertIdentifier":"(DE) MALWARE.AI.40000000000_6940B0D9-7A3D-5132-BDBE-BFFD23100ED3"}],"properties":{"comment":{"type":"string"},"lastEditorId":{"type":"string"},"lastEditorFullName":{"type":"string"},"fileId":{"type":"integer"},"fileType":{"type":"string"},"fileName":{"type":"string"},"isDeleted":{"type":"boolean"},"creatorUserId":{"type":"string"},"creatorFullName":{"type":"string"},"id":{"type":"integer"},"type":{"type":"integer"},"caseId":{"type":"integer"},"isFavorite":{"type":"boolean"},"modificationTimeUnixTimeInMs":{"type":"integer"},"creationTimeUnixTimeInMs":{"type":"integer"},"alertIdentifier":{"type":"string"}}}}}}},"tags":["Case Management"],"operationId":"api.rmm.casemgmt.cases.comments.post"}},"/oneview/v1/casemgmt/accounts/{account_id}/cases/file":{"get":{"description":"Get Cases file","summary":"Get Cases file","security":[{"client_credentials":["read"]},{"user_permissions":["mss.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}},{"name":"region","required":false,"in":"query","description":"Region","schema":{"type":"string","enum":["us","emea","secops"]}},{"name":"caseId","required":false,"in":"query","description":"ID of Case","schema":{"type":"string"}},{"name":"fileId","required":false,"in":"query","description":"ID of File (Evidence ID)","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"$schema":"http://json-schema.org/draft-07/schema","type":"string","title":"Case file response"}}}}},"tags":["Case Management"],"operationId":"api.rmm.casemgmt.cases.file.get"}},"/oneview/v1/casemgmt/accounts/{account_id}/cases/overview":{"get":{"description":"Get cases overview","summary":"Get cases overview","security":[{"client_credentials":["read"]},{"user_permissions":["mss.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}},{"name":"region","required":false,"in":"query","description":"Region","schema":{"type":"string","enum":["us","emea","secops"]}},{"name":"caseId","required":false,"in":"query","description":"ID of Case","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"Case overview response","examples":[{"id":56,"creationTimeUnixTimeInMs":1712752654954,"modificationTimeUnixTimeInMs":1725621115026,"name":"(DE) Roh-Det : Trojan.MBAMTest","priority":-1,"isImportant":false,"isIncident":false,"startTimeUnixTimeInMs":1712752702240,"endTimeUnixTimeInMs":1712752702240,"assignedUser":"a57505c2-5722-46e7-a48d-9be35eab21b3","description":null,"isTestCase":false,"type":0,"stage":"Triage","environment":"rFmzqNuFQ MSP - Rohin MDR 23c7cf8b-8336-43c2-82f5-853ec1e8c77f","status":2,"incidentId":null,"tags":[],"alertCards":[{"id":1147,"creationTimeUnixTimeInMs":1712752655013,"modificationTimeUnixTimeInMs":1712753155482,"identifier":"(DE) TROJAN.MBAMTEST_F7099FBD-1E1E-54DC-A8FB-DDDEF362F715","status":1,"name":"(DE) TROJAN.MBAMTEST","priority":-1,"workflowsStatus":0,"slaExpirationUnixTime":null,"slaCriticalExpirationUnixTime":null,"startTime":1712752654479,"endTime":1712752654479,"alertGroupIdentifier":"(DE) Roh-Det : Trojan.MBAMTestDm9dcjlFtCDNdnPLPIFOnsVICG0SSdpGUjBZv16LRLI=_d5f61ec2-c5a5-4a77-8ac1-2e945af34b90","eventsCount":1,"title":"(DE) TROJAN.MBAMTEST","ruleGenerator":"(DE) Roh-Det : Trojan.MBAMTest","deviceProduct":"Nebula","deviceVendor":"Malwarebytes","playbookAttached":null,"playbookRunCount":0,"isManualAlert":false,"sla":{"slaExpirationTime":null,"criticalExpirationTime":null,"expirationStatus":2,"remainingTimeSinceLastPause":null},"fieldsGroups":[],"sourceUrl":null,"sourceRuleUrl":null,"siemAlertId":null},{"id":1150,"creationTimeUnixTimeInMs":1712752656390,"modificationTimeUnixTimeInMs":1712753155482,"identifier":"(DE) EXPLOIT_6CFD4680-B796-5867-AE89-5D458F9BD784","status":1,"name":"(DE) EXPLOIT","priority":-1,"workflowsStatus":0,"slaExpirationUnixTime":null,"slaCriticalExpirationUnixTime":null,"startTime":1712752654792,"endTime":1712752654792,"alertGroupIdentifier":"(DE) Roh-Det : exploit/dABfai6Wvrd8qF9KVQbUm4gtUoufyW+w0jydVP4XMk=_0d5510de-41b4-4f59-8af4-aeb7f0d6c8f6","eventsCount":1,"title":"(DE) EXPLOIT","ruleGenerator":"(DE) Roh-Det : exploit","deviceProduct":"Nebula","deviceVendor":"Malwarebytes","playbookAttached":null,"playbookRunCount":0,"isManualAlert":false,"sla":{"slaExpirationTime":null,"criticalExpirationTime":null,"expirationStatus":2,"remainingTimeSinceLastPause":null},"fieldsGroups":[],"sourceUrl":null,"sourceRuleUrl":null,"siemAlertId":null},{"id":1151,"creationTimeUnixTimeInMs":1712752656785,"modificationTimeUnixTimeInMs":1712753155482,"identifier":"(DE) RANSOMWARE.SCRIPT_259CF705-6EC6-53C7-889A-150EDEA3F54C","status":1,"name":"(DE) RANSOMWARE.SCRIPT","priority":-1,"workflowsStatus":0,"slaExpirationUnixTime":null,"slaCriticalExpirationUnixTime":null,"startTime":1712752654883,"endTime":1712752654883,"alertGroupIdentifier":"(DE) Roh-Det : ransomware.scriptVF1KEvOwxSsd+oBQtb3ejxdVqFP1wPn0QkHKk9wqpbU=_0a660865-9c60-4bf9-8b7e-6d2c8a708542","eventsCount":1,"title":"(DE) RANSOMWARE.SCRIPT","ruleGenerator":"(DE) Roh-Det : ransomware.script","deviceProduct":"Nebula","deviceVendor":"Malwarebytes","playbookAttached":null,"playbookRunCount":0,"isManualAlert":false,"sla":{"slaExpirationTime":null,"criticalExpirationTime":null,"expirationStatus":2,"remainingTimeSinceLastPause":null},"fieldsGroups":[],"sourceUrl":null,"sourceRuleUrl":null,"siemAlertId":null},{"id":1152,"creationTimeUnixTimeInMs":1712752702820,"modificationTimeUnixTimeInMs":1712753155482,"identifier":"(DE) TROJAN.MBAMTEST_08E0B2F2-DBE4-5A05-BDD0-4D2D6DB51843","status":1,"name":"(DE) TROJAN.MBAMTEST","priority":-1,"workflowsStatus":0,"slaExpirationUnixTime":null,"slaCriticalExpirationUnixTime":null,"startTime":1712752702240,"endTime":1712752702240,"alertGroupIdentifier":"(DE) Roh-Det : Trojan.MBAMTestOiDuUIAKA7iFZUhTraRGsycSGJwPpaJkuWH9HJRyoDs=_b031eded-9dc0-4434-94fc-aa37080074ca","eventsCount":1,"title":"(DE) TROJAN.MBAMTEST","ruleGenerator":"(DE) Roh-Det : Trojan.MBAMTest","deviceProduct":"Nebula","deviceVendor":"Malwarebytes","playbookAttached":null,"playbookRunCount":0,"isManualAlert":false,"sla":{"slaExpirationTime":null,"criticalExpirationTime":null,"expirationStatus":2,"remainingTimeSinceLastPause":null},"fieldsGroups":[],"sourceUrl":null,"sourceRuleUrl":null,"siemAlertId":null},{"id":1148,"creationTimeUnixTimeInMs":1712752655618,"modificationTimeUnixTimeInMs":1712753155482,"identifier":"(DE) TROJAN.MBAMTEST_B51E80C8-B790-50E4-8CBF-0053A7E00D42","status":1,"name":"(DE) TROJAN.MBAMTEST","priority":-1,"workflowsStatus":0,"slaExpirationUnixTime":null,"slaCriticalExpirationUnixTime":null,"startTime":1712752654559,"endTime":1712752654559,"alertGroupIdentifier":"(DE) Roh-Det : Trojan.MBAMTestpcDwx3p0RzHE2VIDDcxpkQqOYQoP/FRZzQGEIcmShCU=_c883249d-320a-473e-b22a-319bfdb33b15","eventsCount":1,"title":"(DE) TROJAN.MBAMTEST","ruleGenerator":"(DE) Roh-Det : Trojan.MBAMTest","deviceProduct":"Nebula","deviceVendor":"Malwarebytes","playbookAttached":null,"playbookRunCount":0,"isManualAlert":false,"sla":{"slaExpirationTime":null,"criticalExpirationTime":null,"expirationStatus":2,"remainingTimeSinceLastPause":null},"fieldsGroups":[],"sourceUrl":null,"sourceRuleUrl":null,"siemAlertId":null},{"id":1149,"creationTimeUnixTimeInMs":1712752656010,"modificationTimeUnixTimeInMs":1712753155482,"identifier":"(DE) TROJAN.MBAMTEST_6CD3644B-81A6-5318-91AA-7589EA8B6AA4","status":1,"name":"(DE) TROJAN.MBAMTEST","priority":-1,"workflowsStatus":0,"slaExpirationUnixTime":null,"slaCriticalExpirationUnixTime":null,"startTime":1712752654674,"endTime":1712752654674,"alertGroupIdentifier":"(DE) Roh-Det : Trojan.MBAMTestKQK/CII8WWRWIr6/TsaqUpVe9+9hMI1Ng0aWbRRbHKc=_569a6ac7-949f-4e6f-bd64-9d940e3dba85","eventsCount":1,"title":"(DE) TROJAN.MBAMTEST","ruleGenerator":"(DE) Roh-Det : Trojan.MBAMTest","deviceProduct":"Nebula","deviceVendor":"Malwarebytes","playbookAttached":null,"playbookRunCount":0,"isManualAlert":false,"sla":{"slaExpirationTime":null,"criticalExpirationTime":null,"expirationStatus":2,"remainingTimeSinceLastPause":null},"fieldsGroups":[],"sourceUrl":null,"sourceRuleUrl":null,"siemAlertId":null}],"isOverflowCase":false,"isManualCase":false,"slaExpirationUnixTime":null,"slaCriticalExpirationUnixTime":null,"stageSlaExpirationUnixTimeInMs":null,"stageSlaCriticalExpirationUnixTimeInMs":null,"canOpenIncident":false,"sla":{"slaExpirationTime":null,"criticalExpirationTime":null,"expirationStatus":2,"remainingTimeSinceLastPause":null},"stageSla":{"slaExpirationTime":null,"criticalExpirationTime":null,"expirationStatus":2,"remainingTimeSinceLastPause":null},"relatedAlertTicketId":null}],"properties":{"id":{"type":"integer"},"creationTimeUnixTimeInMs":{"type":"integer"},"modificationTimeUnixTimeInMs":{"type":"integer"},"name":{"type":"string"},"priority":{"type":"integer"},"isImportant":{"type":"boolean"},"isIncident":{"type":"boolean"},"startTimeUnixTimeInMs":{"type":"integer"},"endTimeUnixTimeInMs":{"type":"integer"},"assignedUser":{"type":"string"},"description":{"type":"string"},"isTestCase":{"type":"boolean"},"type":{"type":"integer"},"stage":{"type":"string"},"environment":{"type":"string"},"status":{"type":"integer"},"incidentId":{"type":"integer"},"tags":{"type":"array","items":[{"type":"string"}]},"alertCards":{"type":"array","items":[{"type":"object","properties":{"id":{"type":"integer"},"creationTimeUnixTimeInMs":{"type":"integer"},"modificationTimeUnixTimeInMs":{"type":"integer"},"identifier":{"type":"string"},"status":{"type":"integer"},"name":{"type":"string"},"priority":{"type":"integer"},"workflowsStatus":{"type":"integer"},"slaExpirationUnixTime":{"type":"integer"},"slaCriticalExpirationUnixTime":{"type":"integer"},"startTime":{"type":"integer"},"endTime":{"type":"integer"},"alertGroupIdentifier":{"type":"string"},"eventsCount":{"type":"integer"},"title":{"type":"string"},"ruleGenerator":{"type":"string"},"deviceProduct":{"type":"string"},"deviceVendor":{"type":"string"},"playbookAttached":{"type":"string"},"playbookRunCount":{"type":"integer"},"isManualAlert":{"type":"boolean"},"sla":{"type":"object"},"fieldsGroups":{"type":"array","items":[{"type":"object","properties":{"order":{"type":"integer"},"groupName":{"type":"string"},"isIntegration":{"type":"boolean"},"isHighlight":{"type":"boolean"},"items":{"type":"array","items":[{"type":"object"}]}}}]},"sourceUrl":{"type":"string"},"sourceRuleUrl":{"type":"string"},"siemAlertId":{"type":"string"}}}]},"isOverflowCase":{"type":"boolean"},"isManualCase":{"type":"boolean"},"slaExpirationUnixTime":{"type":"integer"},"slaCriticalExpirationUnixTime":{"type":"integer"},"stageSlaExpirationUnixTimeInMs":{"type":"integer"},"stageSlaCriticalExpirationUnixTimeInMs":{"type":"integer"},"canOpenIncident":{"type":"boolean"},"sla":{"type":"object"},"stageSla":{"type":"object"},"relatedAlertTicketId":{"type":"string"}}}}}}},"tags":["Case Management"],"operationId":"api.rmm.casemgmt.cases.overview.get"}},"/oneview/v1/casemgmt/accounts/{account_id}/cases/wall":{"get":{"description":"Get cases wall","summary":"Get cases wall","security":[{"client_credentials":["read"]},{"user_permissions":["mss.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}},{"name":"region","required":false,"in":"query","description":"Region","schema":{"type":"string","enum":["us","emea","secops"]}},{"name":"caseId","required":false,"in":"query","description":"ID of Case","schema":{"type":"string"}}],"responses":{"200":{"description":"Successful response"}},"tags":["Case Management"],"operationId":"api.rmm.casemgmt.cases.wall.get"}},"/oneview/v1/casemgmt/accounts/{account_id}/multiplexer/cases/events":{"get":{"description":"Get cases events","summary":"Get Case events","security":[{"client_credentials":["read"]},{"user_permissions":["mss.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}},{"name":"region","required":false,"in":"query","description":"Region","schema":{"type":"string","enum":["us","emea","secops"]}},{"name":"caseId","required":false,"in":"query","description":"ID of Case","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"Multiplexer cases events response","examples":[{"caseOverview":{"id":71,"creationTimeUnixTimeInMs":1712921652190,"modificationTimeUnixTimeInMs":1725956986615,"name":"(DE) alessio-mock-endpoint : Malware.AI.40000000000","priority":-1,"isImportant":false,"isIncident":false,"startTimeUnixTimeInMs":1712921662880,"endTimeUnixTimeInMs":1712921662880,"assignedUser":"a57505c2-5722-46e7-a48d-9be35eab21b3","description":null,"isTestCase":false,"type":0,"stage":"Triage","environment":"Test-Account3 550a20b8-6d36-4222-afbc-54d100f2e894","status":2,"incidentId":null,"tags":[],"alertCards":[{"id":1313,"creationTimeUnixTimeInMs":1712921652223,"modificationTimeUnixTimeInMs":1712926418357,"identifier":"(DE) MALWARE.AI.40000000000_6940B0D9-7A3D-5132-BDBE-BFFD23100ED3","status":1,"name":"(DE) MALWARE.AI.40000000000","priority":-1,"workflowsStatus":0,"slaExpirationUnixTime":null,"slaCriticalExpirationUnixTime":null,"startTime":1712921650142,"endTime":1712921650142,"alertGroupIdentifier":"(DE) alessio-mock-endpoint : Malware.AI.40000000000yb+p8Ht/RD3x2+kkJue9z1dPZDLxWZWVRG4C2TE0Azs=_5ba3b19a-ea0a-4309-9f2f-23cc8406b121","eventsCount":1,"title":"(DE) MALWARE.AI.40000000000","ruleGenerator":"(DE) alessio-mock-endpoint : Malware.AI.40000000000","deviceProduct":"Nebula","deviceVendor":"Malwarebytes","playbookAttached":null,"playbookRunCount":0,"isManualAlert":false,"sla":{"slaExpirationTime":null,"criticalExpirationTime":null,"expirationStatus":2,"remainingTimeSinceLastPause":null},"fieldsGroups":[],"sourceUrl":null,"sourceRuleUrl":null,"siemAlertId":null}],"isOverflowCase":false,"isManualCase":false,"slaExpirationUnixTime":null,"slaCriticalExpirationUnixTime":null,"stageSlaExpirationUnixTimeInMs":null,"stageSlaCriticalExpirationUnixTimeInMs":null,"canOpenIncident":false,"sla":{"slaExpirationTime":null,"criticalExpirationTime":null,"expirationStatus":2,"remainingTimeSinceLastPause":null},"stageSla":{"slaExpirationTime":null,"criticalExpirationTime":null,"expirationStatus":2,"remainingTimeSinceLastPause":null},"relatedAlertTicketId":null},"events":[{"identifier":"ff35d1c4-0208-4afb-826a-df7150076e5d","caseId":71,"alertIdentifier":"(DE) MALWARE.AI.61000000000_A9F68AB8-62C5-501F-A5BB-8DB8409F700F","name":"Malware.AI.61000000000","product":"Nebula","port":null,"sourceSystemName":"Malwarebytes Nebula","outcome":"found","time":0,"type":"file","artifactEntities":["C:\\USERS\\DOWNLOADS\\ADMINISTRATOR11\\SAMPLE_THREAT.EXE","D52A306A18221C4A2D6765BD3B3C99F9"],"fields":[{"order":0,"groupName":"Highlighted Fields","isIntegration":false,"isHighlight":true,"items":[{"originalName":"id","name":"id","value":"a9f68ab8-62c5-501f-a5bb-8db8409f700f"},{"originalName":"category","name":"category","value":"MALWARE"},{"originalName":"status","name":"status","value":"found"},{"originalName":"is_rtp_stream_event","name":"is_rtp_stream_event","value":"false"},{"originalName":"scan_id","name":"scan_id","value":"18f5bc2d-11a3-53fa-8360-e61f7f1ba95a"},{"originalName":"threat_name","name":"threat_name","value":"Malware.AI.61000000000"},{"originalName":"name","name":"Name","value":"Malware.AI.61000000000"}]},{"order":0,"groupName":"Default","isIntegration":false,"isHighlight":false,"items":[{"originalName":"child_trace_count","name":"child_trace_count","value":"0"},{"originalName":"group_name","name":"group_name","value":"_Alessio test"},{"originalName":"policy_id","name":"policy_id","value":"f24e4fc0-d8fd-48bf-9558-8f4222b283b5"},{"originalName":"policy_name","name":"policy_name","value":"_____________231231231231"},{"originalName":"managed","name":"managed","value":"true"},{"originalName":"id","name":"id","value":"a9f68ab8-62c5-501f-a5bb-8db8409f700f"},{"originalName":"category","name":"category","value":"MALWARE"},{"originalName":"status","name":"status","value":"found"},{"originalName":"group_id","name":"group_id","value":"a00fd4a0-d499-4f4f-acd8-7b07a1496aae"},{"originalName":"machine_id","name":"machine_id","value":"2205448e-1fe3-47cb-824d-df4871cfb900"},{"originalName":"is_rtp_stream_event","name":"is_rtp_stream_event","value":"false"},{"originalName":"scan_id","name":"scan_id","value":"18f5bc2d-11a3-53fa-8360-e61f7f1ba95a"},{"originalName":"rule_id","name":"rule_id","value":"2baad3b6-b59c-478f-856b-9d50e24ba800"},{"originalName":"scanned_at","name":"scanned_at","value":"2024-04-12T11:33:59.232786Z"},{"originalName":"reported_at","name":"reported_at","value":"2024-04-12T11:33:59.501779624Z"},{"originalName":"threat_name","name":"threat_name","value":"Malware.AI.61000000000"},{"originalName":"md5","name":"md5","value":"d52a306a18221c4a2d6765bd3b3c99f9"},{"originalName":"sha256","name":"sha256","value":"4fde13de40bc5079099488773431c7f8d5b4719ebddbc996636ea401a072993c"},{"originalName":"machine_name","name":"machine_name","value":"alessio-mock-endpoint"},{"originalName":"detection_id_from_endpoint","name":"detection_id_from_endpoint","value":"2492999c-dc59-45f6-9d70-5a230c93afa2"},{"originalName":"machine_ip","name":"machine_ip","value":"213.35.176.146"},{"originalName":"last_user","name":"last_user","value":"alessio-mock-endpoint\\administrator"},{"originalName":"engine_version","name":"engine_version","value":"1.2.0.971"},{"originalName":"type_1","name":"type_1","value":"file"},{"originalName":"start_time","name":"start_time","value":"2024-04-12T11:33:59.501779624Z"},{"originalName":"end_time","name":"end_time","value":"2024-04-12T11:33:59.501779624Z"},{"originalName":"nebula_link","name":"nebula_link","value":"https://nebula-retina-mb-qa.eng-dev.mb-internal.com/550a20b8-6d36-4222-afbc-54d100f2e894/details/endpoint/2205448e-1fe3-47cb-824d-df4871cfb900?selectedTab=detections&id=a9f68ab8-62c5-501f-a5bb-8db8409f700f"}]},{"order":0,"groupName":"Carbon Black","isIntegration":false,"isHighlight":false,"items":[{"originalName":"path","name":"Path","value":"C:\\Users\\Downloads\\administrator11\\sample_threat.exe"}]},{"order":0,"groupName":"System","isIntegration":false,"isHighlight":false,"items":[{"originalName":"name","name":"Name","value":"Malware.AI.61000000000"}]}]}]}],"properties":{"caseOverview":{"type":"object","properties":{"id":{"type":"integer"},"creationTimeUnixTimeInMs":{"type":"integer"},"modificationTimeUnixTimeInMs":{"type":"integer"},"name":{"type":"string"},"priority":{"type":"integer"},"isImportant":{"type":"boolean"},"isIncident":{"type":"boolean"},"startTimeUnixTimeInMs":{"type":"integer"},"endTimeUnixTimeInMs":{"type":"integer"},"assignedUser":{"type":"string"},"description":{"type":"string"},"isTestCase":{"type":"boolean"},"type":{"type":"integer"},"stage":{"type":"string"},"environment":{"type":"string"},"status":{"type":"integer"},"incidentId":{"type":"boolean"},"tags":{"type":"array","items":[{"type":"string"}]},"alertCards":{"type":"array","items":[{"type":"object","properties":{"id":{"type":"integer"},"creationTimeUnixTimeInMs":{"type":"integer"},"modificationTimeUnixTimeInMs":{"type":"integer"},"identifier":{"type":"string"},"status":{"type":"integer"},"name":{"type":"string"},"priority":{"type":"integer"},"workflowsStatus":{"type":"integer"},"slaExpirationUnixTime":{"type":"integer"},"slaCriticalExpirationUnixTime":{"type":"integer"},"startTime":{"type":"integer"},"endTime":{"type":"integer"},"alertGroupIdentifier":{"type":"string"},"eventsCount":{"type":"integer"},"title":{"type":"string"},"ruleGenerator":{"type":"string"},"deviceProduct":{"type":"string"},"deviceVendor":{"type":"string"},"playbookAttached":{"type":"string"},"playbookRunCount":{"type":"integer"},"isManualAlert":{"type":"boolean"},"sla":{"type":"object","properties":{"slaExpirationTime":{"type":"integer"},"criticalExpirationTime":{"type":"integer"},"expirationStatus":{"type":"integer"},"remainingTimeSinceLastPause":{"type":"integer"}}},"fieldsGroups":{"type":"array","items":{"type":"object","properties":{"order":{"type":"integer"},"groupName":{"type":"string"},"isIntegration":{"type":"boolean"},"isHighlight":{"type":"boolean"},"items":{"type":"array","items":[{"type":"string"}]}}}},"sourceUrl":{"type":"string"},"sourceRuleUrl":{"type":"string"},"siemAlertId":{"type":"string"}}}]},"isOverflowCase":{"type":"boolean"},"isManualCase":{"type":"boolean"},"slaExpirationUnixTime":{"type":"integer"},"slaCriticalExpirationUnixTime":{"type":"integer"},"stageSlaExpirationUnixTimeInMs":{"type":"integer"},"stageSlaCriticalExpirationUnixTimeInMs":{"type":"integer"},"canOpenIncident":{"type":"boolean"},"sla":{"type":"object","properties":{"slaExpirationTime":{"type":"integer"},"criticalExpirationTime":{"type":"integer"},"expirationStatus":{"type":"integer"},"remainingTimeSinceLastPause":{"type":"integer"}}},"stageSla":{"type":"object","properties":{"slaExpirationTime":{"type":"integer"},"criticalExpirationTime":{"type":"integer"},"expirationStatus":{"type":"integer"},"remainingTimeSinceLastPause":{"type":"integer"}}},"relatedAlertTicketId":{"type":"string"}}},"events":{"type":"array","items":[{"type":"object","properties":{"identifier":{"type":"string"},"caseId":{"type":"integer"},"alertIdentifier":{"type":"string"},"name":{"type":"string"},"product":{"type":"string"},"port":{"type":"string"},"sourceSystemName":{"type":"string"},"outcome":{"type":"string"},"time":{"type":"integer"},"type":{"type":"string"},"artifactEntities":{"type":"array","items":[{"type":"string"}]},"fields":{"type":"array","items":[{"type":"object","properties":{"order":{"type":"integer"},"groupName":{"type":"string"},"isIntegration":{"type":"boolean"},"isHighlight":{"type":"boolean"},"items":{"type":"array","items":[{"type":"object","properties":{"originalName":{"type":"string"},"name":{"type":"string"},"value":{"type":"string"}}}]}}}]}}}]},"accountId":{"type":"string"},"region":{"type":"string"}}}}}}},"tags":["Case Management"],"operationId":"api.rmm.casemgmt.multiplexer.cases.events.get"}},"/oneview/v1/casemgmt/accounts/{account_id}/cases/action":{"post":{"description":"Placeholder. Please extend this","summary":"Placeholder. Please extend this","deprecated":false,"security":[{"client_credentials":["write"]},{"user_permissions":["mss.manage"]}],"status":{"outage":["auth"]},"parameters":[{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Post Case Action","required":["caseId","alertGroupIdentifiers","environment","config"],"properties":{"environment":{"type":"string","title":"environment"},"alertGroupIdentifiers":{"type":"array","title":"alertGroupIdentifiers"},"caseId":{"type":"number","title":"caseId"},"config":{"type":"object","title":"config","oneOf":[{"type":"object","properties":{"type":{"const":"msgraphapi"},"action":{"type":"string","title":"Action","enum":["AzureActiveDirectory_Disable Account","AzureActiveDirectory_Force Password Update","AzureActiveDirectory_Remove User from a Group","AzureActiveDirectory_Reset User Password","AzureActiveDirectory_Revoke User Session","AzureActiveDirectory_Enforce MFA for Users"]},"user_email":{"type":"string","title":"User Email"},"group_name":{"type":"string","title":"Group Name"},"password":{"type":"string","format":"password","title":"password","writeOnly":true}},"required":["type","action"],"allOf":[{"if":{"properties":{"action":{"const":"AzureActiveDirectory_Disable Account"}}},"then":{"required":["user_email"]}},{"if":{"properties":{"action":{"const":"AzureActiveDirectory_Enforce MFA for Users"}}},"then":{"required":["user_email"]}},{"if":{"properties":{"action":{"const":"AzureActiveDirectory_Force Password Update"}}},"then":{"required":["user_email"]}},{"if":{"properties":{"action":{"const":"AzureActiveDirectory_Remove User from a Group"}}},"then":{"required":["user_email","group_name"]}},{"if":{"properties":{"action":{"const":"AzureActiveDirectory_Reset User Password"}}},"then":{"required":["user_email","password"]}},{"if":{"properties":{"action":{"const":"AzureActiveDirectory_Revoke User Session"}}},"then":{"required":["user_email"]}}]},{"type":"object","properties":{"type":{"const":"okta"},"action":{"type":"string","title":"Action","enum":["Okta_Disable User","Okta_Force Password Update","Okta_Reset Password","Okta_Force 2FA User","Okta_Revoke User"]},"user_email":{"type":"string","title":"User Email"}},"required":["type","action","user_email"]}]}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"Post cases action response","examples":[{"scriptResultEntityData":[],"resultName":"is_success","alertDisplayName":null,"parameters":null,"properties":{"scriptName":"AzureActiveDirectory_Disable Account","scriptParametersEntityFields":"{}","selectedScopeName":null,"scriptFirstIterationAsyncRunningTime":"1762348235571","integrationInstance":"4f4b0201-baed-413a-9a9d-cbbbe49a452d"},"executingUser":"Siemplify automation","providerIdentifier":"Scripts","integration":"AzureActiveDirectory","integrationInstanceIdentifier":"4f4b0201-baed-413a-9a9d-cbbbe49a452d","integrationInstanceName":"AzureActiveDirectory_1","integrationInstanceEnvironment":"Nebula QA EPR f6fcc25b-eb30-4eb3-b049-c32cda5a0b61","actionIdentifier":"AzureActiveDirectory_Disable Account","actionCategory":7,"caseId":81322,"entityIdentifier":"RSKUMAR_TEST@TD-ESO.COM","shouldCreateActivity":false,"resultCode":0,"isFavorite":false,"message":"Successfully disabled users: \nRSKUMAR_TEST@TD-ESO.COM\n","resultJsonObject":"{}","targetedEntitiesJsonObject":"[\n {\n \"RelatedRelations\": [],\n \"InvolvedEntities\": [],\n \"InvolvedRelations\": [],\n \"UseForGrouping\": false,\n \"SourceSystemUrl\": \"https://mlwrbytsw.backstory.chronicle.security\",\n \"SourceRuleIdentifier\": null,\n \"Type\": \"USERUNIQNAME\",\n \"Properties\": [\n {\n \"Key\": \"Identifier\",\n \"Value\": \"RSKUMAR_TEST@TD-ESO.COM\"\n },\n {\n \"Key\": \"Network_Priority\",\n \"Value\": \"0\"\n },\n {\n \"Key\": \"IsSuspicious\",\n \"Value\": \"False\"\n },\n {\n \"Key\": \"IsAttacker\",\n \"Value\": \"False\"\n },\n {\n \"Key\": \"IsPivot\",\n \"Value\": \"False\"\n },\n {\n \"Key\": \"IsManuallyCreated\",\n \"Value\": \"False\"\n },\n {\n \"Key\": \"Environment\",\n \"Value\": \"Nebula QA EPR f6fcc25b-eb30-4eb3-b049-c32cda5a0b61\"\n },\n {\n \"Key\": \"Alert_Id\",\n \"Value\": \"[ARW] RANSOMWARE.SCRIPT : RSKUMAR_TEST@TD-ESO.COM ::INCIDENT_ID=2660985::_A6AE1A93-B63C-47D5-B626-DD092BE42848\"\n },\n {\n \"Key\": \"Type\",\n \"Value\": \"USERUNIQNAME\"\n },\n {\n \"Key\": \"IsArtifact\",\n \"Value\": \"False\"\n },\n {\n \"Key\": \"IsEnriched\",\n \"Value\": \"False\"\n },\n {\n \"Key\": \"IsTestCase\",\n \"Value\": \"False\"\n },\n {\n \"Key\": \"IsVulnerable\",\n \"Value\": \"False\"\n },\n {\n \"Key\": \"IsInternalAsset\",\n \"Value\": \"False\"\n },\n {\n \"Key\": \"SourceSystemUrl\",\n \"Value\": \"https://mlwrbytsw.backstory.chronicle.security\"\n },\n {\n \"Key\": \"IsFromLdapString\",\n \"Value\": \"False\"\n },\n {\n \"Key\": \"OriginalIdentifier\",\n \"Value\": \"RSKUMAR_TEST@TD-ESO.COM\"\n },\n {\n \"Key\": \"RAW_event_principal_user_userid\",\n \"Value\": \"rskumar_test@td-eso.com\"\n }\n ]\n }\n]","resultEntitiesJsonObject":"[\n {\n \"RelatedRelations\": [],\n \"InvolvedEntities\": [],\n \"InvolvedRelations\": [],\n \"UseForGrouping\": false,\n \"SourceSystemUrl\": \"https://mlwrbytsw.backstory.chronicle.security\",\n \"SourceRuleIdentifier\": null,\n \"Type\": \"USERUNIQNAME\",\n \"Properties\": [\n {\n \"Key\": \"Identifier\",\n \"Value\": \"RSKUMAR_TEST@TD-ESO.COM\"\n },\n {\n \"Key\": \"Network_Priority\",\n \"Value\": \"0\"\n },\n {\n \"Key\": \"IsSuspicious\",\n \"Value\": \"False\"\n },\n {\n \"Key\": \"IsAttacker\",\n \"Value\": \"False\"\n },\n {\n \"Key\": \"IsPivot\",\n \"Value\": \"False\"\n },\n {\n \"Key\": \"IsManuallyCreated\",\n \"Value\": \"False\"\n },\n {\n \"Key\": \"Environment\",\n \"Value\": \"Nebula QA EPR f6fcc25b-eb30-4eb3-b049-c32cda5a0b61\"\n },\n {\n \"Key\": \"Alert_Id\",\n \"Value\": \"[ARW] RANSOMWARE.SCRIPT : RSKUMAR_TEST@TD-ESO.COM ::INCIDENT_ID=2660985::_A6AE1A93-B63C-47D5-B626-DD092BE42848\"\n },\n {\n \"Key\": \"Type\",\n \"Value\": \"USERUNIQNAME\"\n },\n {\n \"Key\": \"IsArtifact\",\n \"Value\": \"False\"\n },\n {\n \"Key\": \"IsEnriched\",\n \"Value\": \"False\"\n },\n {\n \"Key\": \"IsTestCase\",\n \"Value\": \"False\"\n },\n {\n \"Key\": \"IsVulnerable\",\n \"Value\": \"False\"\n },\n {\n \"Key\": \"IsInternalAsset\",\n \"Value\": \"False\"\n },\n {\n \"Key\": \"SourceSystemUrl\",\n \"Value\": \"https://mlwrbytsw.backstory.chronicle.security\"\n },\n {\n \"Key\": \"IsFromLdapString\",\n \"Value\": \"False\"\n },\n {\n \"Key\": \"OriginalIdentifier\",\n \"Value\": \"RSKUMAR_TEST@TD-ESO.COM\"\n },\n {\n \"Key\": \"RAW_event_principal_user_userid\",\n \"Value\": \"rskumar_test@td-eso.com\"\n }\n ]\n }\n]","resultValue":"true","status":2,"indicatorIdentifier":"[ARW] ransomware.script : rskumar_test@td-eso.com ::incident_id=2660985::lLGxlFOXDXgeR6A94FvgDXUwwwXMKCq/O79inbcyYyg=_ff06cfa6-4fe3-477d-bb75-2c52525e1da0","workflowId":null,"workflowStep":null,"blockStepId":null,"workflowStepInstanceName":null,"isAsyncPollingResult":false,"firstResultUnixTime":1762261836985,"isSkippedAndNotExecuted":false,"loopIteration":null,"startLoopStepIdentifier":null,"id":1682738,"creationTimeUnixTimeInMs":1762261836985,"modificationTimeUnixTimeInMs":1762261836985}],"properties":{"scriptResultEntityData":{"type":"array","nullable":true},"resultName":{"type":"string","nullable":true},"alertDisplayName":{"type":"string","nullable":true},"parameters":{"type":"array","nullable":true},"properties":{"type":"object","additionalProperties":{"type":"string","nullable":true},"nullable":true},"executingUser":{"type":"string","nullable":true},"providerIdentifier":{"type":"string","nullable":true},"integration":{"type":"string","nullable":true},"integrationInstanceIdentifier":{"type":"string","format":"uuid"},"integrationInstanceName":{"type":"string","nullable":true},"integrationInstanceEnvironment":{"type":"string","nullable":true},"actionIdentifier":{"type":"string","nullable":true},"actionCategory":{"type":"integer"},"caseId":{"type":"integer","format":"int64","nullable":true},"entityIdentifier":{"type":"string","nullable":true},"shouldCreateActivity":{"type":"boolean"},"resultCode":{"type":"integer","format":"int32"},"isFavorite":{"type":"boolean"},"message":{"type":"string","nullable":true},"resultJsonObject":{"type":"string","nullable":true},"targetedEntitiesJsonObject":{"type":"string","nullable":true},"resultEntitiesJsonObject":{"type":"string","nullable":true},"resultValue":{"type":"string","nullable":true},"status":{"type":"integer"},"indicatorIdentifier":{"type":"string","nullable":true},"workflowId":{"type":"string","format":"uuid","nullable":true},"workflowStep":{"type":"string","format":"uuid","nullable":true},"blockStepId":{"type":"string","format":"uuid","nullable":true},"workflowStepInstanceName":{"type":"string","nullable":true},"isAsyncPollingResult":{"type":"boolean"},"firstResultUnixTime":{"type":"integer","format":"int64"},"isSkippedAndNotExecuted":{"type":"boolean"},"loopIteration":{"type":"integer","format":"int32","nullable":true},"startLoopStepIdentifier":{"type":"string","format":"uuid","nullable":true},"id":{"type":"integer","format":"int64"},"creationTimeUnixTimeInMs":{"type":"integer","format":"int64"},"modificationTimeUnixTimeInMs":{"type":"integer","format":"int64"}},"additionalProperties":false}}}}},"tags":["Case Management"],"operationId":"api.rmm.casemgmt.cases.action.post"}},"/oneview/v1/casemgmt/accounts/{account_id}/cases/requests":{"post":{"description":"Post Cases Requests","summary":"Post Cases Requests","security":[{"client_credentials":["write"]},{"user_permissions":["mss.manage"]}],"status":{"outage":["auth"]},"parameters":[{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}},{"name":"region","required":true,"in":"query","description":"Region","schema":{"type":"string","enum":["us","emea","secops"]}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Post Case Requests","required":["priority","description","environment"],"properties":{"caseNumber":{"type":"number","title":"caseNumber"},"priority":{"type":"string","title":"priority","enum":["Low","Medium","High","Critical","Informative"]},"description":{"type":"string","title":"description"},"environment":{"type":"string","title":"environment"}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"$schema":"http://json-schema.org/draft-07/schema","type":"boolean"}}}}},"tags":["Case Management"],"operationId":"api.rmm.casemgmt.cases.requests.post"}},"/oneview/v1/casemgmt/cases/search":{"post":{"description":"Search Cases across accounts","summary":"Search Cases","security":[{"client_credentials":["read"]},{"user_permissions":["mss.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Case search","allOf":[{"type":"object","title":"Post Case search","properties":{"startTime":{"type":"string","title":"startTime"},"endTime":{"type":"string","title":"endTime"},"pageSize":{"type":"number","title":"pageSize"},"requestedPage":{"type":"number","title":"requestedPage"},"caseSource":{"type":"array","title":"caseSource","items":{"type":"string","enum":["System","Manual","Test"]}},"tags":{"type":"array","title":"tags","items":{"type":"string"}},"priorities":{"type":"array","title":"priorities","items":{"type":"string","enum":["Low","Informative","Medium","High","Critical"]}},"importance":{"type":"array","title":"importance","items":{"type":"boolean"}},"incident":{"type":"array","title":"incident","items":{"type":"boolean"}},"assignedUsers":{"type":"array","title":"assignedUsers","items":{"type":"string"}},"products":{"type":"array","title":"products","items":{"type":"string"}},"ports":{"type":"array","title":"ports","items":{"type":"string"}},"title":{"type":"string","title":"title"},"stage":{"type":"array","title":"stage","items":{"type":"string","enum":["Closed by Automation","Resolved","Remediation","Customer Action Required","Research","Incident","Investigation","Assessment","New Case","Triage","Improvement"]}},"isCaseClosed":{"type":"boolean","title":"isCaseClosed"},"closeReason":{"type":"string","title":"closeReason","enum":["malicious","not_malicious","maintenance","inconclusive","unknown"]},"timeRangeFilter":{"type":"string","title":"timeRangeFilter","enum":["custom","last_day","last_2_days","last_3_days","last_week","last_2_weeks","last_month","last_3_months","last_6_months","last_year"]},"sortBy":{"type":"object","title":"Sorting","properties":{"sortBy":{"type":"string","title":"The sortby field","enum":["id","title","time","user_assigned","is_important","is_incident","involved_suspicious_entity","is_case_closed","environment","priority","stage"]},"sortOrder":{"type":"string","title":"The sort order asc or desc","enum":["desc","asc"]}}}}},{"type":"object","required":["account_ids"],"properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"Post cases search response","examples":[{"results":[{"id":1,"title":"Swati test","time":"2022-08-05T16:24:24.829Z","closingTime":"2024-04-10T07:55:10.39Z","tags":["Manual Case"],"products":[],"alertNames":[],"ticketIds":["23c7cf8b-8336-43c2-82f5-853ec1e8c77f||8458e6b9-5682-449e-9825-cb2266cd3bc1||Roho-casemgmt||fec957fb-8404-57e2-bfc7-98382f9adc99","23c7cf8b-8336-43c2-82f5-853ec1e8c77f||8458e6b9-5682-449e-9825-cb2266cd3bc1||Roho-casemgmt||11b8f173-a966-5f40-9be3-98fb142a0bfd","23c7cf8b-8336-43c2-82f5-853ec1e8c77f||8458e6b9-5682-449e-9825-cb2266cd3bc1||Roho-casemgmt||77035722-2187-5219-ad26-5774768ac69c","23c7cf8b-8336-43c2-82f5-853ec1e8c77f||8458e6b9-5682-449e-9825-cb2266cd3bc1||Roho-casemgmt||d6c9defd-769f-5c3b-a9d9-d5cc2c2def3b","23c7cf8b-8336-43c2-82f5-853ec1e8c77f||8458e6b9-5682-449e-9825-cb2266cd3bc1||Roho-casemgmt||c679f20f-2d8d-54b5-95c1-be6d5c333984","23c7cf8b-8336-43c2-82f5-853ec1e8c77f||8458e6b9-5682-449e-9825-cb2266cd3bc1||Roho-casemgmt||2eacbaa8-f975-50fc-bac0-4193a560e46a","23c7cf8b-8336-43c2-82f5-853ec1e8c77f||8458e6b9-5682-449e-9825-cb2266cd3bc1||Roho-casemgmt||3568072","23c7cf8b-8336-43c2-82f5-853ec1e8c77f||8458e6b9-5682-449e-9825-cb2266cd3bc1||Roho-casemgmt||3568074"],"eventNames":[],"sources":[],"destinations":[],"artificats":[],"ports":[],"outcomes":[],"userAssigned":"Rohin Sambath Kumar","isImportant":false,"isIncident":false,"involvedSuspiciousEntity":false,"isCaseClosed":true,"environment":"IYABoAyLQ MSP - Dev Site MDR1","priority":40,"stage":"Triage","closeReason":"NotMalicious","rootCause":"Human error","alertsCount":1,"updated_at":1726750609684,"endpoint_info":{"machine_id":"8458e6b9-5682-449e-9825-cb2266cd3bc1","machine_name":"Roho-casemgmt"}}],"totalCount":1,"pageNumber":0,"pageSize":0}],"properties":{"results":{"type":"array","items":[{"type":"object","properties":{"id":{"type":"integer"},"title":{"type":"string"},"time":{"type":"string"},"closingTime":{"type":"string"},"tags":{"type":"array","items":[{"type":"string"}]},"products":{"type":"array","items":[{"type":"string"}]},"alertNames":{"type":"array","items":[{"type":"string"}]},"ticketIds":{"type":"array","items":[{"type":"string"}]},"eventNames":{"type":"array","items":[{"type":"string"}]},"sources":{"type":"array","items":[{"type":"string"}]},"destinations":{"type":"array","items":[{"type":"string"}]},"artificats":{"type":"array","items":[{"type":"string"}]},"ports":{"type":"array","items":[{"type":"string"}]},"outcomes":{"type":"array","items":[{"type":"string"}]},"userAssigned":{"type":"string"},"isImportant":{"type":"boolean"},"isIncident":{"type":"boolean"},"involvedSuspiciousEntity":{"type":"boolean"},"isCaseClosed":{"type":"boolean"},"environment":{"type":"string"},"priority":{"type":"integer"},"stage":{"type":"string"},"closeReason":{"type":"string"},"rootCause":{"type":"string"},"alertsCount":{"type":"integer"},"updated_at":{"type":"integer"},"endpoint_info":{"type":"object","properties":{"machine_id":{"type":"string"},"machine_name":{"type":"string"}}}}}]},"totalCount":{"type":"integer"},"pageNumber":{"type":"integer"},"pageSize":{"type":"integer"}}}}}}},"tags":["Case Management"],"operationId":"api.rmm.casemgmt.cases.search.post"}},"/oneview/v1/casemgmt/multiplexer/cases/bulk":{"post":{"description":"Post multiplexer cases bulk","summary":"Post multiplexer cases bulk","security":[{"client_credentials":["read"]},{"user_permissions":["mss.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"allOf":[{"type":"object","title":"Get case time filter","properties":{"timeFilter":{"type":"string","title":"time filter","enum":["custom","last_day","last_2_days","last_3_days","last_week","last_2_weeks","last_month","last_3_months","last_6_months","last_year"]}}},{"type":"object","required":["account_ids"],"properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"Post cases search response","examples":[{"results":[{"id":1,"title":"Swati test","time":"2022-08-05T16:24:24.829Z","closingTime":"2024-04-10T07:55:10.39Z","tags":["Manual Case"],"products":[],"alertNames":[],"ticketIds":["23c7cf8b-8336-43c2-82f5-853ec1e8c77f||8458e6b9-5682-449e-9825-cb2266cd3bc1||Roho-casemgmt||fec957fb-8404-57e2-bfc7-98382f9adc99","23c7cf8b-8336-43c2-82f5-853ec1e8c77f||8458e6b9-5682-449e-9825-cb2266cd3bc1||Roho-casemgmt||11b8f173-a966-5f40-9be3-98fb142a0bfd","23c7cf8b-8336-43c2-82f5-853ec1e8c77f||8458e6b9-5682-449e-9825-cb2266cd3bc1||Roho-casemgmt||77035722-2187-5219-ad26-5774768ac69c","23c7cf8b-8336-43c2-82f5-853ec1e8c77f||8458e6b9-5682-449e-9825-cb2266cd3bc1||Roho-casemgmt||d6c9defd-769f-5c3b-a9d9-d5cc2c2def3b","23c7cf8b-8336-43c2-82f5-853ec1e8c77f||8458e6b9-5682-449e-9825-cb2266cd3bc1||Roho-casemgmt||c679f20f-2d8d-54b5-95c1-be6d5c333984","23c7cf8b-8336-43c2-82f5-853ec1e8c77f||8458e6b9-5682-449e-9825-cb2266cd3bc1||Roho-casemgmt||2eacbaa8-f975-50fc-bac0-4193a560e46a","23c7cf8b-8336-43c2-82f5-853ec1e8c77f||8458e6b9-5682-449e-9825-cb2266cd3bc1||Roho-casemgmt||3568072","23c7cf8b-8336-43c2-82f5-853ec1e8c77f||8458e6b9-5682-449e-9825-cb2266cd3bc1||Roho-casemgmt||3568074"],"eventNames":[],"sources":[],"destinations":[],"artificats":[],"ports":[],"outcomes":[],"userAssigned":"Rohin Sambath Kumar","isImportant":false,"isIncident":false,"involvedSuspiciousEntity":false,"isCaseClosed":true,"environment":"IYABoAyLQ MSP - Dev Site MDR1","priority":40,"stage":"Triage","closeReason":"NotMalicious","rootCause":"Human error","alertsCount":1,"updated_at":1726750609684,"endpoint_info":{"machine_id":"8458e6b9-5682-449e-9825-cb2266cd3bc1","machine_name":"Roho-casemgmt"}}],"totalCount":1,"pageNumber":0,"pageSize":0}],"properties":{"results":{"type":"array","items":[{"type":"object","properties":{"id":{"type":"integer"},"title":{"type":"string"},"time":{"type":"string"},"closingTime":{"type":"string"},"tags":{"type":"array","items":[{"type":"string"}]},"products":{"type":"array","items":[{"type":"string"}]},"alertNames":{"type":"array","items":[{"type":"string"}]},"ticketIds":{"type":"array","items":[{"type":"string"}]},"eventNames":{"type":"array","items":[{"type":"string"}]},"sources":{"type":"array","items":[{"type":"string"}]},"destinations":{"type":"array","items":[{"type":"string"}]},"artificats":{"type":"array","items":[{"type":"string"}]},"ports":{"type":"array","items":[{"type":"string"}]},"outcomes":{"type":"array","items":[{"type":"string"}]},"userAssigned":{"type":"string"},"isImportant":{"type":"boolean"},"isIncident":{"type":"boolean"},"involvedSuspiciousEntity":{"type":"boolean"},"isCaseClosed":{"type":"boolean"},"environment":{"type":"string"},"priority":{"type":"integer"},"stage":{"type":"string"},"closeReason":{"type":"string"},"rootCause":{"type":"string"},"alertsCount":{"type":"integer"},"updated_at":{"type":"integer"},"endpoint_info":{"type":"object","properties":{"machine_id":{"type":"string"},"machine_name":{"type":"string"}}}}}]},"totalCount":{"type":"integer"},"pageNumber":{"type":"integer"},"pageSize":{"type":"integer"}}}}}}},"tags":["Case Management"],"operationId":"api.rmm.casemgmt.multiplexer.cases.bulk.post"}},"/oneview/v1/casemgmt/multiplexer/metrics/bulk":{"post":{"description":"Post multiplexer metrics bulk","summary":"Post multiplexer metrics bulk","security":[{"client_credentials":["read"]},{"user_permissions":["mss.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"allOf":[{"type":"object","title":"Get case time filter","properties":{"timeFilter":{"type":"string","title":"time filter","enum":["custom","last_day","last_2_days","last_3_days","last_week","last_2_weeks","last_month","last_3_months","last_6_months","last_year"]}}},{"type":"object","required":["account_ids"],"properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"Multiplexer cases metrics response","examples":[{"secops":{"closed":{"series":[{"identifier":null,"name":"Cases","values":["0"],"seriesType":0,"entity":null,"text":null,"environments":null,"id":0,"creationTimeUnixTimeInMs":1725967783134,"modificationTimeUnixTimeInMs":1725967783134},{"identifier":null,"name":"Alerts","values":["0"],"seriesType":0,"entity":null,"text":null,"environments":null,"id":0,"creationTimeUnixTimeInMs":1725967783134,"modificationTimeUnixTimeInMs":1725967783134},{"identifier":null,"name":"Important Cases","values":["0"],"seriesType":0,"entity":null,"text":null,"environments":null,"id":0,"creationTimeUnixTimeInMs":1725967783134,"modificationTimeUnixTimeInMs":1725967783134},{"identifier":null,"name":"Cases Exceeded SLA","values":["0"],"seriesType":0,"entity":null,"text":null,"environments":null,"id":0,"creationTimeUnixTimeInMs":1725967783134,"modificationTimeUnixTimeInMs":1725967783134},{"identifier":null,"name":"Incidents","values":["0"],"seriesType":0,"entity":null,"text":null,"environments":null,"id":0,"creationTimeUnixTimeInMs":1725967783134,"modificationTimeUnixTimeInMs":1725967783134}]},"awaiting_customer_response":{"series":[{"identifier":null,"name":"Cases","values":["0"],"seriesType":0,"entity":null,"text":null,"environments":null,"id":0,"creationTimeUnixTimeInMs":1725967783113,"modificationTimeUnixTimeInMs":1725967783113},{"identifier":null,"name":"Alerts","values":["0"],"seriesType":0,"entity":null,"text":null,"environments":null,"id":0,"creationTimeUnixTimeInMs":1725967783113,"modificationTimeUnixTimeInMs":1725967783113},{"identifier":null,"name":"Important Cases","values":["0"],"seriesType":0,"entity":null,"text":null,"environments":null,"id":0,"creationTimeUnixTimeInMs":1725967783113,"modificationTimeUnixTimeInMs":1725967783113},{"identifier":null,"name":"Cases Exceeded SLA","values":["0"],"seriesType":0,"entity":null,"text":null,"environments":null,"id":0,"creationTimeUnixTimeInMs":1725967783113,"modificationTimeUnixTimeInMs":1725967783113},{"identifier":null,"name":"Incidents","values":["0"],"seriesType":0,"entity":null,"text":null,"environments":null,"id":0,"creationTimeUnixTimeInMs":1725967783113,"modificationTimeUnixTimeInMs":1725967783113}]}},"us":{"closed":{"series":[{"identifier":null,"name":"Cases","values":["2"],"seriesType":0,"entity":null,"text":null,"environments":null,"id":0,"creationTimeUnixTimeInMs":1725967783044,"modificationTimeUnixTimeInMs":1725967783044},{"identifier":null,"name":"Alerts","values":["8"],"seriesType":0,"entity":null,"text":null,"environments":null,"id":0,"creationTimeUnixTimeInMs":1725967783044,"modificationTimeUnixTimeInMs":1725967783044},{"identifier":null,"name":"Important Cases","values":["0"],"seriesType":0,"entity":null,"text":null,"environments":null,"id":0,"creationTimeUnixTimeInMs":1725967783044,"modificationTimeUnixTimeInMs":1725967783044},{"identifier":null,"name":"Cases Exceeded SLA","values":["0"],"seriesType":0,"entity":null,"text":null,"environments":null,"id":0,"creationTimeUnixTimeInMs":1725967783044,"modificationTimeUnixTimeInMs":1725967783044},{"identifier":null,"name":"Incidents","values":["0"],"seriesType":0,"entity":null,"text":null,"environments":null,"id":0,"creationTimeUnixTimeInMs":1725967783044,"modificationTimeUnixTimeInMs":1725967783044}]},"awaiting_customer_response":{"series":[{"identifier":null,"name":"Cases","values":["0"],"seriesType":0,"entity":null,"text":null,"environments":null,"id":0,"creationTimeUnixTimeInMs":1725967783039,"modificationTimeUnixTimeInMs":1725967783039},{"identifier":null,"name":"Alerts","values":["0"],"seriesType":0,"entity":null,"text":null,"environments":null,"id":0,"creationTimeUnixTimeInMs":1725967783039,"modificationTimeUnixTimeInMs":1725967783039},{"identifier":null,"name":"Important Cases","values":["0"],"seriesType":0,"entity":null,"text":null,"environments":null,"id":0,"creationTimeUnixTimeInMs":1725967783039,"modificationTimeUnixTimeInMs":1725967783039},{"identifier":null,"name":"Cases Exceeded SLA","values":["0"],"seriesType":0,"entity":null,"text":null,"environments":null,"id":0,"creationTimeUnixTimeInMs":1725967783039,"modificationTimeUnixTimeInMs":1725967783039},{"identifier":null,"name":"Incidents","values":["0"],"seriesType":0,"entity":null,"text":null,"environments":null,"id":0,"creationTimeUnixTimeInMs":1725967783039,"modificationTimeUnixTimeInMs":1725967783039}]}}}],"patternProperties":{"^us|emea|secops$":{"type":"object","patternProperties":{"^[\\s\\S]+$":{"type":"object","properties":{"series":{"type":"array","items":{"type":"object","properties":{"identifier":{"type":["string","null"]},"name":{"type":"string"},"values":{"type":"array","items":{"type":"string"}},"seriesType":{"type":"integer"},"entity":{"type":["string","null"]},"text":{"type":["string","null"]},"environments":{"type":["array","null"]},"id":{"type":"integer"},"creationTimeUnixTimeInMs":{"type":"integer"},"modificationTimeUnixTimeInMs":{"type":"integer"}}}}}}}}}}}}}},"tags":["Case Management"],"operationId":"api.rmm.casemgmt.multiplexer.metrics.bulk.post"}},"/oneview/v1/casemgmt/accounts/{account_id}/cases/favorite":{"put":{"description":"Put Cases favorite","summary":"Put Cases favorite","security":[{"client_credentials":["write"]},{"user_permissions":["mss.manage"]}],"status":{"outage":["auth"]},"parameters":[{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}},{"name":"region","required":false,"in":"query","description":"Region","schema":{"type":"string","enum":["us","emea","secops"]}},{"name":"caseId","required":false,"in":"query","description":"ID of Case","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Put Case favorite","required":["isFavorite","recordId","type","activityKind"],"properties":{"isFavorite":{"type":"boolean","title":"isFavorite"},"recordId":{"type":"integer","title":"recordId"},"type":{"type":"integer","title":"type"},"activityKind":{"type":"integer","title":"activityKind"}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"$schema":"http://json-schema.org/draft-07/schema","type":"string","title":"put cases favorite response"}}}}},"tags":["Case Management"],"operationId":"api.rmm.casemgmt.cases.favorite.put"}},"/oneview/v1/accounts/{account_id}/assets/ignore-rules":{"post":{"description":"Placeholder. Please extend this","summary":"Placeholder. Please extend this","deprecated":false,"security":[{"client_credentials":["write"]},{"user_permissions":["patchManagement.manage"]}],"status":{"outage":["auth"]},"parameters":[{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","description":"Create ignore rule","allOf":[{"type":"object","description":"Create ignore rule","allOf":[{"type":"object","description":"Ignore rule","required":["type","name","os_platform","config"],"properties":{"type":{"type":"string","description":"Type of ignore rule","enum":["os-patch","software-update"]},"name":{"type":"string","description":"Name of the ignore rule"},"os_platform":{"type":"string","description":"Operating system platform the ignore rule applies to","enum":["windows","macos","linux"]},"config":{"type":"object","description":"Ignore rule configuration","properties":{"patch_ids":{"type":"array","description":"Patch IDs to ignore","items":{"type":"string"}},"applications":{"type":"array","description":"Applications to ignore","items":{"type":"object","properties":{"product":{"type":"number"},"versions":{"oneOf":[{"type":"null"},{"type":"array","items":{"type":"string"},"minItems":1}]}}}}}},"expires_at":{"type":"string","description":"Date when the ignore rule expires","format":"date-time"},"reason":{"type":"string","description":"Reason for creating the ignore rule"}},"if":{"properties":{"type":{"const":"os-patch"}}},"then":{"properties":{"config":{"required":["patch_ids"],"properties":{"patch_ids":{"minItems":1}},"not":{"required":["applications"]}}}},"else":{"properties":{"config":{"required":["applications"],"properties":{"applications":{"minItems":1}},"not":{"required":["patch_ids"]}}}}},{"properties":{"policy_ids":{"type":"array","description":"list of policy IDs the ignore rule applies to","items":{"type":"string","format":"uuid"}},"patch_titles":{"type":"array","description":"list of patch titles the ignore rule applies to","items":{"type":"string"}},"application_names":{"type":"array","description":"list of application names the ignore rule applies to","items":{"type":"string"}}}}]},{"properties":{"account_ids":{"type":"array","description":"List of account IDs the ignore rule applies to","items":{"type":"string","format":"uuid"}}}}],"if":{"required":["account_ids"]},"then":{"not":{"required":["policy_ids"]}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","description":"Ignore rule response schema","allOf":[{"type":"object","description":"Ignore rule response schema","allOf":[{"type":"object","description":"Ignore rule","required":["type","name","os_platform","config"],"properties":{"type":{"type":"string","description":"Type of ignore rule","enum":["os-patch","software-update"]},"name":{"type":"string","description":"Name of the ignore rule"},"os_platform":{"type":"string","description":"Operating system platform the ignore rule applies to","enum":["windows","macos","linux"]},"config":{"type":"object","description":"Ignore rule configuration","properties":{"patch_ids":{"type":"array","description":"Patch IDs to ignore","items":{"type":"string"}},"applications":{"type":"array","description":"Applications to ignore","items":{"type":"object","properties":{"product":{"type":"number"},"versions":{"oneOf":[{"type":"null"},{"type":"array","items":{"type":"string"},"minItems":1}]}}}}}},"expires_at":{"type":"string","description":"Date when the ignore rule expires","format":"date-time"},"reason":{"type":"string","description":"Reason for creating the ignore rule"}},"if":{"properties":{"type":{"const":"os-patch"}}},"then":{"properties":{"config":{"required":["patch_ids"],"properties":{"patch_ids":{"minItems":1}},"not":{"required":["applications"]}}}},"else":{"properties":{"config":{"required":["applications"],"properties":{"applications":{"minItems":1}},"not":{"required":["patch_ids"]}}}}},{"properties":{"id":{"type":"string","format":"uuid","description":"Unique identifier for the ignore rule"},"created_at":{"type":"string","description":"Timestamp when the ignore rule was created"},"updated_at":{"type":"string","description":"Timestamp when the ignore rule was last updated"},"created_by":{"type":"string","description":"Identifier of the user who created the ignore rule"},"updated_by":{"type":"string","description":"Identifier of the user who last updated the ignore rule"},"policies":{"type":["array","null"],"description":"List of policies associated with the ignore rule","items":{"type":"object","properties":{"policy_id":{"type":"string","format":"uuid"},"policy_name":{"type":"string"},"ignore_rule_id":{"type":"string","format":"uuid"},"account_id":{"type":"string","format":"uuid"}}}},"patches":{"type":["array"],"description":"Ignored patches details","items":{"type":"object","properties":{"title":{"type":"string"},"kb_id":{"type":"string"}}}}}}]},{"properties":{"accounts":{"type":["array","null"],"description":"List of accounts associated with the ignore rule","items":{"type":"object","properties":{"account_id":{"type":"string","format":"uuid"},"account_name":{"type":"string"},"ignore_rule_id":{"type":"string","format":"uuid"}}}}}}]}}}}},"tags":["Ignore Rules"],"operationId":"api.rmm.post.assets.ignore-rules"},"delete":{"description":"Placeholder. Please extend this","summary":"Placeholder. Please extend this","deprecated":false,"security":[{"client_credentials":["write"]},{"user_permissions":["patchManagement.manage"]}],"status":{"outage":["auth"]},"parameters":[{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","description":"Delete ignore rules in bulk","properties":{"rule_ids":{"type":"array","description":"List of ignore rule IDs to delete","items":{"type":"string","format":"uuid"}}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","description":"Response after deleting ignore rules in bulk","properties":{"deleted":{"type":"array","description":"List of successfully deleted ignore rule IDs","items":{"type":"string","format":"uuid"}},"errors":{"type":"array","description":"List of ignore rule IDs that failed to delete, if any","items":{"type":"string","format":"uuid"}},"not_found":{"type":"array","description":"List of ignore rule IDs that were not found","items":{"type":"string","format":"uuid"}}}}}}}},"tags":["Ignore Rules"],"operationId":"api.rmm.delete.assets.ignore-rules.bulk"},"get":{"description":"Placeholder. Please extend this","summary":"Placeholder. Please extend this","deprecated":false,"security":[{"client_credentials":["read"]},{"user_permissions":["patchManagement.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}},{"name":"page_size","required":false,"in":"query","schema":{"type":"number"}},{"name":"next_cursor","required":false,"in":"query","schema":{"type":"string"}},{"name":"type","required":false,"in":"query","schema":{"type":"string","enum":["os-patch","software-update"]}},{"name":"ids","required":false,"in":"query","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","description":"Search ignore rules response schema","properties":{"ignore_rules":{"type":"array","description":"List of ignore rules","items":{"type":"object","description":"Ignore rule response schema","allOf":[{"type":"object","description":"Ignore rule response schema","allOf":[{"type":"object","description":"Ignore rule","required":["type","name","os_platform","config"],"properties":{"type":{"type":"string","description":"Type of ignore rule","enum":["os-patch","software-update"]},"name":{"type":"string","description":"Name of the ignore rule"},"os_platform":{"type":"string","description":"Operating system platform the ignore rule applies to","enum":["windows","macos","linux"]},"config":{"type":"object","description":"Ignore rule configuration","properties":{"patch_ids":{"type":"array","description":"Patch IDs to ignore","items":{"type":"string"}},"applications":{"type":"array","description":"Applications to ignore","items":{"type":"object","properties":{"product":{"type":"number"},"versions":{"oneOf":[{"type":"null"},{"type":"array","items":{"type":"string"},"minItems":1}]}}}}}},"expires_at":{"type":"string","description":"Date when the ignore rule expires","format":"date-time"},"reason":{"type":"string","description":"Reason for creating the ignore rule"}},"if":{"properties":{"type":{"const":"os-patch"}}},"then":{"properties":{"config":{"required":["patch_ids"],"properties":{"patch_ids":{"minItems":1}},"not":{"required":["applications"]}}}},"else":{"properties":{"config":{"required":["applications"],"properties":{"applications":{"minItems":1}},"not":{"required":["patch_ids"]}}}}},{"properties":{"id":{"type":"string","format":"uuid","description":"Unique identifier for the ignore rule"},"created_at":{"type":"string","description":"Timestamp when the ignore rule was created"},"updated_at":{"type":"string","description":"Timestamp when the ignore rule was last updated"},"created_by":{"type":"string","description":"Identifier of the user who created the ignore rule"},"updated_by":{"type":"string","description":"Identifier of the user who last updated the ignore rule"},"policies":{"type":["array","null"],"description":"List of policies associated with the ignore rule","items":{"type":"object","properties":{"policy_id":{"type":"string","format":"uuid"},"policy_name":{"type":"string"},"ignore_rule_id":{"type":"string","format":"uuid"},"account_id":{"type":"string","format":"uuid"}}}},"patches":{"type":["array"],"description":"Ignored patches details","items":{"type":"object","properties":{"title":{"type":"string"},"kb_id":{"type":"string"}}}}}}]},{"properties":{"accounts":{"type":["array","null"],"description":"List of accounts associated with the ignore rule","items":{"type":"object","properties":{"account_id":{"type":"string","format":"uuid"},"account_name":{"type":"string"},"ignore_rule_id":{"type":"string","format":"uuid"}}}}}}]}},"total_count":{"type":"integer","description":"Total number of ignore rules"}},"required":["ignore_rules","total_count"]}}}}},"tags":["Ignore Rules"],"operationId":"api.rmm.get.assets.ignore-rules"}},"/oneview/v1/accounts/{account_id}/assets/ignore-rules/{id}":{"delete":{"description":"Placeholder. Please extend this","summary":"Placeholder. Please extend this","deprecated":false,"security":[{"client_credentials":["write"]},{"user_permissions":["patchManagement.manage"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":true,"in":"path","description":"ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"Successful response"}},"tags":["Ignore Rules"],"operationId":"api.rmm.delete.assets.ignore-rules"},"get":{"description":"Placeholder. Please extend this","summary":"Placeholder. Please extend this","deprecated":false,"security":[{"client_credentials":["read"]},{"user_permissions":["patchManagement.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":true,"in":"path","description":"ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","description":"Ignore rule response schema","allOf":[{"type":"object","description":"Ignore rule response schema","allOf":[{"type":"object","description":"Ignore rule","required":["type","name","os_platform","config"],"properties":{"type":{"type":"string","description":"Type of ignore rule","enum":["os-patch","software-update"]},"name":{"type":"string","description":"Name of the ignore rule"},"os_platform":{"type":"string","description":"Operating system platform the ignore rule applies to","enum":["windows","macos","linux"]},"config":{"type":"object","description":"Ignore rule configuration","properties":{"patch_ids":{"type":"array","description":"Patch IDs to ignore","items":{"type":"string"}},"applications":{"type":"array","description":"Applications to ignore","items":{"type":"object","properties":{"product":{"type":"number"},"versions":{"oneOf":[{"type":"null"},{"type":"array","items":{"type":"string"},"minItems":1}]}}}}}},"expires_at":{"type":"string","description":"Date when the ignore rule expires","format":"date-time"},"reason":{"type":"string","description":"Reason for creating the ignore rule"}},"if":{"properties":{"type":{"const":"os-patch"}}},"then":{"properties":{"config":{"required":["patch_ids"],"properties":{"patch_ids":{"minItems":1}},"not":{"required":["applications"]}}}},"else":{"properties":{"config":{"required":["applications"],"properties":{"applications":{"minItems":1}},"not":{"required":["patch_ids"]}}}}},{"properties":{"id":{"type":"string","format":"uuid","description":"Unique identifier for the ignore rule"},"created_at":{"type":"string","description":"Timestamp when the ignore rule was created"},"updated_at":{"type":"string","description":"Timestamp when the ignore rule was last updated"},"created_by":{"type":"string","description":"Identifier of the user who created the ignore rule"},"updated_by":{"type":"string","description":"Identifier of the user who last updated the ignore rule"},"policies":{"type":["array","null"],"description":"List of policies associated with the ignore rule","items":{"type":"object","properties":{"policy_id":{"type":"string","format":"uuid"},"policy_name":{"type":"string"},"ignore_rule_id":{"type":"string","format":"uuid"},"account_id":{"type":"string","format":"uuid"}}}},"patches":{"type":["array"],"description":"Ignored patches details","items":{"type":"object","properties":{"title":{"type":"string"},"kb_id":{"type":"string"}}}}}}]},{"properties":{"accounts":{"type":["array","null"],"description":"List of accounts associated with the ignore rule","items":{"type":"object","properties":{"account_id":{"type":"string","format":"uuid"},"account_name":{"type":"string"},"ignore_rule_id":{"type":"string","format":"uuid"}}}}}}]}}}}},"tags":["Ignore Rules"],"operationId":"api.rmm.get.assets.ignore-rules.id"},"put":{"description":"Placeholder. Please extend this","summary":"Placeholder. Please extend this","deprecated":false,"security":[{"client_credentials":["write"]},{"user_permissions":["patchManagement.manage"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":true,"in":"path","description":"ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","description":"Create ignore rule","allOf":[{"type":"object","description":"Create ignore rule","allOf":[{"type":"object","description":"Ignore rule","required":["type","name","os_platform","config"],"properties":{"type":{"type":"string","description":"Type of ignore rule","enum":["os-patch","software-update"]},"name":{"type":"string","description":"Name of the ignore rule"},"os_platform":{"type":"string","description":"Operating system platform the ignore rule applies to","enum":["windows","macos","linux"]},"config":{"type":"object","description":"Ignore rule configuration","properties":{"patch_ids":{"type":"array","description":"Patch IDs to ignore","items":{"type":"string"}},"applications":{"type":"array","description":"Applications to ignore","items":{"type":"object","properties":{"product":{"type":"number"},"versions":{"oneOf":[{"type":"null"},{"type":"array","items":{"type":"string"},"minItems":1}]}}}}}},"expires_at":{"type":"string","description":"Date when the ignore rule expires","format":"date-time"},"reason":{"type":"string","description":"Reason for creating the ignore rule"}},"if":{"properties":{"type":{"const":"os-patch"}}},"then":{"properties":{"config":{"required":["patch_ids"],"properties":{"patch_ids":{"minItems":1}},"not":{"required":["applications"]}}}},"else":{"properties":{"config":{"required":["applications"],"properties":{"applications":{"minItems":1}},"not":{"required":["patch_ids"]}}}}},{"properties":{"policy_ids":{"type":"array","description":"list of policy IDs the ignore rule applies to","items":{"type":"string","format":"uuid"}},"patch_titles":{"type":"array","description":"list of patch titles the ignore rule applies to","items":{"type":"string"}},"application_names":{"type":"array","description":"list of application names the ignore rule applies to","items":{"type":"string"}}}}]},{"properties":{"account_ids":{"type":"array","description":"List of account IDs the ignore rule applies to","items":{"type":"string","format":"uuid"}}}}],"if":{"required":["account_ids"]},"then":{"not":{"required":["policy_ids"]}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","description":"Ignore rule response schema","allOf":[{"type":"object","description":"Ignore rule response schema","allOf":[{"type":"object","description":"Ignore rule","required":["type","name","os_platform","config"],"properties":{"type":{"type":"string","description":"Type of ignore rule","enum":["os-patch","software-update"]},"name":{"type":"string","description":"Name of the ignore rule"},"os_platform":{"type":"string","description":"Operating system platform the ignore rule applies to","enum":["windows","macos","linux"]},"config":{"type":"object","description":"Ignore rule configuration","properties":{"patch_ids":{"type":"array","description":"Patch IDs to ignore","items":{"type":"string"}},"applications":{"type":"array","description":"Applications to ignore","items":{"type":"object","properties":{"product":{"type":"number"},"versions":{"oneOf":[{"type":"null"},{"type":"array","items":{"type":"string"},"minItems":1}]}}}}}},"expires_at":{"type":"string","description":"Date when the ignore rule expires","format":"date-time"},"reason":{"type":"string","description":"Reason for creating the ignore rule"}},"if":{"properties":{"type":{"const":"os-patch"}}},"then":{"properties":{"config":{"required":["patch_ids"],"properties":{"patch_ids":{"minItems":1}},"not":{"required":["applications"]}}}},"else":{"properties":{"config":{"required":["applications"],"properties":{"applications":{"minItems":1}},"not":{"required":["patch_ids"]}}}}},{"properties":{"id":{"type":"string","format":"uuid","description":"Unique identifier for the ignore rule"},"created_at":{"type":"string","description":"Timestamp when the ignore rule was created"},"updated_at":{"type":"string","description":"Timestamp when the ignore rule was last updated"},"created_by":{"type":"string","description":"Identifier of the user who created the ignore rule"},"updated_by":{"type":"string","description":"Identifier of the user who last updated the ignore rule"},"policies":{"type":["array","null"],"description":"List of policies associated with the ignore rule","items":{"type":"object","properties":{"policy_id":{"type":"string","format":"uuid"},"policy_name":{"type":"string"},"ignore_rule_id":{"type":"string","format":"uuid"},"account_id":{"type":"string","format":"uuid"}}}},"patches":{"type":["array"],"description":"Ignored patches details","items":{"type":"object","properties":{"title":{"type":"string"},"kb_id":{"type":"string"}}}}}}]},{"properties":{"accounts":{"type":["array","null"],"description":"List of accounts associated with the ignore rule","items":{"type":"object","properties":{"account_id":{"type":"string","format":"uuid"},"account_name":{"type":"string"},"ignore_rule_id":{"type":"string","format":"uuid"}}}}}}]}}}}},"tags":["Ignore Rules"],"operationId":"api.rmm.put.assets.ignore-rules"}},"/oneview/v1/vulnerability-assessment/report":{"post":{"description":"Get vulnerability assessment report for accounts","summary":"Get vulnerability assessment report","security":[{"client_credentials":["read"]},{"user_permissions":["vulnerabilities.view"]}],"status":{"outage":["auth","search_stateless"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","allOf":[{"type":"object","required":["account_ids"],"properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}],"properties":{"aggregate":{"type":"boolean","default":false,"description":"When true, the report is aggregated across all account_ids. When false, results are returned per account."}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","properties":{"results":{"type":"array","items":{"type":"object","properties":{"account_id":{"type":"string"},"aggregated":{"type":"boolean"},"endpoints_total":{"type":"number"},"accounts_total":{"type":"number"},"cves":{"type":"object","properties":{"endpoints":{"type":"number"},"total":{"type":"number"}},"required":["endpoints","total"]},"critical_cves":{"type":"object","properties":{"endpoints":{"type":"number"},"total":{"type":"number"},"total_within_thirty_days":{"type":"number"},"endpoints_within_thirty_days":{"type":"number"}},"required":["endpoints","total","total_within_thirty_days"]},"critical_os_patches":{"type":"object","properties":{"endpoints":{"type":"number"},"total":{"type":"number"}},"required":["endpoints","total"]},"cisa_cves":{"type":"object","properties":{"endpoints":{"type":"number"},"total":{"type":"number"},"total_within_twenty_one_days":{"type":"number"},"endpoints_total":{"type":"number"},"endpoints_percentage":{"type":"number"}},"required":["endpoints","total","total_within_twenty_one_days","endpoints_total","endpoints_percentage"]},"known_ransomware_campaign_use":{"type":"object","properties":{"endpoints":{"type":"number"},"total":{"type":"number"}},"required":["endpoints","total"]},"os_patches":{"type":"object","properties":{"endpoints_percentage":{"type":"number"}},"required":["endpoints_percentage"]},"cves_by_severity":{"type":"object","properties":{"critical_percentage":{"type":"number"},"high_percentage":{"type":"number"},"medium_percentage":{"type":"number"},"low_percentage":{"type":"number"},"unknown_percentage":{"type":"number"}},"required":["critical_percentage","high_percentage","medium_percentage","low_percentage","unknown_percentage"]},"critical_software":{"type":"array","items":{"type":"object","properties":{"display_product":{"type":"string"},"endpoints":{"type":"number"},"cves":{"type":"number"},"cisa_cves":{"type":"number"}},"required":["display_product","endpoints","cves","cisa_cves"]}},"high_risk_sites":{"type":"array","items":{"type":"object","properties":{"account_id":{"type":"string"},"critical_cves":{"type":"number"},"known_ransomware_campaign_use":{"type":"number"},"critical_os_patches":{"type":"number"},"cisa_cves":{"type":"number"},"endpoints":{"type":"number"},"affected_endpoints":{"type":"number"}},"required":["critical_cves","known_ransomware_campaign_use","critical_os_patches","cisa_cves","endpoints"]}}},"required":["endpoints_total","accounts_total","cves","critical_cves","critical_os_patches","cisa_cves","known_ransomware_campaign_use","os_patches","cves_by_severity","critical_software","high_risk_sites"]}}},"required":["results"]}}}}},"tags":["Vulnerability Assessment"],"operationId":"api.rmm.vulnerability-assessment.report"}},"/oneview/v1/vulnerability-assessment/cve-stats":{"post":{"description":"Get vulnerability assessment CVE statistics for accounts","summary":"Get vulnerability assessment CVE statistics","security":[{"client_credentials":["read"]},{"user_permissions":["vulnerabilities.view"]}],"status":{"outage":["auth","search_stateless"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","allOf":[{"type":"object","required":["account_ids"],"properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}],"properties":{"cve_id":{"type":"string","description":"The CVE ID to retrieve stats for"}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","properties":{"total":{"type":"number"},"accounts":{"type":"number"},"endpoints":{"type":"number"}}}}}}},"tags":["Vulnerability Assessment"],"operationId":"api.rmm.vulnerability-assessment.cve.stats"}},"/oneview/v1/vulnerability-assessment/details":{"post":{"description":"Get vulnerability assessment details for accounts","summary":"Get vulnerability assessment details","security":[{"client_credentials":["read"]},{"user_permissions":["vulnerabilities.view"]}],"status":{"outage":["auth","search_stateless"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","allOf":[{"type":"object","required":["account_ids"],"properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","additionalProperties":{"type":"object","properties":{"severity":{"type":"object","additionalProperties":{"type":"object","properties":{"total":{"type":"number"}},"required":["total"],"additionalProperties":false}},"machine_id_total":{"type":"number"},"known_ransomware_campaign_use_total":{"type":"number"},"critical_os_patches_total":{"type":"number"},"last_asset_scan_at":{"type":["string","null"]},"has_va":{"type":"boolean"},"has_vpm":{"type":"boolean"}}}}}}}},"tags":["Vulnerability Assessment"],"operationId":"api.rmm.vulnerability-assessment.details"}},"/oneview/v1/vulnerability-assessment/software-stats":{"post":{"description":"Get vulnerability assessment software statistics for accounts","summary":"Get vulnerability assessment software statistics","security":[{"client_credentials":["read"]},{"user_permissions":["vulnerabilities.view"]}],"status":{"outage":["auth","search_stateless"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","required":["account_ids"],"properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","properties":{"updatable_software_percentage":{"type":"number","description":"The percentage of software with available updates."}}}}}}},"tags":["Vulnerability Assessment"],"operationId":"api.rmm.vulnerability-assessment.software.stats"}},"/oneview/v1/vulnerability-assessment/summary":{"post":{"description":"Get vulnerability assessment summary for accounts","summary":"Get vulnerability assessment summary","security":[{"client_credentials":["read"]},{"user_permissions":["vulnerabilities.view"]}],"status":{"outage":["auth","search_stateless"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","allOf":[{"type":"object","required":["account_ids"],"properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","definitions":{"total_counts":{"type":"object","properties":{"total":{"type":"number"},"accounts":{"type":"number"}},"required":["total","accounts"]}},"properties":{}}}}}},"tags":["Vulnerability Assessment"],"operationId":"api.rmm.vulnerability-assessment.summary"}},"/oneview/v1/accounts/{account_id}/aidr/rules":{"post":{"description":"Placeholder. Please extend this","summary":"Placeholder. Please extend this","deprecated":false,"security":[{"client_credentials":["write"]},{"user_permissions":["aidr.manage"]}],"status":{"outage":["auth"]},"parameters":[{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"title":"Create AIDR Rule","description":"Create an AIDR per-tool or default governance rule","type":"object","required":["scope","action"],"properties":{"tool":{"description":"Canonical AI tool name. Omit or null for a default rule.","type":["string","null"]},"scope":{"type":"string","description":"Targeting scope. \"category\" is only valid when tool is null.","enum":["global","policy","category"]},"category":{"description":"AI category. Required when scope = \"category\", must be absent otherwise.","type":"string","enum":["AI Assistant","AI Code Tool","AI Framework & Local LLM","AI Image & Video","AI Meeting & Productivity","AI Writing & Translation"]},"policy_id":{"description":"Policy UUID. Required when scope = \"policy\", must be absent otherwise.","type":"string","format":"uuid"},"action":{"type":"string","description":"Governance action.","enum":["authorized","unauthorized","pending"]}},"allOf":[{"description":"scope=category requires tool=null and category to be a non-null string","if":{"properties":{"scope":{"const":"category"}},"required":["scope"]},"then":{"properties":{"tool":{"type":"null"}},"required":["category"]}},{"description":"scope!=category requires category to be absent","if":{"properties":{"scope":{"not":{"const":"category"}}},"required":["scope"]},"then":{"not":{"required":["category"]}}},{"description":"scope=policy requires policy_id to be a non-null UUID string","if":{"properties":{"scope":{"const":"policy"}},"required":["scope"]},"then":{"properties":{"policy_id":{"type":"string","format":"uuid"}},"required":["policy_id"]}},{"description":"scope!=policy requires policy_id to be absent","if":{"properties":{"scope":{"not":{"const":"policy"}}},"required":["scope"]},"then":{"not":{"required":["policy_id"]}}}]}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"AIDR Rule","description":"A single AIDR governance rule or default. A rule with tool=null acts as a category or global default.","required":["id","account_id","tool","scope","action","created_at","created_by"],"properties":{"id":{"type":"string","format":"uuid","description":"Server-assigned rule UUID"},"account_id":{"type":"string","format":"uuid","description":"Account this rule belongs to. On a parent account, child account rules are included in GET responses."},"tool":{"type":["string","null"],"description":"AI tool name this rule targets. null = default rule applying to all tools (or all tools in a category)."},"scope":{"type":"string","description":"\"global\" applies to all policies. \"policy\" scopes the rule to a single policy_id. \"category\" is only valid when tool is null.","enum":["global","policy","category"]},"category":{"type":"string","description":"AI category (e.g. \"AI Assistant\"). Present only when scope is \"category\".","enum":["AI Assistant","AI Code Tool","AI Framework & Local LLM","AI Image & Video","AI Meeting & Productivity","AI Writing & Translation"]},"policy_id":{"type":"string","format":"uuid","description":"Policy UUID. Present only when scope is \"policy\"."},"action":{"type":"string","description":"Governance action. \"pending\" is only valid when tool is null.","enum":["authorized","unauthorized","pending"]},"created_at":{"type":"string","description":"ISO 8601 timestamp of rule creation"},"updated_at":{"type":["string","null"],"description":"ISO 8601 timestamp of last update"},"created_by":{"type":"string","description":"UUID of the user who created the rule"},"updated_by":{"type":["string","null"],"description":"UUID of the user who last updated the rule"}}}}}}},"tags":["AI Detection & Response"],"operationId":"api.rmm.aidr.rules.post"},"get":{"description":"Placeholder. Please extend this","summary":"Placeholder. Please extend this","deprecated":false,"security":[{"client_credentials":["read"]},{"user_permissions":["aidr.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}},{"name":"page_size","required":false,"in":"query","schema":{"type":"integer"}},{"name":"next_cursor","required":false,"in":"query","schema":{"type":"string"}},{"name":"filter[rule.tool][eq]","required":false,"in":"query","schema":{"type":"string"}},{"name":"filter[rule.tool][exists]","required":false,"in":"query","schema":{"type":"boolean"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"title":"AIDR Rules Response","description":"Paginated list of AIDR rules and defaults. When called on a parent account, includes rules for all child accounts.","type":"object","required":["rules","total_count"],"properties":{"rules":{"type":"array","items":{"type":"object","title":"AIDR Rule","description":"A single AIDR governance rule or default. A rule with tool=null acts as a category or global default.","required":["id","account_id","tool","scope","action","created_at","created_by"],"properties":{"id":{"type":"string","format":"uuid","description":"Server-assigned rule UUID"},"account_id":{"type":"string","format":"uuid","description":"Account this rule belongs to. On a parent account, child account rules are included in GET responses."},"tool":{"type":["string","null"],"description":"AI tool name this rule targets. null = default rule applying to all tools (or all tools in a category)."},"scope":{"type":"string","description":"\"global\" applies to all policies. \"policy\" scopes the rule to a single policy_id. \"category\" is only valid when tool is null.","enum":["global","policy","category"]},"category":{"type":"string","description":"AI category (e.g. \"AI Assistant\"). Present only when scope is \"category\".","enum":["AI Assistant","AI Code Tool","AI Framework & Local LLM","AI Image & Video","AI Meeting & Productivity","AI Writing & Translation"]},"policy_id":{"type":"string","format":"uuid","description":"Policy UUID. Present only when scope is \"policy\"."},"action":{"type":"string","description":"Governance action. \"pending\" is only valid when tool is null.","enum":["authorized","unauthorized","pending"]},"created_at":{"type":"string","description":"ISO 8601 timestamp of rule creation"},"updated_at":{"type":["string","null"],"description":"ISO 8601 timestamp of last update"},"created_by":{"type":"string","description":"UUID of the user who created the rule"},"updated_by":{"type":["string","null"],"description":"UUID of the user who last updated the rule"}}}},"total_count":{"type":"integer","description":"Total number of rules matching the request (unpaginated)"}}}}}}},"tags":["AI Detection & Response"],"operationId":"api.rmm.aidr.rules.get"}},"/oneview/v1/accounts/{account_id}/aidr/rules/{id}":{"delete":{"description":"Placeholder. Please extend this","summary":"Placeholder. Please extend this","deprecated":false,"security":[{"client_credentials":["write"]},{"user_permissions":["aidr.manage"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":true,"in":"path","description":"ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"Successful response"}},"tags":["AI Detection & Response"],"operationId":"api.rmm.aidr.rules.delete"},"get":{"description":"Placeholder. Please extend this","summary":"Placeholder. Please extend this","deprecated":false,"security":[{"client_credentials":["read"]},{"user_permissions":["aidr.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":true,"in":"path","description":"ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"AIDR Rule","description":"A single AIDR governance rule or default. A rule with tool=null acts as a category or global default.","required":["id","account_id","tool","scope","action","created_at","created_by"],"properties":{"id":{"type":"string","format":"uuid","description":"Server-assigned rule UUID"},"account_id":{"type":"string","format":"uuid","description":"Account this rule belongs to. On a parent account, child account rules are included in GET responses."},"tool":{"type":["string","null"],"description":"AI tool name this rule targets. null = default rule applying to all tools (or all tools in a category)."},"scope":{"type":"string","description":"\"global\" applies to all policies. \"policy\" scopes the rule to a single policy_id. \"category\" is only valid when tool is null.","enum":["global","policy","category"]},"category":{"type":"string","description":"AI category (e.g. \"AI Assistant\"). Present only when scope is \"category\".","enum":["AI Assistant","AI Code Tool","AI Framework & Local LLM","AI Image & Video","AI Meeting & Productivity","AI Writing & Translation"]},"policy_id":{"type":"string","format":"uuid","description":"Policy UUID. Present only when scope is \"policy\"."},"action":{"type":"string","description":"Governance action. \"pending\" is only valid when tool is null.","enum":["authorized","unauthorized","pending"]},"created_at":{"type":"string","description":"ISO 8601 timestamp of rule creation"},"updated_at":{"type":["string","null"],"description":"ISO 8601 timestamp of last update"},"created_by":{"type":"string","description":"UUID of the user who created the rule"},"updated_by":{"type":["string","null"],"description":"UUID of the user who last updated the rule"}}}}}}},"tags":["AI Detection & Response"],"operationId":"api.rmm.aidr.rules.get.id"},"put":{"description":"Placeholder. Please extend this","summary":"Placeholder. Please extend this","deprecated":false,"security":[{"client_credentials":["write"]},{"user_permissions":["aidr.manage"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":true,"in":"path","description":"ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"title":"Update AIDR Rule","description":"Request body for replacing all mutable fields of an existing AIDR rule or default.","allOf":[{"title":"Create AIDR Rule","description":"Create an AIDR per-tool or default governance rule","type":"object","required":["scope","action"],"properties":{"tool":{"description":"Canonical AI tool name. Omit or null for a default rule.","type":["string","null"]},"scope":{"type":"string","description":"Targeting scope. \"category\" is only valid when tool is null.","enum":["global","policy","category"]},"category":{"description":"AI category. Required when scope = \"category\", must be absent otherwise.","type":"string","enum":["AI Assistant","AI Code Tool","AI Framework & Local LLM","AI Image & Video","AI Meeting & Productivity","AI Writing & Translation"]},"policy_id":{"description":"Policy UUID. Required when scope = \"policy\", must be absent otherwise.","type":"string","format":"uuid"},"action":{"type":"string","description":"Governance action.","enum":["authorized","unauthorized","pending"]}},"allOf":[{"description":"scope=category requires tool=null and category to be a non-null string","if":{"properties":{"scope":{"const":"category"}},"required":["scope"]},"then":{"properties":{"tool":{"type":"null"}},"required":["category"]}},{"description":"scope!=category requires category to be absent","if":{"properties":{"scope":{"not":{"const":"category"}}},"required":["scope"]},"then":{"not":{"required":["category"]}}},{"description":"scope=policy requires policy_id to be a non-null UUID string","if":{"properties":{"scope":{"const":"policy"}},"required":["scope"]},"then":{"properties":{"policy_id":{"type":"string","format":"uuid"}},"required":["policy_id"]}},{"description":"scope!=policy requires policy_id to be absent","if":{"properties":{"scope":{"not":{"const":"policy"}}},"required":["scope"]},"then":{"not":{"required":["policy_id"]}}}]}]}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"AIDR Rule","description":"A single AIDR governance rule or default. A rule with tool=null acts as a category or global default.","required":["id","account_id","tool","scope","action","created_at","created_by"],"properties":{"id":{"type":"string","format":"uuid","description":"Server-assigned rule UUID"},"account_id":{"type":"string","format":"uuid","description":"Account this rule belongs to. On a parent account, child account rules are included in GET responses."},"tool":{"type":["string","null"],"description":"AI tool name this rule targets. null = default rule applying to all tools (or all tools in a category)."},"scope":{"type":"string","description":"\"global\" applies to all policies. \"policy\" scopes the rule to a single policy_id. \"category\" is only valid when tool is null.","enum":["global","policy","category"]},"category":{"type":"string","description":"AI category (e.g. \"AI Assistant\"). Present only when scope is \"category\".","enum":["AI Assistant","AI Code Tool","AI Framework & Local LLM","AI Image & Video","AI Meeting & Productivity","AI Writing & Translation"]},"policy_id":{"type":"string","format":"uuid","description":"Policy UUID. Present only when scope is \"policy\"."},"action":{"type":"string","description":"Governance action. \"pending\" is only valid when tool is null.","enum":["authorized","unauthorized","pending"]},"created_at":{"type":"string","description":"ISO 8601 timestamp of rule creation"},"updated_at":{"type":["string","null"],"description":"ISO 8601 timestamp of last update"},"created_by":{"type":"string","description":"UUID of the user who created the rule"},"updated_by":{"type":["string","null"],"description":"UUID of the user who last updated the rule"}}}}}}},"tags":["AI Detection & Response"],"operationId":"api.rmm.aidr.rules.put"}},"/oneview/v1/accounts/{account_id}/aidr/metadata":{"get":{"description":"Placeholder. Please extend this","summary":"Placeholder. Please extend this","deprecated":false,"security":[{"client_credentials":["read"]},{"user_permissions":["aidr.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"AIDR Metadata","description":"Enumerated AI tools and categories available for use in AIDR rule creation.","required":["tools","categories"],"properties":{"tools":{"type":"array","description":"Distinct canonical AI tool names from the AIDR metadata catalogue.","items":{"type":"string"}},"categories":{"type":"array","description":"Distinct AI tool category names from the AIDR metadata catalogue.","items":{"type":"string"}}}}}}}},"tags":["AI Detection & Response"],"operationId":"api.rmm.aidr.metadata.get"}},"/oneview/v1/aidr/tools/search":{"post":{"description":"Placeholder. Please extend this","summary":"Placeholder. Please extend this","deprecated":false,"security":[{"client_credentials":["read"]},{"user_permissions":["aidr.view"]}],"status":{"outage":["auth","search_stateless"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"title":"AIDR Tools Search Schema (RMM)","type":"object","allOf":[{"title":"AIDR Tools Search Schema","type":"object","properties":{"start_date":{"type":"string","title":"Return records after this date (ISO 8601)","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2026-04-07T00:00:00Z"]},"end_date":{"type":"string","title":"Return records before this date (ISO 8601)","pattern":"^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([Zz])|([\\+|\\-]([01][0-9]|2[0-3]):[0-5][0-9]))$","examples":["2026-05-07T00:00:00Z"]},"populate":{"type":"object","description":"Optional server-side enrichment flags.","properties":{"ai_status":{"type":"boolean","description":"When true, orion evaluates AIDR rules from Postgres and adds ai_statuses to each tool item."}}}}},{"type":"object","required":["account_ids"],"properties":{"account_ids":{"type":"array","title":"The account ids to filter your search","minItems":1,"items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}},{"properties":{"group_by_account":{"type":"boolean","description":"When true, response includes tools_by_account keyed by account UUID. RMM/OneView only."}}}]}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Search AI tools response","required":["tools"],"properties":{"tools":{"type":"array","title":"Per-tool aggregated stats","items":{"type":"object","properties":{"ai_tool":{"type":"string","title":"AI tool name"},"ai_category":{"type":"string","title":"AI tool category"},"ai_risk":{"type":"string"},"vendor":{"type":"string"},"install_count":{"type":"integer","title":"Number of machines with tool installed"},"last_detected":{"type":"string","format":"date-time","title":"Most recent detection from software inventory"},"min_installation_date":{"type":"string","format":"date-time","title":"Earliest installation date of the tool across the software inventory"},"query_count":{"type":"object","description":"Domain-usage query count breakdown for the requested period","required":["total","authorized","unauthorized","pending"],"properties":{"total":{"type":"integer","title":"Total query count in the period"},"authorized":{"type":"integer","title":"Authorized query count in the period"},"unauthorized":{"type":"integer","title":"Unauthorized query count in the period"},"pending":{"type":"integer","title":"Pending query count in the period"}}},"endpoint_count":{"type":"integer","title":"Number of distinct endpoints that accessed the tool in the period"},"last_used":{"type":"string","format":"date-time","title":"Most recent domain access in the period"},"ai_statuses":{"type":"array","title":"Distinct governance actions derived from rules evaluation, considering the first fully-covering cascade level. Only present when populate.ai_status is true in the request. Defaults to [\"pending\"] when no rule matches.","items":{"type":"string","enum":["authorized","unauthorized","pending"]}},"account_count":{"type":"integer","title":"Number of distinct child accounts where this tool appears. Always 1 for Nebula."}}}},"total_count":{"type":"integer","title":"Number of distinct AI tools in the result"},"tools_by_account":{"type":"object","title":"Per-child-account tool breakdown. Only present when group_by_account is true in the request (RMM only).","additionalProperties":true}}}}}}},"tags":["AI Detection & Response"],"operationId":"api.rmm.aidr.tools.search"}},"/oneview/v2/sites/subscriptions/availability":{"get":{"description":"Use this endpoint to retrieve the available subscriptions for a given MSP account\n\n## Field descriptions\n### products\n| Field name | Data type or example | Description |\n|----------------------------|----------------------------|---------------------------------------------------------------------------------------------------------------------------|\n| product | `ir`, `ep`, `edr` or `mob` | Contains a list of product objects that an MSP is allowed to create or add to each site |\n| max_workstation_allocation | Integer | This indicates the number of maximum workstation allocation (`ir`, `ep`, `edr` or `mob`) allowed for the specific product |\n| max_server_allocation | Integer | This indicates the number of maximum server allocation allowed (`eps` or `edrs`) for the specific product |\n| is_workstation_allowed | Boolean | This indicated if a user may use `ws` as a `machine_type` when creating a subscription |\n| is_server_allowed | Boolean | This indicated if a user may use `ws-ser` as a `machine_type` when creating a subscription |\n| is_trial_only | Boolean | This indicated if a user may use `trial` only as a `term_type` when creating a subscription |\n| is_paid_only | Boolean | This indicated if a user may use `paid` only as a `term_type` when creating a subscription |\n\n\n### add_ons\nContains a list of add-on objects that an MSP is able to add to their site subscriptions\n* add-ons require an active product subscription to be added to a site\n\n| Field name | Data type or example | Description |\n|-----------------|-----------------------------------------------|----------------------------------------------------------------------------------------|\n| product | `BUS-MBVPM-01`, `BUS-MBDNS-01`, `BUS-MBVM-01` | The add-on name the user will need to send when adding the module |\n| max_allocation | Integer | This indicates the number of maximum add-on allocation allowed for the specific module |\n| is_trial_only | Boolean | This indicated if a user may use `trial` only as a `term_type` |\n| is_paid_only | Boolean | This indicated if a user may use `paid` only as a `term_type` |\n\n### is_nfr_allowed\nThis field indicates if an MSP is allowed to add an NFR subscription to a site\n* this field will automatically return false if there is already an active site with NFR subscription\n\n## Response payload examples:\nIn this example, the MSP is eligible to the add the following subscription to a site\n* Endpoint Protection\n * workstation\n * server\n* Endpoint Detection and Response\n * workstation\n * server\n* Add-ons\n * Vulnerability and Patch Management\n * Vulnerability Assessment\n* NFR\n * The MSP is eligible to create a subscription with NFR `term_type`\n\nThe MSP is **NOT** eligible to the following subscriptions to a site:\n* Incident Response\n * workstation\n* Mobile Security\n* Add-ons\n * ThreatDown Application Block\n * ThreatDown Managed Detection and Response\n * ThreatDown DNS Filtering\n\nSince the allocations are `-1` for all the products, we can determine that the current MSP is a `Usage` billed MSP\n```\n{\n \"products\":\n [\n {\n \"product\": \"ep\",\n \"max_workstation_allocation\": -1,\n \"max_server_allocation\": -1,\n \"is_workstation_allowed\": true,\n \"is_server_allowed\": true,\n \"is_trial_only\": false,\n \"is_paid_only\": false\n },\n {\n \"product\": \"edr\",\n \"max_workstation_allocation\": -1,\n \"max_server_allocation\": -1,\n \"is_workstation_allowed\": true,\n \"is_server_allowed\": true,\n \"is_trial_only\": false,\n \"is_paid_only\": false\n }\n ],\n \"add_ons\":\n [\n {\n \"product\": \"BUS-MBVPM-01\",\n \"max_allocation\": -1,\n \"is_trial_only\": false,\n \"is_paid_only\": true\n },\n {\n \"product\": \"BUS-MBVM-01\",\n \"max_allocation\": -1,\n \"is_trial_only\": false,\n \"is_paid_only\": true\n }\n ],\n \"is_nfr_allowed\": true\n}\n```\n","summary":"[v2 - À la carte] Get account available subscriptions","security":[{"client_credentials":["read"]},{"user_permissions":["sites.view"]}],"status":{"outage":["auth","ov"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"The allowed subscriptions","description":"The allowed subscriptions for an account to be assigned to a site.","examples":[{"products":[{"product":"ep","max_workstation_allocation":-1,"max_server_allocation":-1,"is_workstation_allowed":true,"is_server_allowed":true,"is_trial_only":false,"is_paid_only":false},{"product":"edr","max_workstation_allocation":-1,"max_server_allocation":-1,"is_workstation_allowed":true,"is_server_allowed":true,"is_trial_only":false,"is_paid_only":false},{"product":"ir","max_workstation_allocation":-1,"max_server_allocation":0,"is_workstation_allowed":true,"is_server_allowed":false,"is_trial_only":false,"is_paid_only":true}],"add_ons":[{"product":"BUS-MBVPM-01","max_allocation":-1,"is_trial_only":false,"is_paid_only":true},{"product":"BUS-MBVM-01","max_allocation":-1,"is_trial_only":false,"is_paid_only":true}],"is_nfr_allowed":true}],"required":[],"properties":{"products":{"$schema":"http://json-schema.org/draft-07/schema","type":"array","title":"The allowed add-on subscriptions","description":"The allowed add-on subscriptions for an account to be assigned to a site.","examples":[{"product":"ep","max_workstation_allocation":-1,"max_server_allocation":-1,"is_workstation_allowed":true,"is_server_allowed":true,"is_trial_only":true,"is_paid_only":false},{"product":"edr","max_workstation_allocation":-1,"max_server_allocation":-1,"is_workstation_allowed":false,"is_server_allowed":true,"is_trial_only":false,"is_paid_only":true},{"product":"ir","max_workstation_allocation":2000,"max_server_allocation":0,"is_workstation_allowed":true,"is_server_allowed":false,"is_trial_only":false,"is_paid_only":true}],"required":[],"properties":{"product":{"type":"string","title":"Add-on product code","description":"The add-on product code","examples":["ep","edr","ir"]},"max_workstation_allocation":{"type":"integer","title":"Maximum allocation for workstation","description":"The maximum allowed seat count, -1 is no limit","examples":["-1","200","0"]},"max_server_allocation":{"type":"integer","title":"Maximum allocation for server","description":"The maximum allowed seat count, -1 is no limit","examples":["-1","200","0"]},"is_workstation_allowed":{"type":"boolean","title":"Worksation only subscription","description":"Is workstation only allowed for a specific product","examples":[true,false]},"is_server_allowed":{"type":"boolean","title":"Server only subscription","description":"Is server only allowed for a specific product","examples":[true,false]},"is_trial_only":{"type":"boolean","title":"Trial only subscription","description":"Is trial only allowed for a specific product","examples":[true,false]},"is_paid_only":{"type":"boolean","title":"Paid only subscription","description":"Is paid only allowed for a specific product","examples":[true,false]}}},"add_ons":{"$schema":"http://json-schema.org/draft-07/schema","type":"array","title":"The allowed add-on subscriptions","description":"The allowed add-on subscriptions for an account to be assigned to a site.","examples":[{"product":"BUS-MBVPM-01","max_allocation":-1,"is_trial_only":false,"is_paid_only":true},{"product":"BUS-MBVM-01","max_allocation":-1,"is_trial_only":false,"is_paid_only":true}],"required":[],"properties":{"product":{"type":"string","title":"Add-on product code","description":"The add-on product code","examples":["BUS-MBVPM-01","BUS-MBVM-01"]},"max_allocation":{"type":"integer","title":"Maximum allocation","description":"The maximum allowed seat count, -1 is no limit","examples":["-1","200","0"]},"is_trial_only":{"type":"boolean","title":"Trial only subscription","description":"Is trial only allowed for a specific add-on","examples":[true,false]},"is_paid_only":{"type":"boolean","title":"Paid only subscription","description":"Is paid only allowed for a specific add-on","examples":[true,false]}}},"is_nfr_allowed":{"type":"boolean","title":"Not for resale term type","description":"Not for resale subscription is allowed to be created","examples":[true,false]}}}}}}},"tags":["Subscriptions"],"operationId":"api.v2.oneview.availability.subscriptionv2.id"}},"/oneview/v2/sites/{id}/subscriptions":{"post":{"description":"Use this endpoint to create a subscription for one of your managed sites.\n\nAfter creating one subscription, your customer's data will be populated with an `account_id` field that you can use for security's management apis, like detections, endpoints and jobs.\n\n- This api can only be used when it does not have a current subscription\n- If a site was created through the OneView console, it will likely have a subscription already\n- If site has an active subscription, use the update subscription api\n- For adding add-on modules, see add-ons api\n\nAvailable options will be provided by another api\n\n- https://oneview.malwarebytes.com/oauth/documentation/msp#operation/api.v2.oneview.availability.subscriptionv2.id\n\n## Acceptable values for each field\n\n### product\n\nDetermines the product for the subscription\n\n| Value | Description |\n| ----- | ------------------------------------------ |\n| ir | ThreatDown Incident Response |\n| ep | ThreatDown Endpoint Endpoint Protection |\n| edr | ThreatDown Endpoint Detection And Response |\n| mob | ThreatDown Mobile Security for Business |\n\n### machine_type\n\nDetermines the machine type of the subscription\n\n- field not required for mobile entitlements\n\n| Value | Description |\n| ------ | ---------------------- |\n| ws | Workstation only |\n| ws-ser | Workstation and Server |\n\n### term_type\n\nDetermines whether the subscription is paid or trial\n\n| Value | Description | Billable |\n| ----- | ------------------ | -------- |\n| paid | Paid subscription | yes |\n| trial | Trial subscription | no |\n\n### term_length\n\nDetermines the term length of a subscription, most notable for trial subscriptions\n\n| Value | Description |\n| ----- | ------------------------------- |\n| 0 | set to 0 for paid subscriptions |\n| 15 | set to 15 for 15 day trial |\n| 30 | set to 30 for 30 daytrial |\n\n### allocations\n\nDetermines the seat count allocated for a certain product subscription\n\n- If MSP is on Upfront billing\n - **Required field**\n - Allocations here are limited by the seats purchased\n- If MSP is on Usage billing\n - **Not Required**\n - allocation here does not reflect as billable\n\n| Value | Description |\n| ----- | ----------------------------- |\n| ir | allocation for IR |\n| ep | allocation for EP |\n| edr | allocation for EDR |\n| eps | allocation for EP for Server |\n| edrs | allocation for EDR for Server |\n| mob | allocation for Mobile |\n\n## Request payload examples:\n\n**Create a subscription with ThreatDown Endpoint Protection**\n\n```\n{\n \"product\": \"ep\",\n \"machine_type\": \"ws\",\n \"term_type\": \"paid\",\n \"term_length\": 0,\n \"allocations\": {\n \"ep\": 10\n }\n}\n```\n\n**Create a subscription with ThreatDown Endpoint Protection and Server**\n\n```\n{\n \"product\": \"ep\",\n \"machine_type\": \"ws-ser\",\n \"term_type\": \"paid\",\n \"term_length\": 0,\n \"allocations\": {\n \"ep\": 15,\n \"eps\": 20\n }\n}\n```\n\n**Create a subscription with ThreatDown Mobile Security**\n\n```\n{\n \"product\": \"mob\",\n \"term_type\": \"paid\",\n \"term_length\": 0,\n \"allocations\": {\n \"mob\": 5\n }\n}\n```\n\n**Create an NFR subscription with ThreatDown Endpoint Protection and Server**\n\n```\n{\n \"product\": \"ep\",\n \"machine_type\": \"ws-ser\",\n \"term_type\": \"nfr\",\n \"term_length\": 0,\n \"allocations\": {\n \"ep\": 15,\n \"eps\": 20\n }\n}\n```\n","summary":"[v2 - À la carte] Create a new subscription for a site","security":[{"client_credentials":["write"]},{"user_permissions":["sites.manage"]}],"status":{"outage":["auth","ov"]},"parameters":[{"name":"id","required":true,"in":"path","description":"Valid OneView site ID (Ex. \"30616562663436302D643733312D346238622D623338332D613031343538363566383333\")","schema":{"type":"string","pattern":"^[A-Fa-f0-9]+$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"The body for creating a new subscription","description":"The payload for creating a new subscription.","examples":[{"product":"edr","machine_type":"ws-ser","term_type":"paid","term_length":0,"allocations":{"ir":0,"ep":0,"edr":0,"eps":0,"edrs":0},"auto_convert_trial_to_paid":true}],"required":["product","term_type","term_length","allocations"],"properties":{"product":{"type":"string","title":"Product type","description":"Select product for subscription","examples":["ir","ep","edr","eps","edrs","mob"]},"machine_type":{"type":"string","title":"Machine type","description":"Select machine type to support, workstation or workstation-server | Not required for mobile (exclude from payload)","examples":["ws","ws-ser"]},"term_type":{"type":"string","title":"Term type","description":"Select term type, paid or trial","examples":["paid","trial"]},"term_length":{"type":"string","title":"Term length","description":"Select term length for subscription. Trial is either 15 or 30. Paid is 0 for usage based billing or 365 for upfront","examples":["0","15","30","365"]},"allocations":{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"The allocation payload for creating a new subscription","description":"The allocation payload for creating a new subscription.","examples":[{"ir":77,"ep":6,"edr":12,"eps":25,"edrs":17}],"required":[],"properties":{"ir":{"type":"integer","title":"Incident Response Allocation","description":"Seat count allocation for Incident Response","examples":["5","12","100"]},"ep":{"type":"integer","title":"Endpoint Protection Allocation","description":"Seat count allocation for Endpoint Protection","examples":["8","1","72"]},"edr":{"type":"integer","title":"Endpoint Detection and Response Allocation","description":"Seat count allocation for Endpoint Detection and Response","examples":["578","43","86"]},"eps":{"type":"integer","title":"Endpoint Protection for Servers Allocation","description":"Seat count allocation for Endpoint Protection for Servers","examples":["72","45","36"]},"edrs":{"type":"integer","title":"Endpoint Detection and Response for Servers Allocation","description":"Seat count allocation for Endpoint Detection and Response for Servers","examples":["62","8","824 "]},"mob":{"type":"integer","title":"ThreatDown Mobile Security for Business","description":"Seat count allocation for ThreatDown Mobile Security for Business","examples":["4","56","100"]}}},"auto_convert_trial_to_paid":{"type":"boolean","title":"Auto Convert Trial to Paid","description":"Choose to auto convert trial subscriptions to paid when trial term ends"}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"$schema":"http://json-schema.org/draft-07/schema","type":"array","title":"Payload returned when getting a subscription","description":"get subscription v2 response","examples":[[{"product":"edr","machine_type":"ws-ser","term_type":"paid","term_length":0,"trial_extension_available":false,"allocations":{"ir":0,"ep":0,"edr":0,"eps":0,"edrs":0}}]],"required":[],"items":{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"The body for creating a new subscription","description":"The payload for creating a new subscription.","examples":[{"product":"edr","machine_type":"ws-ser","term_type":"paid","term_length":0,"allocations":{"ir":0,"ep":0,"edr":0,"eps":0,"edrs":0},"auto_convert_trial_to_paid":true}],"required":["product","term_type","term_length","allocations"],"properties":{"product":{"type":"string","title":"Product type","description":"Select product for subscription","examples":["ir","ep","edr","eps","edrs","mob"]},"machine_type":{"type":"string","title":"Machine type","description":"Select machine type to support, workstation or workstation-server | Not required for mobile (exclude from payload)","examples":["ws","ws-ser"]},"term_type":{"type":"string","title":"Term type","description":"Select term type, paid or trial","examples":["paid","trial"]},"term_length":{"type":"string","title":"Term length","description":"Select term length for subscription. Trial is either 15 or 30. Paid is 0 for usage based billing or 365 for upfront","examples":["0","15","30","365"]},"allocations":{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"The allocation payload for creating a new subscription","description":"The allocation payload for creating a new subscription.","examples":[{"ir":77,"ep":6,"edr":12,"eps":25,"edrs":17}],"required":[],"properties":{"ir":{"type":"integer","title":"Incident Response Allocation","description":"Seat count allocation for Incident Response","examples":["5","12","100"]},"ep":{"type":"integer","title":"Endpoint Protection Allocation","description":"Seat count allocation for Endpoint Protection","examples":["8","1","72"]},"edr":{"type":"integer","title":"Endpoint Detection and Response Allocation","description":"Seat count allocation for Endpoint Detection and Response","examples":["578","43","86"]},"eps":{"type":"integer","title":"Endpoint Protection for Servers Allocation","description":"Seat count allocation for Endpoint Protection for Servers","examples":["72","45","36"]},"edrs":{"type":"integer","title":"Endpoint Detection and Response for Servers Allocation","description":"Seat count allocation for Endpoint Detection and Response for Servers","examples":["62","8","824 "]},"mob":{"type":"integer","title":"ThreatDown Mobile Security for Business","description":"Seat count allocation for ThreatDown Mobile Security for Business","examples":["4","56","100"]}}},"auto_convert_trial_to_paid":{"type":"boolean","title":"Auto Convert Trial to Paid","description":"Choose to auto convert trial subscriptions to paid when trial term ends"}}}}}}}},"tags":["Subscriptions"],"operationId":"api.v2.oneview.create.subscriptionv2.id"},"get":{"description":"Get active subscriptions for an existing site.","summary":"[v2 - À la carte] Get a site subscription","security":[{"client_credentials":["read"]},{"user_permissions":["sites.view"]}],"status":{"outage":["auth","ov"]},"parameters":[{"name":"id","required":true,"in":"path","description":"Valid OneView site ID (Ex. \"30616562663436302D643733312D346238622D623338332D613031343538363566383333\")","schema":{"type":"string","pattern":"^[A-Fa-f0-9]+$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"$schema":"http://json-schema.org/draft-07/schema","type":"array","title":"Payload returned when getting a subscription","description":"get subscription v2 response","examples":[[{"product":"edr","machine_type":"ws-ser","term_type":"paid","term_length":0,"trial_extension_available":false,"allocations":{"ir":0,"ep":0,"edr":0,"eps":0,"edrs":0}}]],"required":[],"items":{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"The body for creating a new subscription","description":"The payload for creating a new subscription.","examples":[{"product":"edr","machine_type":"ws-ser","term_type":"paid","term_length":0,"allocations":{"ir":0,"ep":0,"edr":0,"eps":0,"edrs":0},"auto_convert_trial_to_paid":true}],"required":["product","term_type","term_length","allocations"],"properties":{"product":{"type":"string","title":"Product type","description":"Select product for subscription","examples":["ir","ep","edr","eps","edrs","mob"]},"machine_type":{"type":"string","title":"Machine type","description":"Select machine type to support, workstation or workstation-server | Not required for mobile (exclude from payload)","examples":["ws","ws-ser"]},"term_type":{"type":"string","title":"Term type","description":"Select term type, paid or trial","examples":["paid","trial"]},"term_length":{"type":"string","title":"Term length","description":"Select term length for subscription. Trial is either 15 or 30. Paid is 0 for usage based billing or 365 for upfront","examples":["0","15","30","365"]},"allocations":{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"The allocation payload for creating a new subscription","description":"The allocation payload for creating a new subscription.","examples":[{"ir":77,"ep":6,"edr":12,"eps":25,"edrs":17}],"required":[],"properties":{"ir":{"type":"integer","title":"Incident Response Allocation","description":"Seat count allocation for Incident Response","examples":["5","12","100"]},"ep":{"type":"integer","title":"Endpoint Protection Allocation","description":"Seat count allocation for Endpoint Protection","examples":["8","1","72"]},"edr":{"type":"integer","title":"Endpoint Detection and Response Allocation","description":"Seat count allocation for Endpoint Detection and Response","examples":["578","43","86"]},"eps":{"type":"integer","title":"Endpoint Protection for Servers Allocation","description":"Seat count allocation for Endpoint Protection for Servers","examples":["72","45","36"]},"edrs":{"type":"integer","title":"Endpoint Detection and Response for Servers Allocation","description":"Seat count allocation for Endpoint Detection and Response for Servers","examples":["62","8","824 "]},"mob":{"type":"integer","title":"ThreatDown Mobile Security for Business","description":"Seat count allocation for ThreatDown Mobile Security for Business","examples":["4","56","100"]}}},"auto_convert_trial_to_paid":{"type":"boolean","title":"Auto Convert Trial to Paid","description":"Choose to auto convert trial subscriptions to paid when trial term ends"}}}}}}}},"tags":["Subscriptions"],"operationId":"api.v2.oneview.get.subscriptionv2.id"},"put":{"description":"Use this endpoint to add or modify a current site subscription\n* The user may add or remove a trial through this api\n *

The user will not be able to re-add a trial once it has been removed

\n * Trials are limited to 100 seats\n* The user may only trial a higher tier product to an existing Paid subscription\n * If the user has a paid EP subscription, the user may add an EDR trial (assuming the MSP is entitled to EDR)\n * If the user has a paid EDR subscription, the user may only add mobile as a trial\n\nNote: There must be a POST before a PUT subscription can be used. \n\n## Request payload examples:\n**Update a subscription with**\n* paid EP workstation and server\n* trial EDR workstation and server\n* trial Mobile Security\n\n```\n[\n {\n \"product\": \"ep\",\n \"machine_type\": \"ws-ser\",\n \"term_type\": \"paid\",\n \"term_length\": 0,\n \"allocations\": {\n \"ep\": 1,\n \"eps\": 0\n }\n },\n {\n \"product\": \"edr\",\n \"machine_type\": \"ws-ser\",\n \"term_type\": \"trial\",\n \"term_length\": 0,\n \"allocations\": {\n \"edr\": 10,\n \"edrs\": 20\n }\n },\n {\n \"product\": \"mob\",\n \"term_type\": \"trial\",\n \"term_length\": 0,\n \"allocations\": {\n \"mob\": 30\n }\n }\n]\n```\n\n**Update a subscription with the following subscription**\n* paid EDR workstation and server\n* paid Mobile Security for Business\n\n```\n[\n {\n \"product\": \"edr\",\n \"machine_type\": \"ws-ser\",\n \"term_type\": \"paid\",\n \"term_length\": 0,\n \"allocations\": {\n \"ep\": 1,\n \"eps\": 0\n }\n },\n {\n \"product\": \"mob\",\n \"term_type\": \"paid\",\n \"term_length\": 0,\n \"allocations\": {\n \"mob\": 10\n }\n }\n]\n```\n\n**Remove all current subscriptions of a site, simply send an empty list**\n*

WARNING: Removing all subscriptions will also remove all add-on modules

\n\n```\n[]\n```\n","summary":"[v2 - À la carte] Update a site's current subscription","security":[{"client_credentials":["write"]},{"user_permissions":["sites.manage"]}],"status":{"outage":["auth","ov"]},"parameters":[{"name":"id","required":true,"in":"path","description":"Valid OneView site ID (Ex. \"30616562663436302D643733312D346238622D623338332D613031343538363566383333\")","schema":{"type":"string","pattern":"^[A-Fa-f0-9]+$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$schema":"http://json-schema.org/draft-07/schema","type":"array","title":"Get add-ons Response","description":"get subscription v2 response for add-ons","examples":[[{"product":"ep","machine_type":"ws-ser","term_type":"paid","term_length":0,"allocations":{"ir":8,"ep":12,"eps":35}},{"product":"edr","machine_type":"ws-ser","term_type":"trial","term_length":0,"allocations":{"edr":13,"edrs":26},"auto_convert_trial_to_paid":true}]],"required":[],"items":{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"The body for creating a new subscription","description":"The payload for creating a new subscription.","examples":[{"product":"edr","machine_type":"ws-ser","term_type":"paid","term_length":0,"allocations":{"ir":0,"ep":0,"edr":0,"eps":0,"edrs":0},"auto_convert_trial_to_paid":true}],"required":["product","term_type","term_length","allocations"],"properties":{"product":{"type":"string","title":"Product type","description":"Select product for subscription","examples":["ir","ep","edr","eps","edrs","mob"]},"machine_type":{"type":"string","title":"Machine type","description":"Select machine type to support, workstation or workstation-server | Not required for mobile (exclude from payload)","examples":["ws","ws-ser"]},"term_type":{"type":"string","title":"Term type","description":"Select term type, paid or trial","examples":["paid","trial"]},"term_length":{"type":"string","title":"Term length","description":"Select term length for subscription. Trial is either 15 or 30. Paid is 0 for usage based billing or 365 for upfront","examples":["0","15","30","365"]},"allocations":{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"The allocation payload for creating a new subscription","description":"The allocation payload for creating a new subscription.","examples":[{"ir":77,"ep":6,"edr":12,"eps":25,"edrs":17}],"required":[],"properties":{"ir":{"type":"integer","title":"Incident Response Allocation","description":"Seat count allocation for Incident Response","examples":["5","12","100"]},"ep":{"type":"integer","title":"Endpoint Protection Allocation","description":"Seat count allocation for Endpoint Protection","examples":["8","1","72"]},"edr":{"type":"integer","title":"Endpoint Detection and Response Allocation","description":"Seat count allocation for Endpoint Detection and Response","examples":["578","43","86"]},"eps":{"type":"integer","title":"Endpoint Protection for Servers Allocation","description":"Seat count allocation for Endpoint Protection for Servers","examples":["72","45","36"]},"edrs":{"type":"integer","title":"Endpoint Detection and Response for Servers Allocation","description":"Seat count allocation for Endpoint Detection and Response for Servers","examples":["62","8","824 "]},"mob":{"type":"integer","title":"ThreatDown Mobile Security for Business","description":"Seat count allocation for ThreatDown Mobile Security for Business","examples":["4","56","100"]}}},"auto_convert_trial_to_paid":{"type":"boolean","title":"Auto Convert Trial to Paid","description":"Choose to auto convert trial subscriptions to paid when trial term ends"}}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"$schema":"http://json-schema.org/draft-07/schema","type":"array","title":"Payload returned when getting a subscription","description":"get subscription v2 response","examples":[[{"product":"edr","machine_type":"ws-ser","term_type":"paid","term_length":0,"trial_extension_available":false,"allocations":{"ir":0,"ep":0,"edr":0,"eps":0,"edrs":0}}]],"required":[],"items":{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"The body for creating a new subscription","description":"The payload for creating a new subscription.","examples":[{"product":"edr","machine_type":"ws-ser","term_type":"paid","term_length":0,"allocations":{"ir":0,"ep":0,"edr":0,"eps":0,"edrs":0},"auto_convert_trial_to_paid":true}],"required":["product","term_type","term_length","allocations"],"properties":{"product":{"type":"string","title":"Product type","description":"Select product for subscription","examples":["ir","ep","edr","eps","edrs","mob"]},"machine_type":{"type":"string","title":"Machine type","description":"Select machine type to support, workstation or workstation-server | Not required for mobile (exclude from payload)","examples":["ws","ws-ser"]},"term_type":{"type":"string","title":"Term type","description":"Select term type, paid or trial","examples":["paid","trial"]},"term_length":{"type":"string","title":"Term length","description":"Select term length for subscription. Trial is either 15 or 30. Paid is 0 for usage based billing or 365 for upfront","examples":["0","15","30","365"]},"allocations":{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"The allocation payload for creating a new subscription","description":"The allocation payload for creating a new subscription.","examples":[{"ir":77,"ep":6,"edr":12,"eps":25,"edrs":17}],"required":[],"properties":{"ir":{"type":"integer","title":"Incident Response Allocation","description":"Seat count allocation for Incident Response","examples":["5","12","100"]},"ep":{"type":"integer","title":"Endpoint Protection Allocation","description":"Seat count allocation for Endpoint Protection","examples":["8","1","72"]},"edr":{"type":"integer","title":"Endpoint Detection and Response Allocation","description":"Seat count allocation for Endpoint Detection and Response","examples":["578","43","86"]},"eps":{"type":"integer","title":"Endpoint Protection for Servers Allocation","description":"Seat count allocation for Endpoint Protection for Servers","examples":["72","45","36"]},"edrs":{"type":"integer","title":"Endpoint Detection and Response for Servers Allocation","description":"Seat count allocation for Endpoint Detection and Response for Servers","examples":["62","8","824 "]},"mob":{"type":"integer","title":"ThreatDown Mobile Security for Business","description":"Seat count allocation for ThreatDown Mobile Security for Business","examples":["4","56","100"]}}},"auto_convert_trial_to_paid":{"type":"boolean","title":"Auto Convert Trial to Paid","description":"Choose to auto convert trial subscriptions to paid when trial term ends"}}}}}}}},"tags":["Subscriptions"],"operationId":"api.v2.oneview.update.subscriptionv2.id"}},"/oneview/v2/sites/{id}/extend/{product}":{"put":{"description":"Extend a trial for an existing site.\n\nDespite 404s often being a non-recoverable error, on this endpoing, 404s are sometimes recoverable. In this case, setting a retry limit (for example 3 times) is suggested instead of not retrying when a 404 is received.","summary":"[v2 - À la carte] Extend a trial for a site","security":[{"client_credentials":["write"]},{"user_permissions":["sites.manage"]}],"status":{"outage":["auth","ov"]},"parameters":[{"name":"id","required":true,"in":"path","description":"Valid OneView site ID (Ex. \"30616562663436302D643733312D346238622D623338332D613031343538363566383333\")","schema":{"type":"string","pattern":"^[A-Fa-f0-9]+$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"Successful response"}},"tags":["Subscriptions"],"operationId":"api.v2.oneview.extend.trial.subscriptionv2.id"}},"/oneview/v2/sites/{id}/addOns":{"get":{"description":"Get active add-ons for an existing site","summary":"[v2 - À la carte] Get site's add-on subscriptions","security":[{"client_credentials":["read"]},{"user_permissions":["sites.view"]}],"status":{"outage":["auth","ov"]},"parameters":[{"name":"id","required":true,"in":"path","description":"Valid OneView site ID (Ex. \"30616562663436302D643733312D346238622D623338332D613031343538363566383333\")","schema":{"type":"string","pattern":"^[A-Fa-f0-9]+$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"$schema":"http://json-schema.org/draft-07/schema","type":"array","title":"Get add-ons Response","description":"get subscription v2 response for add-ons","examples":[[{"product":"BUS-MBVM-01","term_type":"paid","term_length":0,"trial_extension_available":true,"add_on_allocation":4}]],"required":[],"items":{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"Get add-ons Response","description":"get subscription v2 response for add-ons","examples":[{"product":"BUS-MBVM-01","term_type":"paid","term_length":0,"trial_extension_available":true,"add_on_allocation":4}],"required":["product","term_type","term_length","add_on_allocation"],"properties":{"product":{"type":"string","title":"Add-on product code","description":"The product code of the add-on","examples":["BUS-MBVM-01","BUS-MBVPM-01"]},"term_type":{"type":"string","title":"Term Type of add-on","description":"The term type of the add-on","examples":["paid","trial"]},"term_length":{"type":"integer","title":"Term length of add-on","description":"The term length of the add-on","examples":[15,30,0,365]},"trial_extension_available":{"type":"boolean","title":"Trial extension","description":"Is a trial extension allowed for this add-on","examples":[true,false]},"add_on_allocation":{"type":"integer","title":"Add-on allocation","description":"Seat count allocation for add-on","examples":[5,20,56,0]}}}}}}}},"tags":["Subscriptions"],"operationId":"api.v2.oneview.get.addons.subscriptionv2.id"},"put":{"description":"Use this endpoint to add or modify a current site's add-on subscription\n* Please note the product values are not static\n* The product values are provided in the `availability` API under `add_ons` field\n* If the user would like to update the seat count, simply increase the values here\n\n## Request payload examples:\nUpdate a subscription with\n* ThreatDown DNS Filtering and 5 seats\n```\n[\n {\n \"product\": \"BUS-MBDNS-01\",\n \"term_type\": \"paid\",\n \"term_length\": 0,\n \"add_on_allocation\": 5\n }\n]\n```\nIncrease allocation of the previous DNS subscription from 5 to 20\n* ThreatDown DNS Filtering and 20 seats\n```\n[\n {\n \"product\": \"BUS-MBDNS-01\",\n \"term_type\": \"paid\",\n \"term_length\": 0,\n \"add_on_allocation\": 20\n }\n]\n```\nUpdate a subscription with\n* ThreatDown DNS Filtering and 20 seats\n* ThreatDown Application Block and 15 seats\n```\n[\n {\n \"product\": \"BUS-MBDNS-01\",\n \"term_type\": \"paid\",\n \"term_length\": 0,\n \"add_on_allocation\": 20\n },\n {\n \"product\": \"BUS-MBAB-01\",\n \"term_type\": \"paid\",\n \"term_length\": 0,\n \"add_on_allocation\": 15\n }\n]\n```\nTo remove all add-on modules of a site, simply send an empty list\n```\n[]\n```\n","summary":"[v2 - À la carte] Update a site's current add-on subscription","security":[{"client_credentials":["write"]},{"user_permissions":["sites.manage"]}],"status":{"outage":["auth","ov"]},"parameters":[{"name":"id","required":true,"in":"path","description":"Valid OneView site ID (Ex. \"30616562663436302D643733312D346238622D623338332D613031343538363566383333\")","schema":{"type":"string","pattern":"^[A-Fa-f0-9]+$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$schema":"http://json-schema.org/draft-07/schema","type":"array","title":"Get add-ons Response","description":"get subscription v2 response for add-ons","examples":[[{"product":"BUS-MBVM-01","term_type":"paid","term_length":0,"add_on_allocation":4}]],"required":[],"items":{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"Get add-ons Response","description":"get subscription v2 response for add-ons","examples":[{"product":"BUS-MBVM-01","term_type":"paid","term_length":0,"trial_extension_available":true,"add_on_allocation":4}],"required":[],"properties":{"product":{"type":"string","title":"Add-on product code","description":"The product code of the add-on","examples":["BUS-MBVM-01","BUS-MBVPM-01"]},"term_type":{"type":"string","title":"Term Type of add-on","description":"The term type of the add-on","examples":["paid","trial"]},"term_length":{"type":"integer","title":"Term length of add-on","description":"The term length of the add-on","examples":[15,30,0,365]},"add_on_allocation":{"type":"integer","title":"Add-on allocation","description":"Seat count allocation for add-on","examples":[5,20,56,0]}}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"$schema":"http://json-schema.org/draft-07/schema","type":"array","title":"Get add-ons Response","description":"get subscription v2 response for add-ons","examples":[[{"product":"BUS-MBVM-01","term_type":"paid","term_length":0,"trial_extension_available":true,"add_on_allocation":4}]],"required":[],"items":{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"Get add-ons Response","description":"get subscription v2 response for add-ons","examples":[{"product":"BUS-MBVM-01","term_type":"paid","term_length":0,"trial_extension_available":true,"add_on_allocation":4}],"required":["product","term_type","term_length","add_on_allocation"],"properties":{"product":{"type":"string","title":"Add-on product code","description":"The product code of the add-on","examples":["BUS-MBVM-01","BUS-MBVPM-01"]},"term_type":{"type":"string","title":"Term Type of add-on","description":"The term type of the add-on","examples":["paid","trial"]},"term_length":{"type":"integer","title":"Term length of add-on","description":"The term length of the add-on","examples":[15,30,0,365]},"trial_extension_available":{"type":"boolean","title":"Trial extension","description":"Is a trial extension allowed for this add-on","examples":[true,false]},"add_on_allocation":{"type":"integer","title":"Add-on allocation","description":"Seat count allocation for add-on","examples":[5,20,56,0]}}}}}}}},"tags":["Subscriptions"],"operationId":"api.v2.oneview.update.addons.subscriptionv2.id"}},"/oneview/v2/accounts/{account_id}/policies/{id}":{"delete":{"description":"Delete policy.","summary":"Delete policy","security":[{"client_credentials":["write"]},{"user_permissions":["policies.delete"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":true,"in":"path","description":"ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"Successful response"}},"tags":["PoliciesV2"],"operationId":"api.rmm.delete.policy"},"get":{"description":"Get policy by id.","summary":"Get policy by id","security":[{"client_credentials":["read"]},{"user_permissions":["policies.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":true,"in":"path","description":"ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}},{"name":"populate","required":false,"in":"query","schema":{"type":"string","pattern":"^(groups|exclusions)([,](groups|exclusions))*$"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Policy","properties":{"id":{"type":"string","title":"Id","examples":["3606af9f-f539-426c-be76-6f9bc18531e2"]},"account_id":{"type":"string","title":"Account id","examples":["1b8d7513-3336-45fe-8d6f-db43bc9c9613"]},"etag":{"type":"string","title":"Etag","description":"etags are identifiers that change on every update. Their use is to prevent race conditions when multiple clients are modifying the same resource. Supply this tag empty when creating a policy. When updating, you need to fetch the latest value by GETting a policy. You should always get the current etag before trying to modify a resource that has an etag property.","examples":["4d3ae3923cca7cf30bd712f4d8188bb9"]},"name":{"type":"string","title":"Name","examples":["Default Policy"]},"expire_endpoints":{"type":["number","null"],"title":"Expire endpoints","examples":[230]},"contents":{"type":"object","title":"Policy Contents"},"created_at":{"type":"string","title":"Policy created at","examples":["2020-02-13T17:09:20.741145Z"]},"updated_at":{"type":"string","title":"Policy updated at","examples":["2020-02-13T17:09:22.532969Z"]},"migrated_at":{"type":"string","title":"Policy migrated at","examples":["2020-02-13T17:09:22.532969Z"]},"is_default":{"type":"boolean","title":"Is default"},"deny_edit":{"type":"boolean","title":"Deny edit"},"groups":{"type":"array","title":"Groups","items":{"type":"object","title":"Group","additionalProperties":true,"properties":{"id":{"type":"string","title":"The Id of the group"},"account_id":{"type":"string","title":"The account id to which this group belong"},"name":{"type":"string","title":"The neame of the group"},"machines_count":{"type":"integer","title":"Count of machines"},"policy_id":{"type":"string","title":"Policy id associated to the group"},"policy_name":{"type":"string","title":"Policy name"},"updated_at":{"type":"string","title":"Updated at","examples":["2017-04-06T20:26:07.345213Z"]},"is_default":{"type":"boolean","title":"Default"},"schedule_ids":{"type":"array","title":"Array of schedule ids","items":{"type":"string","title":"Schedule Id"}},"parent_id":{"type":"string","title":"Parent id"},"root_id":{"type":"string","title":"Root id"},"ou_object_id":{"type":["string","null"],"title":"Ou object id"},"child_group_count":{"type":"integer","title":"Child group count"}}}},"exclusions":{"type":"array","title":"Exclusions","items":{"title":"Exclusion from server","type":"object","additionalProperties":true,"properties":{"id":{"type":"string","title":"UUID of the exclusion (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"etag":{"type":"string","title":"Etag","description":"etags are identifiers that change on every update. Their use is to prevent race conditions when multiple clients are modifying the same resource. Supply this tag empty when creating a exclusion. When updating, you need to fetch the latest value by GETting an exclusion. You should always get the current etag before trying to modify a resource that has an etag property.","examples":["c87998228b2f7511bb1616f686d06bae"]},"type":{"type":"integer","title":"1: Exclusion for file path, 2: Exclusion for folder path, 3: Exclusion for wildcard path, 4: Exclusion for registry, 5: Exclusion for file extensions, 6: Exclusion for web domain, 7: Exclusion for web IP, 8: Exclusion for Web Monitoring, 13: Exclusion for hash, 14: Exclusion for command line","examples":[1,2,3,4,5,6,7,13,14,17]},"value":{"type":"string","title":"String value","examples":["%PROGRAMDATA%"]},"enabled":{"type":"boolean","title":"Enable"},"comment":{"type":"string","title":"Comment"},"created_at":{"type":"string","title":"Created at"},"updated_at":{"type":"string","title":"Updated at"},"created_by":{"type":"string","title":"Created by"},"updated_by":{"type":"string","title":"Updated by"},"exclude_from":{"type":"object","title":"Exclusion applied to","properties":{"exploit_protection":{"type":["boolean","null"],"title":"Uses multiple protection layers to guard against attempted exploits of vulnerabilities in legitimate applications"},"malware_protection":{"type":["boolean","null"],"title":"Protects against malware infections and zero-day threats"},"ransomware_protection":{"type":["boolean","null"],"title":"Detects and blocks ransomware threats using advanced behavior analysis"},"suspicious_activity":{"type":["boolean","null"],"title":"Uses advanced machine learning to identify suspicious processes that require additional review"},"website_protection":{"type":["boolean","null"],"title":"Blocks network traffic from malicious websites and IP addresses"},"bruteforce_protection":{"type":["boolean","null"],"title":"Bruteforce attack protection on RDP, IMAP and so on."}}},"friendly_name":{"type":"string","title":"Friendly name","examples":["File by MD5 hash"]},"account_level":{"type":"boolean","title":"Account level"},"policies":{"type":"array","title":"Policies","items":{"type":"object","title":"Policy","properties":{"id":{"type":"string","title":"ID of policy (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","additionalProperties":true,"pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["20da4613-5fa5-4460-9016-963d2c4f6753"]},"name":{"type":"string","title":"Name of policy"}}}}}}},"secret_hash":{"type":"string","title":"Secret hash of the policy"},"secret_allow_site_override":{"type":"boolean","title":"Allow secret override"},"quarantine_retention_duration":{"type":["integer","null"],"minimum":0,"title":"Quarantine retention duration","description":"Number of days to retain quarantined items. 0 means no retention."}}}}}}},"tags":["PoliciesV2"],"operationId":"api.rmm.get.policy.id"},"put":{"description":"Update policy.","summary":"Update policy","security":[{"client_credentials":["read","write"]},{"user_permissions":["policies.edit"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":true,"in":"path","description":"ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"The Put Policy Request","required":["name","contents","etag"],"properties":{"contents":{"type":"object","additionalProperties":true,"title":"Policy contents","properties":{"policy":{"type":"object","additionalProperties":true,"title":"Policy","examples":[{"startup_options":{"timeout":"60000","toggle_on":true},"sirius_update_schedule":"FREQ=DAILY","updates":{"pause_until":"2020-04-10T14:55:00+03:00"},"endpoint_interface_options":{"allow_run_threat_scan":true,"show_threat_scan_shortcuts":true,"limit_endpoint_agent_control":true,"show_tray_icon":"true","show_windows_contextmenu":true,"display_rtp_events":true},"endpoint_tamper_protection":{"uninstall_password":"$2a$10$EPD4LGvmr7zGoh7wXb9iUe.l5bikO/UzeayibCu1q/tFNT22ePQOK"},"protect_service":true}],"properties":{"updates":{"type":"object","additionalProperties":true,"title":"Software Updates","examples":[{"pause_until":"2020-04-10T14:55:00+03:00"}],"properties":{"pause_until":{"type":["string","null"],"title":"While paused, prevents ThreatDown software from updating (Windows Only)","examples":["2020-04-10T14:55:00+03:00"]}}},"protect_service":{"type":"boolean","title":"Prevents ThreatDown services and processes from being stopped (Windows 10 only)","examples":[true]},"startup_options":{"type":"object","additionalProperties":true,"title":"Allow services additional time to start","examples":[{"timeout":"60000","toggle_on":true}],"properties":{"timeout":{"type":["integer","string"],"title":"Adjust the timeout period for all services, milliseconds. Max 10min.","examples":[60000]},"toggle_on":{"type":"boolean","title":"Provide all services with additional time to initiate","examples":[false]}}},"sirius_update_schedule":{"type":"string","title":"How often agent should be updated","examples":["FREQ=DAILY"]},"endpoint_interface_options":{"type":"object","additionalProperties":true,"title":"Endpoint interface options","examples":[{"show_windows_contextmenu":true,"display_rtp_events":true,"allow_run_threat_scan":true,"show_threat_scan_shortcuts":true,"limit_endpoint_agent_control":true,"show_tray_icon":"true"}],"properties":{"show_tray_icon":{"type":["string","boolean"],"title":"Show Malwarebytes icon in notification area","examples":["true"]},"display_rtp_events":{"type":"boolean","title":"Display real-time protection notifications","examples":[true]},"allow_run_threat_scan":{"type":"boolean","title":"Allow users to run a Threat Scan (all threats will be quarantined automatically)","examples":[true]},"show_windows_contextmenu":{"type":"boolean","title":"Show ThreatDown option in context menus (Windows only)","examples":[true]},"show_threat_scan_shortcuts":{"type":"boolean","title":"Show ThreatDown shortcuts on Start menu and desktop to run Threat Scans (Windows only)","examples":[true]},"limit_endpoint_agent_control":{"type":"boolean","title":"The Limit_endpoint_agent_control Schema","description":"Allow only Administrator level users to interact with the ThreatDown Tray (Windows only, not supported in XP or Server 2003)","examples":[true]}}},"endpoint_tamper_protection":{"type":["object","null"],"additionalProperties":true,"title":"Tamper protection","examples":[{"uninstall_password":"$2a$10$EPD4LGvmr7zGoh7wXb9iUe.l5bikO/UzeayibCu1q/tFNT22ePQOK"}],"properties":{"uninstall_password":{"type":"string","title":"Encrypted password","examples":[""]}}}}},"status":{"type":"string","title":"Status of the Policy","examples":["ok"]},"packages":{"type":"array","title":"Collection of packages","default":[],"items":{"type":"object","additionalProperties":true,"title":"Packages contain Policies for different products","examples":[{"sirius_os_packages":[{"operating_system":"windows","sirius_package_name":"epa.win.plugin.assetmanager"}],"policy":{"policy_version":1,"default_scan_settings":{"include_nics":true,"include_installs":true,"include_processes":false,"include_memory":true,"include_modules":false,"include_updates":true,"include_drives":true,"include_startups":true}},"product_name":"Asset Manager","schema_version":"1.0"},{"enabled":true,"sirius_os_packages":[{"sirius_package_name":"epa.win.plugin.edr","operating_system":"windows"}],"policy":{"isolation":{"enabled":true,"title_image_path":"https://nebula-retina-mb-qa.eng-dev.mb-internal.com/api/v1/machine/isolation_image/20200310_105756.bmp?amazonaws=1","text":"Your system has been locked by the IT Department. Please contact the Helpdesk for further information.","title":"Malware or suspicious application behavior has been detected on this computer."},"log_file_retention_rules":{"max_num_roll_backups":5,"max_file_size":"125MB"},"flight_recorder":{"learning_duration":20,"very_aggressive":true,"enabled_server":true,"rollback":{"window":48,"enabled":true,"file_size":"20MB","backup_quota":30,"file_size_server":"100MB","backup_folder_server":"C:\\ProgramData\\Malwarebytes Endpoint Agent\\Plugins\\EDRPlugin\\Backup\\"},"enabled":true,"eagle_url":""},"policy_version":1},"product_name":"Endpoint Detection and Response","schema_version":"1.0"},{"sirius_os_packages":[{"operating_system":"mac","sirius_package_name":"epa.mac.plugin.assetmanager"}],"policy":{"policy_version":1,"default_scan_settings":{"include_startups":true,"include_nics":true,"include_installs":true,"include_processes":false,"include_memory":true,"include_modules":false,"include_updates":true,"include_drives":true}},"product_name":"Mac Asset Manager","schema_version":"1.0"},{"policy":{"isolation":{"enabled":false},"policy_version":1,"flight_recorder":{"enabled":false,"eagle_url":"","enabled_server":false,"learning_duration":20,"network_collection_enabled":false},"log_file_retention_rules":{"max_file_size":"125MB","max_file_size_server":"1024MB","max_num_roll_backups":5}},"enabled":false,"product_name":"Mac Endpoint Detection and Response","schema_version":"1.0","sirius_os_packages":[{"operating_system":"mac","sirius_package_name":"epa.mac.plugin.edr"}]},{"enabled":true,"policy_version":1,"schema_version":"1.0","sirius_os_packages":[{"operating_system":"windows","sirius_package_name":"epa.win.plugin.mbam"}],"policy":{"self_protect_early_start":true,"usage_stat":true,"application_updates":true,"windows_context_menus":false,"protection_aging":"180","win_ac":"default","rtp_settings":{"ransomware":{"enabled":true},"delay_rtp":true,"exploit":{"enabled":true,"options":{"amp_sp_other":true,"java_wmcl":true,"java_aijoip":true,"amp_crg32_media":true,"abp_pmbp_media":true,"amp_mrad_pdf":true,"amp_mrad_browser":true,"amp_sp_pdf":true,"ah_bua_ms":true,"amp_mph_chrome":true,"ah_bua_pdf":true,"ah_ahs_chrome":true,"java_misp":true,"ah_daef_browser":true,"ah_dep_chrome":true,"amp_depb_ms":true,"amp_rrg64_browser":true,"amp_crg32_other":true,"amp_rrg32_media":true,"amp_crg64_media":true,"abp_pmbp_other":true,"abp_mll_media":true,"amp_mph_pdf":true,"amp_mrad_media":true,"amp_rrg32_ms":true,"ah_bua_browser":true,"amp_rrg32_browser":true,"java_mosp":true,"amp_mph_media":true,"ah_dahs_browser":true,"amp_rrg32_other":true,"abp_pmbp_pdf":true,"amp_crg64_other":true,"abp_mll_other":true,"abp_pmbp_browser":true,"amp_rrg64_media":true,"amp_mrad_other":true,"amp_crg32_pdf":true,"amp_depb_media":true,"amp_rrg64_chrome":true,"amp_crg64_pdf":true,"abp_mll_pdf":true,"ah_bua_chrome":true,"amp_depb_pdf":true,"java_mmgp":true,"amp_rrg32_chrome":true,"ah_dep_ms":true,"abp_powmi_ms":true,"amp_depb_chrome":true,"amp_mph_other":false,"abp_mll_chrome":true,"amp_crg64_chrome":true,"amp_mph_ms":true,"abp_povba_ms":true,"amp_sp_chrome":true,"abp_piev_browser":true,"ah_ahs_media":true,"amp_crg32_chrome":true,"ah_dep_media":true,"ah_ahs_pdf":false,"amp_crg64_ms":true,"abp_mll_ms":true,"amp_rrg64_other":true,"amp_depb_browser":true,"amp_depb_other":true,"amp_mrad_chrome":true,"ah_bua_media":false,"amp_mph_browser":true,"abp_pmbp_chrome":true,"java_mmcep":true,"abp_mll_browser":true,"amp_crg64_browser":true,"amp_sp_ms":true,"ah_ahs_browser":true,"ah_ahs_other":true,"ah_dep_other":true,"amp_sp_browser":true,"ah_bua_other":true,"amp_rrg32_pdf":true,"ah_ahs_ms":true,"amp_rrg64_pdf":true,"amp_crg32_browser":true,"ah_diev_browser":true,"amp_sp_media":true,"amp_rrg64_ms":true,"ah_dep_pdf":true,"ah_dep_browser":true,"amp_mrad_ms":true,"abp_pmbp_ms":true,"amp_crg32_ms":true},"protected":[{"application":"Adobe Acrobat","default":true,"enabled":true,"file":"acrobat.exe","type":"FamilyPdfReader"},{"application":"Adobe Reader","default":true,"enabled":true,"file":"acrord32.exe","type":"FamilyPdfReader"},{"application":"Comodo Dragon","default":true,"enabled":true,"file":"dragon.exe","type":"FamilyWebBrowser"},{"type":"FamilyWebBrowser","application":"Cyberfox","default":true,"enabled":true,"file":"cyberfox.exe"},{"default":true,"enabled":true,"file":"Foxit PhantomPDF.exe","type":"FamilyPdfReader","application":"Foxit Phantom"},{"type":"FamilyPdfReader","application":"Foxit Phantom","default":true,"enabled":true,"file":"FoxitPhantomPDF.exe"},{"application":"Foxit Reader","default":true,"enabled":true,"file":"foxit reader.exe","type":"FamilyPdfReader"},{"default":true,"enabled":true,"file":"icedragon.exe","type":"FamilyWebBrowser","application":"IceDragon"},{"enabled":true,"file":"iexplore.exe","type":"FamilyWebBrowser","application":"Internet Explorer (and add-ons)","default":true},{"enabled":true,"file":"java.exe","type":"FamilyJava","application":"Java","default":true},{"default":true,"enabled":true,"file":"javaw.exe","type":"FamilyJava","application":"Java"},{"default":true,"enabled":true,"file":"javaws.exe","type":"FamilyJava","application":"Java"},{"application":"LibreOffice","default":true,"enabled":true,"file":"soffice.bin","type":"FamilyOffice"},{"application":"Maxthon","default":true,"enabled":true,"file":"maxthon.exe","type":"FamilyWebBrowser"},{"enabled":true,"file":"MicrosoftEdge.exe","type":"FamilyWebBrowser","application":"Microsoft Edge (and add-ons)","default":true},{"application":"Microsoft Office Excel","default":true,"enabled":true,"file":"excel.exe","type":"FamilyOffice"},{"default":true,"enabled":true,"file":"powerpnt.exe","type":"FamilyOffice","application":"Microsoft Office PowerPoint"},{"type":"FamilyOffice","application":"Microsoft Office Publisher","default":true,"enabled":true,"file":"mspub.exe"},{"type":"FamilyOffice","application":"Microsoft Office Word","default":true,"enabled":true,"file":"winword.exe"},{"type":"FamilyWebBrowser","application":"Mozilla Firefox (and add-ons)","default":true,"enabled":true,"file":"firefox.exe"},{"enabled":true,"file":"opera.exe","type":"FamilyWebBrowser","application":"Opera (and plug-ins)","default":true},{"enabled":true,"file":"palemoon.exe","type":"FamilyWebBrowser","application":"Palemoon","default":true},{"application":"QuickTime Player","default":true,"enabled":true,"file":"quicktimeplayer.exe","type":"FamilyMultimedia"},{"enabled":true,"file":"seamonkey.exe","type":"FamilyWebBrowser","application":"Seamonkey","default":true},{"enabled":true,"file":"tor.exe","type":"FamilyWebBrowser","application":"Tor Browser","default":true},{"enabled":true,"file":"vlc.exe","type":"FamilyMultimedia","application":"VLC Player","default":true},{"type":"FamilyWebBrowser","application":"Waterfox","default":true,"enabled":true,"file":"waterfox.exe"},{"application":"Winamp Player","default":true,"enabled":true,"file":"winamp.exe","type":"FamilyMultimedia"},{"type":"FamilyMultimedia","application":"Windows Media Player (mplayer2)","default":true,"enabled":true,"file":"mplayer2.exe"},{"default":true,"enabled":true,"file":"wmplayer.exe","type":"FamilyMultimedia","application":"Windows Media Player (wmplayer)"}]},"malware":{"enabled":true},"web":{"enabled":true},"display_rtp_notifications":true,"delay_seconds":"30"},"protection_update_enabled":true,"auto_service_updates":true,"self_protection":true,"default_scan_settings":{"no_reboot":false,"no_archive":false,"reboot_message":"In order to completely quarantine the detected threat(s), your computer must be restarted.","enable_shuriken":true,"ark":true,"scan_priority":"low","reboot_delay_rrule":"FREQ=HOURLY;INTERVAL=2;COUNT=1","pup_detection":"Detect","allow_postpone_reboot":true,"reboot_delay":60,"pum_detection":"Detect"},"install_settings":{"start_menu":true,"program_folder":null,"desktop_shortcut":true},"protection_update_schedule":"FREQ=HOURLY;INTERVAL=2","monitoring_options":{"enabled":false}},"product_name":"Endpoint Protection"},{"policy":{"policy_version":1,"rtp_settings":{"app_block":{"enabled":true},"malware":{"enabled":true}},"default_scan_settings":{"reboot_delay_rrule":"FREQ=HOURLY;INTERVAL=2;COUNT=1","no_reboot":false,"pup_detection":"Detect","allow_postpone_reboot":true,"reboot_message":"In order to completely quarantine the detected threat(s),your computer must be restarted."}},"product_name":"Mac Endpoint Protection","schema_version":"1.0","enabled":true,"sirius_os_packages":[{"sirius_package_name":"epa.mac.plugin.epp","operating_system":"mac"}]},{"policy":{"policy_version":1,"default_scan_settings":{"include_nics":true,"include_drives":false,"include_memory":false,"include_installs":true,"include_startups":true}},"enabled":true,"product_name":"Chrome OS Asset Manager","schema_version":"1.0","sirius_os_packages":[{"operating_system":"chromeos","sirius_package_name":"epa.chromeos.plugin.assetmanager"}]},{"policy":{"policy_version":1,"default_scan_settings":{"include_nics":true,"include_drives":true,"include_memory":true,"include_installs":false,"include_startups":false}},"enabled":true,"product_name":"Linux Asset Manager","schema_version":"1.0","sirius_os_packages":[{"operating_system":"linux","sirius_package_name":"epa.linux.plugin.assetmanager"}]},{"policy":{"action":"BLOCK","policy_version":1,"minutes_to_block":5,"protected_protocols":[{"name":"FTP","ports":[21],"enabled":false},{"name":"RDP","ports":[],"enabled":false}],"allowed_failed_attempts":5,"exclude_private_networks":false,"minutes_between_failed_attempts":5},"enabled":false,"product_name":"Windows Remote Intrusion Detection and Prevention","schema_version":"1.0","sirius_os_packages":[{"min_os_version":"6.1","operating_system":"windows","sirius_package_name":"epa.win.plugin.bfp"}]},{"policy":{"rtp_settings":{"malware":{"enabled":true}},"policy_version":1},"enabled":true,"product_name":"Linux Endpoint Protection","schema_version":"1.0","sirius_os_packages":[{"operating_system":"linux","sirius_package_name":"epa.linux.plugin.epp"}]},{"policy":{"rtp_settings":{"web":{"enabled":true},"malware":{"enabled":true},"ransomware":{"enabled":true}},"policy_version":1,"default_scan_settings":{"scan_after_reboot":false,"scan_after_update":true},"protection_update_schedule":"FREQ=HOURLY;INTERVAL=1"},"enabled":true,"product_name":"Chrome OS Endpoint Protection","schema_version":"1.0","sirius_os_packages":[{"operating_system":"chromeos","sirius_package_name":"epa.chromeos.plugin.epp"}]}],"properties":{"policy":{"type":"object","additionalProperties":true,"title":"Policy for a product, see examples of Policies for different products.","properties":{"protected_protocols":{"type":"array","additionalProperties":true,"title":"Protected Protocols","examples":[{"name":"RDP","ports":[3389],"enabled":true}],"items":{"type":"object","additionalProperties":true,"title":"Items of protected protocols.","properties":{"name":{"type":"string","title":"Protocol Name","examples":["RDP","FTP","IMAP","MSSQL","POP3","SMTP","SSH"],"enum":["RDP","FTP","IMAP","MSSQL","POP3","SMTP","SSH"]},"ports":{"type":"array","title":"Protected Protocol Ports","description":"1-65535","examples":[[3389,1433,21]],"items":{"type":"integer","minimum":1,"maximum":65535}},"enabled":{"title":"Enable Protected Protocol","type":"boolean","default":false,"examples":[true,false]}}}}}},"product_name":{"type":"string","title":"Name of the product","examples":["Asset Manager"]},"schema_version":{"type":"string","title":"Version of the schema","examples":["1.0"]},"sirius_os_packages":{"type":"array","title":"Defines the package and OS for updates.","items":{"type":"object","additionalProperties":true,"title":"Items of OS packages.","examples":[{"operating_system":"windows","sirius_package_name":"epa.win.plugin.assetmanager"}],"properties":{"operating_system":{"type":"string","title":"Specify operating system","examples":["windows"]},"sirius_package_name":{"type":"string","title":"Package name","examples":["epa.win.plugin.assetmanager"]}}}}}}},"schema_version":{"type":"string","title":"Version of the Policy schema","examples":["1.0"]}}},"name":{"type":"string","title":"The name for this policy"},"etag":{"type":"string","title":"Etag of this policy","description":"etags are identifiers that change on every update. Their use is to prevent race conditions when multiple clients are modifying the same resource. Supply this tag empty when creating a policy. When updating, you need to fetch the latest value by GETting a policy. You should always get the current etag before trying to modify a resource that has an etag property."},"quarantine_retention_duration":{"type":["integer","null"],"minimum":0,"title":"Quarantine retention duration","description":"Number of days to retain quarantined items. 0 means no retention."}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Policy","properties":{"id":{"type":"string","title":"Id","examples":["3606af9f-f539-426c-be76-6f9bc18531e2"]},"account_id":{"type":"string","title":"Account id","examples":["1b8d7513-3336-45fe-8d6f-db43bc9c9613"]},"etag":{"type":"string","title":"Etag","description":"etags are identifiers that change on every update. Their use is to prevent race conditions when multiple clients are modifying the same resource. Supply this tag empty when creating a policy. When updating, you need to fetch the latest value by GETting a policy. You should always get the current etag before trying to modify a resource that has an etag property.","examples":["4d3ae3923cca7cf30bd712f4d8188bb9"]},"name":{"type":"string","title":"Name","examples":["Default Policy"]},"expire_endpoints":{"type":["number","null"],"title":"Expire endpoints","examples":[230]},"contents":{"type":"object","title":"Policy Contents"},"created_at":{"type":"string","title":"Policy created at","examples":["2020-02-13T17:09:20.741145Z"]},"updated_at":{"type":"string","title":"Policy updated at","examples":["2020-02-13T17:09:22.532969Z"]},"migrated_at":{"type":"string","title":"Policy migrated at","examples":["2020-02-13T17:09:22.532969Z"]},"is_default":{"type":"boolean","title":"Is default"},"deny_edit":{"type":"boolean","title":"Deny edit"},"groups":{"type":"array","title":"Groups","items":{"type":"object","title":"Group","additionalProperties":true,"properties":{"id":{"type":"string","title":"The Id of the group"},"account_id":{"type":"string","title":"The account id to which this group belong"},"name":{"type":"string","title":"The neame of the group"},"machines_count":{"type":"integer","title":"Count of machines"},"policy_id":{"type":"string","title":"Policy id associated to the group"},"policy_name":{"type":"string","title":"Policy name"},"updated_at":{"type":"string","title":"Updated at","examples":["2017-04-06T20:26:07.345213Z"]},"is_default":{"type":"boolean","title":"Default"},"schedule_ids":{"type":"array","title":"Array of schedule ids","items":{"type":"string","title":"Schedule Id"}},"parent_id":{"type":"string","title":"Parent id"},"root_id":{"type":"string","title":"Root id"},"ou_object_id":{"type":["string","null"],"title":"Ou object id"},"child_group_count":{"type":"integer","title":"Child group count"}}}},"exclusions":{"type":"array","title":"Exclusions","items":{"title":"Exclusion from server","type":"object","additionalProperties":true,"properties":{"id":{"type":"string","title":"UUID of the exclusion (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"etag":{"type":"string","title":"Etag","description":"etags are identifiers that change on every update. Their use is to prevent race conditions when multiple clients are modifying the same resource. Supply this tag empty when creating a exclusion. When updating, you need to fetch the latest value by GETting an exclusion. You should always get the current etag before trying to modify a resource that has an etag property.","examples":["c87998228b2f7511bb1616f686d06bae"]},"type":{"type":"integer","title":"1: Exclusion for file path, 2: Exclusion for folder path, 3: Exclusion for wildcard path, 4: Exclusion for registry, 5: Exclusion for file extensions, 6: Exclusion for web domain, 7: Exclusion for web IP, 8: Exclusion for Web Monitoring, 13: Exclusion for hash, 14: Exclusion for command line","examples":[1,2,3,4,5,6,7,13,14,17]},"value":{"type":"string","title":"String value","examples":["%PROGRAMDATA%"]},"enabled":{"type":"boolean","title":"Enable"},"comment":{"type":"string","title":"Comment"},"created_at":{"type":"string","title":"Created at"},"updated_at":{"type":"string","title":"Updated at"},"created_by":{"type":"string","title":"Created by"},"updated_by":{"type":"string","title":"Updated by"},"exclude_from":{"type":"object","title":"Exclusion applied to","properties":{"exploit_protection":{"type":["boolean","null"],"title":"Uses multiple protection layers to guard against attempted exploits of vulnerabilities in legitimate applications"},"malware_protection":{"type":["boolean","null"],"title":"Protects against malware infections and zero-day threats"},"ransomware_protection":{"type":["boolean","null"],"title":"Detects and blocks ransomware threats using advanced behavior analysis"},"suspicious_activity":{"type":["boolean","null"],"title":"Uses advanced machine learning to identify suspicious processes that require additional review"},"website_protection":{"type":["boolean","null"],"title":"Blocks network traffic from malicious websites and IP addresses"},"bruteforce_protection":{"type":["boolean","null"],"title":"Bruteforce attack protection on RDP, IMAP and so on."}}},"friendly_name":{"type":"string","title":"Friendly name","examples":["File by MD5 hash"]},"account_level":{"type":"boolean","title":"Account level"},"policies":{"type":"array","title":"Policies","items":{"type":"object","title":"Policy","properties":{"id":{"type":"string","title":"ID of policy (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","additionalProperties":true,"pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["20da4613-5fa5-4460-9016-963d2c4f6753"]},"name":{"type":"string","title":"Name of policy"}}}}}}},"secret_hash":{"type":"string","title":"Secret hash of the policy"},"secret_allow_site_override":{"type":"boolean","title":"Allow secret override"},"quarantine_retention_duration":{"type":["integer","null"],"minimum":0,"title":"Quarantine retention duration","description":"Number of days to retain quarantined items. 0 means no retention."}}}}}}},"tags":["PoliciesV2"],"operationId":"api.rmm.put.policy"}},"/oneview/v2/accounts/{account_id}/policies/{id}/isolation_image":{"delete":{"description":"Delete policy isolation image.","summary":"Delete policy isolation image","security":[{"client_credentials":["read","write"]},{"user_permissions":["policies.edit"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":true,"in":"path","description":"ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"Successful response"}},"tags":["PoliciesV2"],"operationId":"api.rmm.delete.policy.isolation_image.id"},"get":{"description":"Get policy isolation image by id.","summary":"Get policy isolation image by id","security":[{"client_credentials":["read"]},{"user_permissions":["policies.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":true,"in":"path","description":"ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Response of isolation image request","properties":{"url":{"type":"string","title":"Url of the isolation image attached to the policy"}}}}}}},"tags":["PoliciesV2"],"operationId":"api.rmm.get.policy.isolation_image.id"},"post":{"description":"This route allows you to add an icon to display on the custom message screen.\n\nOther routes in this API accept `Content-Type: application/json`.\n\nThis route is meant for file uploads and expects the request following `Content-Type: multipart/form-data` structure.\n\nTechnically it is _form upload_ and the field for linking a file is called `metadata`.\n\nFile Requirements:\n\nFILE TYPE: BMP\nOPTIMAL FILE SIZE: 150PX BY 150PX\nFILE SIZE: 2MB (maximum)\n\nExample usage:\n\ncurl --location --request POST 'https://cloud.malwarebytes.com/api/v2/rmm/accounts//policies//isolation_image' \\\n--header 'Authorization: Bearer ' \\\n--header 'Content-Type: multipart/form-data;' \\\n--form 'metadata=@'\n","summary":"Add isolation image","security":[{"client_credentials":["read","write"]},{"user_permissions":["policies.edit"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":true,"in":"path","description":"ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Policy","properties":{"id":{"type":"string","title":"Id","examples":["3606af9f-f539-426c-be76-6f9bc18531e2"]},"account_id":{"type":"string","title":"Account id","examples":["1b8d7513-3336-45fe-8d6f-db43bc9c9613"]},"etag":{"type":"string","title":"Etag","description":"etags are identifiers that change on every update. Their use is to prevent race conditions when multiple clients are modifying the same resource. Supply this tag empty when creating a policy. When updating, you need to fetch the latest value by GETting a policy. You should always get the current etag before trying to modify a resource that has an etag property.","examples":["4d3ae3923cca7cf30bd712f4d8188bb9"]},"name":{"type":"string","title":"Name","examples":["Default Policy"]},"expire_endpoints":{"type":["number","null"],"title":"Expire endpoints","examples":[230]},"contents":{"type":"object","title":"Policy Contents"},"created_at":{"type":"string","title":"Policy created at","examples":["2020-02-13T17:09:20.741145Z"]},"updated_at":{"type":"string","title":"Policy updated at","examples":["2020-02-13T17:09:22.532969Z"]},"migrated_at":{"type":"string","title":"Policy migrated at","examples":["2020-02-13T17:09:22.532969Z"]},"is_default":{"type":"boolean","title":"Is default"},"deny_edit":{"type":"boolean","title":"Deny edit"},"groups":{"type":"array","title":"Groups","items":{"type":"object","title":"Group","additionalProperties":true,"properties":{"id":{"type":"string","title":"The Id of the group"},"account_id":{"type":"string","title":"The account id to which this group belong"},"name":{"type":"string","title":"The neame of the group"},"machines_count":{"type":"integer","title":"Count of machines"},"policy_id":{"type":"string","title":"Policy id associated to the group"},"policy_name":{"type":"string","title":"Policy name"},"updated_at":{"type":"string","title":"Updated at","examples":["2017-04-06T20:26:07.345213Z"]},"is_default":{"type":"boolean","title":"Default"},"schedule_ids":{"type":"array","title":"Array of schedule ids","items":{"type":"string","title":"Schedule Id"}},"parent_id":{"type":"string","title":"Parent id"},"root_id":{"type":"string","title":"Root id"},"ou_object_id":{"type":["string","null"],"title":"Ou object id"},"child_group_count":{"type":"integer","title":"Child group count"}}}},"exclusions":{"type":"array","title":"Exclusions","items":{"title":"Exclusion from server","type":"object","additionalProperties":true,"properties":{"id":{"type":"string","title":"UUID of the exclusion (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"etag":{"type":"string","title":"Etag","description":"etags are identifiers that change on every update. Their use is to prevent race conditions when multiple clients are modifying the same resource. Supply this tag empty when creating a exclusion. When updating, you need to fetch the latest value by GETting an exclusion. You should always get the current etag before trying to modify a resource that has an etag property.","examples":["c87998228b2f7511bb1616f686d06bae"]},"type":{"type":"integer","title":"1: Exclusion for file path, 2: Exclusion for folder path, 3: Exclusion for wildcard path, 4: Exclusion for registry, 5: Exclusion for file extensions, 6: Exclusion for web domain, 7: Exclusion for web IP, 8: Exclusion for Web Monitoring, 13: Exclusion for hash, 14: Exclusion for command line","examples":[1,2,3,4,5,6,7,13,14,17]},"value":{"type":"string","title":"String value","examples":["%PROGRAMDATA%"]},"enabled":{"type":"boolean","title":"Enable"},"comment":{"type":"string","title":"Comment"},"created_at":{"type":"string","title":"Created at"},"updated_at":{"type":"string","title":"Updated at"},"created_by":{"type":"string","title":"Created by"},"updated_by":{"type":"string","title":"Updated by"},"exclude_from":{"type":"object","title":"Exclusion applied to","properties":{"exploit_protection":{"type":["boolean","null"],"title":"Uses multiple protection layers to guard against attempted exploits of vulnerabilities in legitimate applications"},"malware_protection":{"type":["boolean","null"],"title":"Protects against malware infections and zero-day threats"},"ransomware_protection":{"type":["boolean","null"],"title":"Detects and blocks ransomware threats using advanced behavior analysis"},"suspicious_activity":{"type":["boolean","null"],"title":"Uses advanced machine learning to identify suspicious processes that require additional review"},"website_protection":{"type":["boolean","null"],"title":"Blocks network traffic from malicious websites and IP addresses"},"bruteforce_protection":{"type":["boolean","null"],"title":"Bruteforce attack protection on RDP, IMAP and so on."}}},"friendly_name":{"type":"string","title":"Friendly name","examples":["File by MD5 hash"]},"account_level":{"type":"boolean","title":"Account level"},"policies":{"type":"array","title":"Policies","items":{"type":"object","title":"Policy","properties":{"id":{"type":"string","title":"ID of policy (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","additionalProperties":true,"pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["20da4613-5fa5-4460-9016-963d2c4f6753"]},"name":{"type":"string","title":"Name of policy"}}}}}}},"secret_hash":{"type":"string","title":"Secret hash of the policy"},"secret_allow_site_override":{"type":"boolean","title":"Allow secret override"},"quarantine_retention_duration":{"type":["integer","null"],"minimum":0,"title":"Quarantine retention duration","description":"Number of days to retain quarantined items. 0 means no retention."}}}}}}},"tags":["PoliciesV2"],"operationId":"api.rmm.post.policy.isolation_image.id"}},"/oneview/v2/accounts/{account_id}/policies/{id}/expire-endpoints":{"delete":{"description":"Configure policy not to expire when inactive","summary":"Prevent expire endpoint","security":[{"client_credentials":["read","write"]},{"user_permissions":["policies.edit"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":true,"in":"path","description":"ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"Successful response"}},"tags":["PoliciesV2"],"operationId":"api.rmm.delete.policy.expire"},"put":{"description":"Set property to expire endpoints on a policy","summary":"Set expire endpoint","security":[{"client_credentials":["read","write"]},{"user_permissions":["policies.edit"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":true,"in":"path","description":"ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"The Put Policy Request","required":["expire_duration"],"properties":{"expire_duration":{"type":"number","title":"Number of days after which to expire endpoints and remove from the console","minimum":1,"maximum":365}}}}}},"responses":{"200":{"description":"Successful response"}},"tags":["PoliciesV2"],"operationId":"api.rmm.put.policy.expire"}},"/oneview/v2/accounts/{account_id}/policies":{"get":{"description":"Get all policies.","summary":"Get all policies","security":[{"client_credentials":["read"]},{"user_permissions":["policies.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Response of policies","required":["policies","total_count"],"properties":{"policies":{"type":"array","title":"Collection of policies","items":{"type":"object","additionalProperties":true,"title":"Policy","properties":{"id":{"type":"string","title":"Id","examples":["3606af9f-f539-426c-be76-6f9bc18531e2"]},"account_id":{"type":"string","title":"Account id","examples":["1b8d7513-3336-45fe-8d6f-db43bc9c9613"]},"etag":{"type":"string","title":"Etag","description":"etags are identifiers that change on every update. Their use is to prevent race conditions when multiple clients are modifying the same resource. Supply this tag empty when creating a policy. When updating, you need to fetch the latest value by GETting a policy. You should always get the current etag before trying to modify a resource that has an etag property.","examples":["4d3ae3923cca7cf30bd712f4d8188bb9"]},"name":{"type":"string","title":"Name","examples":["Default Policy"]},"expire_endpoints":{"type":["number","null"],"title":"Expire endpoints","examples":[230]},"contents":{"type":"object","title":"Policy Contents"},"created_at":{"type":"string","title":"Policy created at","examples":["2020-02-13T17:09:20.741145Z"]},"updated_at":{"type":"string","title":"Policy updated at","examples":["2020-02-13T17:09:22.532969Z"]},"migrated_at":{"type":"string","title":"Policy migrated at","examples":["2020-02-13T17:09:22.532969Z"]},"is_default":{"type":"boolean","title":"Is default"},"deny_edit":{"type":"boolean","title":"Deny edit"},"groups":{"type":"array","title":"Groups","items":{"type":"object","title":"Group","additionalProperties":true,"properties":{"id":{"type":"string","title":"The Id of the group"},"account_id":{"type":"string","title":"The account id to which this group belong"},"name":{"type":"string","title":"The neame of the group"},"machines_count":{"type":"integer","title":"Count of machines"},"policy_id":{"type":"string","title":"Policy id associated to the group"},"policy_name":{"type":"string","title":"Policy name"},"updated_at":{"type":"string","title":"Updated at","examples":["2017-04-06T20:26:07.345213Z"]},"is_default":{"type":"boolean","title":"Default"},"schedule_ids":{"type":"array","title":"Array of schedule ids","items":{"type":"string","title":"Schedule Id"}},"parent_id":{"type":"string","title":"Parent id"},"root_id":{"type":"string","title":"Root id"},"ou_object_id":{"type":["string","null"],"title":"Ou object id"},"child_group_count":{"type":"integer","title":"Child group count"}}}},"exclusions":{"type":"array","title":"Exclusions","items":{"title":"Exclusion from server","type":"object","additionalProperties":true,"properties":{"id":{"type":"string","title":"UUID of the exclusion (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"etag":{"type":"string","title":"Etag","description":"etags are identifiers that change on every update. Their use is to prevent race conditions when multiple clients are modifying the same resource. Supply this tag empty when creating a exclusion. When updating, you need to fetch the latest value by GETting an exclusion. You should always get the current etag before trying to modify a resource that has an etag property.","examples":["c87998228b2f7511bb1616f686d06bae"]},"type":{"type":"integer","title":"1: Exclusion for file path, 2: Exclusion for folder path, 3: Exclusion for wildcard path, 4: Exclusion for registry, 5: Exclusion for file extensions, 6: Exclusion for web domain, 7: Exclusion for web IP, 8: Exclusion for Web Monitoring, 13: Exclusion for hash, 14: Exclusion for command line","examples":[1,2,3,4,5,6,7,13,14,17]},"value":{"type":"string","title":"String value","examples":["%PROGRAMDATA%"]},"enabled":{"type":"boolean","title":"Enable"},"comment":{"type":"string","title":"Comment"},"created_at":{"type":"string","title":"Created at"},"updated_at":{"type":"string","title":"Updated at"},"created_by":{"type":"string","title":"Created by"},"updated_by":{"type":"string","title":"Updated by"},"exclude_from":{"type":"object","title":"Exclusion applied to","properties":{"exploit_protection":{"type":["boolean","null"],"title":"Uses multiple protection layers to guard against attempted exploits of vulnerabilities in legitimate applications"},"malware_protection":{"type":["boolean","null"],"title":"Protects against malware infections and zero-day threats"},"ransomware_protection":{"type":["boolean","null"],"title":"Detects and blocks ransomware threats using advanced behavior analysis"},"suspicious_activity":{"type":["boolean","null"],"title":"Uses advanced machine learning to identify suspicious processes that require additional review"},"website_protection":{"type":["boolean","null"],"title":"Blocks network traffic from malicious websites and IP addresses"},"bruteforce_protection":{"type":["boolean","null"],"title":"Bruteforce attack protection on RDP, IMAP and so on."}}},"friendly_name":{"type":"string","title":"Friendly name","examples":["File by MD5 hash"]},"account_level":{"type":"boolean","title":"Account level"},"policies":{"type":"array","title":"Policies","items":{"type":"object","title":"Policy","properties":{"id":{"type":"string","title":"ID of policy (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","additionalProperties":true,"pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["20da4613-5fa5-4460-9016-963d2c4f6753"]},"name":{"type":"string","title":"Name of policy"}}}}}}},"secret_hash":{"type":"string","title":"Secret hash of the policy"},"secret_allow_site_override":{"type":"boolean","title":"Allow secret override"},"quarantine_retention_duration":{"type":["integer","null"],"minimum":0,"title":"Quarantine retention duration","description":"Number of days to retain quarantined items. 0 means no retention."}}}},"total_count":{"type":"integer","title":"Count of policies"}}}}}}},"tags":["PoliciesV2"],"operationId":"api.get.get.policy"},"post":{"description":"Create policy.","summary":"Create policy","security":[{"client_credentials":["read"]},{"user_permissions":["policies.create"]}],"status":{"outage":["auth"]},"parameters":[{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Create policy","required":["name","contents"],"additionalProperties":true,"properties":{"name":{"type":"string","title":"Name for this policy"},"contents":{"type":"object","additionalProperties":true,"title":"Policy contents","properties":{"policy":{"type":"object","additionalProperties":true,"title":"Policy","examples":[{"startup_options":{"timeout":"60000","toggle_on":true},"sirius_update_schedule":"FREQ=DAILY","updates":{"pause_until":"2020-04-10T14:55:00+03:00"},"endpoint_interface_options":{"allow_run_threat_scan":true,"show_threat_scan_shortcuts":true,"limit_endpoint_agent_control":true,"show_tray_icon":"true","show_windows_contextmenu":true,"display_rtp_events":true},"endpoint_tamper_protection":{"uninstall_password":"$2a$10$EPD4LGvmr7zGoh7wXb9iUe.l5bikO/UzeayibCu1q/tFNT22ePQOK"},"protect_service":true}],"properties":{"updates":{"type":"object","additionalProperties":true,"title":"Software Updates","examples":[{"pause_until":"2020-04-10T14:55:00+03:00"}],"properties":{"pause_until":{"type":["string","null"],"title":"While paused, prevents ThreatDown software from updating (Windows Only)","examples":["2020-04-10T14:55:00+03:00"]}}},"protect_service":{"type":"boolean","title":"Prevents ThreatDown services and processes from being stopped (Windows 10 only)","examples":[true]},"startup_options":{"type":"object","additionalProperties":true,"title":"Allow services additional time to start","examples":[{"timeout":"60000","toggle_on":true}],"properties":{"timeout":{"type":["integer","string"],"title":"Adjust the timeout period for all services, milliseconds. Max 10min.","examples":[60000]},"toggle_on":{"type":"boolean","title":"Provide all services with additional time to initiate","examples":[false]}}},"sirius_update_schedule":{"type":"string","title":"How often agent should be updated","examples":["FREQ=DAILY"]},"endpoint_interface_options":{"type":"object","additionalProperties":true,"title":"Endpoint interface options","examples":[{"show_windows_contextmenu":true,"display_rtp_events":true,"allow_run_threat_scan":true,"show_threat_scan_shortcuts":true,"limit_endpoint_agent_control":true,"show_tray_icon":"true"}],"properties":{"show_tray_icon":{"type":["string","boolean"],"title":"Show Malwarebytes icon in notification area","examples":["true"]},"display_rtp_events":{"type":"boolean","title":"Display real-time protection notifications","examples":[true]},"allow_run_threat_scan":{"type":"boolean","title":"Allow users to run a Threat Scan (all threats will be quarantined automatically)","examples":[true]},"show_windows_contextmenu":{"type":"boolean","title":"Show ThreatDown option in context menus (Windows only)","examples":[true]},"show_threat_scan_shortcuts":{"type":"boolean","title":"Show ThreatDown shortcuts on Start menu and desktop to run Threat Scans (Windows only)","examples":[true]},"limit_endpoint_agent_control":{"type":"boolean","title":"The Limit_endpoint_agent_control Schema","description":"Allow only Administrator level users to interact with the ThreatDown Tray (Windows only, not supported in XP or Server 2003)","examples":[true]}}},"endpoint_tamper_protection":{"type":["object","null"],"additionalProperties":true,"title":"Tamper protection","examples":[{"uninstall_password":"$2a$10$EPD4LGvmr7zGoh7wXb9iUe.l5bikO/UzeayibCu1q/tFNT22ePQOK"}],"properties":{"uninstall_password":{"type":"string","title":"Encrypted password","examples":[""]}}}}},"status":{"type":"string","title":"Status of the Policy","examples":["ok"]},"packages":{"type":"array","title":"Collection of packages","default":[],"items":{"type":"object","additionalProperties":true,"title":"Packages contain Policies for different products","examples":[{"sirius_os_packages":[{"operating_system":"windows","sirius_package_name":"epa.win.plugin.assetmanager"}],"policy":{"policy_version":1,"default_scan_settings":{"include_nics":true,"include_installs":true,"include_processes":false,"include_memory":true,"include_modules":false,"include_updates":true,"include_drives":true,"include_startups":true}},"product_name":"Asset Manager","schema_version":"1.0"},{"enabled":true,"sirius_os_packages":[{"sirius_package_name":"epa.win.plugin.edr","operating_system":"windows"}],"policy":{"isolation":{"enabled":true,"title_image_path":"https://nebula-retina-mb-qa.eng-dev.mb-internal.com/api/v1/machine/isolation_image/20200310_105756.bmp?amazonaws=1","text":"Your system has been locked by the IT Department. Please contact the Helpdesk for further information.","title":"Malware or suspicious application behavior has been detected on this computer."},"log_file_retention_rules":{"max_num_roll_backups":5,"max_file_size":"125MB"},"flight_recorder":{"learning_duration":20,"very_aggressive":true,"enabled_server":true,"rollback":{"window":48,"enabled":true,"file_size":"20MB","backup_quota":30,"file_size_server":"100MB","backup_folder_server":"C:\\ProgramData\\Malwarebytes Endpoint Agent\\Plugins\\EDRPlugin\\Backup\\"},"enabled":true,"eagle_url":""},"policy_version":1},"product_name":"Endpoint Detection and Response","schema_version":"1.0"},{"sirius_os_packages":[{"operating_system":"mac","sirius_package_name":"epa.mac.plugin.assetmanager"}],"policy":{"policy_version":1,"default_scan_settings":{"include_startups":true,"include_nics":true,"include_installs":true,"include_processes":false,"include_memory":true,"include_modules":false,"include_updates":true,"include_drives":true}},"product_name":"Mac Asset Manager","schema_version":"1.0"},{"policy":{"isolation":{"enabled":false},"policy_version":1,"flight_recorder":{"enabled":false,"eagle_url":"","enabled_server":false,"learning_duration":20,"network_collection_enabled":false},"log_file_retention_rules":{"max_file_size":"125MB","max_file_size_server":"1024MB","max_num_roll_backups":5}},"enabled":false,"product_name":"Mac Endpoint Detection and Response","schema_version":"1.0","sirius_os_packages":[{"operating_system":"mac","sirius_package_name":"epa.mac.plugin.edr"}]},{"enabled":true,"policy_version":1,"schema_version":"1.0","sirius_os_packages":[{"operating_system":"windows","sirius_package_name":"epa.win.plugin.mbam"}],"policy":{"self_protect_early_start":true,"usage_stat":true,"application_updates":true,"windows_context_menus":false,"protection_aging":"180","win_ac":"default","rtp_settings":{"ransomware":{"enabled":true},"delay_rtp":true,"exploit":{"enabled":true,"options":{"amp_sp_other":true,"java_wmcl":true,"java_aijoip":true,"amp_crg32_media":true,"abp_pmbp_media":true,"amp_mrad_pdf":true,"amp_mrad_browser":true,"amp_sp_pdf":true,"ah_bua_ms":true,"amp_mph_chrome":true,"ah_bua_pdf":true,"ah_ahs_chrome":true,"java_misp":true,"ah_daef_browser":true,"ah_dep_chrome":true,"amp_depb_ms":true,"amp_rrg64_browser":true,"amp_crg32_other":true,"amp_rrg32_media":true,"amp_crg64_media":true,"abp_pmbp_other":true,"abp_mll_media":true,"amp_mph_pdf":true,"amp_mrad_media":true,"amp_rrg32_ms":true,"ah_bua_browser":true,"amp_rrg32_browser":true,"java_mosp":true,"amp_mph_media":true,"ah_dahs_browser":true,"amp_rrg32_other":true,"abp_pmbp_pdf":true,"amp_crg64_other":true,"abp_mll_other":true,"abp_pmbp_browser":true,"amp_rrg64_media":true,"amp_mrad_other":true,"amp_crg32_pdf":true,"amp_depb_media":true,"amp_rrg64_chrome":true,"amp_crg64_pdf":true,"abp_mll_pdf":true,"ah_bua_chrome":true,"amp_depb_pdf":true,"java_mmgp":true,"amp_rrg32_chrome":true,"ah_dep_ms":true,"abp_powmi_ms":true,"amp_depb_chrome":true,"amp_mph_other":false,"abp_mll_chrome":true,"amp_crg64_chrome":true,"amp_mph_ms":true,"abp_povba_ms":true,"amp_sp_chrome":true,"abp_piev_browser":true,"ah_ahs_media":true,"amp_crg32_chrome":true,"ah_dep_media":true,"ah_ahs_pdf":false,"amp_crg64_ms":true,"abp_mll_ms":true,"amp_rrg64_other":true,"amp_depb_browser":true,"amp_depb_other":true,"amp_mrad_chrome":true,"ah_bua_media":false,"amp_mph_browser":true,"abp_pmbp_chrome":true,"java_mmcep":true,"abp_mll_browser":true,"amp_crg64_browser":true,"amp_sp_ms":true,"ah_ahs_browser":true,"ah_ahs_other":true,"ah_dep_other":true,"amp_sp_browser":true,"ah_bua_other":true,"amp_rrg32_pdf":true,"ah_ahs_ms":true,"amp_rrg64_pdf":true,"amp_crg32_browser":true,"ah_diev_browser":true,"amp_sp_media":true,"amp_rrg64_ms":true,"ah_dep_pdf":true,"ah_dep_browser":true,"amp_mrad_ms":true,"abp_pmbp_ms":true,"amp_crg32_ms":true},"protected":[{"application":"Adobe Acrobat","default":true,"enabled":true,"file":"acrobat.exe","type":"FamilyPdfReader"},{"application":"Adobe Reader","default":true,"enabled":true,"file":"acrord32.exe","type":"FamilyPdfReader"},{"application":"Comodo Dragon","default":true,"enabled":true,"file":"dragon.exe","type":"FamilyWebBrowser"},{"type":"FamilyWebBrowser","application":"Cyberfox","default":true,"enabled":true,"file":"cyberfox.exe"},{"default":true,"enabled":true,"file":"Foxit PhantomPDF.exe","type":"FamilyPdfReader","application":"Foxit Phantom"},{"type":"FamilyPdfReader","application":"Foxit Phantom","default":true,"enabled":true,"file":"FoxitPhantomPDF.exe"},{"application":"Foxit Reader","default":true,"enabled":true,"file":"foxit reader.exe","type":"FamilyPdfReader"},{"default":true,"enabled":true,"file":"icedragon.exe","type":"FamilyWebBrowser","application":"IceDragon"},{"enabled":true,"file":"iexplore.exe","type":"FamilyWebBrowser","application":"Internet Explorer (and add-ons)","default":true},{"enabled":true,"file":"java.exe","type":"FamilyJava","application":"Java","default":true},{"default":true,"enabled":true,"file":"javaw.exe","type":"FamilyJava","application":"Java"},{"default":true,"enabled":true,"file":"javaws.exe","type":"FamilyJava","application":"Java"},{"application":"LibreOffice","default":true,"enabled":true,"file":"soffice.bin","type":"FamilyOffice"},{"application":"Maxthon","default":true,"enabled":true,"file":"maxthon.exe","type":"FamilyWebBrowser"},{"enabled":true,"file":"MicrosoftEdge.exe","type":"FamilyWebBrowser","application":"Microsoft Edge (and add-ons)","default":true},{"application":"Microsoft Office Excel","default":true,"enabled":true,"file":"excel.exe","type":"FamilyOffice"},{"default":true,"enabled":true,"file":"powerpnt.exe","type":"FamilyOffice","application":"Microsoft Office PowerPoint"},{"type":"FamilyOffice","application":"Microsoft Office Publisher","default":true,"enabled":true,"file":"mspub.exe"},{"type":"FamilyOffice","application":"Microsoft Office Word","default":true,"enabled":true,"file":"winword.exe"},{"type":"FamilyWebBrowser","application":"Mozilla Firefox (and add-ons)","default":true,"enabled":true,"file":"firefox.exe"},{"enabled":true,"file":"opera.exe","type":"FamilyWebBrowser","application":"Opera (and plug-ins)","default":true},{"enabled":true,"file":"palemoon.exe","type":"FamilyWebBrowser","application":"Palemoon","default":true},{"application":"QuickTime Player","default":true,"enabled":true,"file":"quicktimeplayer.exe","type":"FamilyMultimedia"},{"enabled":true,"file":"seamonkey.exe","type":"FamilyWebBrowser","application":"Seamonkey","default":true},{"enabled":true,"file":"tor.exe","type":"FamilyWebBrowser","application":"Tor Browser","default":true},{"enabled":true,"file":"vlc.exe","type":"FamilyMultimedia","application":"VLC Player","default":true},{"type":"FamilyWebBrowser","application":"Waterfox","default":true,"enabled":true,"file":"waterfox.exe"},{"application":"Winamp Player","default":true,"enabled":true,"file":"winamp.exe","type":"FamilyMultimedia"},{"type":"FamilyMultimedia","application":"Windows Media Player (mplayer2)","default":true,"enabled":true,"file":"mplayer2.exe"},{"default":true,"enabled":true,"file":"wmplayer.exe","type":"FamilyMultimedia","application":"Windows Media Player (wmplayer)"}]},"malware":{"enabled":true},"web":{"enabled":true},"display_rtp_notifications":true,"delay_seconds":"30"},"protection_update_enabled":true,"auto_service_updates":true,"self_protection":true,"default_scan_settings":{"no_reboot":false,"no_archive":false,"reboot_message":"In order to completely quarantine the detected threat(s), your computer must be restarted.","enable_shuriken":true,"ark":true,"scan_priority":"low","reboot_delay_rrule":"FREQ=HOURLY;INTERVAL=2;COUNT=1","pup_detection":"Detect","allow_postpone_reboot":true,"reboot_delay":60,"pum_detection":"Detect"},"install_settings":{"start_menu":true,"program_folder":null,"desktop_shortcut":true},"protection_update_schedule":"FREQ=HOURLY;INTERVAL=2","monitoring_options":{"enabled":false}},"product_name":"Endpoint Protection"},{"policy":{"policy_version":1,"rtp_settings":{"app_block":{"enabled":true},"malware":{"enabled":true}},"default_scan_settings":{"reboot_delay_rrule":"FREQ=HOURLY;INTERVAL=2;COUNT=1","no_reboot":false,"pup_detection":"Detect","allow_postpone_reboot":true,"reboot_message":"In order to completely quarantine the detected threat(s),your computer must be restarted."}},"product_name":"Mac Endpoint Protection","schema_version":"1.0","enabled":true,"sirius_os_packages":[{"sirius_package_name":"epa.mac.plugin.epp","operating_system":"mac"}]},{"policy":{"policy_version":1,"default_scan_settings":{"include_nics":true,"include_drives":false,"include_memory":false,"include_installs":true,"include_startups":true}},"enabled":true,"product_name":"Chrome OS Asset Manager","schema_version":"1.0","sirius_os_packages":[{"operating_system":"chromeos","sirius_package_name":"epa.chromeos.plugin.assetmanager"}]},{"policy":{"policy_version":1,"default_scan_settings":{"include_nics":true,"include_drives":true,"include_memory":true,"include_installs":false,"include_startups":false}},"enabled":true,"product_name":"Linux Asset Manager","schema_version":"1.0","sirius_os_packages":[{"operating_system":"linux","sirius_package_name":"epa.linux.plugin.assetmanager"}]},{"policy":{"action":"BLOCK","policy_version":1,"minutes_to_block":5,"protected_protocols":[{"name":"FTP","ports":[21],"enabled":false},{"name":"RDP","ports":[],"enabled":false}],"allowed_failed_attempts":5,"exclude_private_networks":false,"minutes_between_failed_attempts":5},"enabled":false,"product_name":"Windows Remote Intrusion Detection and Prevention","schema_version":"1.0","sirius_os_packages":[{"min_os_version":"6.1","operating_system":"windows","sirius_package_name":"epa.win.plugin.bfp"}]},{"policy":{"rtp_settings":{"malware":{"enabled":true}},"policy_version":1},"enabled":true,"product_name":"Linux Endpoint Protection","schema_version":"1.0","sirius_os_packages":[{"operating_system":"linux","sirius_package_name":"epa.linux.plugin.epp"}]},{"policy":{"rtp_settings":{"web":{"enabled":true},"malware":{"enabled":true},"ransomware":{"enabled":true}},"policy_version":1,"default_scan_settings":{"scan_after_reboot":false,"scan_after_update":true},"protection_update_schedule":"FREQ=HOURLY;INTERVAL=1"},"enabled":true,"product_name":"Chrome OS Endpoint Protection","schema_version":"1.0","sirius_os_packages":[{"operating_system":"chromeos","sirius_package_name":"epa.chromeos.plugin.epp"}]}],"properties":{"policy":{"type":"object","additionalProperties":true,"title":"Policy for a product, see examples of Policies for different products.","properties":{"protected_protocols":{"type":"array","additionalProperties":true,"title":"Protected Protocols","examples":[{"name":"RDP","ports":[3389],"enabled":true}],"items":{"type":"object","additionalProperties":true,"title":"Items of protected protocols.","properties":{"name":{"type":"string","title":"Protocol Name","examples":["RDP","FTP","IMAP","MSSQL","POP3","SMTP","SSH"],"enum":["RDP","FTP","IMAP","MSSQL","POP3","SMTP","SSH"]},"ports":{"type":"array","title":"Protected Protocol Ports","description":"1-65535","examples":[[3389,1433,21]],"items":{"type":"integer","minimum":1,"maximum":65535}},"enabled":{"title":"Enable Protected Protocol","type":"boolean","default":false,"examples":[true,false]}}}}}},"product_name":{"type":"string","title":"Name of the product","examples":["Asset Manager"]},"schema_version":{"type":"string","title":"Version of the schema","examples":["1.0"]},"sirius_os_packages":{"type":"array","title":"Defines the package and OS for updates.","items":{"type":"object","additionalProperties":true,"title":"Items of OS packages.","examples":[{"operating_system":"windows","sirius_package_name":"epa.win.plugin.assetmanager"}],"properties":{"operating_system":{"type":"string","title":"Specify operating system","examples":["windows"]},"sirius_package_name":{"type":"string","title":"Package name","examples":["epa.win.plugin.assetmanager"]}}}}}}},"schema_version":{"type":"string","title":"Version of the Policy schema","examples":["1.0"]}}},"quarantine_retention_duration":{"type":["integer","null"],"minimum":0,"title":"Quarantine retention duration","description":"Number of days to retain quarantined items. 0 means no retention."}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Policy","properties":{"id":{"type":"string","title":"Id","examples":["3606af9f-f539-426c-be76-6f9bc18531e2"]},"account_id":{"type":"string","title":"Account id","examples":["1b8d7513-3336-45fe-8d6f-db43bc9c9613"]},"etag":{"type":"string","title":"Etag","description":"etags are identifiers that change on every update. Their use is to prevent race conditions when multiple clients are modifying the same resource. Supply this tag empty when creating a policy. When updating, you need to fetch the latest value by GETting a policy. You should always get the current etag before trying to modify a resource that has an etag property.","examples":["4d3ae3923cca7cf30bd712f4d8188bb9"]},"name":{"type":"string","title":"Name","examples":["Default Policy"]},"expire_endpoints":{"type":["number","null"],"title":"Expire endpoints","examples":[230]},"contents":{"type":"object","title":"Policy Contents"},"created_at":{"type":"string","title":"Policy created at","examples":["2020-02-13T17:09:20.741145Z"]},"updated_at":{"type":"string","title":"Policy updated at","examples":["2020-02-13T17:09:22.532969Z"]},"migrated_at":{"type":"string","title":"Policy migrated at","examples":["2020-02-13T17:09:22.532969Z"]},"is_default":{"type":"boolean","title":"Is default"},"deny_edit":{"type":"boolean","title":"Deny edit"},"groups":{"type":"array","title":"Groups","items":{"type":"object","title":"Group","additionalProperties":true,"properties":{"id":{"type":"string","title":"The Id of the group"},"account_id":{"type":"string","title":"The account id to which this group belong"},"name":{"type":"string","title":"The neame of the group"},"machines_count":{"type":"integer","title":"Count of machines"},"policy_id":{"type":"string","title":"Policy id associated to the group"},"policy_name":{"type":"string","title":"Policy name"},"updated_at":{"type":"string","title":"Updated at","examples":["2017-04-06T20:26:07.345213Z"]},"is_default":{"type":"boolean","title":"Default"},"schedule_ids":{"type":"array","title":"Array of schedule ids","items":{"type":"string","title":"Schedule Id"}},"parent_id":{"type":"string","title":"Parent id"},"root_id":{"type":"string","title":"Root id"},"ou_object_id":{"type":["string","null"],"title":"Ou object id"},"child_group_count":{"type":"integer","title":"Child group count"}}}},"exclusions":{"type":"array","title":"Exclusions","items":{"title":"Exclusion from server","type":"object","additionalProperties":true,"properties":{"id":{"type":"string","title":"UUID of the exclusion (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"etag":{"type":"string","title":"Etag","description":"etags are identifiers that change on every update. Their use is to prevent race conditions when multiple clients are modifying the same resource. Supply this tag empty when creating a exclusion. When updating, you need to fetch the latest value by GETting an exclusion. You should always get the current etag before trying to modify a resource that has an etag property.","examples":["c87998228b2f7511bb1616f686d06bae"]},"type":{"type":"integer","title":"1: Exclusion for file path, 2: Exclusion for folder path, 3: Exclusion for wildcard path, 4: Exclusion for registry, 5: Exclusion for file extensions, 6: Exclusion for web domain, 7: Exclusion for web IP, 8: Exclusion for Web Monitoring, 13: Exclusion for hash, 14: Exclusion for command line","examples":[1,2,3,4,5,6,7,13,14,17]},"value":{"type":"string","title":"String value","examples":["%PROGRAMDATA%"]},"enabled":{"type":"boolean","title":"Enable"},"comment":{"type":"string","title":"Comment"},"created_at":{"type":"string","title":"Created at"},"updated_at":{"type":"string","title":"Updated at"},"created_by":{"type":"string","title":"Created by"},"updated_by":{"type":"string","title":"Updated by"},"exclude_from":{"type":"object","title":"Exclusion applied to","properties":{"exploit_protection":{"type":["boolean","null"],"title":"Uses multiple protection layers to guard against attempted exploits of vulnerabilities in legitimate applications"},"malware_protection":{"type":["boolean","null"],"title":"Protects against malware infections and zero-day threats"},"ransomware_protection":{"type":["boolean","null"],"title":"Detects and blocks ransomware threats using advanced behavior analysis"},"suspicious_activity":{"type":["boolean","null"],"title":"Uses advanced machine learning to identify suspicious processes that require additional review"},"website_protection":{"type":["boolean","null"],"title":"Blocks network traffic from malicious websites and IP addresses"},"bruteforce_protection":{"type":["boolean","null"],"title":"Bruteforce attack protection on RDP, IMAP and so on."}}},"friendly_name":{"type":"string","title":"Friendly name","examples":["File by MD5 hash"]},"account_level":{"type":"boolean","title":"Account level"},"policies":{"type":"array","title":"Policies","items":{"type":"object","title":"Policy","properties":{"id":{"type":"string","title":"ID of policy (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","additionalProperties":true,"pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["20da4613-5fa5-4460-9016-963d2c4f6753"]},"name":{"type":"string","title":"Name of policy"}}}}}}},"secret_hash":{"type":"string","title":"Secret hash of the policy"},"secret_allow_site_override":{"type":"boolean","title":"Allow secret override"},"quarantine_retention_duration":{"type":["integer","null"],"minimum":0,"title":"Quarantine retention duration","description":"Number of days to retain quarantined items. 0 means no retention."}}}}}}},"tags":["PoliciesV2"],"operationId":"api.rmm.post.policy"}},"/oneview/v2/accounts/{account_id}/policies/{id}/auto_isolation":{"get":{"description":"Get policy auto-isolation options by policy ID","summary":"Get policy auto-isolation","security":[{"client_credentials":["read"]},{"user_permissions":["policies.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":true,"in":"path","description":"ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"title":"policy auto-isolation settings","description":"Set policy expire endpoints payload specification","type":"object","properties":{"host_type":{"type":"integer","description":"Bitmask representing 'workstation (1)' and 'servers (2)'. Use 3 for all the host_types (1+2=3)","enum":[0,1,2,3]},"platform":{"type":"integer","description":"Bitmask representing 'windows (1)', 'macOS (2)', 'linux (4)'. Use 7 for all the platforms (1+2+4=7)","enum":[0,1,2,3,4,5,6,7]},"isolation_type":{"type":"object","properties":{"network":{"type":"boolean"},"process":{"type":"boolean"},"desktop":{"type":"boolean"}},"required":["network","process","desktop"],"anyOf":[{"properties":{"network":{"const":true}}},{"properties":{"process":{"const":true}}},{"properties":{"desktop":{"const":true}}}]}},"required":["host_type","platform","isolation_type"]}}}}},"tags":["PoliciesV2"],"operationId":"api.rmm.get.policy.auto_isolation"},"post":{"description":"Set policy auto-isolation options by policy ID","summary":"Set policy auto-isolation","security":[{"client_credentials":["write"]},{"user_permissions":["policies.edit"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":true,"in":"path","description":"ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"title":"policy auto-isolation settings","description":"Set policy expire endpoints payload specification","type":"object","properties":{"host_type":{"type":"integer","description":"Bitmask representing 'workstation (1)' and 'servers (2)'. Use 3 for all the host_types (1+2=3)","enum":[0,1,2,3]},"platform":{"type":"integer","description":"Bitmask representing 'windows (1)', 'macOS (2)', 'linux (4)'. Use 7 for all the platforms (1+2+4=7)","enum":[0,1,2,3,4,5,6,7]},"isolation_type":{"type":"object","properties":{"network":{"type":"boolean"},"process":{"type":"boolean"},"desktop":{"type":"boolean"}},"required":["network","process","desktop"],"anyOf":[{"properties":{"network":{"const":true}}},{"properties":{"process":{"const":true}}},{"properties":{"desktop":{"const":true}}}]}},"required":["host_type","platform","isolation_type"]}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"title":"policy auto-isolation settings","description":"Set policy expire endpoints payload specification","type":"object","properties":{"host_type":{"type":"integer","description":"Bitmask representing 'workstation (1)' and 'servers (2)'. Use 3 for all the host_types (1+2=3)","enum":[0,1,2,3]},"platform":{"type":"integer","description":"Bitmask representing 'windows (1)', 'macOS (2)', 'linux (4)'. Use 7 for all the platforms (1+2+4=7)","enum":[0,1,2,3,4,5,6,7]},"isolation_type":{"type":"object","properties":{"network":{"type":"boolean"},"process":{"type":"boolean"},"desktop":{"type":"boolean"}},"required":["network","process","desktop"],"anyOf":[{"properties":{"network":{"const":true}}},{"properties":{"process":{"const":true}}},{"properties":{"desktop":{"const":true}}}]}},"required":["host_type","platform","isolation_type"]}}}}},"tags":["PoliciesV2"],"operationId":"api.rmm.post.policy.auto_isolation"}},"/oneview/v2/accounts/{account_id}/policies/{id}/secret":{"get":{"description":"Get policy secret by id.","summary":"Get policy secret by id","security":[{"client_credentials":["read"]},{"user_permissions":["tamperProtection.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":true,"in":"path","description":"ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Response of policy tamper protection secret","properties":{"secret":{"type":"string","title":"Secret of policy tamper protection"}}}}}}},"tags":["PoliciesV2"],"operationId":"api.rmm.get.policy.secret.id"},"post":{"description":"Change policy secret by id.","summary":"Change policy secret by id","security":[{"client_credentials":["write"]},{"user_permissions":["tamperProtection.manage"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":true,"in":"path","description":"ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Change Secret","required":["secret"],"properties":{"secret":{"type":"string","title":"New tamper protection secret for the policy"}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","title":"Response of policy tamper protection secret","properties":{"secret":{"type":"string","title":"Secret of policy tamper protection"}}}}}}},"tags":["PoliciesV2"],"operationId":"api.rmm.post.policy.secret.id"}},"/oneview/v2/accounts/{account_id}/policies/system_default":{"get":{"description":"Get system default policy.","summary":"Get system default policy","security":[{"client_credentials":["read"]},{"user_permissions":["policies.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Policy","properties":{"id":{"type":"string","title":"Id","examples":["3606af9f-f539-426c-be76-6f9bc18531e2"]},"account_id":{"type":"string","title":"Account id","examples":["1b8d7513-3336-45fe-8d6f-db43bc9c9613"]},"etag":{"type":"string","title":"Etag","description":"etags are identifiers that change on every update. Their use is to prevent race conditions when multiple clients are modifying the same resource. Supply this tag empty when creating a policy. When updating, you need to fetch the latest value by GETting a policy. You should always get the current etag before trying to modify a resource that has an etag property.","examples":["4d3ae3923cca7cf30bd712f4d8188bb9"]},"name":{"type":"string","title":"Name","examples":["Default Policy"]},"expire_endpoints":{"type":["number","null"],"title":"Expire endpoints","examples":[230]},"contents":{"type":"object","title":"Policy Contents"},"created_at":{"type":"string","title":"Policy created at","examples":["2020-02-13T17:09:20.741145Z"]},"updated_at":{"type":"string","title":"Policy updated at","examples":["2020-02-13T17:09:22.532969Z"]},"migrated_at":{"type":"string","title":"Policy migrated at","examples":["2020-02-13T17:09:22.532969Z"]},"is_default":{"type":"boolean","title":"Is default"},"deny_edit":{"type":"boolean","title":"Deny edit"},"groups":{"type":"array","title":"Groups","items":{"type":"object","title":"Group","additionalProperties":true,"properties":{"id":{"type":"string","title":"The Id of the group"},"account_id":{"type":"string","title":"The account id to which this group belong"},"name":{"type":"string","title":"The neame of the group"},"machines_count":{"type":"integer","title":"Count of machines"},"policy_id":{"type":"string","title":"Policy id associated to the group"},"policy_name":{"type":"string","title":"Policy name"},"updated_at":{"type":"string","title":"Updated at","examples":["2017-04-06T20:26:07.345213Z"]},"is_default":{"type":"boolean","title":"Default"},"schedule_ids":{"type":"array","title":"Array of schedule ids","items":{"type":"string","title":"Schedule Id"}},"parent_id":{"type":"string","title":"Parent id"},"root_id":{"type":"string","title":"Root id"},"ou_object_id":{"type":["string","null"],"title":"Ou object id"},"child_group_count":{"type":"integer","title":"Child group count"}}}},"exclusions":{"type":"array","title":"Exclusions","items":{"title":"Exclusion from server","type":"object","additionalProperties":true,"properties":{"id":{"type":"string","title":"UUID of the exclusion (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"etag":{"type":"string","title":"Etag","description":"etags are identifiers that change on every update. Their use is to prevent race conditions when multiple clients are modifying the same resource. Supply this tag empty when creating a exclusion. When updating, you need to fetch the latest value by GETting an exclusion. You should always get the current etag before trying to modify a resource that has an etag property.","examples":["c87998228b2f7511bb1616f686d06bae"]},"type":{"type":"integer","title":"1: Exclusion for file path, 2: Exclusion for folder path, 3: Exclusion for wildcard path, 4: Exclusion for registry, 5: Exclusion for file extensions, 6: Exclusion for web domain, 7: Exclusion for web IP, 8: Exclusion for Web Monitoring, 13: Exclusion for hash, 14: Exclusion for command line","examples":[1,2,3,4,5,6,7,13,14,17]},"value":{"type":"string","title":"String value","examples":["%PROGRAMDATA%"]},"enabled":{"type":"boolean","title":"Enable"},"comment":{"type":"string","title":"Comment"},"created_at":{"type":"string","title":"Created at"},"updated_at":{"type":"string","title":"Updated at"},"created_by":{"type":"string","title":"Created by"},"updated_by":{"type":"string","title":"Updated by"},"exclude_from":{"type":"object","title":"Exclusion applied to","properties":{"exploit_protection":{"type":["boolean","null"],"title":"Uses multiple protection layers to guard against attempted exploits of vulnerabilities in legitimate applications"},"malware_protection":{"type":["boolean","null"],"title":"Protects against malware infections and zero-day threats"},"ransomware_protection":{"type":["boolean","null"],"title":"Detects and blocks ransomware threats using advanced behavior analysis"},"suspicious_activity":{"type":["boolean","null"],"title":"Uses advanced machine learning to identify suspicious processes that require additional review"},"website_protection":{"type":["boolean","null"],"title":"Blocks network traffic from malicious websites and IP addresses"},"bruteforce_protection":{"type":["boolean","null"],"title":"Bruteforce attack protection on RDP, IMAP and so on."}}},"friendly_name":{"type":"string","title":"Friendly name","examples":["File by MD5 hash"]},"account_level":{"type":"boolean","title":"Account level"},"policies":{"type":"array","title":"Policies","items":{"type":"object","title":"Policy","properties":{"id":{"type":"string","title":"ID of policy (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","additionalProperties":true,"pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["20da4613-5fa5-4460-9016-963d2c4f6753"]},"name":{"type":"string","title":"Name of policy"}}}}}}},"secret_hash":{"type":"string","title":"Secret hash of the policy"},"secret_allow_site_override":{"type":"boolean","title":"Allow secret override"},"quarantine_retention_duration":{"type":["integer","null"],"minimum":0,"title":"Quarantine retention duration","description":"Number of days to retain quarantined items. 0 means no retention."}}}}}}},"tags":["PoliciesV2"],"operationId":"api.rmm.get.policy.system_default"}},"/oneview/v2/accounts/{account_id}/policies/{source_id}/clone":{"post":{"description":"Clone policy by id of an existing policy.","summary":"Clone policy","security":[{"client_credentials":["read","write"]},{"user_permissions":["policies.create"]}],"status":{"outage":["auth"]},"parameters":[{"name":"source_id","required":true,"in":"path","description":"ID of the policy to be cloned (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Clone policy","allOf":[{"type":"object","title":"Clone policy","required":["name"],"properties":{"name":{"type":"string","title":"Name for the cloned policy."},"include_policy_exclusions":{"type":"boolean","title":"Set to true for including exclusions. Defaults to false.","default":false}}},{"properties":{"destination_account_id":{"type":"string","title":"Destination Account ID. If omitted, the policy will be cloned in the same account"}}}]}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Policy","properties":{"id":{"type":"string","title":"Id","examples":["3606af9f-f539-426c-be76-6f9bc18531e2"]},"account_id":{"type":"string","title":"Account id","examples":["1b8d7513-3336-45fe-8d6f-db43bc9c9613"]},"etag":{"type":"string","title":"Etag","description":"etags are identifiers that change on every update. Their use is to prevent race conditions when multiple clients are modifying the same resource. Supply this tag empty when creating a policy. When updating, you need to fetch the latest value by GETting a policy. You should always get the current etag before trying to modify a resource that has an etag property.","examples":["4d3ae3923cca7cf30bd712f4d8188bb9"]},"name":{"type":"string","title":"Name","examples":["Default Policy"]},"expire_endpoints":{"type":["number","null"],"title":"Expire endpoints","examples":[230]},"contents":{"type":"object","title":"Policy Contents"},"created_at":{"type":"string","title":"Policy created at","examples":["2020-02-13T17:09:20.741145Z"]},"updated_at":{"type":"string","title":"Policy updated at","examples":["2020-02-13T17:09:22.532969Z"]},"migrated_at":{"type":"string","title":"Policy migrated at","examples":["2020-02-13T17:09:22.532969Z"]},"is_default":{"type":"boolean","title":"Is default"},"deny_edit":{"type":"boolean","title":"Deny edit"},"groups":{"type":"array","title":"Groups","items":{"type":"object","title":"Group","additionalProperties":true,"properties":{"id":{"type":"string","title":"The Id of the group"},"account_id":{"type":"string","title":"The account id to which this group belong"},"name":{"type":"string","title":"The neame of the group"},"machines_count":{"type":"integer","title":"Count of machines"},"policy_id":{"type":"string","title":"Policy id associated to the group"},"policy_name":{"type":"string","title":"Policy name"},"updated_at":{"type":"string","title":"Updated at","examples":["2017-04-06T20:26:07.345213Z"]},"is_default":{"type":"boolean","title":"Default"},"schedule_ids":{"type":"array","title":"Array of schedule ids","items":{"type":"string","title":"Schedule Id"}},"parent_id":{"type":"string","title":"Parent id"},"root_id":{"type":"string","title":"Root id"},"ou_object_id":{"type":["string","null"],"title":"Ou object id"},"child_group_count":{"type":"integer","title":"Child group count"}}}},"exclusions":{"type":"array","title":"Exclusions","items":{"title":"Exclusion from server","type":"object","additionalProperties":true,"properties":{"id":{"type":"string","title":"UUID of the exclusion (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"etag":{"type":"string","title":"Etag","description":"etags are identifiers that change on every update. Their use is to prevent race conditions when multiple clients are modifying the same resource. Supply this tag empty when creating a exclusion. When updating, you need to fetch the latest value by GETting an exclusion. You should always get the current etag before trying to modify a resource that has an etag property.","examples":["c87998228b2f7511bb1616f686d06bae"]},"type":{"type":"integer","title":"1: Exclusion for file path, 2: Exclusion for folder path, 3: Exclusion for wildcard path, 4: Exclusion for registry, 5: Exclusion for file extensions, 6: Exclusion for web domain, 7: Exclusion for web IP, 8: Exclusion for Web Monitoring, 13: Exclusion for hash, 14: Exclusion for command line","examples":[1,2,3,4,5,6,7,13,14,17]},"value":{"type":"string","title":"String value","examples":["%PROGRAMDATA%"]},"enabled":{"type":"boolean","title":"Enable"},"comment":{"type":"string","title":"Comment"},"created_at":{"type":"string","title":"Created at"},"updated_at":{"type":"string","title":"Updated at"},"created_by":{"type":"string","title":"Created by"},"updated_by":{"type":"string","title":"Updated by"},"exclude_from":{"type":"object","title":"Exclusion applied to","properties":{"exploit_protection":{"type":["boolean","null"],"title":"Uses multiple protection layers to guard against attempted exploits of vulnerabilities in legitimate applications"},"malware_protection":{"type":["boolean","null"],"title":"Protects against malware infections and zero-day threats"},"ransomware_protection":{"type":["boolean","null"],"title":"Detects and blocks ransomware threats using advanced behavior analysis"},"suspicious_activity":{"type":["boolean","null"],"title":"Uses advanced machine learning to identify suspicious processes that require additional review"},"website_protection":{"type":["boolean","null"],"title":"Blocks network traffic from malicious websites and IP addresses"},"bruteforce_protection":{"type":["boolean","null"],"title":"Bruteforce attack protection on RDP, IMAP and so on."}}},"friendly_name":{"type":"string","title":"Friendly name","examples":["File by MD5 hash"]},"account_level":{"type":"boolean","title":"Account level"},"policies":{"type":"array","title":"Policies","items":{"type":"object","title":"Policy","properties":{"id":{"type":"string","title":"ID of policy (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","additionalProperties":true,"pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["20da4613-5fa5-4460-9016-963d2c4f6753"]},"name":{"type":"string","title":"Name of policy"}}}}}}},"secret_hash":{"type":"string","title":"Secret hash of the policy"},"secret_allow_site_override":{"type":"boolean","title":"Allow secret override"},"quarantine_retention_duration":{"type":["integer","null"],"minimum":0,"title":"Quarantine retention duration","description":"Number of days to retain quarantined items. 0 means no retention."}}}}}}},"tags":["PoliciesV2"],"operationId":"api.rmm.post.policy.clone"}},"/oneview/v2/accounts/policies":{"post":{"description":"Get policies of multiple accounts","summary":"Get policies of multiple accounts","security":[{"client_credentials":["read"]},{"user_permissions":["policies.view"]}],"status":{"outage":["auth"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","title":"Get policies for multiple account ids","required":["account_ids"],"properties":{"account_ids":{"type":"array","minItems":1,"title":"The account ids","items":{"type":"string","title":"Account id items (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}},"page_size":{"type":"number","title":"The size of the page","minimum":1,"default":100,"maximum":2000},"populate":{"type":"object","properties":{"dns_rules":{"type":"boolean","title":"Whether to populate dns rules"},"firewall_policies":{"type":"boolean","title":"Whether to populate firewall policies"}}},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Response of policies","required":["policies","total_count"],"properties":{"policies":{"type":"array","title":"Collection of policies","items":{"allOf":[{"type":"object","additionalProperties":true,"title":"Policy","properties":{"id":{"type":"string","title":"Id","examples":["3606af9f-f539-426c-be76-6f9bc18531e2"]},"account_id":{"type":"string","title":"Account id","examples":["1b8d7513-3336-45fe-8d6f-db43bc9c9613"]},"etag":{"type":"string","title":"Etag","description":"etags are identifiers that change on every update. Their use is to prevent race conditions when multiple clients are modifying the same resource. Supply this tag empty when creating a policy. When updating, you need to fetch the latest value by GETting a policy. You should always get the current etag before trying to modify a resource that has an etag property.","examples":["4d3ae3923cca7cf30bd712f4d8188bb9"]},"name":{"type":"string","title":"Name","examples":["Default Policy"]},"expire_endpoints":{"type":["number","null"],"title":"Expire endpoints","examples":[230]},"contents":{"type":"object","title":"Policy Contents"},"created_at":{"type":"string","title":"Policy created at","examples":["2020-02-13T17:09:20.741145Z"]},"updated_at":{"type":"string","title":"Policy updated at","examples":["2020-02-13T17:09:22.532969Z"]},"migrated_at":{"type":"string","title":"Policy migrated at","examples":["2020-02-13T17:09:22.532969Z"]},"is_default":{"type":"boolean","title":"Is default"},"deny_edit":{"type":"boolean","title":"Deny edit"},"groups":{"type":"array","title":"Groups","items":{"type":"object","title":"Group","additionalProperties":true,"properties":{"id":{"type":"string","title":"The Id of the group"},"account_id":{"type":"string","title":"The account id to which this group belong"},"name":{"type":"string","title":"The neame of the group"},"machines_count":{"type":"integer","title":"Count of machines"},"policy_id":{"type":"string","title":"Policy id associated to the group"},"policy_name":{"type":"string","title":"Policy name"},"updated_at":{"type":"string","title":"Updated at","examples":["2017-04-06T20:26:07.345213Z"]},"is_default":{"type":"boolean","title":"Default"},"schedule_ids":{"type":"array","title":"Array of schedule ids","items":{"type":"string","title":"Schedule Id"}},"parent_id":{"type":"string","title":"Parent id"},"root_id":{"type":"string","title":"Root id"},"ou_object_id":{"type":["string","null"],"title":"Ou object id"},"child_group_count":{"type":"integer","title":"Child group count"}}}},"exclusions":{"type":"array","title":"Exclusions","items":{"title":"Exclusion from server","type":"object","additionalProperties":true,"properties":{"id":{"type":"string","title":"UUID of the exclusion (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"etag":{"type":"string","title":"Etag","description":"etags are identifiers that change on every update. Their use is to prevent race conditions when multiple clients are modifying the same resource. Supply this tag empty when creating a exclusion. When updating, you need to fetch the latest value by GETting an exclusion. You should always get the current etag before trying to modify a resource that has an etag property.","examples":["c87998228b2f7511bb1616f686d06bae"]},"type":{"type":"integer","title":"1: Exclusion for file path, 2: Exclusion for folder path, 3: Exclusion for wildcard path, 4: Exclusion for registry, 5: Exclusion for file extensions, 6: Exclusion for web domain, 7: Exclusion for web IP, 8: Exclusion for Web Monitoring, 13: Exclusion for hash, 14: Exclusion for command line","examples":[1,2,3,4,5,6,7,13,14,17]},"value":{"type":"string","title":"String value","examples":["%PROGRAMDATA%"]},"enabled":{"type":"boolean","title":"Enable"},"comment":{"type":"string","title":"Comment"},"created_at":{"type":"string","title":"Created at"},"updated_at":{"type":"string","title":"Updated at"},"created_by":{"type":"string","title":"Created by"},"updated_by":{"type":"string","title":"Updated by"},"exclude_from":{"type":"object","title":"Exclusion applied to","properties":{"exploit_protection":{"type":["boolean","null"],"title":"Uses multiple protection layers to guard against attempted exploits of vulnerabilities in legitimate applications"},"malware_protection":{"type":["boolean","null"],"title":"Protects against malware infections and zero-day threats"},"ransomware_protection":{"type":["boolean","null"],"title":"Detects and blocks ransomware threats using advanced behavior analysis"},"suspicious_activity":{"type":["boolean","null"],"title":"Uses advanced machine learning to identify suspicious processes that require additional review"},"website_protection":{"type":["boolean","null"],"title":"Blocks network traffic from malicious websites and IP addresses"},"bruteforce_protection":{"type":["boolean","null"],"title":"Bruteforce attack protection on RDP, IMAP and so on."}}},"friendly_name":{"type":"string","title":"Friendly name","examples":["File by MD5 hash"]},"account_level":{"type":"boolean","title":"Account level"},"policies":{"type":"array","title":"Policies","items":{"type":"object","title":"Policy","properties":{"id":{"type":"string","title":"ID of policy (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","additionalProperties":true,"pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["20da4613-5fa5-4460-9016-963d2c4f6753"]},"name":{"type":"string","title":"Name of policy"}}}}}}},"secret_hash":{"type":"string","title":"Secret hash of the policy"},"secret_allow_site_override":{"type":"boolean","title":"Allow secret override"},"quarantine_retention_duration":{"type":["integer","null"],"minimum":0,"title":"Quarantine retention duration","description":"Number of days to retain quarantined items. 0 means no retention."}}},{"properties":{"default_for_accounts":{"type":"array","title":"If is_default=true, default_for_accounts is the list of accounts for which it is default","items":{"type":"string","title":"account id (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]}}}}]}},"total_count":{"type":"integer","title":"Count of policies"},"next_cursor":{"type":"string","title":"The pagination cursor for next set of results. For further documentation, check Pagination section.","examples":["eyJzdGFydF9pbmRleCI6MTAwfQ=="]}}}}}}},"tags":["PoliciesV2"],"operationId":"api.v2.rmm.search.policies"}},"/oneview/v2/accounts/{account_id}/policies/{id}/promote":{"put":{"description":"Promote policy.","summary":"Promote policy","security":[{"client_credentials":["read","write"]},{"user_permissions":["policies.edit"]}],"status":{"outage":["auth"]},"parameters":[{"name":"id","required":true,"in":"path","description":"ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"account_id","required":true,"in":"path","description":"Account ID (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","schema":{"type":"string","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Policy","properties":{"id":{"type":"string","title":"Id","examples":["3606af9f-f539-426c-be76-6f9bc18531e2"]},"account_id":{"type":"string","title":"Account id","examples":["1b8d7513-3336-45fe-8d6f-db43bc9c9613"]},"etag":{"type":"string","title":"Etag","description":"etags are identifiers that change on every update. Their use is to prevent race conditions when multiple clients are modifying the same resource. Supply this tag empty when creating a policy. When updating, you need to fetch the latest value by GETting a policy. You should always get the current etag before trying to modify a resource that has an etag property.","examples":["4d3ae3923cca7cf30bd712f4d8188bb9"]},"name":{"type":"string","title":"Name","examples":["Default Policy"]},"expire_endpoints":{"type":["number","null"],"title":"Expire endpoints","examples":[230]},"contents":{"type":"object","title":"Policy Contents"},"created_at":{"type":"string","title":"Policy created at","examples":["2020-02-13T17:09:20.741145Z"]},"updated_at":{"type":"string","title":"Policy updated at","examples":["2020-02-13T17:09:22.532969Z"]},"migrated_at":{"type":"string","title":"Policy migrated at","examples":["2020-02-13T17:09:22.532969Z"]},"is_default":{"type":"boolean","title":"Is default"},"deny_edit":{"type":"boolean","title":"Deny edit"},"groups":{"type":"array","title":"Groups","items":{"type":"object","title":"Group","additionalProperties":true,"properties":{"id":{"type":"string","title":"The Id of the group"},"account_id":{"type":"string","title":"The account id to which this group belong"},"name":{"type":"string","title":"The neame of the group"},"machines_count":{"type":"integer","title":"Count of machines"},"policy_id":{"type":"string","title":"Policy id associated to the group"},"policy_name":{"type":"string","title":"Policy name"},"updated_at":{"type":"string","title":"Updated at","examples":["2017-04-06T20:26:07.345213Z"]},"is_default":{"type":"boolean","title":"Default"},"schedule_ids":{"type":"array","title":"Array of schedule ids","items":{"type":"string","title":"Schedule Id"}},"parent_id":{"type":"string","title":"Parent id"},"root_id":{"type":"string","title":"Root id"},"ou_object_id":{"type":["string","null"],"title":"Ou object id"},"child_group_count":{"type":"integer","title":"Child group count"}}}},"exclusions":{"type":"array","title":"Exclusions","items":{"title":"Exclusion from server","type":"object","additionalProperties":true,"properties":{"id":{"type":"string","title":"UUID of the exclusion (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["9256034b-7967-4253-a5d9-260663e4fa4f"]},"etag":{"type":"string","title":"Etag","description":"etags are identifiers that change on every update. Their use is to prevent race conditions when multiple clients are modifying the same resource. Supply this tag empty when creating a exclusion. When updating, you need to fetch the latest value by GETting an exclusion. You should always get the current etag before trying to modify a resource that has an etag property.","examples":["c87998228b2f7511bb1616f686d06bae"]},"type":{"type":"integer","title":"1: Exclusion for file path, 2: Exclusion for folder path, 3: Exclusion for wildcard path, 4: Exclusion for registry, 5: Exclusion for file extensions, 6: Exclusion for web domain, 7: Exclusion for web IP, 8: Exclusion for Web Monitoring, 13: Exclusion for hash, 14: Exclusion for command line","examples":[1,2,3,4,5,6,7,13,14,17]},"value":{"type":"string","title":"String value","examples":["%PROGRAMDATA%"]},"enabled":{"type":"boolean","title":"Enable"},"comment":{"type":"string","title":"Comment"},"created_at":{"type":"string","title":"Created at"},"updated_at":{"type":"string","title":"Updated at"},"created_by":{"type":"string","title":"Created by"},"updated_by":{"type":"string","title":"Updated by"},"exclude_from":{"type":"object","title":"Exclusion applied to","properties":{"exploit_protection":{"type":["boolean","null"],"title":"Uses multiple protection layers to guard against attempted exploits of vulnerabilities in legitimate applications"},"malware_protection":{"type":["boolean","null"],"title":"Protects against malware infections and zero-day threats"},"ransomware_protection":{"type":["boolean","null"],"title":"Detects and blocks ransomware threats using advanced behavior analysis"},"suspicious_activity":{"type":["boolean","null"],"title":"Uses advanced machine learning to identify suspicious processes that require additional review"},"website_protection":{"type":["boolean","null"],"title":"Blocks network traffic from malicious websites and IP addresses"},"bruteforce_protection":{"type":["boolean","null"],"title":"Bruteforce attack protection on RDP, IMAP and so on."}}},"friendly_name":{"type":"string","title":"Friendly name","examples":["File by MD5 hash"]},"account_level":{"type":"boolean","title":"Account level"},"policies":{"type":"array","title":"Policies","items":{"type":"object","title":"Policy","properties":{"id":{"type":"string","title":"ID of policy (Ex. \"9256034b-7967-4253-a5d9-260663e4fa4f\")","additionalProperties":true,"pattern":"[\\da-fA-F]{8}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{4}-?[\\da-fA-F]{12}$","examples":["20da4613-5fa5-4460-9016-963d2c4f6753"]},"name":{"type":"string","title":"Name of policy"}}}}}}},"secret_hash":{"type":"string","title":"Secret hash of the policy"},"secret_allow_site_override":{"type":"boolean","title":"Allow secret override"},"quarantine_retention_duration":{"type":["integer","null"],"minimum":0,"title":"Quarantine retention duration","description":"Number of days to retain quarantined items. 0 means no retention."}}}}}}},"tags":["PoliciesV2"],"operationId":"api.rmm.put.policy.promote"}},"/oneview/v3/sites/subscriptions/availability":{"get":{"description":"Use this endpoint to retrieve the available **Bundle** subscriptions for a given MSP account\n\n## Field descriptions\n## Bundles\n| Field name | Data type or example | Description |\n|------------|----------------------|------------------------------------------------------------|\n| core | Allocation Object | Available seat allocation for `core` bundle per device |\n| advanced | Allocation Object | Available seat allocation for `advanced` bundle per device |\n| elite | Allocation Object | Available seat allocation for `elite` bundle per device |\n| ultimate | Allocation Object | Available seat allocation for `ultimate` bundle per device |\n\n## Allocation Object\n\n| Field name | Data type or example | Description |\n|-------------|----------------------|------------------------------------------------------------|\n| workstation | Integer | Available `workstation` seat allocation for a given bundle |\n| server | Integer | Available `server` seat allocation for a given bundle |\n| mobile | Integer | Available `mobile` seat allocation for a given bundle |\n\n\n### is_nfr_allowed\nThis field indicates if an MSP is allowed to add an NFR subscription to a site\n* this field will automatically return false if there is already an active site with NFR subscription\n\n## Response payload examples:\nIn this example, the MSP is eligible to add one of the following bundle subscriptions\n* Core bundle\n* Elite bundle\n* Ultimate\n\nWith term_type `paid`, `trial` or `nfr`\n\nThe MSP is **NOT** eligible to the following subscriptions to a site:\n* Core Bundle Server - server allocation count is 0\n* Advanced Bundle - not listed in the response\n\n```\n{\n \"is_nfr_allowed\": true,\n \"core\":\n {\n \"workstation\": 995,\n \"server\": 0,\n \"mobile\": 998\n },\n \"elite\":\n {\n \"workstation\": 777,\n \"server\": 784,\n \"mobile\": 998\n },\n \"ultimate\":\n {\n \"workstation\": 441,\n \"server\": 415,\n \"mobile\": 998\n }\n}\n```\n","summary":"[v3 - Bundles] Get account's available bundle subscriptions","security":[{"client_credentials":["read"]},{"user_permissions":["sites.view"]}],"status":{"outage":["auth","ov"]},"parameters":[{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"The allowed subscriptions","description":"The allowed subscriptions for an account to be assigned to a site.","examples":[{"is_nfr_allowed":true,"core":{"workstation":995,"server":992,"mobile":1000},"advanced":{"workstation":1000,"server":0,"mobile":1000},"elite":{"workstation":677,"server":836,"mobile":1000},"ultimate":{"workstation":872,"server":727,"mobile":1000}}],"required":[],"properties":{"core":{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"Device available seats","description":"The number of seats available for allocation per device type.","examples":[{"workstation":995,"server":992,"mobile":1000}],"required":[],"properties":{"workstation":{"type":"integer","title":"Server seats available","description":"The number of workstation seats available for allocation","examples":[10,20,30]},"server":{"type":"integer","title":"Workstation seats available","description":"The number of server seats available for allocation","examples":[10,20,30]},"mobile":{"type":"integer","title":"Mobile seats available","description":"The number of mobile seats available for allocation","examples":[10,20,30]}}},"advanced":{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"Device available seats","description":"The number of seats available for allocation per device type.","examples":[{"workstation":995,"server":992,"mobile":1000}],"required":[],"properties":{"workstation":{"type":"integer","title":"Server seats available","description":"The number of workstation seats available for allocation","examples":[10,20,30]},"server":{"type":"integer","title":"Workstation seats available","description":"The number of server seats available for allocation","examples":[10,20,30]},"mobile":{"type":"integer","title":"Mobile seats available","description":"The number of mobile seats available for allocation","examples":[10,20,30]}}},"elite":{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"Device available seats","description":"The number of seats available for allocation per device type.","examples":[{"workstation":995,"server":992,"mobile":1000}],"required":[],"properties":{"workstation":{"type":"integer","title":"Server seats available","description":"The number of workstation seats available for allocation","examples":[10,20,30]},"server":{"type":"integer","title":"Workstation seats available","description":"The number of server seats available for allocation","examples":[10,20,30]},"mobile":{"type":"integer","title":"Mobile seats available","description":"The number of mobile seats available for allocation","examples":[10,20,30]}}},"ultimate":{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"Device available seats","description":"The number of seats available for allocation per device type.","examples":[{"workstation":995,"server":992,"mobile":1000}],"required":[],"properties":{"workstation":{"type":"integer","title":"Server seats available","description":"The number of workstation seats available for allocation","examples":[10,20,30]},"server":{"type":"integer","title":"Workstation seats available","description":"The number of server seats available for allocation","examples":[10,20,30]},"mobile":{"type":"integer","title":"Mobile seats available","description":"The number of mobile seats available for allocation","examples":[10,20,30]}}},"is_nfr_allowed":{"type":"boolean","title":"Not for resale term type","description":"Not for resale subscription is allowed to be created","examples":[true,false]}}}}}}},"tags":["Subscriptions"],"operationId":"api.v2.oneview.availability.subscription.v3.id"}},"/oneview/v3/sites/{id}/subscriptions":{"post":{"description":"Use this endpoint to create a subscription for one of your managed sites.\n\nAfter creating one subscription, your customer's data will be populated with an `account_id` field that you can use for security's management apis, like detections, endpoints and jobs.\n\n- This api can be used to both create a subscription and update a subscription\n- If a site was created through the OneView console, it will likely have a subscription already\n\nAvailable options will be provided by another api\n\n- https://oneview.malwarebytes.com/oauth/documentation/msp#operation/api.v2.oneview.availability.subscriptionv3.id\n\n## Acceptable values for each field\n\n### bundle\n\nDetermines the bundle for the subscription\n\n| value | Description |\n|----------|-----------------------------------|\n| core | Apply `core` bundle to a site |\n| advanced | Apply `advanced` bundle to a site |\n| elite | Apply `elite` bundle to a site |\n| ultimate | Apply `ultimate` bundle to a site |\n\n### auto_convert_trial_to_paid\n\nDetermines if a trial subscription will auto convert to paid. Set to `false` on paid subscriptions\n\n### devices\n\nA list of device object containing the device type, number of seats and term type (paid, trial or nfr)\n\n#### Device Object fields\n| Field name | Data type or example | Acceptable Values |\n|-----------------|----------------------|--------------------------------------|\n| type | String | `workstation`, `server` and `mobile` |\n| seat_allocation | Integer | Any integer limited by availability |\n| term_type | String | `paid`, `trial` or `nfr` |\n\n\n## Request payload examples:\n\n**Create a Paid ThreatDown Core Bundle with 511 workstation allocation and 2 mobile allocation**\n\n```\n{\n \"bundle\": \"core\",\n \"auto_convert_trial_to_paid\": false,\n \"devices\":\n [\n {\n \"type\": \"workstation\",\n \"seat_allocation\": 511,\n \"term_type\": \"paid\"\n },\n {\n \"type\": \"mobile\",\n \"seat_allocation\": 2,\n \"term_type\": \"paid\"\n }\n ]\n}\n```\n\n**Create a Trial ThreatDown Elite Bundle with 10 workstation allocation and 10 server allocation with auto conversion to paid at the end of trial period**\n\n```\n{\n \"bundle\": \"elite\",\n \"auto_convert_trial_to_paid\": true,\n \"devices\":\n [\n {\n \"type\": \"workstation\",\n \"seat_allocation\": 10,\n \"term_type\": \"trial\"\n },\n {\n \"type\": \"server\",\n \"seat_allocation\": 10,\n \"term_type\": \"trial\"\n }\n ]\n}\n```\n\n**Remove site bundle subscription**\n\n```\n{\n \"bundle\": \"core\",\n \"auto_convert_trial_to_paid\": false,\n \"devices\": []\n}\n```\n","summary":"[v3 - Bundles] Create or update a site's bundle subscriptions","security":[{"client_credentials":["write"]},{"user_permissions":["sites.manage"]}],"status":{"outage":["auth","ov"]},"parameters":[{"name":"id","required":true,"in":"path","description":"Valid OneView site ID (Ex. \"30616562663436302D643733312D346238622D623338332D613031343538363566383333\")","schema":{"type":"string","pattern":"^[A-Fa-f0-9]+$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"The body for creating a new subscription","description":"The payload for creating a new subscription.","examples":[{"bundle":"ultimate","auto_convert_trial_to_paid":true,"devices":[{"type":"workstation","seat_allocation":111,"term_type":"paid"},{"type":"server","seat_allocation":222,"term_type":"paid"},{"type":"mobile","seat_allocation":333,"term_type":"paid"}]}],"required":["bundle","auto_convert_trial_to_paid","devices"],"properties":{"bundle":{"type":"string","title":"Bundle type","description":"Select bundle for subscription","examples":["core","advanced","elite","ultimate"]},"devices":{"type":"array","title":"Devices","description":"List of device objects containing device type, seat count and term type for the site subscription","examples":[[{"type":"workstation","seat_allocation":511,"term_type":"trial"},{"type":"server","seat_allocation":511,"term_type":"trial"},{"type":"mobile","seat_allocation":511,"term_type":"trial"}]],"items":{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"Device","description":"The object definition for a device","examples":[{"type":"workstation","seat_allocation":511,"term_type":"trial"},{"type":"server","seat_allocation":511,"term_type":"trial"},{"type":"mobile","seat_allocation":511,"term_type":"trial"}],"required":["type","seat_allocation","term_type"],"properties":{"type":{"type":"string","title":"Device type","description":"The device type for this allocation.","examples":["workstation","server","mobile"]},"seat_allocation":{"type":"integer","title":"Seat count","description":"The number of seats for the device allocation.","examples":[100,200]},"term_type":{"type":"string","title":"Term type","description":"Select term type, paid, trial or nfr.","examples":["paid","trial","nfr"]}}}},"auto_convert_trial_to_paid":{"type":"boolean","title":"Auto Convert Trial to Paid","description":"Choose to auto convert trial subscriptions to paid when trial term ends"}}}}}},"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"Payload returned when getting a subscription","description":"get subscription v3 response","examples":[{"bundle":"core","auto_convert_trial_to_paid":false,"devices":[{"type":"workstation","seat_allocation":511,"seat_used":511,"term_type":"trial","status":"active","term_ends_on":"2024-03-13T23:59:59+00:00"},{"type":"server","seat_allocation":511,"seat_used":511,"term_type":"trial","status":"active","term_ends_on":"2024-03-13T23:59:59+00:00"},{"type":"mobile","seat_allocation":511,"seat_used":511,"term_type":"trial","status":"active","term_ends_on":"2024-03-13T23:59:59+00:00"}]}],"required":[],"properties":{"bundle":{"type":"string","title":"Bundle type","description":"Bundle selected for a given site.","examples":["core","advanced","elite","ultimate"]},"auto_convert_trial_to_paid":{"type":"boolean","title":"Auto convert trial","description":"Flag to auto convert trial subscription to paid at the end of trial period.","examples":[true,false]},"devices":{"$schema":"http://json-schema.org/draft-07/schema","type":"array","title":"Device","description":"The object definition for a device","examples":[{"type":"workstation","seat_allocation":511,"seat_used":100,"term_type":"trial","status":"active","term_ends_on":"2024-03-13T23:59:59+00:00"},{"type":"server","seat_allocation":511,"seat_used":100,"term_type":"trial","status":"active","term_ends_on":"2024-03-13T23:59:59+00:00"},{"type":"mobile","seat_allocation":511,"seat_used":100,"term_type":"trial","status":"active","term_ends_on":"2024-03-13T23:59:59+00:00"}],"required":[],"properties":{"type":{"type":"string","title":"Device type","description":"The device type for this allocation.","examples":["workstation","server","mobile"]},"seat_allocation":{"type":"integer","title":"Seat count","description":"The number of seats for the device allocation.","examples":[100,200]},"seat_used":{"type":"integer","title":"Seat used","description":"The number of seats being used by endpoints.","examples":[180,360]},"term_type":{"type":"string","title":"Term type","description":"Select term type, paid, trial or nfr.","examples":["paid","trial","nfr"]},"status":{"type":"string","title":"Status","description":"Status of the current subcription.","examples":["active","expired"]},"term_ends_on":{"type":"string","title":"Subscription end date","description":"This shows when the subscription ends.","examples":["2024-03-13T23:59:59+00:00","2025-10-10T23:59:59+00:00"]}}}}}}}}},"tags":["Subscriptions"],"operationId":"api.v2.oneview.create.subscription.v3.id"},"get":{"description":"Use this endpoint to fetch the subscription for one of your managed sites.\n\n### bundle\n\nDetermines the bundle for the subscription\n\n| value | Description |\n|----------|-----------------------------------|\n| core | Apply `core` bundle to a site |\n| advanced | Apply `advanced` bundle to a site |\n| elite | Apply `elite` bundle to a site |\n| ultimate | Apply `ultimate` bundle to a site |\n\n### auto_convert_trial_to_paid\n\nDetermines if a trial subscription will auto convert to paid. Set to `false` on paid subscriptions\n\n### devices\n\nA list of device object containing the device type, number of seats and term type (paid, trial or nfr)\n\n#### Device Object fields\n| Field name | Data type or example | Acceptable Values |\n|-----------------|----------------------|--------------------------------------------|\n| type | String | `workstation`, `server` and `mobile` |\n| seats_allocated | Integer | Seat allocated on subscribe |\n| seat_used | Integer | Seat being utilized by installed endpoints |\n| term_type | String | `paid`, `trial` or `nfr` |\n| status | String | `active` or `expired` for trials |\n| term_ends_on | String | Site subscription expires on this date |\n\n\n## Response payload examples:\n\n**A site with trial of ThreatDown Advanced Bundle with 14 workstation seat allocation that will auto convert to paid on 2024-03-27**\n\n```\n{\n \"bundle\": \"advanced\",\n \"auto_convert_trial_to_paid\": true,\n \"devices\": [\n {\n \"type\": \"workstation\",\n \"seat_allocation\": 14,\n \"seat_used\": 0,\n \"term_type\": \"trial\",\n \"status\": \"active\",\n \"term_ends_on\": \"2024-03-27T23:59:59+00:00\"\n }\n ]\n}\n```\n\n","summary":"[v3 - Bundles] Get site's bundle subscription","security":[{"client_credentials":["read"]},{"user_permissions":["sites.view"]}],"status":{"outage":["auth","ov"]},"parameters":[{"name":"id","required":true,"in":"path","description":"Valid OneView site ID (Ex. \"30616562663436302D643733312D346238622D623338332D613031343538363566383333\")","schema":{"type":"string","pattern":"^[A-Fa-f0-9]+$"}},{"name":"authorization","required":true,"in":"header","description":"Authorization token","schema":{"type":"string"}}],"responses":{"200":{"description":"response schema","content":{"application/json":{"schema":{"$schema":"http://json-schema.org/draft-07/schema","type":"object","title":"Payload returned when getting a subscription","description":"get subscription v3 response","examples":[{"bundle":"core","auto_convert_trial_to_paid":false,"devices":[{"type":"workstation","seat_allocation":511,"seat_used":511,"term_type":"trial","status":"active","term_ends_on":"2024-03-13T23:59:59+00:00"},{"type":"server","seat_allocation":511,"seat_used":511,"term_type":"trial","status":"active","term_ends_on":"2024-03-13T23:59:59+00:00"},{"type":"mobile","seat_allocation":511,"seat_used":511,"term_type":"trial","status":"active","term_ends_on":"2024-03-13T23:59:59+00:00"}]}],"required":[],"properties":{"bundle":{"type":"string","title":"Bundle type","description":"Bundle selected for a given site.","examples":["core","advanced","elite","ultimate"]},"auto_convert_trial_to_paid":{"type":"boolean","title":"Auto convert trial","description":"Flag to auto convert trial subscription to paid at the end of trial period.","examples":[true,false]},"devices":{"$schema":"http://json-schema.org/draft-07/schema","type":"array","title":"Device","description":"The object definition for a device","examples":[{"type":"workstation","seat_allocation":511,"seat_used":100,"term_type":"trial","status":"active","term_ends_on":"2024-03-13T23:59:59+00:00"},{"type":"server","seat_allocation":511,"seat_used":100,"term_type":"trial","status":"active","term_ends_on":"2024-03-13T23:59:59+00:00"},{"type":"mobile","seat_allocation":511,"seat_used":100,"term_type":"trial","status":"active","term_ends_on":"2024-03-13T23:59:59+00:00"}],"required":[],"properties":{"type":{"type":"string","title":"Device type","description":"The device type for this allocation.","examples":["workstation","server","mobile"]},"seat_allocation":{"type":"integer","title":"Seat count","description":"The number of seats for the device allocation.","examples":[100,200]},"seat_used":{"type":"integer","title":"Seat used","description":"The number of seats being used by endpoints.","examples":[180,360]},"term_type":{"type":"string","title":"Term type","description":"Select term type, paid, trial or nfr.","examples":["paid","trial","nfr"]},"status":{"type":"string","title":"Status","description":"Status of the current subcription.","examples":["active","expired"]},"term_ends_on":{"type":"string","title":"Subscription end date","description":"This shows when the subscription ends.","examples":["2024-03-13T23:59:59+00:00","2025-10-10T23:59:59+00:00"]}}}}}}}}},"tags":["Subscriptions"],"operationId":"api.v2.oneview.get.subscription.v3.id"}}},"components":{"securitySchemes":{"client_credentials":{"type":"oauth2","flows":{"clientCredentials":{"tokenUrl":"/oneview/oauth2/token","scopes":{"read":"Read data of your Nebula account","write":"Write access. Create Users, Sites, Policies, Exclusions and other resources","execute":"Issue jobs on your endpoints, like Scan, Reboot or Isolate."}}}},"user_permissions":{"type":"http","scheme":"bearer"}}}}